Now that we have our theories on how the attack will work and where it will occur, now we have to figure out what the attackers will do once they've got the compromised account. For the most part, attackers would do a few different things. They would shard and sell everything a 'toon has then transfer the gold to another character. They may also just flat out transfer the character off the server. Either way, the password would often be changed from the original so the player could not log in.
With an authenticator, the attacker will only get one shot at an account at a time, so they will have to make a decision as to what method to take. Based on my last entry, a website-based keylogger will still allow an attacker one-time entry into the legitimate "Account Management" page for a compromised account, allowing the attacker to change the password and transfer characters off the server. The problem with that method of attack is even if the character is moved entirely off server the attacker will not be able to gain access to it, a loss of $25 to the attacker. Ergo this method of attack still seems only to be really viable for players that do not use the authenticators.
A program front-end keylogger will allow the attacker to log into the game as that player's toons, but they won't be able to wheel around and get into the "Account Management" website. So this leaves the attacker one option, to shard & sell as many items as they can and then mail the gold to a gold mule. The mule itself will then be transferred off the server, where the gold can be picked up and used for sale on the market.
Now as I had said on my last entry, the open window for a successful attack will be a short period indeed, maybe a maximum of 60 seconds. As of this writing we still don't know anything regarding Blizzard's configuration of the authentication window. Either way with such a small amount of time this means someone will need to be at the machine all the time to take advantage of a compromised account and harvest gold. It's possible such a requirement could force smaller operations out of business due to the increased complications to keep their coffers full of plundered gold. This will probably not affect larger operations quite so much as they will be able to afford a workforce to keep running 24/7.
Of course a bot program to automatically log into compromised accounts and then sell items at the nearest vendor *might* be feasible, but that's beyond the scope of this document.
Monday, July 7, 2008
Monday, June 30, 2008
Compromising The Blizzard Authenticator: Man-In-The-Middle
I need to get this out of the way: BLIZZARD I AM NOT CONDONING THIS IN ANY WAY SHAPE OR FORM I LOVE YOU GUYS. I am not a security expert, nor do I claim to be one. My theories of what you are about to read below may have some, most or all of it incorrect; and have been culled from what I've come to understand about how these systems work and what sort of attacks have occurred on them.
As with keyloggers, Blizzard will not be able to prevent these attacks as they are occuring against the player's PC directly. Getting this out in the open will help raise player awareness that the authenticator is not the end of account compromising security risks, and that players still need to diligently maintain their computers, scan for unwanted programs, and change their passwords regularly.
Now then. Compromising the Blizzard authenticator. It will be hard, but it can be done.
First off, some background on the authenticator. Blizzard appears to have contracted the company Vasco and it's line of security tokens called "Digipass Go6". The Go6 has a non-replaceable battery with an expected lifetime of seven years. Go6 is tamper-resistant and supports the DES, 3DES and AES cryptography algorithms. It can also withstand a 1 meter (~3 foot) drop intact. Blizzard's version will look like this:
It uses a secure key between the authenticator (AKA a"keyfob" or "token"), and the Blizzard login servers. On the image above it is six digits, the Vasco brochure states it can display up to eight. It remains to be seen how many digits will be used but I'm sure we'll find out shortly. Every certain number of seconds, both the token and the server will generate a new one-time code. If the code is not entered within the correct timeframe a new one-time code will be generated and the displayed code will be rendered useless. The details of how all this works is far too complicated for this document, and there are plenty of great websites and books out there that cover it in detail if you really would like to learn more.
So to get into World of Warcraft and in theory Starcraft 2 and Diablo 3 if they code for it, the login will go as thus (click to enlarge):
Ok, easy enough, you can see where the pathing goes. Now, how does someone compromise a token-based login?
Technically speaking what I am about to describe is more of a phishing attack than a true MITM, but I feel the terminology still works. These attacks can occur one of two ways. The first way is a simple tried and true spoofed webpage. Old, reliable, works without fail. Create a false website that pretends to be Blizzard's account management site. Have the proper fields to fill out for account name, password and code. Upon clicking submit the user is redirected somewhere else, while their information is forwarded to the attacker.
How does this work if the attacker wants to go to the source, IE the game itself? This method will prove more time consuming and costly as they will have to code up an entire program that mimics the launcher and/or portal login screen. I figure the flowchart for such a program will look like one of these three ideas (click to enlarge):
My new ideas came to me after I had originally posted this on 6/30 and I felt I should show how each one will break down. I believe all of these can be considered "Man-In-The-Middle" style attacks.
The complicated version is a bit of a mess, and will require the attacker's program to pass authentication data to the Blizzard login servers. I have been informed the complicated idea would not work as after the token code is passed to Blizzard it is rendered useless to be used a second time. I should have realized this. --7/01/08
The simple version is very straightforward. The attacker's program never passes any data to Blizzard, just collecting it until the code is entered. I feel this is the most likely angle of attack, but it assumes the target uses the authenticator. If they are not using one then the program is rendered useless.
