News for hackers. Stuff that matters.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by Pfhreak on Tuesday November 03, 2020 @11:05AM (#24980842)
Interpreting text for commands has an interest parallel to a major World of Warcraft bug. It turns out that you could run arbitrary lua code in your chat terminal by using the "/run ..." command.

Enterprising thieves figured out that one of the things you could do was redefine functions, in particular the 'RemoveExtraSpaces' function that gets run against every chat line. If you set RemoveExtraSpaces=RunScript you've told WoW to execute every chat message displayed in your terminal.

Attackers just have to trick you into writing "/run RemoveExtraSpaces=RunScript" into your terminal, and after that all they had to do was chat code to you and it would execute. They basically get full control of anything lua can do in your game -- including sending messages to your friends asking them to also run the attack command.

Re:GitHub: Widespread Injection Vulnerabilities in Actions by est31 on Tuesday November 03, 2020 @12:16PM (#24981615)
Kinda reminds me of the "don't type anything into the browser console" warnings that sites like facebook etc. emit so that people don't type in commands strangers gave them, believing it allows them "hack" others while in reality it only hacks themselves.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by airstrike on Tuesday November 03, 2020 @12:46PM (#24981961)
Reminds me of when I was a 12-year-old on IRC typing "/say /con/con" into really busy channels and watching nearly everyone disconnect, and laughing like a moronic teenager with my friends
Re:GitHub: Widespread Injection Vulnerabilities in Actions by bcrosby95 on Tuesday November 03, 2020 @02:24PM (#24982995)
We used to do this stuff on text MUDs. People would make triggers to do certain things based upon text the MUD sent them. But a lot of people failed to properly "anchor" their triggers (you anchored them with '^' like in the regex world).

So you would send people a message with a series of commands to try to exploit commonly used triggers in order to make people give you all their items.

Re:GitHub: Widespread Injection Vulnerabilities in Actions by PenguinCoder on Tuesday November 03, 2020 @03:36PM (#24983686)
Ahh, fond memories of writing code and triggers for MUDs. Frustrating at times but helped for me to learn programing in an interactive and iterative manner.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by strbean on Tuesday November 03, 2020 @03:27PM (#24983605)
That is amazing. Essentially neurolinguistic programming a la Snowcrash.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by naikrovek on Tuesday November 03, 2020 @12:55PM (#24982061)
DCC SEND +++ATH0 had the same effect for modem users in the day.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by kabdib on Tuesday November 03, 2020 @01:03PM (#24982158)
For Hayes modems, this wouldn't (well, shouldn't) have worked, since it requires a one second pause between the last '+' and the command. It's part of Hayes' patent IIRC. I believe it was also only processed on the transmitted traffic, not the received.

What does a competing and not-wanting-to-infringe-a-patent modem company do? They just don't implement the delay, and ignore the direction of the traffic while they're at it. Problem solved! (head-to-desk, repeatedly)

Re:GitHub: Widespread Injection Vulnerabilities in Actions by jlgaddis on Tuesday November 03, 2020 @05:10PM (#24984594)
> I believe it was also only processed on the transmitted traffic, not the received.

I believe you're correct, although it's been ~25 years...

Which explains why the command above isn't exactly correct, IIRC. What you had to do was send a CTCP ECHO containing the "+++ATH0" to a channel -- or an individual user, but sending it to an entire channel full of people was a helluva lot more fun!

Anyways, I don't recall the exact command nowadays but it was

  /CTCP #channel ECHO Goodbye +++ATH0
or something very similar.

As long as the "victim's" IRC client wasn't ignoring those CTCP commands, it would "echo" the text and, as expected, command their modem to hang up.

Perhaps it shouldn't have worked... but I promise you that it absolutely did.

(Also, you could do the same thing by putting the "command" into the payload of an (ICMP) "ping" -- and that's a completely different thing from the "ping of death" that was discovered in that same era.)

