New WC3 exploit

[Draknyte1]

isnt barney a dinosaur?

 

[Tleno]

Bush thinks so...

 

[NearbyHermit]

Last year I encountered a virused map!

It happens with the Custom Data contained,it was an infected Mp3 file,then game sometimes crashed when it played!

So I went in the Editor and Saved it,scanned it,and it had positive for infection

 

[Captain Griffen]

Last year I encountered a virused map!

It happens with the Custom Data contained,it was an infected Mp3 file,then game sometimes crashed when it played!

So I went in the Editor and Saved it,scanned it,and it had positive for infection

Your virus scanner surely cannot scan map archives (unless it has an MPQ archiving tool)? This is highly unlikely. If you don't know how to decompress it, compressed files are as unreadable as encrypted ones.

 

[NearbyHermit]

I didn't scan the map itself!

I exported the mp3 file,and scanned it!

As I said,the map was suspecting when the game suddenly crashed when it played!

 

[Pyritie]

Eh, it was probably just corrupted and not a virus. AFAIK you can't really put a virus in an mp3 file.

Also, Blizzard has said they know about this problem and are working on it. Someone posted a link to blizz's forums on wc3c (I lost the link) where they said they know about it.

 

[NearbyHermit]

Well,they still think about Warcraft 3!

Anyway,it isn't such a big threat,I mean Anti-Virus programs are very powerful,facing viruses that occur from maps!

 

[Bloody_Turds]

honestly id love for this 'exploit' to stay, and theres not much they can do about it probably.... although blizz could have its own virusscan that scans a file after dl, for known virus's (only ones that are known to have been on wc3), they should also keep IP of the creator saved incrypted in the map at creation, this would be atleast a little protection, since maps could be traced back

really though, with this you can have actual save/load rpgs, without codes, all it has to do is save a file on the comp, in the wc3 folder, or possibly even ON A SERVER. that would greatly decrease the ability to cheat. btw no im not an rpg fan, im just useing rpgs since they would probably benifit the most from this.

that or maybe any executable file, could be registered by the owner at battle.net, then the virus scan would find any unregistered files, or files onlist as viruses. It would not have to be ran by blizz employies, but rather the comunity, except when a virus is detected (then blizz ban's the submitters key) not to mention, mods would be alot more widespread, if they could be dled over bnet, and or synced

 

[NearbyHermit]

honestly id love for this 'exploit' to stay, and theres not much they can do about it probably.... although blizz could have its own virusscan that scans a file after dl, for known virus's (only ones that are known to have been on wc3), they should also keep IP of the creator saved incrypted in the map at creation, this would be atleast a little protection, since maps could be traced back

really though, with this you can have actual save/load rpgs, without codes, all it has to do is save a file on the comp, in the wc3 folder, or possibly even ON A SERVER. that would greatly decrease the ability to cheat. btw no im not an rpg fan, im just useing rpgs since they would probably benifit the most from this.

that or maybe any executable file, could be registered by the owner at battle.net, then the virus scan would find any unregistered files, or files onlist as viruses. It would not have to be ran by blizz employies, but rather the comunity, except when a virus is detected (then blizz ban's the submitters key) not to mention, mods would be alot more widespread, if they could be dled over bnet, and or synced

Dude,this sounds pretty anarchic,but efficient!

 

[HFR]

First the fail maps flood, now this!!!!

/me explodes is angreh!

At least I don't play on battle.net, he he...

 

[Billy the Cat]

I don't play wc3 anyways.

First the fail maps flood, now this!!!!

/me explodes is angreh!

At least I don't play on battle.net, he he...

To be honest a large number of us no longer make warcraft III maps or resources, as well as many of us who no longer play warcraft III at all
Nevertheless this is indeed slightly worrying, and I hope Blizzard make patching this a priority.

I see, just being addicted to the Hive?
This is a Warcraft-based community, but it just surprised me to hear a lot of people say that they don't play Warcraft 3 or B.Net. Why are there so many non-warcrafters on the Hive?

I could understand it if some played Warcraft, but stopped playing while still being attracted to the site.

I hope this exploit will be fixed, although an easier save option would be great. I usually dislike RPG's on B.Net, but if one would not be abuseable and would require no codes it would be awesome. Now most RPG's get boring with all those huge level heroes from players who did nothing except for some cheating.

If they fix the whole thing it's okay to, I don't need RPG's that badly and most people wouldn't be able to exploit it I think (unless people would release a how-to-abuse-the-exploit-for-saving tutorial). ^^

 

[HFR]

I still play Wc3, I only don't play in battle.net because of my Dial up lol...

 

[br_shadow]

Omg you are right. They can encrypt the virus on an protected map and have it executed in game, if someone need to do damage, they sure can.

