4 ms·

Interpreting text for commands has an interest parallel to a major World of Warcraft bug. It turns out that you could run arbitrary lua code in your chat termin

Interpreting text for commands has an interest parallel to a major World of Warcraft bug. It turns out that you could run arbitrary lua code in your chat terminal by using the "/run ..." command. Enterprising thieves figured out that one of the things you could do was redefine functions, in particular the 'RemoveExtraSpaces' function that gets run against every chat line. If you set RemoveExtraSpaces=RunScript you've told WoW to execute every chat message displayed in your terminal. Attackers just have to trick you into writing "/run RemoveExtraSpaces=RunScript" into your terminal, and after that all they had to do was chat code to you and it would execute. They basically get full control of anything lua can do in your game -- including sending messages to your friends asking them to also run the attack command.

est31 6y ago
Kinda reminds me of the "don't type anything into the browser console" warnings that sites like facebook etc. emit so that people don't type in commands strangers gave them, believing it allows them "hack" others while in reality it only hacks themselves.
diarrhea 6y ago
That is super interesting. When did this happen? What is the worst that did happen through this?
- Pfhreak 6y ago
  I'm not sure. I do know that you could, for instance, have your gold sent to a scammer with little to no recourse. It may be possible that this bug still exists because it's one of those "bugs that is also a feature".
  - lilyball 6y ago
    Blizzard's response was to modify /run to pop up a dialog first warning you that /run is used by scammers and requires you to confirm that you know what you're doing.
- kyrra 6y ago
  Looks like it became popular in 2016. https://www.gdatasoftware.com/blog/2016/07/28809-world-of-warcraft-one-simple-line-of-code-can-cost-you-dearly https://www.gdatasoftware.com/blog/2016/07/28809-world-of-wa...
  - pvg 6y ago
    It's astonishing nobody found this till 2016, given that people were stealing WoW gold with keyloggers installed though 0 day flash vulns a few years before that.
    - virtue3 6y ago
      I think it would be a little harder to make monetary gains off of this. You still needed to be in physical proximity to trade. I'm not sure if you had the ability to script over the mailbox and change recipients, that could have worked perhaps. You'd get much more bang for the buck getting access to the whole account.
airstrike 6y ago
Reminds me of when I was a 12-year-old on IRC typing "/say /con/con" into really busy channels and watching nearly everyone disconnect, and laughing like a moronic teenager with my friends
- naikrovek 6y ago
  DCC SEND +++ATH0 had the same effect for modem users in the day.
  - kabdib 6y ago
    For Hayes modems, this wouldn't (well, shouldn't) have worked, since it requires a one second pause between the last '+' and the command. It's part of Hayes' patent IIRC. I believe it was also only processed on the transmitted traffic, not the received. What does a competing and not-wanting-to-infringe-a-patent modem company do? They just don't implement the delay, and ignore the direction of the traffic while they're at it. Problem solved! (head-to-desk, repeatedly)
    - jlgaddis 6y ago
      > I believe it was also only processed on the transmitted traffic, not the received. I believe you're correct, although it's been ~25 years... Which explains why the command above isn't exactly correct, IIRC. What you had to do was send a CTCP ECHO containing the "+++ATH0" to a channel -- or an individual user, but sending it to an entire channel full of people was a helluva lot more fun! Anyways, I don't recall the exact command nowadays but it was /CTCP #channel ECHO Goodbye +++ATH0 or something very similar. As long as the "victim's" IRC client wasn't ignoring those CTCP commands, it would "echo" the text and, as expected, command their modem to hang up. Perhaps it shouldn't have worked... but I promise you that it absolutely did. (Also, you could do the same thing by putting the "command" into the payload of an (ICMP) "ping" -- and that's a completely different thing from the "ping of death" that was discovered in that same era.) -- https://en.wikipedia.org/wiki/Client-to-client_protocol https://en.wikipedia.org/wiki/Client-to-client_protocol
    - naivedevops 6y ago
miki123211 6y ago
Some speech synthesizers for blind people, particularly old versions of Eloquence, crashed when they tried to say specific pieces of text. They often took down the screen reader with them, so the only thing you could do was a hard reset. An example of such a crashword is the mistyping of wednesday, where n is replaced with h. People were posting those crashwords in chats, on MUDs, or even as usernames. Some places where a lot of blind people hung out even contained specific filters for those. There were also programs that didn't escape SAPI5 tags properly, so, by posting particularly clever bits of XML, you could change parameters like the pitch, speech rate, volume, or even the currently active voice, and make users, particularly younger users, scared of weird ghosts in their computers.
- Pfhreak 6y ago
  This is absolutely fascinating and I'd love to read more.

