News for hackers. Stuff that matters.

A comment on World of Warcraft: one simple line of code can cost you dearly.

Re:World of Warcraft: one simple line of code can cost you d... by niftich on Monday July 25, 2016 @12:46PM (#12159877)
What's happening here is the 'RemoveExtraSpaces' function (ie. basically a trim) is called by the game engine every time a chat message is received. But apparently, you can rebind this name and point it to any other function, including 'RunScript', which is an eval.

When this was revealed, Blizzard quickly patched in a warning dialog that warns against running scripts from untrusted sources, including being social-engineered to enter stuff yourself (which is what's happening here). That attitude seems prudent, but isn't entirely helpful, as many players in fact use Lua in their chatbox to do complex actions or calculations.

Like this one that prints your current position in 'map coordinates':

  /script x,y = GetPlayerMapPosition("player");
  map=GetZoneText();
  c1=x*100;c2=y*100;
  print(string.format("%s: %.2f, %.2f", map, c1, c2));
or the 'CTC macro' that was used to calculate a value that raid tanks must have attained:

  /run DEFAULT_CHAT_FRAME:AddMessage("Need 102.4 combat table coverage. Currently at:"
  ..string.format("%.2f", GetDodgeChance()+GetBlockChance()+GetParryChance() +5))
It's true that users shouldn't run untrusted code, but realistically, they'll probably click through most warnings to run legitimate functions like this. A better fix is to prevent rebinding the 'RunScript' function to some other name, and to prevent rebinding the 'RemoveExtraSpaces' function by anything else.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by niftich on Monday July 25, 2016 @01:20PM (#12160089)
Another contributing factor in this vulnerability is that the 'chat compose input' and the 'script console' are one and the same.

While this was done to simplify UX, it's really not a good idea in retrospect.

Even as something simple as a different chat frame that only allowed script commands, into which only local script output can go, would also serve as an effective mitigation.

[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by seanp2k2 on Monday July 25, 2016 @01:45PM (#12160248)
Or do it like Quake and HL did and have tilde be the console. You can do things like "/say foo" or commands / settings through there, and in the case of quake at least, it can load scripts from files in a directory. This is not new stuff, and it's surprising that it doesn't do this already. Example: http://ezquake.sourceforge.net/docs/?scripting
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by ryanlol on Tuesday July 26, 2016 @09:54AM (#12165606)
It supports this already, or at least did. Console just needs to be manually enabled.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by eridius on Monday July 25, 2016 @01:49PM (#12160278)
I'm not sure how that would solve anything, the attacker would just convince the victim to type that line of code into the script console instead of the chat console.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by alistairSH on Monday July 25, 2016 @03:08PM (#12160821)
Sure, the rebinding could still happen. But, the remote execution is prevented (right now, after rebinding the trim function, the attacker can enter script in the chat window to be executed - this part goes away with a separate console).
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by TheCoelacanth on Monday July 25, 2016 @04:37PM (#12161445)
I don't think so.

The attacker is executing script through the RemoveExtraSpaces function that gets run on every chat message, not by executing it with either player's chat console.

[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by niftich on Monday July 25, 2016 @05:12PM (#12161650)
The assumption is that a proper mitigation would result in the script console being in a separate execution context; such that variables that are (re-)declared in the script console would not affect the chat console's context, or its 'RemoveExtraSpaces' function, nor the global context. I should've been more clear.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by eridius on Monday July 25, 2016 @07:07PM (#12162250)
That assumption wouldn't work. If the script console is a separate Lua environment, it's completely useless. As long as it's the same environment that the rest of the game/addons use (which it must be), then there's no "mitigation" that can be done like you're hoping for.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by ahoy on Monday July 25, 2016 @04:01PM (#12161186)
You (presumably) couldn't send chat messages directly to another player's script console, which is how this works.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by pdpi on Monday July 25, 2016 @05:53PM (#12161882)
> A better fix is to prevent rebinding the 'RunScript' function to some other name, and to prevent rebinding the 'RemoveExtraSpaces' function by anything else.

Or maybe forbid rebinding any system-provided global symbols at all?

[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by eyelidlessness on Monday July 25, 2016 @06:31PM (#12162095)
Or maybe forbid rebinding any bound symbol at all.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by developer2 on Tuesday July 26, 2016 @02:28AM (#12163712)
This completely misses the point. Incoming chat messages from other players should simply be incapable of reaching a context in which it is interpreted as script. Inbound text chat should be treated as such - text. If the player types in commands that directly have an effect, that is their problem. If a single command provides remote code execution of anything another player types in their chat... that is simply ridiculous.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by erezyehuda on Tuesday July 26, 2016 @02:07PM (#12167596)
The very existence of RunScript combined with the ability to rebind functions makes this impossible, I think. Unfortunately, I'd guess that, at this point, those features are too tangled into the game to be easily cut out.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by eridius on Monday July 25, 2016 @01:49PM (#12160271)
> A better fix is to prevent rebinding the 'RunScript' function to some other name

Breaking a huge number of addons in the process, for literally no benefit because the attacker can just use that other name.

> and to prevent rebinding the 'RemoveExtraSpaces' function by anything else

Which wouldn't really solve anything because the attacker can just find some other function that is regularly executed with attacker-supplied input and use that instead.

[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by tomc1985 on Monday July 25, 2016 @04:17PM (#12161302)
No, a better fix is to remove the ability to re-bind ALL functions, or at least system calls. How is function-hotswapping-bullshit permissible in an untrusted environment?
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by cheald on Monday July 25, 2016 @04:44PM (#12161491)
There isn't really a good way to prevent reassignment of first-class functions to new names in Lua.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by tomc1985 on Monday July 25, 2016 @05:15PM (#12161662)
So it seems.
[ Parent | on HN ]
Re:World of Warcraft: one simple line of code can cost you d... by nitrogen on Monday July 25, 2016 @04:27PM (#12161377)
That's how Lua works. It would be prudent, but difficult to change.
[ Parent | on HN ]