Blizzard Exempt from iOS and MacOS Security Sandbox | Hacker News Reader

Blizzard Exempt from iOS and MacOS Security Sandbox

twitter.com

141 pointspersonjerry64 comments

Tweet has been deleted: https://twitter.com/i0n1c/status/738258436161449984

I deleted the tweet with the picture of the sandbox because people start hyping it up without linking the clarification.

And the "clarification" tweet: https://twitter.com/i0n1c/status/738084828202053633

For those late to the party: the sandbox bypass exception for Blizzard only affects the access() family of syscalls - probably harmless

Edit: Original tweet screenshot http://imgur.com/c8RnYjo (it's still in Google cache… for now).

I Google'd and here is one result, showing at least one theoretical security vulnerability of access(): http://stackoverflow.com/a/14333217/3650441

If an attacker knows what files Blizzard is calling access() on, they could likely use this exploit and execute arbitrary code.

The existence of the inherent time-of-check versus time-of-use hole with access is a several steps away from "execute arbitrary code". The example given presumes you are using access on crontab (and that the app can write to it).

Could they though? The way I understand the answer is that the security hole happens if a privileged user which manipulates files for an unprivileged user calls access() and then open(). In this case Blizzard's application is an unprivileged user, thus even if you manage to insert yourself between the calls, you will only be able to make Blizzards application execute code. The application still runs in a sandbox so you will not get that far.

And for an attacker to exploit this (which in all likelihood is impossible anyways), they'd need to already be executing arbitrary code.

> I Google'd and here is one result, showing at least one theoretical security vulnerability of access(): http://stackoverflow.com/a/14333217/3650441

That is not a security flaw in access, it's a potential security flaw in administrative processes that use access() and then operate on files. There's a hole there where someone could swap the file that they are trying to open. That's just a reason to not use that API (there are the at APIs for a reason). But since Blizzard processes are (presumably) not running as root, there isn't a security flaw.

> If an attacker knows what files Blizzard is calling access() on, they could likely use this exploit and execute arbitrary code.

The ability to maybe* get a program to do some file operations on a different file than it checked against is miles away from code execution, unless the program's job is to execute code from a file.

0xBuLL of 0xa bytes, dev's feelings come through loud and clear here.

You're looking at the output of a disassembler, not at the original source code. It probably reads something boring like sizeof(Identifier) in the original.

That's exactly what it is. The third parameter to memcmp is the length of the buffers to be compared - "G847MC6JZ5", the string being compared, has a length of 11 characters (including the null terminator, which is a little odd). 11 is B in hex, and is stored as an unsigned Long Long, so the representation in the disassembler is 0xBuLL.

And that string is the Blizzard identifier: https://www.virustotal.com/en/file/bdfd2017fb776b52a4604928e...

Not odd to include the null terminator if you want to ensure another string is "equal to", not just "starts with" the string you're comparing it to.

Dang it, I counted the \0 but miscounted the characters in the string.

I recall a story of how the windows 95 team (or the like) was crazy dedicated to backwards compatibility, so they had a check to see if the user was running Roller Coaster Tycoon and if so, disabled virtual memory so the game would run.

Though I'd like to know more details, like:

* Why does blizzard need to run in the sandbox on Mac OS X? The app sandbox is opt-in (though required for App Store apps)

* Can anyone set their team ID to blizzard's?

* Are blizzard games attack vectors?

Interesting point. Never heard of any program impersonating 'Warden' for malicious purposes but it seems possible.

Warden isn't particularly widespread, and impersonating it wouldn't gain you any extra privileges. Seems pretty unlikely.

> * Can anyone set their team ID to blizzard's?

No, at least not for apps that are distributed on the official channels and signed with an official developer cert.

> * Are blizzard games attack vectors?

All games are, savegame manipulation is often the first step towards jailbreaking a game console.

What if your game sucks/isn't mechanically complicated and doesn't read saves?

Checkmate.

Apparently Steam games are favourite attack vector of NSA, they love exploiting Steam games on sysadmin machines.

https://www.wired.com/2016/01/nsa-hacker-chief-explains-how-...

The steam uri handler probably has lots of avenues of easy RCE.

No Sysadmin shoud be playing games on the systems he/she uses for admin work.

Oh, I so wish that were true.

Heck, back in the day I caught someone (thankfully not at the place I worked) running a game (some FPS) server on their exchange server box. Running Steam is well within the realm of possibilities.

At one building, friends and I rigged every machine to have hidden copies of Alien vs Predator and Everquest. I modified the system software to intercept keystrokes before they got to the game. One command crashed video, audio, and then whole system. I also set others to randomly crash around same time people walked in to supervise what was going on. Friends and I griped our machines were down about every day. Person in charge ordered us to keep using them and get no replacements because that served wiseasses like us.

