Bandai Namco disables multiplayer Dark Souls games on PC over rce exploit

It appears that a remote code execution vulnerability has been found in Dark Souls III for Windows. The hacker in question has demonstrated it in a stream, Bandai Namco has turned off multiplayer in several Souls games and modders have already released a patch.

Bandai Namco announces the shutdown of multiplayer in Dark Souls Remastered, Dark Souls II and Dark Souls III in a tweet† Although the demonstration took place in Dark Souls III, the makers of an unofficial anti-cheat for that game say predecessors are also vulnerable, which at least doesn’t rule out Bandai Namco, given the downtime across multiple games.

The demonstration of the exploit took place during a broadcast of Twitch streamer The__Grim__Sleeper. His game crashes, after which his streaming software shows an overlay to shield the content from his desktop. He describes that a PowerShell window has opened and the audio from the stream shows the Windows text-to-speech engine reading a message.

According to Reddit user Jonientz, Blue Sentinel, the anti-cheat software for the game created by the community, has since been updated to address the vulnerability. Blue Sentinel closes several security holes in the game, including vulnerabilities reported to Bandai Namco and FromSoftware years ago. According to the community, Bandai Namco and FromSoftware are not active in plugging these kinds of holes.

YouTuber Ratatoskr spoke to the developer of Blue Sentinel. He would be in contact with the discoverer of the vulnerability and this person would not divulge the details. This person does want FromSoftware and Bandai Namco to do something about the vulnerabilities, but because that has not happened to date, he is coming out this way. The Blue Sentinel developer also reports that Dark Souls Remastered, Dark Souls II, Dark Souls III and Elden Ring would be vulnerable. This would be because FromSoftware does not or hardly updates the network architecture for its games in between games.

With a remote code execution, the attacker essentially has the same rights within the system as the application being exploited. Dark Souls III does not run with administrator privileges, which limits the damage somewhat. However, it is possible to exploit another vulnerability after exploiting Dark Souls III, including one that is normally only executable with local access to the PC. With that daisy chaining, the risk of such a vulnerability immediately becomes much greater.

The Verge has reached out to Bandai Namco for further comment, but did not hear from them in time. Elden Ring, FromSoftware’s next game, is set to release on February 25, just over a month away.

Dark Souls III