How one of gaming’s biggest franchises became a victim.
January 25, 2023
Author: Kevin Pozucek
If you have played any form of an online game, you have probably heard another player claim that someone else is “hacking” when they are performing exceptionally well. These accusations may or may not be true in certain cases. What is true is how gamers and gaming companies are targeted by hackers daily. Hackers’ motivations and methods are as diverse as the games they attack.
Traditionally, hackers in games find exploits in order to give themselves an advantage, especially in competitive online games. However, it is not uncommon for these hackers to have other motivations like gathering sensitive information or causing a Denial of Service (DOS)* to others.
Dark Souls 2. Credit: FromSoftware
During the COVID-19 pandemic, there was a significant rise in most forms of cyber attacks against the games industry, especially against mobile and web-based games. However, even larger games made by big companies can be exploited just the same.
Hacking in popular games made by massive development teams is much more common than you might think, take the Dark Souls franchise for example. Earlier this year game Dark Souls and Elden Ring developer FromSoftware was forced to shut down their game servers for more than half a year because of an exploit found within the game’s multiplayer system on PC. Players discovered a Remote Code Execution (RCE)** within the Dark Souls franchise of games that allowed hackers to invade other players’ worlds and take control of their PCs. The issue was brought to the direct attention of developers after a streamer by the name of The_Grim_Sleeper was directly affected by the exploit during a Twitch.tv live stream. The attack from the hacker caused the streamer’s PC to crash and open Microsoft PowerShell, where a prepared text-to-speech prompt began speaking directly to him.
Remote code execution (RCE) is a vulnerability in cyber security that allows the attacker to connect to a remote machine across public or private networks and run any command or code they wish.
Dark Souls 3. Credit: FromSoftware
Naturally, this is extremely dangerous for many reasons. Due to this vulnerability, the developers deactivated all PvP*** servers in the entire library of the Dark Souls games in order to address the issue. FromSoftware has been slowly turning servers for their games back on after extensive testing. They activated Dark Souls III servers after 7 months of downtime, Dark Souls II servers returned 2 months later, and the Dark Souls Remastered servers are still down with no clear sign of returning soon.
Even with the large volume of cyber attacks that happen daily, there are always ways for users to protect themselves. Using two-factor authentication (2FA), for example, is currently one of the best ways of protecting yourself. Two-factor authentication is a security system that requires at least two separate, distinct forms of identification required to access potentially sensitive data. You may have noticed your Google account asking you to verify your email address or sending you a text message with a code. These are all very simple but very effective methods of ensuring that you are who you say you are. Many games like Fortnite and World of Warcraft implement 2FA for good reason, so if you have the option it is highly recommended. If using 2FA is not an option at the very least make sure you are using proper password protection. You may feel that the single password you use for your accounts is unique but all it would take is a breach in any of those accounts to compromise the rest. There are many trusted and free password managers that help you create strong passwords for your accounts and can alert you about data leaks.
The gaming industry is no stranger to cybersecurity threats and though this case was largely in the hands of the developers, don’t let hackers invade your games. Keep yourself safe by engaging in helpful cyber security practices because it never hurts to remain vigilant in the online sphere.
Terms to know:
- Denial of Service (DoS)* – This type of attack can exhaust system resources and crash the system, or leverage the system’s resources to conduct DoS against third parties.
- Remote code execution (RCE)** – A type of security vulnerability that allows attackers to run arbitrary code on a remote machine, connecting to it over public or private networks.
- PvP*** – Short for “player vs player”, a common term used in online gaming
Resources:
- FromSoftware. Dark Souls II. Version Windows PC, Bandai Namco, 2014
- FromSoftware. Dark Souls III. Version Windows PC, Bandai Namco, 2016
- “Cheating in Online Games.” Wikipedia, Wikimedia Foundation, 31 Oct. 2022, https://en.wikipedia.org/wiki/Cheating_in_online_games.
- “Remote Code Execution.” Learning Center, Imperva, https://www.imperva.com/learn/application-security/remote-code-execution/#:~:text=Remote%20code%20execution%20(RCE)%20is,over%20public%20or%20private%20networks.
- Barbosa, Alessandro. “Dark Souls Servers Shut Down After Exploit Allows Attackers To Access Players’ PCs.” GameSpot, Gamespot, 24 Jan. 2022, https://www.gamespot.com/articles/dark-souls-servers-shutdown-after-exploit-allows-attackers-to-access-players-pc/1100-6499889/.
- Guisao, Jason. “After a 7-Month Shutdown, Dark Souls 3 Servers Are Online Again.” Game Informer, Game Informer, 25 Aug. 2022, https://www.gameinformer.com/2022/08/25/after-a-7-month-shutdown-dark-souls-3-servers-are-online-again.
- Williams, Demi. “Details about the ‘Dark Souls’ Hacking Exploit Have Been Published.” NME, NME, 21 Mar. 2022, https://www.nme.com/news/gaming-news/details-about-the-dark-souls-hacking-exploit-have-been-published-3186809.
- DePompa, Rachel, and Daniela Molina. “Game over: Hackers Targeting Online Gamers and Taking over Accounts to Access Financial Information.” WBVT News, WBTV, 25 July 2022, https://www.wbtv.com/2022/07/25/game-over-hackers-targeting-online-gamers-taking-over-accounts-access-financial-information/.
- McKeay, Martin, et al., editors. Gaming in a Pandemic, vol. 7, no. 3, June 2021, pp. 1–13. State of the Internet, https://www.akamai.com/site/en/documents/state-of-the-internet/akamai-state-of-the-internet-gaming-in-a-pandemic.pdf. Accessed 4 Nov. 2022.
- Key, Kim. “How to Protect Your Online Gaming Accounts from Hackers.” PCMAG, PCMag, 12 Apr. 2022, https://www.pcmag.com/how-to/how-to-protect-your-online-gaming-accounts.