 

[Dr Super Good]

I fear we may regret blizzard fixing this, just like we would have if blizzard fixed the H2I bug. If they fix this I demand that they give some means of storing data in a file offline in multiplayer that can be synced at map start. Or atleast some other feature to allow for beter more complicated maps.

Yes sucerity is a problem, but this has the potential to be so handy as well. This could be the next greatest thing since H2I was found. Yes you would need to be more careful which maps you play, but who plays the sort of map that this is likly to be added to...

Remember that getting this to actually do anything financially useful (which is the only reason people would use this in a bad way) would need someone really skilled, and 95% or more of WC3 map makers can barely program JASS letalone machine code.

 

[Captain Griffen]

Once you have gotten outside the sandbox, that's it, you can run whatever you want fairly simply, as I understand it. The step from exploit to dangerous/financially useful exploit is tiny.

 

[Dr Super Good]

The fact is that you have to be a really good programer to use this in a dangerous way. The fact is also that 95%+ of programmers are too stupid to. Also a fact is that main stream custom maps will not abuse this as the makers want their maps to be popular and not to ruin peoples lives. Icefrog for example would have to be a complete idiot to implement a keylogger for stealing passwords as it would cause his map to lose all popularity near instnantly as well as several suicides.

As for the maps most likly to be affected? Loaps, other crappy open source maps and maps which promis ilegal or stupid things.

If they do remove such a bug that may turn out useful, they should atleast add something useful to WC3 like the ability to save a safe text file offline when playing multiplayer.

 

[Billy the Cat]

Icefrog for example would have to be a complete idiot to implement a keylogger for stealing passwords as it would cause his map to lose all popularity near instnantly as well as several suicides.

And THAT is scary and maybe true...

 

[Eleandor]

The fact is that you have to be a really good programer to use this in a dangerous way. The fact is also that 95%+ of programmers are too stupid to. Also a fact is that main stream custom maps will not abuse this as the makers want their maps to be popular and not to ruin peoples lives. Icefrog for example would have to be a complete idiot to implement a keylogger for stealing passwords as it would cause his map to lose all popularity near instnantly as well as several suicides.

Sure, but it's also a fact that you need only one guy to actually create an infected map. Even if the percentage of people able to do this is small, never forget that one guy is enough.

Not to mention the possibility that this one guy could also just write a tool that allows script kiddies (my own term for kids who know nothing of programming but use tools to "create" virusses and stuff) to infect any map they want. When any form of automation would be added, the threat will increase exponentially.

Even more importantly, many people start to know about this exploit, due to threads like this one. To blizzard, it's a matter of reputation now. Blizzard can't allow their own "clean" application to be a possible threat and be considered "unsafe".

 

[Billy the Cat]

I thought of the subject and came with the same idea. If 1 player would decide to make a map that would erase all other player's maps or something it could be a big problem. Maybe worse if it would bug other players maps to have the same effects so that it would create an avalnche of problems.

I don't know all of the options, so what I am saying might be nonsense. My apologies if it is.

 

[Eccho]

For those who haven't read yet - Fake Dota alert.

Source: Warcraft Custom Map Virus - Important! - Dota Allstars Blog

Long quote

Warcraft Custom Map Virus, a Must Read! There's been a big fuss lately on Battle.net because a new exploit has been circulated amongst hackers. The exploits allows for a custom map to execute arbitrary code on a client and install trojans/viruses/keyloggers outside of the Warcraft III engine. In simple words, by just join an unknown person who host the Warcraft III virus map, your pc will be infected when the game started. And Dota is now become the largest target of this virus. This is not hoax or rumor, Dota-Allstars forums (and Battle.net forums) already stickied this topics. I really recommend that you read this article until finish for your own good.

Hackers created fake Dota maps that use the same file extension/directory as DotA 6.59d. Therefore you will see the loading screen displayed in your custom game list and it is effectively impossible to take precautions against, as it has no discernible difference from joining a normal DotA game. It is highly recommend that you stop playing public dota games until blizzard can patch this exploit. They have already had it brought to their attention.'

For those who doubt how dangerous this is; by mimicing dota, anyone who has already downloaded the legitimate map will see the game displayed in the custom game screen with the proper loading image, and it finishes downloading before you switch to the game lobby screen, as it is a tiny file size. Once you enter the game, the virus will unpack itself and infect your computer, allowing malicious code to be executed at the whim of the hacker. This means a malicious user will be able to grab everyone's cd-keys in a game, plant a keylogger in your computer, any known virus etc.

