Linus Tech Tips Discussion

 Arc Raiders patched Discord Game Activity SDK that previously logged coversations and credentials into non encrypted log file Summary Discord via Arc Raiders got caught into privacy and security skill issue once again with the Game Activity SDK used in Arc Raiders caught logging conversations - even private ones, and credentials into a non encrypted log file. The SDK contains events that are somehow doing functions broader than just recording game activity that are usually necessary for in game bonuses or Discord bonuses, such as scanning private DMs, friends list, and bearer token that can be used for accessing some of Discord settings and the token would not change until password change.    Quotes Quote A computer engineer has discovered a serious vulnerability within Discord's SDK that allows games to store Discord DMs between players in game logs without any security measures. System engineer Timothy Meadows published a blog post, revealing an incident where Arc Raiders was storing DMs between two gamers in plaintext to a local log file. Thankfully, at the time of writing, the problem has since been hotfixed by Embark Studios.  Timothy discovered that Arc Raiders' Discord SDK was using a completely unencrypted bearer token and logs "all events" including any private conversations to the user's local drive without any encryption. A bearer token stores the user's Discord credentials, and anyone who gets this token has full access to the Discord user's account, including private DMs, friends list, and account settings.    Quotes Quote Description: Private Discord Direct Messages exchanged between two users were captured by the game's Discord SDK gateway connection and written in full to a plaintext log file stored locally on the user's machine.   Evidence: MESSAGE_CREATE gateway events appearing in the game log file Channel type 1 confirmed - this is a private DM channel, not a game or public channel Messages between users captured in full Message content, timestamps, user IDs, channel IDs all logged in plaintext The Arc Raiders Discord SDK connects using a full user Bearer token, opening a complete Discord gateway connection identical to the one used by the Discord desktop app itself. Discord's gateway pushes all events to this connection - including private DM messages. Rather than filtering sensitive events, the SDK logs everything it receives to disk.   Impact: Any private conversation received while the game is running is written to disk Log files may be included in crash reports or bug report uploads Log files may be accessible to other app