Finding and Exploiting Bugs in Multiplayer Game Engines
Jack Baker shares months of vulnerability research into Unreal Engine and Unity3D multiplayer networking protocols, exposing memory disclosure and speedhack bugs.
Summary
The Attack Surface of Multiplayer Game Engines
Unreal Engine 4 and Unity3D power the vast majority of commercial multiplayer video games, implementing complex low-level C++ networking protocols over UDP.
Auditing Multiplayer Network Synchronization Protocols
Jack Baker examines the internal packet serialization and actor replication mechanisms used by major game engines to synchronize game state.
Discovering Memory Disclosures and Physics Manipulation
Fuzzing network protocol handlers uncovered critical memory disclosure flaws, remote denial of service vulnerabilities, and game state manipulation vectors.
Hardening Game Server Architectures
Baker outlines defensive engineering practices for game developers, emphasizing server-side authority validation and memory-safe packet parsing.
Related talks
Main Stage·30 min
Jack Baker
Jack Baker answers audience questions on auditing multiplayer game protocols in Unreal and Unity, reverse engineering netcode, and fuzzing.
Main Stage·44 min
Max Bazalii · Marius Fleischer
Introduces Orion, an automated fuzzing orchestration platform that streamlines harness generation, corpus management, and crash deduplication at enterprise scale.
Main Stage·45 min
Marco dos Santos · Thibault Guiot
Marco dos Santos and Thibault Guiot audit BGP message parsers across seven modern routing implementations, exposing malformed packet vulnerabilities that disrupt transit.