Update July 19th 1:20PM: Arc System Works has released a patch to fix the RCE exploit issue plaguing BlazBlue: Central Fiction. The developer announced the fix via Steam, and all you need to do if you want to apply the patch is update your game to the latest version via the usual Steam update path.
Update: Discord user GrimFlash has shared information regarding a temporary fix for the below issue. According to GrimFlash, the fix was created by user ThingsNStuffYouKnow, who also highlighted the cause of the issue: a stack-based buffer overflow vulnerability is being exploited for remote code execution. It's not entirely dissimilar to the way hackers used server vulnerabilities for RCE exploits in Dark Souls a few months back. Make sure to download the fix if you're worried about your BlazBlue: Central Fiction servers getting hit by hackers. Original story follows below.
Original story: Players have discovered a BlazBlue: Central Fiction exploit that allows hackers to steal players' passwords and take control of their PCs. Hosting a lobby is enough to make you open to the exploit, but there are steps you can take to protect yourself from it.
What is this BlazBlue: Central Fiction exploit?
Twitter user Chickzama first spotted the BlazBlue: Central Fiction warning on the official Central Fiction Discord server. User GrimFlash posted the methodology of the exploit, which involves hackers sending malicious code disguised as one of Central Fiction's game files. Once this data is sent, it then downloads and runs itself, giving hackers access to your PC or allowing them to steal sensitive data from you. Specifically, the file the malicious data disguises itself as is named "iDmacDrv32.dll", and it can be found in the BlazBlue: Central Fiction game directory.
How to protect yourself from the BlazBlue: Central Fiction exploit
Protecting yourself from this exploit is relatively straightforward. Only online players are affected by it, so if you play entirely offline, then you should be OK. In addition, GrimFlash and Chickzama make no mention of the console versions, so it's likely that if you're playing on PlayStation or on Switch, you'll be fine. If, however, you are an online player and you're on PC, here are some of the steps you can take to stop the malicious data from ruining your day.
- Keep lobbies invite-only so that random players can't join them
- Update your antivirus software (the data payload does get flagged by most major antivirus programs)
- Verify your game files, especially if someone joins your lobby and BlazBlue: Central Fiction crashes. You can verify files by right-clicking the game in Steam, going to Properties, then Local Files, then "Verify integrity of game files"
It's worth noting here that you can very much still play BlazBlue: Central Fiction online, but you should take the above steps to make sure that you're protected as much as you can be. After all, Central Fiction has rollback netcode now, and you wouldn't want to lose out on that online fighting goodness because you're not properly protected from attacks (but the malicious hacker kind of attacks, not the Overdrive kind). Here's hoping Arc System Works picks up on this soon and issues a fix for it.
