Everybody plays games, and a bunch of us plays computer games. Despite this, very few of usconsider them as interesting targets. Granted, you won't likely be able to hack into a corporate network via games, but you can target the people running the company via their games. You should also consider that a game could grant Not So Admirable people access to your network - the network that all your phones, your cameras, and your smart house components are part of. Hackers tend to ignore the low hanging fruits in favor of beautiful exploits, but we really shouldn't. This is why I have decided to take a look around and see what's already there in the games that allows access to the gamers' network. Thus this research about how game scripting engines can be abused started. I'll show in this talk that using custom game content could easily lead to code execution on our PCs. My targets are popular games and I'll show a wide range of script abuse from the most simple to the very technical ones. |