Props go to [email protected] forums for bringing this to attention.
Battle.net - English Forums -> Error

Don't join games of DotA hosted by people you don't know. This applies to public games, TDA, etc. The best precaution you can take at the moment if you want to continue to play DotA, is to keep your Warcraft III maps folder open, and see if any new files are downloaded when you join a game. If they are, immediately leave the game lobby, before the host can start the game (and infect you), and delete the new map file. If your computer has been infected, you should run the best antivirus software you can find, and Don't log into any accounts on your computer, Warcraft III, email, etc, as there is a high probability of getting your password keylogged. If you are certain your computer is infected, the only surefire way to eliminate it is to reformat your computer.


COMODO is the only known program at the moment to prevent Warcraft from running the malicious code as of now. Every other AV/firewall/anti-malware program other than that does not currently prevent this exploit from being used.
This is what ChildLikEmperor, Dota-Allstars forums moderator, said on his thread. But if you have another AntiVirus that can detect it, feel free to share it here.

Blizzard has been notified about the issue. The safest thing to do at the moment is to not play DotA or any other custom map until Blizzard release new patch. OR, you can carefully choose your host when joining a game even though certain risk is still there. Honestly, i prefer the second choice, because it will be hard to stop playing Dota ~_~

Update:
Thanks for anonymous who give this information.

Name of virus: HackTool.Win32.Sniffer.WpePro.w
Contaminated sites are here:
C:\WINDOWS\TEMP\omfg_wtf.dll

Looks like the virus file is on : \WINDOWS\TEMP\omfg_wtf.dll

An advice from Karune (Blizzard poster)
Source: Battle.net - English Forums -> Warcraft III Custom Map Security Warning

Warcraft III Custom Map Security Warning
We have identified an exploit that could allow malicious software to be spread through Warcraft III maps. We have applied a temporary fix to address this issue when playing on Battle.net, and we are working on a patch to permanently address the issue when playing on a LAN or playing single-player custom maps. In the meantime, we recommend that players avoid downloading maps from unofficial sources or websites they do not trust -- be aware that corrupted maps may share the same name as other popular maps. If you encounter custom maps that no longer function or other issues related to this fix, please post details below.

However, it seems Blizzard already made a temporary fix on the b.net servers (by Datth, Blizz poster)
Source: Battle.net - English Forums -> Dat, can you elaborate on this WC3 fix?

This fix patches the area of the game where it runs inappropriate scripts. Beyond that information, I don't have much else for you. You just need to log onto Battle.net to get an updated bncache.dat file, which contains that fix.

So, outside b.net it's anything but safe...

 

[QueloR]

"Houston, we have a problem"

 

[Dr Super Good]

They should much rather address the map curroption issue so that undownloaded maps do not appear downloaded. Also things like map size checks when you join would be good as you would not have like a 40 KB DotA. Equally well, they just have to stop WC3 running or starting other programs with this exploit, and restrict its domain to only a sub folder of WC3 and it will become pretty harmless.

The big problem is it is quite possiable they will eithor totally rework the function reference system so that that type no longer allows dangerous code to be run (possiably resulting in WC3 behaving differently and becoming buggy with existing systems) or they will fix the type conversion bug (the cause of this exploit) so that nearly every JASS spell and system stops functioning.

Thus if you do want the exploit removed, you better hope that they do not remove it and purly restrict its domain to that of it being unable to cause damage. Also hope that whatever they do, it does not slow WC3 down.

A rough guess would have me reconing that blizard will just add an exception preventing the type convstion of X to code and code to X, which may slow down other conversions slightly but will prevent the exploit form being used at all. They should atleast reward us if they do that by adding some new handy native to use, like built in faster type converters or better unit stat control natives.

 

[Captain Griffen]

The cause of the vulnerability in the VM is the lack of bounds checking; that could be fixed without any downside.

 

[Viikuna]

Sounds good.

They should just hire Griffen to fix their shit...

 

[Captain Griffen]

There's a difference between being able to tell you that you need to disarm the detonator to stop the nuke, and being able to disarm the detonator.

 

[syltman]

They should much rather address the map curroption issue so that undownloaded maps do not appear downloaded. Also things like map size checks when you join would be good as you would not have like a 40 KB DotA. Equally well, they just have to stop WC3 running or starting other programs with this exploit, and restrict its domain to only a sub folder of WC3 and it will become pretty harmless.

The big problem is it is quite possiable they will eithor totally rework the function reference system so that that type no longer allows dangerous code to be run (possiably resulting in WC3 behaving differently and becoming buggy with existing systems) or they will fix the type conversion bug (the cause of this exploit) so that nearly every JASS spell and system stops functioning.

Thus if you do want the exploit removed, you better hope that they do not remove it and purly restrict its domain to that of it being unable to cause damage. Also hope that whatever they do, it does not slow WC3 down.

