New Warcraft III security exploit...

[Dr Super Good]

Many of us remember the great type casting problem a while ago where people were able to use Warcraft III as a means to infect computers with harmful software. Blizzard fortunately was able to stop the bug on BattleNet and eventually patched it.

However another equally bad exploit has been discovered, this time permitting Warcraft III to execute some form of scripting language via the Preload native. This can be used to get the game to download files from the internet and place them in dangerous folders (like windows or startup folders). The end result is another means for evil people to infect your computer with dangerous software. Although this method is less direct, it still permits Warcraft III maps to act as trojans to infect your computer.

The exploit apparently is the result of the Preload statement's mechanics. The native works by the use of a scripting language being passed to it but relies on the compiler to spot abuse and terminate the map load. However (like with the previous exploit) you can trick the compiler into thinking that its use is perfectly valid and so permit the compilation of the script with potentially horrible results.

It is advisable to not play any map from a source you do not trust. Avoid downloading maps from BattleNet or playing on bots you do not trust. A trojen map can even take the apparent form of one you already have and can download and run the exploit code before the lobby even loads. Remember that both single player and multiplayer maps are susceptible to this.

Be aware that freshly submitted maps to the Warcraft III map section on this site may also be trojens and if you spot such a map please report it to a map moderator or administrator as soon as possible so it can be removed.

 

[Dr. Boom]

Isn't it still funny, how some people have fun, to hack a computer with a warcraft 3 map or something of warcraft 3?

Let's see how fast blizzard will take care of it and after they did, lets wait if someone found a new way to hack a computer with a map =)

So care what you downloading and more from where you downloading and thanks that you post it on hive, but make it in the news section for (maybe) a better effect!

 

[Dr Super Good]

This was publically annoucned late October so its already been some months just so everyone knows.

 

[Garfield1337]

Thanks for informing,DSG. I'll certanly watch what maps i download D:

 

[Lambdadelta]

Don't you just love Jesus4Lyf? He comes up with the best things ever

 

[Anachron]

YEah, J4L is a freak when it comes to hacking ;D

 

[Dr Super Good]

Naa, the exploit uses simlar principles to the type casting bug in that it tricks the compiler to permit something that should be invalid by inserting extra code which is valid.

He probably picked up that the Preload statement opperates in that way by reverse engineering the game and seeing that it just is a wraper for a script compiler/executor.

Combining the two would give you an instant exploit like this. However I do congratulate him over this due to the amount of time that it takes to find this sort of thing (reverse engineering and creating an example map is not the easiest things to do).

 

[-Kobas-]

Bad, but still brilliant idea...
I downloaded around 200 maps in these few months, still nothing happened (lucky me)

 

[Anachron]

To bad I use ubuntu and that nobody likes to make viruses for it!

 

[Tleno]

Yeah, this is scary... I mean, the ways hacker come up with just to infect your PC... what's next? Maybe SC2 is not so safe too?

 

[Dr Super Good]

SC2 is probably safe cause it is better designed.

 

[Tleno]

True... but these hackers are so nasty, I'm pretty sure they can find even a tinniest little exploit or bug to use. And SC2 has quite enough bugs for now...

 

[Anachron]

What DSG was trying to say is, they have cared more about the design that stands behind the system so the system may not be so easy to hack.

And yes, there will be bugs/hacks for sc2. But I don't think that any of them let you run code in your actual OS.

 

[Dr. Boom]

Actually you can do what you want, if it is a program or a game or a system for your computer. If some people have fun with hacking and want hack someone or something, they can do it, anyway if it's designed more safety or not.

So I bet that some people come up and try to hack ScII ( When a new program comes out, all say "more safety" "better security" , then the next 2 weeks you head "Program was hacked ... a big hole in the security and so on )

So it's on the user, if the user stay safe, it's hard that something happen.

 

[Ironside]

Interesting find...Let's hope it gets fixed then.

