Ready Raider One: Exploring the Misuse of Cloud Gaming Services
Ready Raider One: Exploring the Misuse of Cloud Gaming Services
复制标题
DOI：
10.1145/3548606.3560647
复制
发表时间：
2022-11
期刊：
影响因子：
--
通讯作者：
Guannan Liu;Daiping Liu;Shuai Hao;Xing Gao;Kun Sun;Haining Wang
中科院分区：
文献类型：
--
作者：
Guannan Liu;Daiping Liu;Shuai Hao;Xing Gao;Kun Sun;Haining Wang
近年来，云游戏已经成为一种新兴的计算模式，允许计算机游戏将复杂的图形和逻辑计算卸载到云端。为了提供流畅和高品质的游戏体验，云游戏服务在云中投入了丰富的计算资源，包括足够的CPU，顶级GPU和高带宽互联网连接。不幸的是，云游戏提供的丰富计算资源很容易被滥用和恶意利用。在本文中，我们对云游戏服务中的安全漏洞进行了深入研究。具体来说，我们发现，对手可以故意注入恶意程序/URL到云游戏服务通过游戏模块。利用游戏内子程序、游戏启动选项和内置浏览器等提供的功能，攻击者能够在云游戏服务中执行注入的恶意程序/URL。为了证明这些漏洞构成严重威胁，我们对云游戏服务进行了四次概念验证攻击。其中两个是滥用云游戏服务中的CPU和GPU，以具有吸引力的利润挖掘加密货币，并以微不足道的成本训练机器学习模型。另外两个是利用云游戏提供的高带宽连接进行恶意命令与控制和审查规避。最后，我们提出了几个对策，云游戏服务，以保护其宝贵的资产免受恶意利用。
Cloud gaming has become an emerging computing paradigm in recent years, allowing computer games to offload complex graphics and logic computation to the cloud. To deliver a smooth and high-quality gaming experience, cloud gaming services have invested abundant computing resources in the cloud, including adequate CPUs, top-tier GPUs, and high-bandwidth Internet connections. Unfortunately, the abundant computing resources offered by cloud gaming are vulnerable to misuse and exploitation for malicious purposes. In this paper, we present an in-depth study on security vulnerabilities in cloud gaming services. Specifically, we reveal that adversaries can purposely inject malicious programs/URLs into the cloud gaming services via game mods. Using the provided features such as in-game subroutines, game launch options, and built-in browsers, adversaries are able to execute the injected malicious programs/URLs in cloud gaming services. To demonstrate that such vulnerabilities pose a serious threat, we conduct four proof-of-concept attacks on cloud gaming services. Two of them are to abuse the CPUs and GPUs in cloud gaming services to mine cryptocurrencies with attractive profits and train machine learning models at a trivial cost. The other two are to exploit the high-bandwidth connections provided by cloud gaming for malicious Command & Control and censorship circumvention. Finally, we present several countermeasures for cloud gaming services to protect their valuable assets from malicious exploitation.