Hacker News Reader

Comment by Twisol | Hacker News Reader

The attacker figured. WoW doesn't do this normally - the attack involves the victim explicitly replacing an innocuous "RemoveExtraSpaces" function - which ostensibly is used as a scripting hook to trim spaces from incoming chat messages - with an eval-equivalent "RunScript". They basically just tied the ends of the right wires together.

I'm not even sure this is a vulnerability at the scripting level. I think it's just a bad idea to include `/run` by default.

View on HN

The `/run` command is pretty essential for debugging mods. I think that it'd be a wise idea to disable it by default, and allow an advanced user to change a setting in a file to turn it back on.

To add to this, any barriers Blizzard introduces will just become an extra step in the social engineering portion of the attack, getting the victim to enable the feature.

Facebook has had the same problem with the browser devtools. Fun seeing a repeat of it in a different sector.

It is reminiscent of "Press Alt-F4 for ops", used to troll Mirc users on IRC back in the 90's; or having people enter "+++ATH0,ATDT,911" from the BBS days.

To tie the two together (IRC/++ATH0)... /ctcp #channel PING ++ATH0

http://everything2.com/title/%252B%252B%252BATH0

Incidentally, that ALT+F4 trick worked in WoW too, since we're on the subject.

I understand that WoW doesn't execute all received chat.

My issue is that this exploit was possible AT ALL and that this wasn't tested. As a web developper, this is the kind of exploits I keep in the back of my mind every time I develop something.

> As a web developper, this is the kind of exploits I keep in the back of my mind every time I develop something.

As a web developer, you should also know that there is absolutely nothing you can do to prevent attacks performed through the developer console. This is the moral equivalent.

At that point, yes, it's too late. The issue here is that their developer console is also the chat and that users can receive external messages from anyone in that "console". If you want to have the chat be the console, you really need to make sure everything is safe.

No part of this attack involves exploiting a bug. There is a deliberate feature which lets you enter and run arbitrary code. Tricking people into running malicious code results in bad things happening to them.

Nope. Perl (e.g.) calls this 'tainted' data and it should never be passed to any kind of evaluator. And that means that console should never pass arrived data to anything initially unknown. It's implementor HAS NO RIGHT to call functions that can be overridden, he should save startup values of all used functions as local values and never look there again, at least. As I already said in this thread, blizzard devs are just incompetent in trivial security.

At least someone else in the comments has heard of "tainted" data. How in the world incoming chat text from other players is ever allowed to wind up in an executable/scriptable context is baffling.

I know, right? I can't believe that my message are getting downvoted so much.

Yes, the user has to be tricked into writing a piece of code into the console. The problem here is that this piece of code shouldn't have been able to be executed at all. Who in their right mind would allow incoming messages to be parsed? They should have caught that bug in development!

Users shouldn't be able to alias anything to RunScript. Much less alias RunScript to RemoveExtraSpaces or other functions which are called by the core. This is a big big big security fail.

Yes, this bug involve some social engineering but the bug itself is big. This is not a bug but a really bad oversight. If someone made it so that the field of a website's form called eval() directly we would all be pointing fingers right now. This bug is the exact same thing.

You can make every website in existence call eval() directly on the contents of a form field if you persuade the user to paste some arbitrary text into the developer tools. The attack here happened to involve hooking an internal helper function, but that hook was in no way necessary for the attack; it could have instead just registered for the incoming chat text event and called eval() on it there.

Reply on news.ycombinator.com