est31 6y ago

Kinda reminds me of the "don't type anything into the browser console" warnings that sites like facebook etc. emit so that people don't type in commands strangers gave them, believing it allows them "hack" others while in reality it only hacks themselves.

diarrhea 6y ago

That is super interesting. When did this happen? What is the worst that did happen through this?

Pfhreak 6y ago
I'm not sure. I do know that you could, for instance, have your gold sent to a scammer with little to no recourse. It may be possible that this bug still exists because it's one of those "bugs that is also a feature".
- lilyball 6y ago
  Blizzard's response was to modify /run to pop up a dialog first warning you that /run is used by scammers and requires you to confirm that you know what you're doing.
kyrra 6y ago
Looks like it became popular in 2016. https://www.gdatasoftware.com/blog/2016/07/28809-world-of-warcraft-one-simple-line-of-code-can-cost-you-dearly https://www.gdatasoftware.com/blog/2016/07/28809-world-of-wa...
- pvg 6y ago
  It's astonishing nobody found this till 2016, given that people were stealing WoW gold with keyloggers installed though 0 day flash vulns a few years before that.
  - virtue3 6y ago
    I think it would be a little harder to make monetary gains off of this. You still needed to be in physical proximity to trade. I'm not sure if you had the ability to script over the mailbox and change recipients, that could have worked perhaps. You'd get much more bang for the buck getting access to the whole account.

airstrike 6y ago

Reminds me of when I was a 12-year-old on IRC typing "/say /con/con" into really busy channels and watching nearly everyone disconnect, and laughing like a moronic teenager with my friends

naikrovek 6y ago
DCC SEND +++ATH0 had the same effect for modem users in the day.
- kabdib 6y ago
  For Hayes modems, this wouldn't (well, shouldn't) have worked, since it requires a one second pause between the last '+' and the command. It's part of Hayes' patent IIRC. I believe it was also only processed on the transmitted traffic, not the received. What does a competing and not-wanting-to-infringe-a-patent modem company do? They just don't implement the delay, and ignore the direction of the traffic while they're at it. Problem solved! (head-to-desk, repeatedly)
  - jlgaddis 6y ago
    > I believe it was also only processed on the transmitted traffic, not the received. I believe you're correct, although it's been ~25 years... Which explains why the command above isn't exactly correct, IIRC. What you had to do was send a CTCP ECHO containing the "+++ATH0" to a channel -- or an individual user, but sending it to an entire channel full of people was a helluva lot more fun! Anyways, I don't recall the exact command nowadays but it was /CTCP #channel ECHO Goodbye +++ATH0 or something very similar. As long as the "victim's" IRC client wasn't ignoring those CTCP commands, it would "echo" the text and, as expected, command their modem to hang up. Perhaps it shouldn't have worked... but I promise you that it absolutely did. (Also, you could do the same thing by putting the "command" into the payload of an (ICMP) "ping" -- and that's a completely different thing from the "ping of death" that was discovered in that same era.) -- https://en.wikipedia.org/wiki/Client-to-client_protocol https://en.wikipedia.org/wiki/Client-to-client_protocol
  - naivedevops 6y ago

miki123211 6y ago

Some speech synthesizers for blind people, particularly old versions of Eloquence, crashed when they tried to say specific pieces of text. They often took down the screen reader with them, so the only thing you could do was a hard reset. An example of such a crashword is the mistyping of wednesday, where n is replaced with h. People were posting those crashwords in chats, on MUDs, or even as usernames. Some places where a lot of blind people hung out even contained specific filters for those. There were also programs that didn't escape SAPI5 tags properly, so, by posting particularly clever bits of XML, you could change parameters like the pitch, speech rate, volume, or even the currently active voice, and make users, particularly younger users, scared of weird ghosts in their computers.

Pfhreak 6y ago
This is absolutely fascinating and I'd love to read more.