13 ms·
World of Warcraft: one simple line of code can cost you dearly (2016)
- rhacker 8y agoAs a player of a different game, Elder Scrolls Online, is there any similar danger? The add-on system I believe is also Lua.
- WrtCdEvrydy 8y agoYes, but most of these LUA games have no remote executions. Just don't copy magical things from people.
- NathanKP 8y agoThe difference is Elder Scrolls Online doesn't have a command to run a script inline from the chat window. So you are pretty safe unless you specifically install a compromised add on. It is definitely possible for add ons to mail stuff from your account automatically, including gold because some add ons have a "tip" feature built in, and some operate by using the mail to help you transfer stuff to a mule character. So a compromised add on could just set it up so every time you log in it automatically mails 1000 gold to another account. But at least you would have to install the plugin explicitly instead of just compromising yourself via the chat window.
- mdhughes 8y agoYou can actually run LUA scripts from chat, exactly the same way: ``` /script d("Hello") ``` But the PC/Mac ESO community tends to be older (rated M) and less gullible in chat. Gold-sellers got a cold reception and rapid bans. I suspect that'd work on console players, who tend to be younger, if they had scripting and addons, which they do not.
- WrtCdEvrydy 8y agoIt's funny that if you open developer tools in facebook.com, you get a nice message about not to copy things into the developer console. Stop! t78-eatOBZQ.js:172 This is a browser feature intended for developers. If someone told you to copy-paste something here to enable a Facebook feature or "hack" someone's account, it is a scam and will give them access to your Facebook account. t78-eatOBZQ.js:172 See https://www.facebook.com/selfxss https://www.facebook.com/selfxss for more information.
- ryanlol 8y agoThere used to be pretty widespread "worms" instructing you to paste javascript snippets into the developer console.
- kostarelo 8y agoAnd "hacks" that would make your FB Page go viral and stuff. I used to hear that a lot from close friends and I remember how hard I wanted to laugh but couldn't.
- Moru 8y agoYou get this when trying to paste on any page in firefox console view: Scam Warning: Take care when pasting things you don't understand. This could allow attackers to steal your identity or take control of your computer. Please type 'allow pasting' below (no need to press enter) to allow pasting.
- merb 8y agoI actually don't get that.
- danShumway 8y agoDumb question, but have you ever pasted in the past? Once you do it once and turn on pasting, you won't get the warning again. about:config --> devtools.selfxss.count needs to be 0 when Firefox boots up to get the warning.
- TravHatesMe 8y ago"pasted in the past" I had to reread that a couple of times
- askafriend 8y agoPlease try to make a more substantive contribution next time. Comments like this don't contribute to the conversation and have quite a distracting effect. HN has its issues but the least we can do is to take care that the quality of discourse doesn't turn into another Reddit.
- XCabbage 8y agotl;dr: if you run untrusted code from malicious actors, bad things will happen. Nothing new here.
- sbierwagen 8y agoAs a moderately sophisticated user, I wouldn't have expected the function RemoveExtraSpaces to immediately enable a RCE attack. It sounds pretty innocuous.
- okket 8y agoThe 'RunScript' keyword does give a slight, glaring hint IMHO.
- vectorEQ 8y agomost people who play wow don't know what a script is. they just click mobs and do raids. it's not obvious atall to a lot of people, just like phone scams, people who go door to door to scam, or even spam emails. Its for a good reason these things still go on: they are still effecive against people who aren't developers or IT enthousiasts, which most gamers aren't. they like games, not scripting engines and LUA interpreters or w/e
- bialpio 8y agoYou would if someone told you to replace trim() with eval(). :-)
- thecatspaw 8y agoits not the function thats the problem, its replacing it with the run function, which (to me) are obviozs signs of shenanigans
- krageon 8y agoJust the fact that RunScript is being substituted for something else should set off alarm bells.
