5 ms·
As a moderately sophisticated user, I wouldn't have expected the function RemoveExtraSpaces to immediately enable a RCE attack. It sounds pretty innocuous.
by sbierwagen 8y ago
As a moderately sophisticated user, I wouldn't have expected the function RemoveExtraSpaces to immediately enable a RCE attack. It sounds pretty innocuous.
- okket 8y agoThe 'RunScript' keyword does give a slight, glaring hint IMHO.
- vectorEQ 8y agomost people who play wow don't know what a script is. they just click mobs and do raids. it's not obvious atall to a lot of people, just like phone scams, people who go door to door to scam, or even spam emails. Its for a good reason these things still go on: they are still effecive against people who aren't developers or IT enthousiasts, which most gamers aren't. they like games, not scripting engines and LUA interpreters or w/e
- bialpio 8y agoYou would if someone told you to replace trim() with eval(). :-)
- thecatspaw 8y agoits not the function thats the problem, its replacing it with the run function, which (to me) are obviozs signs of shenanigans
- krageon 8y agoJust the fact that RunScript is being substituted for something else should set off alarm bells.
- SmellyGeekBoy 8y agoNot everyone who plays WoW is a developer.
- mywittyname 8y agoThe OP specified "moderately sophisticated."
- nfriedly 8y agoI don't think RemoveExtraSpaces has any RCE, but it is overwriteable. The "hack" is tricking the user into overwriting it with a different function called RunScript.
- nightski 8y agoWhich is complicated by the fact that any addon (which many users use a dozen or more) can do this without the user knowing at all on initialization.
- jdmichal 8y agoAny add-on added by the user is already executing in the client's space and has zero need for a vulnerability like this. It's like saying that any program running on my computer could exploit a remote code execution bug... I mean, yes, it could. But why would it, when it already has local execution rights?
- Qwertystop 8y agoBecause if the add-on just opens up a backdoor, the author can do more specifically targeted things at their whim rather than blasting everyone who installed it? Harder to get caught.
- horsawlarway 8y agoStill zero need for this kind of exploit. The author of the addon can already do specifically targeted things at whim at a later point in time.
- nightski 8y agoI mean it was already maliciously exploited in a highly used addon. It was a lot easier to slip in a short one liner than some highly suspicious "hack the user" blob of code. It was also extremely flexible. They could then do different things to each person instead of one fixed attack.
- jschwartzi 8y agoThe issue is that Lua treats functions as "first-class," meaning that they are stored in variables like other data. This is how named functions are created within the language, and function syntax is sugar for initializing a variable and stuffing a function into it. This works with API functions also, which is why this works.