Oh, yes it did. Served us well. (evil grin)

Note: Also embedded web browser into our business application in development-mode only. The GUI forms and such. Policy had IE locked down but embedded browser still worked lol. So, fast coders got the job done quickly then were bullshitting around on Internet till someone approached. One key stroke and back to boring UI testing. ;)

Since I alternate between developer and system admin jobs[1], you message hits me both as "Righteous" and "Dammit you $^%& developer". I am so conflicted.

1) welcome to the wonderful and horrible world of a journeyman in the middle

I try to stay in those grey areas where people sort of want to stop me but find my antics too useful or entertaining. :) Far as that setup, sysadmin was a pal of mine who hated the unreliable crap he had to manage. He had already made sure all the work sync'd to their Novell network's central storage. I also told people to make CD backups with the CD burners on the machines. With my help, people just lost time here and there with him not having to do any extra work.

So, sysadmin was thanking me for helping him deal with machines that were inexplicably always crashing "because Acer machines are garbage." You feel more or less conflicted now? :P

Sadly, these days, the Acer machines are the least problematic of the machines (looking at you H "100 hard drive failures out of 120 machines" P) I have to deal with.

[edit] I feel about the same, as a system admin, I get bit in the /\$$ way too often by good intentions. I hear they pave a road with them (I think I worked there).

I once heard a (probably apocryphal) story of a developer who had been playing Doom installed on a server.

The sysadm caught him playing it and promptly unistalled the game.

However the important business application hosted on the server then stopped working and no one could figure out why.

Nothing would work... even after lots of debugging, error log analysis and redeploying.

The developer suggested installing Doom again and lo and behold, the application started working.

If someone tells you that story, they have to explain why.

It was actually a common problem back in the day.

Software would ship with shared DLL's, uninstalling an application would usually have a knock on effect.

MS-DOS was used a lot for small office servers. Whilst Windows NT4 was growing in popularity, it was an expensive option for firms. Plus it was hard to play games on NT4 due to memory protection issues.

A fable of Doom being needed to run a server in today's environment is ridiculous, however back then things were a lot less mature. The issue wasn't limited to just games. Any application with shared files was a nightmare, normally you just renamed files, rebooted, then if things worked you could delete the files.

Okay, nitpick time. Your story about the game is surely wrong. Rollercoaster Tycoon was developed for Windows 95/98.

Perhaps you meant it's a later version of Windows, or the game's spiritual predecessor, Theme Park, which ran in DOS.

This seems to mention the virtual memory but not any specific game https://blogs.msdn.microsoft.com/oldnewthing/20160328-00/?p=...

Probably SimCity, there's a bit about Microsoft adding a workaround for a bug in the game in this article http://www.joelonsoftware.com/articles/fog0000000054.html

Edit: Maybe not this since it's unrelated to virtual memory but it's along the same lines, going to some lengths to keep software compatible

You're right that's the story I was thinking of. I didn't remember all the details though, I guess I knew some old version of windows, some simulation game, and something involving memory. Turns out the actual details got mixed up in my head!

Could've been Transport Tycoon (Deluxe) which was the previous game from the developer of RCT

It could be that this was done for Blizzard's iOS games, and OS X just happens to share the code.

I remember that backward compatibility story, but when I search for it I keep finding this post. :)

Here's the story Joel Spolsky wrote some time ago[1]:

> Windows 95? No problem. Nice new 32 bit API, but it still ran old 16 bit software perfectly. Microsoft obsessed about this, spending a big chunk of change testing every old program they could find with Windows 95. Jon Ross, who wrote the original version of SimCity for Windows 3.x, told me that he accidentally left a bug in SimCity where he read memory that he had just freed. Yep. It worked fine on Windows 3.x, because the memory never went anywhere. Here's the amazing part: On beta versions of Windows 95, SimCity wasn't working in testing. Microsoft tracked down the bug and added specific code to Windows 95 that looks for SimCity. If it finds SimCity running, it runs the memory allocator in a special mode that doesn't free memory right away. That's the kind of obsession with backward compatibility that made people willing to upgrade to Windows 95.

[1] http://www.joelonsoftware.com/articles/fog0000000054.html

There are a lot of checks for specific apps in the Cocoa framework. It's pretty much what the undocumented CFExecutableLinkedOnOrAfter() is for (sometimes called in conjunction with a check for a specific bundle name).

Do you have examples?

one example is Popover controls on iPhone. http://marksands.github.io/2014/05/27/how-apple-cheats.html

Nobody saw this yet?

https://mobile.twitter.com/gruber/status/738149554978070529

Turns out a complete non-story.

Non-story? This just confirms that Blizzard indeed got an exception.

The reason doesn't make it a "non-story" in any way.

