Welcome to the game development community! This is a place to talk about and post anything related to the field of game development.
Apparently the biggest risk is that another malicious application could modify the intent urls of the runtime to pass extra arguments to the command line and run arbitrary code whenever you start a unity game. Apparently permissions could be escalated on windows but only if you registered the app as a custom URL schema handler
It’s an easy attack vector to drain crypto wallets!
I didn't want to take any Risks. So did the fix first thing in the morning and had QAs doing tests all morning. Pushed the fixed build after lunch. The fix was really simple with a Unity made tool. It was actually clear and understandable, unlike the messes Unity usually ships.
LOL yeah, they took this seriously and handled it well
I see, but still - how is that different from a regular old .dll injection? Or, just replacing the .exe alltogether.
If you're at the point of R/W/X on a machine, then you have a lot of similar vectors of attack.
That is, assuming there's no privilege escalation, which the vuln report does not mention.
The attack is through other unrelated apps that get installed, so if some shitty todo app gets compromised the rest of the games that use the unpatched runtime can be targeted. Yes, the risks are probably pretty minimal, but app permissions on android are not well-known for their sensibility.
Also on windows:
your Unity app could be vulnerable to privilege escalation if it is registered as a custom URL schema handler.
Interesting, can you pass arbitrary command line arguments via a URL like that on Windows? If so, this could be catastrophic if all you need is a malicious link on any website to trigger it.