Anatomy of a bug: Battlefield: Play4Free hole allows dodgy updates to go unnoticed

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

A pair of Maltese vulnerability researchers have revealed a security hole in the game Battlefield: Play4Free from digital games giant EA.

The vulnerability takes advantage of the fact that different versions of Windows deal in different ways with erroneous input to the system function used to start new processes.

It's also a timely reminder to programmers that compatibility across many years' worth of operating system versions can come with an unexpected cost.

I shan't repeat the entire exploit (you should read the authors' original paper for that), but the jiggery-pokery goes something like this:

1. Tell the game's browser plugin to use the builtin "Game Updater" feature.

2. Trick the Game Updater into thinking it is connecting to one of a small list of official, trusted servers.

3. Send the Game Updater to a bogus updater site instead.

4. Instruct it to use TFTP to download and run a reverse shell program instead of a real update.

A reverse shell is a program that runs CMD.EXE, the Windows command prompt, on the victim's computer. The reverse shell then connects the command prompt's input and output to a network socket, not to the local keyboard and screen. This network socket is itself connected to a remote server specified by the attacker. So, when CMD.EXE starts and the network connection is made, the command prompt appears on the attacker's screen, not the victim's.

It's called "reverse" because the network connection is sneakily made outwards from the victim to the remote attacker, unlike a legitimate login, which is usually made inwards. Many firewalls don't regulate outbound connections as strictly as inbound ones, which are often prohibited altogether.

It's called a "shell" because that's the traditional Unix name for a command prompt.

The devious part of the security bypass here is the trickery in step 2.

The Game Updater has its own allowlisting feature which is supposed to restrict updates to a small set of websites. (The authors list just ten different names.)

But the allowlisting check is based upon a command line passed from the game's browser plugin to the Game Updater component via the Windows system function CreateProcessW().

And that's where the authors spotted an anomaly.

Windows itself limits the CreateProcessW() command line to a rather old-school 32 kilocharacters.

But the Windows documentation doesn't actually define what happens if your lpCommandLine string is too long; it says only that:

The maximum length of this string is 32,768 characters, including the Unicode terminating null character.

According to the authors of the vulnerability paper, only Windows Vista and later actually treat overly-long command lines as erroneous.

On Windows XP and Server 2003 (but you don't play online games from the server room, do you?), a superlong command line is quietly pruned back to fit into the limit.

Modifying the user's input and then processing it without notification is almost always the wrong thing to do.

If there is something wrong with your input, it should not be trusted and that fact should be reported.

So, on Windows XP, the attackers were able to bypass the allowlist check by tricking the calling process into padding out the command line so that the hostname part ended up more than 32,768 characters along in memory.

The browser plugin then faithfully reported the attacker's dodgy hostname, blissfully ignorant that the next process in the chain would never see the offending data.

The wrong hostname would be checked against the allowlist and would falsely pass the checks.

Note that if you don't play Battlefield: Play4Free, or you aren't running Windows XP, you aren't at risk here.

Four days ago, however, 950,631 people were signed up to play, and as many as 39.5% were still on Windows XP.

Let's call that 40% of one million people, a population that could make quite a handy botnet if the worst came to the worst.

So, if you are an XP-based Battlefield: Play4Free player, be sure to keep your eyes open for an update from EA!

Follow @duckblog

View the original article here

Beware dodgy computer repair work - your data is at risk along with your wallet

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Sometimes-outspoken and always-cynical IT news site The Register wrote yesterday about dodgy PC repair shops in its home country, England. [*]

The report was based on an exposé by the investigative TV programme BBC Watchdog. (Users with UK IP numbers: watch here.)

The usual sorts of problem you might expect from any shonky operator in any maintenance or repair business in any industry sector were there: overcharging, bogus diagnosis of "faults", and old parts sold as new.

Passing off old parts as new is plain dishonesty in any industry - but it's more dangerous in some than in others.

The hazards in the engineering, electrical and automotive industries are obvious: old parts, especially if they were taken out of service because they were faulty, might be physically dangerous. They're certainly likely to mess with any future scheduled replacement cycles.

In IT, however, an old electronic part might have loads of life left in it. Hard disks fail eventually, but they don't wear out like chainsaw blades or cam belts. The problem is not what they may have lost in their life so far, but in what they have gained: other people's data.

In the Watchdog programme, apparently, that's just what happened, with a used hard drive supplied as new at the impressive price of £200 ($320). The "new" drive, it seems, turned out to contain medical records from a residential care home. (To add insult to injury, the "faulty" drive it replaced wasn't actually broken.)

Ow.

There are four obvious lessons in this:

Before you hand your computer to a third party, take as much time as you can to decide whether you should trust them. If you aren't sure, ask for advice from an IT-savvy friend or family member whom you know well and trust. Be wary of positive recommendations in open online forums and blog comments. They could come from anyone, including the company apparently being recommended.Consider using full-disk encryption so that if your computer needs to go in for repairs or an upgrade, you don't inevitably have to give the repairer (or anyone else in the repair chain) access to all your data. The repair may not need your computer to be started from your hard disk; if it does, a pre-boot password means you can ensure that you need to be present whenever it is booted up.Consider using full-disk encryption so that if your hard disk fails, or you if you retire it for another with more capacity, you don't have to worry about what happens to it later. Even if it ends up in someone else's computer by accident or design, the data will be invisible to the new owner.If you're a computer repairer and you plan to use a second-hand disk, be honest about the fact that it's not new, and wipe it first, at least as best you can. An end-to-end overwrite with dd if=/dev/zero after booting off a BSD or Linux recovery disk is a good start and will reduce the chance of data leakage. Sure, the process takes a while, but it doesn't require any interaction.

And if you do find someone else's data where it's not supposed to be, please do the right thing. Wipe it without examining it, or (assuming that it's obvious where it came from without prying too far) do what BBC Watchdog did: return it to the original owner.

Follow @duckblog

[*] I am aware that England is not a sovereign independent state, and that it doesn't have a government all of its own. But it fits better in this sentence position than "United Kingdom" or "UK", and if FIFA can treat it as a country, so can I.

View the original article here