A dangerous remote code execution (RCE) exploit found in Dark Souls 3 could let a bad actor take control of your computer, according to a report from Dexerto. The vulnerability only puts PC gamers who play online at risk and may potentially affect Dark Souls, Dark Souls 2, and the upcoming Elden Ring.
The exploit was seen in action during The__Grim__Sleeper’s Twitch stream of Dark Souls 3 online. At the end of the stream (1:20:22), The__Grim__Sleeper’s game crashes, and the robotic voice belonging to Microsoft’s text-to-speech generator suddenly starts criticizing his gameplay. The__Grim__Sleeper then reports that Microsoft PowerShell opened by itself, a sign that a hacker used the program to run a script that triggered the text-to-speech feature.
However, this likely wasn’t a malicious hacker — a screenshotted post on the SpeedSouls’ Discord may reveal the “hacker’s” actual intentions. According to the post, the “hacker” knew about the vulnerability and attempted to contact Dark Souls developer FromSoftware about the issue. He was reportedly ignored, so he started using the hack on streamers to draw attention to the problem.
But if a bad actor discovered this problem first, the outcome could’ve been much worse. RCE is one of the most dangerous vulnerabilities, as noted by Kaspersky. It allows hackers to run malicious code on their victim’s computer, causing irreparable damage, and potentially stealing sensitive information while they’re at it.
Blue Sentinel, a community-made anti-cheat mod for Dark Souls 3, has since been patched to protect against the RCE vulnerability. In a post on the r/darksouls3 subreddit, a user explains that (hopefully) only four people know how to execute the RCE hack — two of which are Blue Sentinel developers, and the other two are people “who worked on it,” possibly referring to the individuals who helped uncover the issue.
For now, though, it’s probably best to stay off Dark Souls online until an official fix has been released. A Bandai Namco representative commented on a Reddit post in response to the issue, stating: “Thanks very much for the ping, a report on this topic was submitted to the relevant internal teams earlier today, the information is much appreciated!” The Verge reached out to Bandai Namco with a request for comment but didn’t immediately hear back.
wazup.
