New Warcraft III security exploit...

[Vercas]

Well since I don't know which language you can inject into this exploit... If it could be any (which I'm sure that isn't the case) then it would be quite easy.

C++?
I have no idea which language is that...
VBScript?

 

[Ironside]

VBScript? you sure? Anyway if so, then it's quite easy to check for processes

 

[Vercas]

VBScript? you sure? Anyway if so, then it's quite easy to check for processes

I am sure, because, in the example, it saves files as .vbs, which is Visual Basic Script.
I speculate that the "necho" and "nstart" are compiler commands.

 

[Ironside]

Well if I'll find out how to use the exploit, then I'll attempt something like an antihack.

EDIT: checked the code in the link, if he'd use echo instead of necho, then this would definatly be batch.

EDIT2: I was right, confirmed:

http://www.thehelper.net/forums/showpost.php?p=1301123&postcount=8

Another virus vulnerability. WC3 isn't safe until next patch. This allows us to run batch script on a computer on startup... Just write out to a batch file located in Start > Programs > Startup, and you're done.

And since batch can write to files, you can make VBS, JavaScript, Batch, HTML, and any other files which don't need to be compiled like C++, VB, ...

 

[Vercas]

Well if I'll find out how to use the exploit, then I'll attempt something like an antihack.

Edit, checked the code in the link, if he'd use echo instead of necho, then this would definatly be batch.

Not quite.

 

[Ironside]

The link above confirmed that you can create batch files, with which you could create a VBS to download an exe, therefore we can code an antihack in any language, upload it, and make it download.

I think this would work very well.

Except if I'm missing something important.

EDIT: Silly me, I just noticed it isn't necho and nstart, it's \necho which means \n = new line then echo further, meaning this is perfectly normal batch.

 

[Vercas]

EDIT: Silly me, I just noticed it isn't necho and nstart, it's \necho which means \n = new line then echo further, meaning this is perfectly normal batch.

You are right, it runs a Batch script which writes into a Visual Basic Script file which is later executed.
This IS a security threat to XP users, mostly, because Vista and Seven WITH UAC ENABLED and running Warcraft III WITHOUT ADMINISTRATOR RIGHTS will not let it place files everywhere.

 

[Ironside]

It is in the example a VBS, can be a mere batch file, which will have more permissions than other scripts, there is also a special batch header, which makes it run as admin.

 

[Vercas]

It is in the example a VBS, can be a mere batch file, which will have more permissions than other scripts, there is also a special batch header, which makes it run as admin.

This can also write bytecode in files... Definitely awesome!

 

[Ironside]

Yeah, in short can do great damage but also great good.

 

[Vercas]

Yeah, in short can do great damage but also great good.

Blizzard could add natives to store data in files and they can fix this exploit afterward.

But really, saving a hashtable in a file could incredibly improve Warcraft III gameplay experience!

 

[Ironside]

Exactly, this feature shouldn't be completely removed, just so far that it can't harm others. It can be of great help too.

 

[Dr Super Good]

It can be, but it also will still be very dangerous in any for due to the flexibility.

 

[Ironside]

That's true too, guess it will be up to blizzard on what they will do with this.

 

[IronForge]

I hope it doesn't render half of the really good oldie maps unplayable again.

 

[Dr Super Good]

No, it will atmost render some new maps unplayable.

 

[Crazed_seal2]

Until this bug is fixed all War3 maps are dangerous. Even the most famous maps could have the code. But something tells me that some people are smiling

 

[Tleno]

Hmmm, does anyone have some recommendations how to know which map is safe and which is suspicious?

 

[Ironside]

Yeah, once you download, check your startup folder. As the exploit adds a file into startup, it will start each time on the next reboot, won't do anything the 1st time (when you get it) And if you got something new, remove it and you're good to go.

 

[Tleno]

You mean download the map with B.net?

 

[Ironside]

Doesn't matter how you download it, when the exploit activates, it will create a .bat file in startup folder on your computer, all you need to do is to remove that file before rebooting your computer.

