Hacker News Reader

Comment by Pfhreak | Hacker News Reader

Interpreting text for commands has an interest parallel to a major World of Warcraft bug. It turns out that you could run arbitrary lua code in your chat terminal by using the "/run ..." command.

Enterprising thieves figured out that one of the things you could do was redefine functions, in particular the 'RemoveExtraSpaces' function that gets run against every chat line. If you set RemoveExtraSpaces=RunScript you've told WoW to execute every chat message displayed in your terminal.

Attackers just have to trick you into writing "/run RemoveExtraSpaces=RunScript" into your terminal, and after that all they had to do was chat code to you and it would execute. They basically get full control of anything lua can do in your game -- including sending messages to your friends asking them to also run the attack command.

View on HN

Kinda reminds me of the "don't type anything into the browser console" warnings that sites like facebook etc. emit so that people don't type in commands strangers gave them, believing it allows them "hack" others while in reality it only hacks themselves.

Reminds me of when I was a 12-year-old on IRC typing "/say /con/con" into really busy channels and watching nearly everyone disconnect, and laughing like a moronic teenager with my friends

DCC SEND +++ATH0 had the same effect for modem users in the day.

For Hayes modems, this wouldn't (well, shouldn't) have worked, since it requires a one second pause between the last '+' and the command. It's part of Hayes' patent IIRC. I believe it was also only processed on the transmitted traffic, not the received.

What does a competing and not-wanting-to-infringe-a-patent modem company do? They just don't implement the delay, and ignore the direction of the traffic while they're at it. Problem solved! (head-to-desk, repeatedly)

> I believe it was also only processed on the transmitted traffic, not the received.

I believe you're correct, although it's been ~25 years...

Which explains why the command above isn't exactly correct, IIRC. What you had to do was send a CTCP ECHO containing the "+++ATH0" to a channel -- or an individual user, but sending it to an entire channel full of people was a helluva lot more fun!

Anyways, I don't recall the exact command nowadays but it was

  /CTCP #channel ECHO Goodbye +++ATH0

or something very similar.

As long as the "victim's" IRC client wasn't ignoring those CTCP commands, it would "echo" the text and, as expected, command their modem to hang up.

Perhaps it shouldn't have worked... but I promise you that it absolutely did.

(Also, you could do the same thing by putting the "command" into the payload of an (ICMP) "ping" -- and that's a completely different thing from the "ping of death" that was discovered in that same era.)

https://en.wikipedia.org/wiki/Client-to-client_protocol

Direction was not ignored. People would be disconnected when their client replied to the DCC request or CTCP ping.

I'm not sure the vulnerable modems would ignore the delay because of patents. Would love if you have any reference. I remember a Smart Link softmodem respected the delay, but an Intel softmodem did not. Always assumed it was an implementation bug on the part of the Intel one.

The US Robotics external modems (from 14.4k to 56k) I had certainly required the pause. You needed a pause before AND after +++, then ATH0 with a CR.

Yep, just as my Smartlink softmodem.

Ping with embedded +++ATH worked too on some modems!

Of course you needed to have the nous to do this in the first place and a IRC server that showed users host names/ip adresses- I fear that I’m showing my age !

IIRC it worked against Microsoft WebTV set-top boxes. Some kids got in a lot of trouble by causing a bunch of them to hang up and dial 911 or something.

We used to do this stuff on text MUDs. People would make triggers to do certain things based upon text the MUD sent them. But a lot of people failed to properly "anchor" their triggers (you anchored them with '^' like in the regex world).

So you would send people a message with a series of commands to try to exploit commonly used triggers in order to make people give you all their items.

That is amazing. Essentially neurolinguistic programming a la Snowcrash.

Ahh, fond memories of writing code and triggers for MUDs. Frustrating at times but helped for me to learn programing in an interactive and iterative manner.

this is a good one too: https://www.youtube.com/watch?v=dgieRaU7E1c

Some speech synthesizers for blind people, particularly old versions of Eloquence, crashed when they tried to say specific pieces of text. They often took down the screen reader with them, so the only thing you could do was a hard reset. An example of such a crashword is the mistyping of wednesday, where n is replaced with h.

People were posting those crashwords in chats, on MUDs, or even as usernames. Some places where a lot of blind people hung out even contained specific filters for those.

There were also programs that didn't escape SAPI5 tags properly, so, by posting particularly clever bits of XML, you could change parameters like the pitch, speech rate, volume, or even the currently active voice, and make users, particularly younger users, scared of weird ghosts in their computers.

This is absolutely fascinating and I'd love to read more.

That is super interesting. When did this happen? What is the worst that did happen through this?

I'm not sure. I do know that you could, for instance, have your gold sent to a scammer with little to no recourse. It may be possible that this bug still exists because it's one of those "bugs that is also a feature".

Blizzard's response was to modify /run to pop up a dialog first warning you that /run is used by scammers and requires you to confirm that you know what you're doing.

Looks like it became popular in 2016.

https://www.gdatasoftware.com/blog/2016/07/28809-world-of-wa...

It's astonishing nobody found this till 2016, given that people were stealing WoW gold with keyloggers installed though 0 day flash vulns a few years before that.

I think it would be a little harder to make monetary gains off of this. You still needed to be in physical proximity to trade. I'm not sure if you had the ability to script over the mailbox and change recipients, that could have worked perhaps.

You'd get much more bang for the buck getting access to the whole account.

Reply on news.ycombinator.com