RCE Vulnerability in Dark Souls III Under Investigation


Fraud and Cybercrime Management, Incident and Breach Response, Security Operations

Game developer admits taking PVP servers offline

Devon Warren-Kachelein (devawarren) •
January 24, 2022

Artist rendering of scenes from Dark Souls III (Photo: Flickr – Natty Dread)

Stay tuned for updates on this developing story.

See also: Zero Trust Webinar: Research Overview Exploring Actionable, Holistic, and Integrative Approach to Security

A gaming community has been alarmed by a remote code execution flaw discovered over the weekend in the popular Dark Souls game series. While Bandai Namco Entertainment Inc., the game’s developer, has not officially confirmed details of the flaw, the official Dark Souls Twitter has confirmed that the servers for Dark Souls, Dark Souls 2, Dark Souls 3, and Dark Souls : Prepare to Die had been “temporarily disabled” to investigate what the developers call “reports of a problem with online services”.

A game developer reportedly discovered the exploit and reported it to Bandai Namco Entertainment. A series of Reddit and online posts led to broader discussions about the vulnerability, according to the security firm Kaspersky’s Blog .

Dark Souls is a popular third-person role-playing game, or RPG, and can be played on consoles such as PlayStation and Xbox, and PCs.

At press time, Bandai Namco Entertainment had not responded to Information Security Media Group‘s request for technical details about the vulnerability.

RCE Flaw Details

At this time, the vulnerability has not been officially cataloged, although the subject of who discovered the exploit is widely discussed on Reddit, where users are also speculating that a non-person was responsible. .

The RCE flaw, which gamers are discussing online, was demonstrated by a Twitch streamer known as The __Grim__Sleeper. While he was live streaming the game, his game suddenly crashed and Microsoft PowerShell launched. From there, an unknown operator took over the player’s account and started commenting through Windows Narrator. According to an article from SpeedSoul Discord.

Some researchers, however, question how the exploit was reported to the public. As of this writing, it has not been confirmed if the vulnerability was previously disclosed to Bandai Namco Entertainment before releasing it to the public.

“Despite the ethically dubious way of drawing attention to the problem, the person behind the attack was apparently not trying to cause any real harm,” Kaspersky’s blog post says.

A Reddit Moderator released more information about the RCE vulnerability, which it claims has been patched by blue sentry, an anti-cheat extension tool available for download.

Elden Ring Reddit gamers r/Eldenring said that the RCE exploit that was reported in the Dark Souls games could also be exploited in this series of games. In response to a post, Bandai Namco Entertainment wrote, “Thank you very much for the ping, a report on this matter was submitted to relevant internal teams earlier today, the information is much appreciated!”

Reddit moderators are advising players to take the game offline. Reddit users discussing the vulnerability online say the RCE vulnerability could lead a malicious hacker to steal sensitive information or install malware.

While not much is known about this flaw yet, it wouldn’t be the first time a critical flaw has been discovered in a popular video game. Log4Shell, the critical vulnerability known as CVE-2021-44228 which has widely affected applications built with the Apache Software Foundation’s Log4j logging library, was first discovered in the popular video game Minecraft, illuminating conversations around open source software and the responsibility of core developers for computer software for publishing secure and secure applications.


Comments are closed.