 

[X-Death]

It isn't even that much of a threat... no one can do anything with that function unless the map maker knows the username of your account on your OS.

But anyway, this finally gives Blizzard a reason to patch WCIII again... maybe they'll patch some of the other hacks that have been roaming around as well.

 

[Dr Super Good]

Not true, there are startup folders which are global. Additionally they could modify windows system files on XP (as that has no security unlike vista and 7).

Old maps that were safe in the past will still be safe. If you host that TD you played 4 years ago (and it works), then it will still be safe. Additionally maps like TKoK RPG will also be safe as the makers are highly respected moders who can be trusted. Maps which do not use preload native are garunteed to be safe as that is a required for this bug. Offical DotA Allstars versions will also be safe as the makers are trusted and respected however people will spoof the map (like last time) so only join trusted hosts.

Maps to be careful with are public DotA Allstars games cause (like with the previous exploit) people can easilly make a broken map which will download and infect you in under a second once you join (and looks like the real genuine map when you press join). Maps which appear hacked or sound funny. Maps which are new but of something old. Common ripped maps (like LoaP or vampirisim or battleships), basically anything which will get lots of people infected.

 

[Newuser]

I wonder how long it will take for Blizzard to notice this; has Blizzard posted any confirmation of the exploit yet?

 

[Tleno]

Not true, there are startup folders which are global. Additionally they could modify windows system files on XP (as that has no security unlike vista and 7).

Old maps that were safe in the past will still be safe. If you host that TD you played 4 years ago (and it works), then it will still be safe. Additionally maps like TKoK RPG will also be safe as the makers are highly respected moders who can be trusted. Maps which do not use preload native are garunteed to be safe as that is a required for this bug. Offical DotA Allstars versions will also be safe as the makers are trusted and respected however people will spoof the map (like last time) so only join trusted hosts.

Maps to be careful with are public DotA Allstars games cause (like with the previous exploit) people can easilly make a broken map which will download and infect you in under a second once you join (and looks like the real genuine map when you press join). Maps which appear hacked or sound funny. Maps which are new but of something old. Common ripped maps (like LoaP or vampirisim or battleships), basically anything which will get lots of people infected.

Oh, we should make some kind of list or some system to make sure which maps are 100% trustable, which are like 50% (Supsicious) and which are definetly infested. Oh, and I really wanted to download that new Founder of the North, but since this issue appeared I got an embargo on all WC3 maps, but you say all big hosted projects that you know are trustable?

 

[-Kobas-]

Founder of the North map uploaded here on THW is safe and clean, after all those moths and authors work, they won't mess up now, as DSG said, just don't download maps directly from Bnet, Garena and other game portals, come here for example and check maps, those that are uploaded at least 1 time per month, have over 2000 downloads and large number of comments should be 99% safe! If not authors "uploaders" will have big problems!

I download and upload around 15-20 maps per day! Some are big some are protected, some are just spells and systems, and I didn't found anything strange!

EDIT:

Damn I just checked something and it worked perfectly fine!

As some of you know you can change file extension right!
I changed .txt file into blp and renamed it into ReplaceableTextures\CommandButtons\BTNExample.blp, WE ofc showed this as image/texture!
Pro map hacker, can easily add anything he want into map like this, there is no way to find it with MPQEditor because you don't know what resource is fake, even if you find one, there can be few other as well! Maps can be used to store anything you want without any notice about it ^^

Now this can be old news, but I just wanted to show you cool way to hide files and informations!
I once hide some "pictures" from younger brother, converting them to mp3 file, when he tried to open them, winamp killed itself to play them ^^

Note: Changing extension directly inside WE won't work!

 

[Tleno]

Founder of the North map uploaded here on THW is safe and clean, after all those moths and authors work, they won't mess up now, as DSG said, just don't download maps directly from Bnet, Garena and other game portals, come here for example and check maps, those that are uploaded at least 1 time per month, have over 2000 downloads and large number of comments should be 99% safe! If not authors "uploaders" will have big problems!

I download and upload around 15-20 maps per day! Some are big some are protected, some are just spells and systems, and I didn't found anything strange!