- minimaxir 8y agoDiscussion back when this was posted in 2016: https://news.ycombinator.com/item?id=12158299 https://news.ycombinator.com/item?id=12158299
- paraboul 8y agoReminds me the old days of mIRC (popular IRC client back then) where you could (and still probably can) run similar scenario using mSL language (https://en.wikipedia.org/wiki/MIRC_scripting_language https://en.wikipedia.org/wiki/MIRC_scripting_language) directly from the chat input. A script could literally takes control of the computer because mIRC is able to load native code by loading arbitrary DLLs
- mickeyp 8y agoBack in the 90s mIRC would download files to the root directory of mIRC itself -- long before the concept of separating user data and code became the norm on Windows -- and if people had "auto accept file transfers" enabled people could send you a viral "script.ini" (as I recall it was called) to you and immediately overwrite your customisations. The end result would spread rapidly as the infected users would share it with others who join and left the channels they were in.
- distantsounds 8y agomIRC by default would not auto-accept .INI files, there was a blacklist on certain file types that would be rejected, with INIs as one of them.
- eiaoa 8y ago> mIRC by default would not auto-accept .INI files, there was a blacklist on certain file types that would be rejected, with INIs as one of them. Was that a reaction to the problem described in the GP? Especially in the 80s/90s, defensiveness like that was probably to solve an existing problem.
- tonylucas 8y agoExactly that, it was known as the ‘script.ini’ problem, the download directory was changed as well. It would attempt to send to people as they joined a channel. More info: http://www.irchelp.org/security/si.html http://www.irchelp.org/security/si.html
- brootstrap 8y agoyou guise i got phat loot just enter this magic command and it will appear in your inventory... Newbies eyes get wide open O.O
- arayh 8y agoIt would have been funny to simply pretend that you had entered the line, just to see the social engineer send you LUA code in plaintext.
- bassman9000 8y agoAnd immediately after tell him there's a syntax error, and how to fix it
- whatcd 8y agoplaying World of Warcraft can cost you dearly
- minimaxir 8y agoNowadays (EDIT: anecdotally, sourced from myself, friends, and forums/Reddit), there's been a player exodus in WoW, as the latest expansion (Battle for Azeroth) has an unrewarding and mandantory grindy endgame, in addition to other player-unfriendly changes which the playerbase suspects is to pad out time-played metrics.
- vlunkr 8y agoEven if that's true, the game has had incredible longevity. That expansion came out 14 years(!) after the original release of the game. I'm sure the player base isn't what it used to be, but that has to be some kind of record.
- minimaxir 8y agoIt's a big downgrade from the previous expansion (Legion), which had a playerbase close to WoW's peak.
- basic1 8y agoThat information came from a blog post which was later refuted by Blizzard.
- SketchySeaBeast 8y agoThere are longer running MMO's, and the playerbase has faded a bit, but you're absolutely right - it's still a monolith, and to which all other MMO's are compared. Regardless of the BFA problems, it still wields a huge amount of power.
- JCharante 8y agoEve Online is still kicking with its frequent updates (they shifted from an expansion every 6 months to a release every 6 weeks about 2 years ago)
- basic1 8y agoWeakAuras also had an import/export feature that was widely abused in a similar way.
- vortico 8y agoDoes the luascript interface have a vulnerability for actual remote code execution? Can someone launch calc.exe with the HUD API?
- madrox 8y agoWhile this attack does not discuss that particular detail, there have been many documented methods for breaking out of the sandbox (you can google around to see citations). I think for most attackers getting access to the user's WoW API is the goal.
- vbezhenar 8y agoNo, you need to find another vulnerability to break from Lua sandbox.
- madrox 8y agoOut of curiosity, why is it ever a good idea to add a command to execute arbitrary strings in the same space as the user? eval() has been the same source of headaches in javascript over the years. I believe WoW uses it primarily to let the player make macros, which is a legit use, but using something like RunScript to do it seems lazy.
- bcoates 8y agoeval is by far the easiest way to run arbitrary code, but you can write eval yourself in any fully-general programming language. It doesn't actually give attackers any additional power. This isn't the eval attack where you accidentally pass attacker-controlled inputs into eval because of an escaping problem or something, the sole purpose of /run is to allow users to run arbitrary Lua in the UI
- tinus_hn 8y agoJavaScript needs a way to load a script from another script. That functionality is equivalent to eval(), whichever way you build it.
- matheusmoreira 8y agoMetaprogramming. It's possible to generate source code and then evaluate it. For example: one can write a parser generator that compiles a grammar to a Javascript function definition that parses that grammar, which can then be evaluated from within Javascript in order to create the custom function.