General Graboids: Worms and Remote Code Execution in Command and Conquer

This talk was a hit at Districtcon's junkyard talks -- outstanding work; and hilarious to see Doom inside of C&C.

joe_mamba 6 hours ago | parent | prev | next [-]

>After initial discovery and creation of the PoCs, we reached out to EA Games in August 2025 to report these issues. EA was helpful but confirmed that the issues were not within scope of their support.

Man, I gotta respect the balls on the author for reaching out to EA, and with a straight face, expecting them to push a bug fix for a ~23 year old game. Someone at EA who got the email probably got a chuckle out of it.

Also happy to see this classic RTS is still being played and even developed by the community. I'd be curious to know what the age of people this invested into the game is, if it's all 30+ year old boomers with nostalgia and knee pain, or if Generals also found its way to the current generation of players. "Can I have some shoes?"

	▲	charcircuit an hour ago \| parent \| next [-]
		https://store.steampowered.com/app/2229870/Command__Conquer_... They are still selling it. Selling games you know have such dangerous security issues is not good.
	▲	skhr0680 24 minutes ago \| parent \| prev \| next [-]
		> Also happy to see this classic RTS is still being played and even developed by the community. I'd be curious to know what the age of people this invested into the game is, if it's all 30+ year old boomers with nostalgia and knee pain There's enough of a community to support a yearly World Series with $25K cash awards in 2025!
	▲	protocolture 4 hours ago \| parent \| prev \| next [-]
		They have a tendency to rerelease the full stack every few years.
	▲	ajsnigrutin an hour ago \| parent \| prev [-]
		It would be a lot more cool if they actually fixed it and showed how they care about their customers even if the games are very old.. it's good PR, compared to eg. the most downvoted reddit comment ever.

▲

OsamaJaber 4 hours ago | parent | prev | next [-]

Surprised it took this long for someone to write it up properly

▲

hexasquid 4 hours ago | parent | prev [-]

Atredis has detected wormsign