EDIT:

Damn I just checked something and it worked perfectly fine!

As some of you know you can change file extension right!
I changed .txt file into blp and renamed it into ReplaceableTextures\CommandButtons\BTNExample.blp, WE ofc showed this as image/texture!
Pro map hacker, can easily add anything he want into map like this, there is no way to find it with MPQEditor because you don't know what resource is fake, even if you find one, there can be few other as well! Maps can be used to store anything you want without any notice about it ^^

Now this can be old news, but I just wanted to show you cool way to hide files and informations!
I once hide some "pictures" from younger brother, converting them to mp3 file, when he tried to open them, winamp killed itself to play them ^^

Note: Changing extension directly inside WE won't work!

Yeah, I touhg about that too. I tough like If I'll ever have to smuggle secret information from North Korea (Just example), I'll use Warcraft 3 editor for that!
But hey, you can store any document, even like .txt.

 

[elfian]

I'm so sad that this is getting fixed

 

[Vercas]

I'm so sad that this is getting fixed

Who said that?

 

[elfian]

Who said that?

Blizzard are going to remove this exploit, no?

By the way "necho" is infact "\necho" where \n is the escape character for a new line and echo is a command that you can use in your command prompt. Indeed this is VBScript for sure. We could make MMOs with this, in theory, we could actually make absolutelly everything. That's the reason I don't want it removed. Maybe restricted... but not removed (

 

[Vercas]

Blizzard are going to remove this exploit, no?

Who said THAT?

I am sure they ain't gonna fix it because of Sc2.

 

[elfian]

Who said THAT?

I am sure they ain't gonna fix it because of Sc2.

Well, they did fix the return bug. But if they leave this one behind, shit, I'm back to mapping )) And I'll make a blast

 

[Vercas]

Well, they did fix the return bug. But if they leave this one behind, shit, I'm back to mapping )) And I'll make a blast

Moreover, there's no information whether they are going to do something or not.

 

[Ironside]

Blizzard are going to remove this exploit, no?

By the way "necho" is infact "\necho" where \n is the escape character for a new line and echo is a command that you can use in your command prompt. Indeed this is VBScript for sure. We could make MMOs with this, in theory, we could actually make absolutelly everything. That's the reason I don't want it removed. Maybe restricted... but not removed (

I wrote that already...
Also, it's batch, but batch can easily create VBS files...

 

[Vercas]

I wrote that already...
Also, it's batch, but batch can easily create VBS files...

Or any other script file that can be executed.

 

[Ironside]

Yeah others too, I just gave the example since it's used in main post and his.

 

[Crazed_seal2]

I feel dumb about saying this. But will a firewall do anything?

 

[zulrivers]

I feel dumb about saying this. But will a firewall do anything?

Doubt it could lol, even badass Kaspersky.

 

[Vercas]

I feel dumb about saying this. But will a firewall do anything?

No, because downloading viruses will ask the server for the file and the file will come in your computer with permission. The firewall will do nothing.
An antivirus could block the download, tho, if it detects a virus code.

 

[elfian]

So when were those "Preload" functions included in War3

 

[Vercas]

So when were those "Preload" functions included in War3

Uh... do you even know what they do?

 

[elfian]

Uh... do you even know what they do?

That doesn't seem like a proper answer.

EDIT: Ha, I got it, whatever. I wonder why I never got to use them...

 

[Vercas]

That doesn't seem like a proper answer.

EDIT: Ha, I got it, whatever. I wonder why I never got to use them...

I always tend to use it, because I kept my code in separate files, because I have editors with much better syntax highlighting.

 

[Newuser]

Who said THAT?

I am sure they ain't gonna fix it because of Sc2.

Yeah . Sadly Blizzard has a habit of not caring for older games (except maybe for D2, they care about it "just enough" to still update it once a year; though the update does not fix every or even the simplest problems but they're still updates).

They even launched a lawsuit against KeSPA; yeah it's in their property, their rights, etc but the thing is no KeSPA = No more (or at least very little of) SC1: Broodwar.