Nobody sane expected the reason to be anything besides something like that (e.g. some evil root access plan) -- and it's still a story.

Yes non-story, read through tweets and links in the link I posted.

The "story" here was that Apple was being irresponsible by giving Blizzard an exception to the sandbox.

In actuality it's little more than a shim to make a buggy Blizzard updater not crash by thinking it could do something it couldn't.

Someone should change the title on the HN story - it's just straight-up false.

Yeah, updates from John Gruber's birdies are so reassuring.

When I worked at Apple before Steve came back there were tons of checks in MacOS for particular versions of apps, especially for Microsoft Word and Excel, working around their buggy behavior (or their workarounds for Apple's buggy behavior, a vicious cycle). While I have no idea if this person knows anything it would not be surprising.

In Safari under Develop in the menu bar there's an item "Disable Site-specific Hacks"

Yeah. We port Windows applications to Mac at work. A couple years ago when Apple switched on a more stringent code signing requirement, we found many of our ports worked without the updated code signing, while some others would warn about an invalid signature. It was clear there was some internal whitelist for old, known signatures which had picked up many, but not all, of our ports. User friendly, I guess, but pretty ugly.

What's the alternative, users wait for some porting house to finally get around to releasing an update to be compatible? Oh, you don't have it in your contract to do that work, and the parent company isn't keen to pay you to do it, sorry users.

Maybe your update is now a paid update, so people can either pony up, or not upgrade, or abandon your software. Hello CS6. Was your latest update $10k? *major enterprise developer thanks you for the multi million dollar windfall your OS update gave them by forcing all their deploys to pay for a compatibility update, caused by "you".

Being a major platform developer is full of hard decisions balancing user experience and security, performance and future looking direction. It's not a problem most developers have to concern themselves with in your average app.

Horribly misleading title here. Blizzard is exempt from one tiny piece of the sandbox, namely the sandboxing around access(). Which is nearly irrelevant.

Why does Blizzard need an exception while the rest of us have to deal with it as is? Exceptions to rules mean the rules are broken.

I have no idea, why are you asking me?

Figuring you know the what so maybe you know the why. You often know more than most.

[edit: why the heck are people voting mikeash down, legitimate question after all in tone and spirit]

I'd speculate that access() was inadvertently left open before, Apple subsequently sandboxed it, this broke Blizzard, and Apple put in an exemption for them to avoid breaking millions of people's games.

But that's a complete guess.

According to tips John Gruber got Blizzard had a bug in one of their updaters that would crash due to the sandbox. Apple put in a check to allow the call the updater was making to succeed, but didn't actually grant any access that the updater didn't have before.

Apple shipped an update to the sandbox and included a small, harmless fix to avoid issues in popular 3rd party software. Microsoft does this all the time.

Also according to those same birdies, the Blizzard fixed the bug a while ago so the 'exemption' may be removed soon as it's no longer necessary.

They're Blizzard. They're bigger than you. It's like all those exceptions that Microsoft made in Windows for different legacy software programs.

Hearthstone is used for competitive play on iOS devices regularly. Would this exemption let them employ some anti-cheating functionality?

This guy published an app that did jailbreak detection and some other stuff on the App Store, it was taken down, and has been rambling since then in a very very childish way about stuff like this: https://twitter.com/i0n1c/status/738286205708738560

Truth is--he knew what was going to happen, so this looks just like another excuse to rant.

He is known in the jailbreak scene as someone who cannot stay serious - he's always involved in some kind of drama.

If I recall correctly, the pangu dev team attended some of his sessions about iOS hacking and used this knowledge to create a publicly available jailbreak tool. He then started to rant about how they "stole" his technologies on twitter (see for example https://twitter.com/i0n1c/status/481020166483238912).

More about his childish public behavior related to the jailbreak scene can be read here: http://www.iclarified.com/41983/pangu-jailbreak-stops-using-...

Yeah, I remember this. He's always taunting people about having jailbreaks and not sharing them.

The problem at the time was that they had used his bug that he gave away only for training purposes to the people attending his class.

After the first release, pangu replaced his bug by one of theirs (and both bugs were fixed by apple in a subsequent iOS release.) He probably had to spend some time finding a new bug to use in his classes so it's understandable to be pissed.

How do you own a bug? Was the bug something in iOS? Wouldn't that be Apple's bug?

A sibling post said they took his code. That's a fair complaint, was it clear when they saw it that it was not code that they could reuse?

Actually, I believe that's the next (or current) big debate in software due to privacy/search warrants/recent FBI vs Apple iPhone unlock debacle.

I can't see how you could possibly describe his behavior as "childish" here. Pangu straight up stole his code and sold it.

Yep, i followed him on twitter for a few months, he's constantly trolling/behaving childish.

Truth is your comment is ad hominem. ;)

Reply on news.ycombinator.com