/i/2004889906.png?fit=%2C&ssl=1)
It seems that there is a remote code executionvulnerability has been found in Dark Souls III for Windows. The hacker in question has demonstrated it in a stream, Bandai Namco has turned off multiplayer in several Souls games and modders have already released a patch.
Bandai Namco announces the shutdown of multiplayer in Dark Souls Remastered, Dark Souls II and Dark Souls III in a tweet. Although the demonstration took place in Dark Souls III, the makers of an unofficial anti-cheat for that game say predecessors are also vulnerable, which at least doesn’t rule out Bandai Namco, given the downtime across multiple games.
From demonstration of the exploit took place during a broadcast of Twitch streamer The__Grim__Sleeper. His game crashes, after which his streaming software a overlay shows to shield the contents of its desktop. He describes that a PowerShell window has opened and the audio of the stream can be heard saying that the text to speech engine of Windows reads a message.
According to Redditgebruiker Jonientz is Blue Sentinel, the anti-cheat software for the game created by the community, has since been updated to address the vulnerability. Blue Sentinel closes multiple security holes in the game, including vulnerabilities reported to Bandai Namco and FromSoftware years ago. According to the community, Bandai Namco and FromSoftware are not active in plugging these kinds of holes.
YouTuber Ratatoskr spoke with the developer of Blue Sentinel. He would be in contact with the discoverer of the vulnerability and this person would not divulge the details. This person does want FromSoftware and Bandai Namco to do something about the vulnerabilities, but because that has not happened to date, he is coming out this way. The Blue Sentinel developer also reports that Dark Souls Remastered, Dark Souls II, Dark Souls III and Elden Ring would be vulnerable. This would be because FromSoftware does not or hardly updates the network architecture for its games in between games.
With a remote code execution, the attacker essentially has the same rights within the system as the application being exploited. Dark Souls III does not run with administrator rights, which limits the damage somewhat. However, it is possible to exploit another vulnerability after exploiting Dark Souls III, including one that is normally only executable with local access to the PC. With that daisy chaining the risk of such a vulnerability immediately becomes much greater.
The Verge has contact wanted with Bandai Namco for further comment, but didn’t hear from them in time. Elden Ring, FromSoftware’s next game, is set to release on February 25, just over a month away.
Dark Souls III
–