--

https://en.wikipedia.org/wiki/Client-to-client_protocol

Re:GitHub: Widespread Injection Vulnerabilities in Actions by naivedevops on Tuesday November 03, 2020 @05:11PM (#24984600)
Direction was not ignored. People would be disconnected when their client replied to the DCC request or CTCP ping.

I'm not sure the vulnerable modems would ignore the delay because of patents. Would love if you have any reference. I remember a Smart Link softmodem respected the delay, but an Intel softmodem did not. Always assumed it was an implementation bug on the part of the Intel one.

Re:GitHub: Widespread Injection Vulnerabilities in Actions by Firehawke on Tuesday November 03, 2020 @06:13PM (#24985114)
The US Robotics external modems (from 14.4k to 56k) I had certainly required the pause. You needed a pause before AND after +++, then ATH0 with a CR.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by naivedevops on Saturday November 07, 2020 @08:33AM (#25014967)
Yep, just as my Smartlink softmodem.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by opless on Tuesday November 03, 2020 @04:18PM (#24984102)
Ping with embedded +++ATH worked too on some modems!

Of course you needed to have the nous to do this in the first place and a IRC server that showed users host names/ip adresses- I fear that I’m showing my age !

Re:GitHub: Widespread Injection Vulnerabilities in Actions by AnIdiotOnTheNet on Tuesday November 03, 2020 @09:17PM (#24986075)
IIRC it worked against Microsoft WebTV set-top boxes. Some kids got in a lot of trouble by causing a bunch of them to hang up and dial 911 or something.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by creade on Tuesday November 03, 2020 @02:49PM (#24983262)
Re:GitHub: Widespread Injection Vulnerabilities in Actions by miki123211 on Wednesday November 04, 2020 @07:13AM (#24988324)
Some speech synthesizers for blind people, particularly old versions of Eloquence, crashed when they tried to say specific pieces of text. They often took down the screen reader with them, so the only thing you could do was a hard reset. An example of such a crashword is the mistyping of wednesday, where n is replaced with h.

People were posting those crashwords in chats, on MUDs, or even as usernames. Some places where a lot of blind people hung out even contained specific filters for those.

There were also programs that didn't escape SAPI5 tags properly, so, by posting particularly clever bits of XML, you could change parameters like the pitch, speech rate, volume, or even the currently active voice, and make users, particularly younger users, scared of weird ghosts in their computers.

Re:GitHub: Widespread Injection Vulnerabilities in Actions by Pfhreak on Thursday November 05, 2020 @09:14AM (#24998353)
This is absolutely fascinating and I'd love to read more.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by diarrhea on Tuesday November 03, 2020 @11:08AM (#24980867)
That is super interesting. When did this happen? What is the worst that did happen through this?
Re:GitHub: Widespread Injection Vulnerabilities in Actions by kyrra on Tuesday November 03, 2020 @11:30AM (#24981104)
Re:GitHub: Widespread Injection Vulnerabilities in Actions by pvg on Tuesday November 03, 2020 @01:10PM (#24982242)
It's astonishing nobody found this till 2016, given that people were stealing WoW gold with keyloggers installed though 0 day flash vulns a few years before that.
Re:GitHub: Widespread Injection Vulnerabilities in Actions by virtue3 on Tuesday November 03, 2020 @06:19PM (#24985152)
I think it would be a little harder to make monetary gains off of this. You still needed to be in physical proximity to trade. I'm not sure if you had the ability to script over the mailbox and change recipients, that could have worked perhaps.

You'd get much more bang for the buck getting access to the whole account.

Re:GitHub: Widespread Injection Vulnerabilities in Actions by Pfhreak on Tuesday November 03, 2020 @11:28AM (#24981081)
I'm not sure. I do know that you could, for instance, have your gold sent to a scammer with little to no recourse. It may be possible that this bug still exists because it's one of those "bugs that is also a feature".
Re:GitHub: Widespread Injection Vulnerabilities in Actions by lilyball on Tuesday November 03, 2020 @03:10PM (#24983450)
Blizzard's response was to modify /run to pop up a dialog first warning you that /run is used by scammers and requires you to confirm that you know what you're doing.