Computer game patch

Bug Game Hunting

Stop. If you’re playing an unpatched version of Unreal Tournament 2004 online right now, hackers could sneak on to your PC. Not many people think about that. But Luigi Auriemma does.

Auriemma has been called a lot of things in the past year: a programmer, an independent security researcher—he was even falsely accused of being a hacker and extortionist. What this 23-year-old from Milan, Italy, will be remembered for, though, is doing the one job that no one else will: looking for security holes in games and then reporting them to the proper authorities.

Vulnerable

Most recently, he discovered the security hole inside Unreal’s multiplayer code. By hammering a game server, hackers can easily implant programs for remote code execution to the host machine or spoof IP addresses to gain access to your PC. Even though this particular issue affects only the game servers using unpatched code, it doesn’t mean you’re totally safe.

“The biggest single security threat from playing an online game is shutting off antivirus software just to get the most out of playing a game,” says Symantec spokesperson Kraig Lane. Lane oversees Symantec’s Consumer Internet Security Products line (which includes programs such as Norton AntiVirus and Norton Personal Firewall) and is an avid gamer. Lane says that it’s not like the old days when AV software would choke down system performance. He says, “We’ve got much more powerful PCs today that can juggle multiple tasks, and most games now preload levels into memory.” This means the eternal loading screen for Far Cry will last a little longer, but it won’t impact gameplay once you get started. Lane stressed that any time you go online, you’re exposing yourself to possible attacks.

So get some firewall software, make sure the antivirus program is running, leave the lights on, deadbolt your door. The point, according to Lane, is that “you open e-mails with a cautious frame of mind, and just because you’re playing a game, you aren’t going to be 100 percent safe.” For example, have you tried playing a map lately? And do you find that in order to join the fight, your computer needs to download a few files from the host? This is how it gets started.

Plugging leaks

Then there’s Half-Life 2. Valve’s vaunted Steam service could have been compromised with the code theft. What then? Will hundreds of thousands of people be lining up to buy a Trojan horse that allows hackers to stroll onto their PCs? While nobody’s talking at Valve, Auriemma is. He says, “The HL2 code theft could be a problem only if programmers have badly programmed the game. Proprietary protocols, hidden functions, and encryption are the real risks for the users.” Hopefully, the year delay on HL2 will have removed any weak points.

Epic MegaGames took Auriemma’s warnings seriously and released a fix to the Unreal code, the V3236 patch. But not everyone is as quick to react. One, there’s the sad reality that “most games are supported only for a short time, so new bugs are never officially fixed,” according to Auriemma. Other companies are occasionally taken aback by outsiders uncovering code flaws. In one case, GameSpy accused Auriemma of being up to no good. While spokespeople were unavailable for comment, we did get to read the cease-and-desist letter, which claimed he had, among other things, demanded money for his findings (which Auriemma says is totally untrue).

Lane wanted to give his two cents and then some on the whole GameSpy matter: “Business software security researchers have been doing this for years. It’s an understood necessity, finding those security holes.” Microsoft issues updates and patches all the time, often for bugs that have been caught by these experts. More important, Lane says, “Luigi is the only guy out there [focusing on games as a possible security hole], and he got a very strange backlash as a result.”