 

[Cihparg]

Well, basically the hacks in b.net are used to harm DotA players.
So, I don't really care about the issue.

I avtually never join other peoples games, I host maps by myself.

 

[Ironside]

Same here.

 

[RiotZ]

It's called Norton Anti-Virus dur dur.

 

[Tleno]

Well, basically the hacks in b.net are used to harm DotA players.
So, I don't really care about the issue.

I avtually never join other peoples games, I host maps by myself.

So that's you who spreads this WC3 virus!

/paranoid

 

[Dr Super Good]

It's called Norton Anti-Virus dur dur.

Anti virus software might be able to help remove them but you will still get infected in the first place until they recognize that sort of virus (which can take weeks).

 

[RiotZ]

Anti virus software might be able to help remove them but you will still get infected in the first place until they recognize that sort of virus (which can take weeks).

I've found Norton to be very very good, and worth the money. Because well I probably shouldn't say this on THW, but the money spent on Norton usually exceeds its worth depending on how much shit you pirate.

I got hacked one day, a major hack that completely nuked me, it took Norton an hour to get rid of all of the viruses, but by the time Norton was done my computer was running at full speed again.

 

[Tleno]

Anti virus software might be able to help remove them but you will still get infected in the first place until they recognize that sort of virus (which can take weeks).

Hmmm... and other security stuff won't work?

Oh, and I suggest putting a warning about this new exploit in the maps section before the... erm... Map Flu 2.0 will be cured.
Even better, we could recommend everyone to wash their hands after playing Dota and close down the site, commencing pandemic.

 

[Ironside]

Anti virus software might be able to help remove them but you will still get infected in the first place until they recognize that sort of virus (which can take weeks).

How do you know the infected files are RAT/Keylogger/Botnet?
It could be something that will just do much damage.

But if the attacker puts one of those 3, then it's pretty simple to get rid of

 

[RiotZ]

How do you know the infected files are RAT/Keylogger/Botnet?
It could be something that will just do much damage.

But if the attacker puts one of those 3, then it's pretty simple to get rid of

I'm glad someone on Hive knows how to blow up my computer.

 

[Ironside]

Just because I know how, doesn't mean I do it (if that's what you meant)...

 

[RiotZ]

Just because I know how, doesn't mean I do it (if that's what you meant)...

No, that was just a friendly joke lol. I've always wanted to know how to hack.

 

[Ironside]

In that case alright.

 

[RiotZ]

In that case alright.

See, when you make statements like that I turn my firewall on.

 

[Ironside]

We went a little offtopic, we should stop the chat here now.

 

[RiotZ]

Indeed lol, just having a little fun with you.

So has anyone on Hive actually been hit by this? Or is it just folklore at this point..

 

[azlier]

My only regret is that I did not play some insane part in bringing the exploit to fruition this time.

 

[En_Fuego]

Actually you can do what you want, if it is a program or a game or a system for your computer. If some people have fun with hacking and want hack someone or something, they can do it, anyway if it's designed more safety or not.

So I bet that some people come up and try to hack ScII ( When a new program comes out, all say "more safety" "better security" , then the next 2 weeks you head "Program was hacked ... a big hole in the security and so on )

So it's on the user, if the user stay safe, it's hard that something happen.

WC3 wasn't really "hacked" in this case...it's more like an exploitation of code that anyone who knows JASS can carry out. SC2 has nothing of the sort. (Then again, WC3 went like 8 years before this shit popped up)

 

[Lambdadelta]

My only regret is that I did not play some insane part in bringing the exploit to fruition this time.

 

[baassee]

To bad I use ubuntu and that nobody likes to make viruses for it!

Oh yes, you're not alone on that one ! (Although I run coop Win7/Ubuntu so it might even work )

 

[Deolrin]

http://www.hiveworkshop.com/forums/warcraft-discussion-99/viruses-wc3-maps-possible-again-182034/
Meh, old news are old.