A rough guess would have me reconing that blizard will just add an exception preventing the type convstion of X to code and code to X, which may slow down other conversions slightly but will prevent the exploit form being used at all. They should atleast reward us if they do that by adding some new handy native to use, like built in faster type converters or better unit stat control natives.

I agree with this althought it's dangerous it's worth it. This could open for new better stuff (Sadly bad stuff aswell). Insteed off having it removed there should be a scanner in bnet that checks the triggers and if it finds something like this it would warn us first.

 

[TheDivineBoss]

I agree with this althought it's dangerous it's worth it. This could open for new better stuff (Sadly bad stuff aswell). Insteed off having it removed there should be a scanner in bnet that checks the triggers and if it finds something like this it would warn us first.

One huge flaw in your scanner idea: Most of the maps contain a shitload of triggerflaws.

 

[Vercas]

Awefull news. But let's see the good part: Someone discovered the bug and didn't use it for personal interests.
Congratulations! Now I will never download any map again until I see this fixed!
Crap, you're scaring the shit out of me...

 

[Dr Super Good]

Or they could combine it with a warning promt if any code that is out of bounds is trying to be run, which defaults to disabling it unless the user clearly specifies that they want it run.

 

[Vercas]

Yeah! How he said! ( )

 

[Marshmalo]

This sucks ive just been downloading loads of maps from Bnet, already had to fix my comp after a virus stoped it booting up properly, trust the Russians to discover an exploit before anyone else does "rolls eyes*.

I saw someone advertising for the new version of map hack aswel, then played with some one who blatantly had it installed, he always knew exactly where the enemy was going to strike next, we won pretty easily. Makes me sick all these people using cheets, hope they burn in hell.

 

[Alfred]

People, you forgot something important, if blizzard dont fix this, this hack may continue to SC2! that means the HAVE to fix it! or they may not sell anything.

 

[Mooglefrooglian]

I would say they should not fix it completely.. the oppurtunities to do ANYTHING with this are endless.. text files with your score saved.. and the game could also check that.. although, sadly, the bug abuse is *huge*. Sigh...

 

[Koromaru]

I hope something is done to solve this problem.

I read somewhere here that it uses JASS codes to hack your computers. What if the maps are made entirely in GUI? (With a few custom scripts)

 

[Vercas]

Customs scripts are basicly JASS codes introduced in a GUI trigger.

 

[Viikuna]

GUI nothing more than ugly looking Jass..

 

[Pyritie]

People, you forgot something important, if blizzard dont fix this, this hack may continue to SC2! that means the HAVE to fix it! or they may not sell anything.

SC2's a different game, in case you haven't noticed.

 

[Tleno]

Still, this "Map flu" must be fixed.

 

[Eccho]

It seems like battle.net and eurobattle.net is "safe" at the moment from executing the malicious code.
In order to be certain you wont execute a virus map in Lan/Single Player, log on to battle.net first, to get the temp fix file (I386Archimonde.mpq or something like that). This file will stay active as long as you dont exit the game.

Garena is still in the riskzone though.

 

[syltman]

The mods on this site needs to check the maps then for this before approving in the future

 

[Rising_Dusk]

I feel like you people are way too worried about this. It'll be dealt with, it's not the end of the WC3 world, just give it time and be a little more cautious about downloading porno maps. Seriously.

 

[Hoernchen]

I am more worried that the bug will be removed completely, preventing us from using it for actually good things like string-less save/load systems.

 

[Rising_Dusk]

I feel that Blizzard recognizes the value of the return bug and is taking measures to avoid ending WC3 MapmakingDotA and is looking for alternatives.

 

[Solbraa]

no one is joning my maps either....

 

[Rising_Dusk]

I somehow doubt that has to do with this exploit.

 

[Eccho]

I guess, if Blizzard is about to remove the return bug or type casting method they will have to change their own Bj scripts as well, since some of them actually uses that technique.

I never realised some uses wc3 for pr0n Dusk

 

[Billy the Cat]

My father ran some programs and discovered that Warcraft removed had messed up with my anti-virus programs and Internet Connection. Maybe this exploit infected my pc. Time to wait for a patch. :<

 

[kmde613]

Hmmm... Seems like Garena is still unsafe. As read from above.
By the way, if the "map flu" only occurs on the new WC3 Patch, can older patches like (1.20c which is mine) still get affected by it? I read from someone here that "Not updating" your WC3 "saved" you, but i don't think thats right.

 

[Kwaliti]

Only 1.23 clients can be affected.

 

[Captain Griffen]

I believe that, due to the different compiler, attacks against 1.22/1.23 won't be effective against 1.21 and earlier. The attack still works, you just need to have different memory addresses I think. In effect, you should be safe, but that assumes no one will target that.