7 ms·

The attacker figured. WoW doesn't do this normally - the attack involves the victim explicitly replacing an innocuous "RemoveExtraSpaces" function - which osten

by Twisol 10y ago

The attacker figured. WoW doesn't do this normally - the attack involves the victim explicitly replacing an innocuous "RemoveExtraSpaces" function - which ostensibly is used as a scripting hook to trim spaces from incoming chat messages - with an eval-equivalent "RunScript". They basically just tied the ends of the right wires together. I'm not even sure this is a vulnerability at the scripting level. I think it's just a bad idea to include `/run` by default.

onetwotree 10y ago
The `/run` command is pretty essential for debugging mods. I think that it'd be a wise idea to disable it by default, and allow an advanced user to change a setting in a file to turn it back on.
- nkrisc 10y ago
  To add to this, any barriers Blizzard introduces will just become an extra step in the social engineering portion of the attack, getting the victim to enable the feature.
  - scrollaway 10y ago
    Facebook has had the same problem with the browser devtools. Fun seeing a repeat of it in a different sector.
    - elliottcarlson 10y ago
      It is reminiscent of "Press Alt-F4 for ops", used to troll Mirc users on IRC back in the 90's; or having people enter "+++ATH0,ATDT,911" from the BBS days.
      - roghummal 10y ago
        To tie the two together (IRC/++ATH0)... /ctcp #channel PING ++ATH0 :D http://everything2.com/title/%252B%252B%252BATH0 http://everything2.com/title/%252B%252B%252BATH0
      - nkrisc 10y ago
        Incidentally, that ALT+F4 trick worked in WoW too, since we're on the subject.
Raphmedia 10y ago
I understand that WoW doesn't execute all received chat. My issue is that this exploit was possible AT ALL and that this wasn't tested. As a web developper, this is the kind of exploits I keep in the back of my mind every time I develop something.
- plorkyeran 10y ago
  No part of this attack involves exploiting a bug. There is a deliberate feature which lets you enter and run arbitrary code. Tricking people into running malicious code results in bad things happening to them.
  - Raphmedia 10y ago
    Users shouldn't be able to alias anything to RunScript. Much less alias RunScript to RemoveExtraSpaces or other functions which are called by the core. This is a big big big security fail. Yes, this bug involve some social engineering but the bug itself is big. This is not a bug but a really bad oversight. If someone made it so that the field of a website's form called eval() directly we would all be pointing fingers right now. This bug is the exact same thing.
    - plorkyeran 10y ago
      You can make every website in existence call eval() directly on the contents of a form field if you persuade the user to paste some arbitrary text into the developer tools. The attack here happened to involve hooking an internal helper function, but that hook was in no way necessary for the attack; it could have instead just registered for the incoming chat text event and called eval() on it there.
  - wruza 10y ago
    Nope. Perl (e.g.) calls this 'tainted' data and it should never be passed to any kind of evaluator. And that means that console should never pass arrived data to anything initially unknown. It's implementor HAS NO RIGHT to call functions that can be overridden, he should save startup values of all used functions as local values and never look there again, at least. As I already said in this thread, blizzard devs are just incompetent in trivial security.

by Twisol 10y ago

onetwotree 10y ago

The `/run` command is pretty essential for debugging mods. I think that it'd be a wise idea to disable it by default, and allow an advanced user to change a setting in a file to turn it back on.

nkrisc 10y ago
To add to this, any barriers Blizzard introduces will just become an extra step in the social engineering portion of the attack, getting the victim to enable the feature.
- scrollaway 10y ago
  Facebook has had the same problem with the browser devtools. Fun seeing a repeat of it in a different sector.
  - elliottcarlson 10y ago
    It is reminiscent of "Press Alt-F4 for ops", used to troll Mirc users on IRC back in the 90's; or having people enter "+++ATH0,ATDT,911" from the BBS days.
    - roghummal 10y ago
      To tie the two together (IRC/++ATH0)... /ctcp #channel PING ++ATH0 :D http://everything2.com/title/%252B%252B%252BATH0 http://everything2.com/title/%252B%252B%252BATH0
    - nkrisc 10y ago
      Incidentally, that ALT+F4 trick worked in WoW too, since we're on the subject.

Raphmedia 10y ago

I understand that WoW doesn't execute all received chat. My issue is that this exploit was possible AT ALL and that this wasn't tested. As a web developper, this is the kind of exploits I keep in the back of my mind every time I develop something.

plorkyeran 10y ago
No part of this attack involves exploiting a bug. There is a deliberate feature which lets you enter and run arbitrary code. Tricking people into running malicious code results in bad things happening to them.
- Raphmedia 10y ago
  Users shouldn't be able to alias anything to RunScript. Much less alias RunScript to RemoveExtraSpaces or other functions which are called by the core. This is a big big big security fail. Yes, this bug involve some social engineering but the bug itself is big. This is not a bug but a really bad oversight. If someone made it so that the field of a website's form called eval() directly we would all be pointing fingers right now. This bug is the exact same thing.
  - plorkyeran 10y ago
    You can make every website in existence call eval() directly on the contents of a form field if you persuade the user to paste some arbitrary text into the developer tools. The attack here happened to involve hooking an internal helper function, but that hook was in no way necessary for the attack; it could have instead just registered for the incoming chat text event and called eval() on it there.
- wruza 10y ago
  Nope. Perl (e.g.) calls this 'tainted' data and it should never be passed to any kind of evaluator. And that means that console should never pass arrived data to anything initially unknown. It's implementor HAS NO RIGHT to call functions that can be overridden, he should save startup values of all used functions as local values and never look there again, at least. As I already said in this thread, blizzard devs are just incompetent in trivial security.