 

[Dr Super Good]

Well I have been trying to get it made more publicly aware since halfway through November (when I found out about it as I nolonger play WC3). This trojen map exploit will work on every OS unless some security of the OS blocks WC3 from writing to the folder (might happen on vista and 7 but as people usually run as an adimistrator, largly not so).

 

[Deolrin]

I just pointed out that I've already posted something like that, except for some reason they made it news only when you posted and you somehow got a lot more attention.

 

[Skycraft]

Well then, Warcraft 3 is screwed.
Can't go too high in ladder because people have map-hacks and drop-hacks.
Can't play too much custom games because of the viruses/trojans.

It's goddamn ridiculous!

 

[Thyrael]

The positiv thing about this is, that it allows us to store a file on the local machine of a player in a multiplayermap. And to load data from that file again. That would allow us to have complex save/load systems for multiplayermaps. I tested it with a testmap Jesus4Lyf set up. It really created a folder in my wc3 directionary and put 2 *.txt files into it. After closing wc3 and restarting the map again I was able to load data from that files. I tested it in a singleplayer game in offline mode and hosting a game on Bnet. Worked for both. Only adjustment players have to make is to allow local files for wc3, which can be done via regedit. If blizzard simply removes that stuff without making gamecaches or something else multiplayer usable, I will feel really sad.

 

[Ironside]

You should create a tutorial on that, not all of us know how to use it

 

[Tleno]

You should create a tutorial on that, not all of us know how to use it

Why should he? It's a soon-to-be removed exploit, not something Blizzard will let us keep...

 

[Ironside]

Well if it's true that the exploit is like a year old as some say, then I doubt it would be fixed anytime soon.

 

[Vercas]

I'd rather use this to provide ad-hoc updates for a map!

 

[Dr Super Good]

Thyrael, it is not that easy...

You have to syncronize the data between players otherwise everyone will just split.

Additionally this is very unsafe. Yes it can be used for good like the previous exploit but the ability for evil is extreem. You could delete whole games and windows files.

 

[Vercas]

Thyrael, it is not that easy...

You have to syncronize the data between players otherwise everyone will just split.

Additionally this is very unsafe. Yes it can be used for good like the previous exploit but the ability for evil is extreem. You could delete whole games and windows files.

Then let's convince Blizzard to restrict the usage to local, relative paths, instead of "fixing the issue".

 

[Ironside]

Thyrael, it is not that easy...

You have to syncronize the data between players otherwise everyone will just split.

Additionally this is very unsafe. Yes it can be used for good like the previous exploit but the ability for evil is extreem. You could delete whole games and windows files.

Or worse...

 

[Zerox]

Am I the only one who thinks that by alerting people of such an exploit, not to mention linking them to a place that has the necessary info on how to produce such an attack on others yourself is a bad idea?

I strongly believe that if people didn't advertise the fact that the return bug was potentially dangerous, we'd still have a large portion of older maps and nothing bad would have ever happened because of it. Even if something malicious occurred because of the return bug, if it hadn't been so wide spread info that there was even such potential I believe such occurences would have been rare.

So in my opinion by, by advertising this to everyone it only makes Battle.net that much more unsafe, and we'll probably get yet another patch that will break something that we used properly before.

Though admittedly now that this problem is public knowledge I wouldn't mind having it fixed, just not at the cost of breaking previous maps. >.>

 

[Ironside]

I just though of an idea, wouldn't it be possible to create a 100% working antihack system with this exploit (check every players computer for hacks, if found, close warcraft, give messagebox, ...)

 

[Vercas]

I just though of an idea, wouldn't it be possible to create a 100% working antihack system with this exploit (check every players computer for hacks, if found, close warcraft, give messagebox, ...)

That sounds possible but it would require hazardous amounts of code.

 

[Ironside]

Well since I don't know which language you can inject into this exploit... If it could be any (which I'm sure that isn't the case) then it would be quite easy.