The saddest part is all the good maps in WC3 will be slowly forgotten (really, it's hard to play any or host any variety of maps with all these hosting bots and now malicious maps too ).

Also they still have not really addressed the popularity system in SC2 (all they need is to add the "hosting" system from SC1 and WC3 back; they could keep the popularity system but just have an alternative option for users to use).

Though I am aware it's in Blizzard's best interest (money wise) to focus on their newer games but they could be good sports and care more about their older games.

 

[Tleno]

Yeah . Sadly Blizzard has a habit of not caring for older games (except maybe for D2, they care about it "just enough" to still update it once a year; though the update does not fix every or even the simplest problems but they're still updates).

They even launched a lawsuit against KeSPA; yeah it's in their property, their rights, etc but the thing is no KeSPA = No more (or at least very little of) SC1: Broodwar.

The saddest part is all the good maps in WC3 will be slowly forgotten (really, it's hard to play any or host any variety of maps with all these hosting bots and now malicious maps too ).

Also they still have not really addressed the popularity system in SC2 (all they need is to add the "hosting" system from SC1 and WC3 back; they could keep the popularity system but just have an alternative option for users to use).

Though I am aware it's in Blizzard's best interest (money wise) to focus on their newer games but they could be good sports and care more about their older games.

Well, actually Blizzard would never do that. But, since they're Activision (a.k.a. Cash-y-vision) slaves now, they have nothing to choose from.

 

[Dr Super Good]

Both Activision and Blizzard are slaves of Activision Blizzard (the head company that owns them). Thus Activision suffers the same problems Blizzard is having with management and it is not the divisions fault.

The problem with D2 is that the division that made it was disolved (for the shitty work they were doing if you think about it) and so few people left in blizzard actually know the game.
WC3 and SC1 have the problem that their development staff nolonger get budgeted any time to maintain them, thus any maintence is out of their own free time (which they probably do not have much of).

SC2 is too new for anyone to complain. Think back to WC3 RoC. In RoC there was not even support of custom objects inside the editor.

By the time HotS and the third expansion are out, I am sure these minor problems will atleast be partly resolved. SC2 has atleast 3 more years of dedicated maintence towards it and probably another 1-2 after that if it takes off like WC3 did. Thus we are looking at SC2 ending the same way WC3 did only in the year 2015-2016. I am sure many of us will have moved on from computer gaming by that time.

Ofcourse, we must not forget that unlike WC3 and D2 and SC1, SC2 was developed more professionally so it should actually be easier to maintain as well as harder to break.
WC3 was orignally planed to be an RPG (the idea was taken to WoW later) so it was dramatically changed mid development to a RTS which underwent constat revisions (probably why it is so buggy and annoying at times). D2 was developed by a team of morons (thus why blizzard north closed and why all the games the former staff make are total failures (next to the few good staff which were adopted by the rest of blizzard) and had more progam bugs and gameplay flaws than people care to document. SC1 was actualy made by morphing the WC2 engine so development on the engine was not as extensive as people imagine (and problems with it may have been inherited from WC2.

WoW and SC2 were the first blizzard games in a long time that were developed from the bottom up with the final result in mind. WoW being planned to always be some form of RPG while SC2 being planned as a sucessor to SC1 and with WC3 modability.

 

[sephiroth1234]

Garena, Battle.net and other online game clients must have a built-in antivirus.....

 

[Dr Super Good]

The only legal online client that is supported is Battle.net. Having anti virus in them would do shit all cause the exploit bypasses that part of the program (is with the JASS script compiler of maps).

 

[tooltiperror]

That's cool, don't even mention who discovered it, or give any credit whatsoever, because I'm sure after tinkering and discovering such things Jesus4Lyf would hate such mentions.

 

[-Kobas-]

That's cool, don't even mention who discovered it, or give any credit whatsoever, because I'm sure after tinkering and discovering such things Jesus4Lyf would hate such mentions.

Well maybe DSG didn't credited Jesus4Lyf directly, but all url links link his posts and comments!
If you are not to lazy, check comments below, people know how discovered this!