Hacker News Reader

Comment by sbierwagen | Hacker News Reader

As a moderately sophisticated user, I wouldn't have expected the function RemoveExtraSpaces to immediately enable a RCE attack. It sounds pretty innocuous.

View on HN

I don't think RemoveExtraSpaces has any RCE, but it is overwriteable. The "hack" is tricking the user into overwriting it with a different function called RunScript.

So really the culprit is monkey-patching.

Which is complicated by the fact that any addon (which many users use a dozen or more) can do this without the user knowing at all on initialization.

Any add-on added by the user is already executing in the client's space and has zero need for a vulnerability like this.

It's like saying that any program running on my computer could exploit a remote code execution bug... I mean, yes, it could. But why would it, when it already has local execution rights?

Because if the add-on just opens up a backdoor, the author can do more specifically targeted things at their whim rather than blasting everyone who installed it? Harder to get caught.

Still zero need for this kind of exploit. The author of the addon can already do specifically targeted things at whim at a later point in time.

I mean it was already maliciously exploited in a highly used addon. It was a lot easier to slip in a short one liner than some highly suspicious "hack the user" blob of code. It was also extremely flexible. They could then do different things to each person instead of one fixed attack.

You’d naturally expect a game’s add-ons to be sandboxed, perhaps with permission-requests, ala mobile, wouldn’t you?

The installation of an add-on shouldn’t inherently give it free reign, with the only possible defense being trust & source-code review.

Addons are sandboxed. They can affect game interface (in a limited ways) and other addons, but not other software or files. And it's kind of hard to require further sandboxing, because that would limit addon power and one of the reasons people like WoW exactly because addon allow very deep interface customization.

That's why I'm thinking you'd naturally involve a simple permissions model [let script access chat?], just to avoid surprising behavior. Or more specifically, in-game I/O operations (eg trading, sending, etc). The latter would really protect you from everything malicious I can think of, outside of deleting your inventory kind of attacks

There're protection mechanisms for many actions in the game. You can't use spells with addons, you can't move your character, etc. Many actions require hardware event, e.g. you can't just buy something, you need to press button for that. If you're sending mail with gold, you need to confirm that you really want to send that gold and addon can't override that confirmation (so malicious addon can't invisibly send your gold to someone). There wasn't protection for trade window, so malicious attacker could steal your gold and/or items, but Blizzard added that protection very quickly after that exploit was found.

It's just a game, so they don't take it very seriously, I guess. They could just revert transaction using their moderator powers if something bad happens.

And a very popular addon did, once, although from what I remember it was debugging code accidentally left in. See ElvUI Backdoor: https://www.reddit.com/r/wow/comments/2jhlzv/psa_elvui_has_a...

You would if someone told you to replace trim() with eval(). :-)

The issue is that Lua treats functions as "first-class," meaning that they are stored in variables like other data. This is how named functions are created within the language, and function syntax is sugar for initializing a variable and stuffing a function into it.

This works with API functions also, which is why this works.

Just the fact that RunScript is being substituted for something else should set off alarm bells.

Not everyone who plays WoW is a developer.

The OP specified "moderately sophisticated."

its not the function thats the problem, its replacing it with the run function, which (to me) are obviozs signs of shenanigans

The 'RunScript' keyword does give a slight, glaring hint IMHO.

most people who play wow don't know what a script is. they just click mobs and do raids. it's not obvious atall to a lot of people, just like phone scams, people who go door to door to scam, or even spam emails. Its for a good reason these things still go on: they are still effecive against people who aren't developers or IT enthousiasts, which most gamers aren't. they like games, not scripting engines and LUA interpreters or w/e

Reply on news.ycombinator.com