nop
16 posts
Last Sunday we awarded a researcher with the largest bounty yet, $20,000 On that Sunday the Hytale security team was alerted to a security vulnerability in the Hytale client. We immediately took steps to triage and investigate. We shipped a fix the same day, and after a thorough investigation we found no evidence it was ever used against any players. The issue was in how the client handled certain images (PNGs) sent by a server. A malicious or compromised server could send a specially crafted image and, in the worst case, use it to run code on a connected player's machine. While we were in there we made several additional passes over the entire codebase to harden it further, and are implementing new checks and processes to catch these earlier on. The researcher @0x90sh, wrote up an amazing write up with the full technical details here: 0x90.sh/threads/how-a-… Safety and security is a top priority for us and our players, we're constantly investing internally in ways to improve our game and platform. Part of that is working with 3rd party security researchers, if you're a researcher and are interested in getting started with our Vulnerability Disclosure Program: hytale.com/security