The token/non-token version may be the best compromise between the two previous versions. The attacker's program will make one single call to the Blizzard login servers and depending on the reply will either ask for the one-time code or go directly to the notification and termination portion of the program. This version allows the attacker access to player accounts that have not purchased the authenticator, effectively operating as a sophisticated keylogger.
Once everything has been entered the attacker can be notified one of many ways. There are 4-5 ways listed here but I'm sure there could be more options. Once the notification has been sent, the program will generate an error, crash, or both. Either way the user will believe that either there is a problem with Blizzard's servers, their installation of WoW, or possibly even their computer.
It's not known how short the key generation window is, or how long the window will stay open once a user has verified their login and password. RSA SecurID keys have a 60 second key generation and use window, meaning every minute a new key is generated and must be used within that minute or else it is no longer valid. If Blizzard keeps to a 60 second key window and if on average it takes about five seconds for a user to input their key, in this scenario the attacker would have about 50 seconds to log in using your pilfered data.
As it stands no one knows the details of the new login system except for Blizzard and Vasco. We may come to learn a few little things about it in the future, but by and large it the inner workings of the token security system will be unknown.
In summation, token authentication is very secure, however a properly executed attack will still be able to circumvent the latest layer of security. Like I said in the beginning of this post these attacks are not things that Blizzard can control. Please be responsible and as I said in the beginning of this post, diligently maintain your computers. Regularly scan for viruses, trojans, malware, and please change your passwords regularly.
As with keyloggers, Blizzard will not be able to prevent these attacks as they are occuring against the player's PC directly. Getting this out in the open will help raise player awareness that the authenticator is not the end of account compromising security risks, and that players still need to diligently maintain their computers, scan for unwanted programs, and change their passwords regularly.
Now then. Compromising the Blizzard authenticator. It will be hard, but it can be done.
First off, some background on the authenticator. Blizzard appears to have contracted the company Vasco and it's line of security tokens called "Digipass Go6". The Go6 has a non-replaceable battery with an expected lifetime of seven years. Go6 is tamper-resistant and supports the DES, 3DES and AES cryptography algorithms. It can also withstand a 1 meter (~3 foot) drop intact. Blizzard's version will look like this:
It uses a secure key between the authenticator (AKA a"keyfob" or "token"), and the Blizzard login servers. On the image above it is six digits, the Vasco brochure states it can display up to eight. It remains to be seen how many digits will be used but I'm sure we'll find out shortly. Every certain number of seconds, both the token and the server will generate a new one-time code. If the code is not entered within the correct timeframe a new one-time code will be generated and the displayed code will be rendered useless. The details of how all this works is far too complicated for this document, and there are plenty of great websites and books out there that cover it in detail if you really would like to learn more.
So to get into World of Warcraft and in theory Starcraft 2 and Diablo 3 if they code for it, the login will go as thus (click to enlarge):
Ok, easy enough, you can see where the pathing goes. Now, how does someone compromise a token-based login?
Man-In-The-Middle (wiki link)
Technically speaking what I am about to describe is more of a phishing attack than a true MITM, but I feel the terminology still works. These attacks can occur one of two ways. The first way is a simple tried and true spoofed webpage. Old, reliable, works without fail. Create a false website that pretends to be Blizzard's account management site. Have the proper fields to fill out for account name, password and code. Upon clicking submit the user is redirected somewhere else, while their information is forwarded to the attacker.
How does this work if the attacker wants to go to the source, IE the game itself? This method will prove more time consuming and costly as they will have to code up an entire program that mimics the launcher and/or portal login screen. I figure the flowchart for such a program will look like one of these three ideas (click to enlarge):
Complicated Token: | Simplistic Token: |
Token/Non-Token Version: | |
My new ideas came to me after I had originally posted this on 6/30 and I felt I should show how each one will break down. I believe all of these can be considered "Man-In-The-Middle" style attacks.
The simple version is very straightforward. The attacker's program never passes any data to Blizzard, just collecting it until the code is entered. I feel this is the most likely angle of attack, but it assumes the target uses the authenticator. If they are not using one then the program is rendered useless.
The token/non-token version may be the best compromise between the two previous versions. The attacker's program will make one single call to the Blizzard login servers and depending on the reply will either ask for the one-time code or go directly to the notification and termination portion of the program. This version allows the attacker access to player accounts that have not purchased the authenticator, effectively operating as a sophisticated keylogger.
Once everything has been entered the attacker can be notified one of many ways. There are 4-5 ways listed here but I'm sure there could be more options. Once the notification has been sent, the program will generate an error, crash, or both. Either way the user will believe that either there is a problem with Blizzard's servers, their installation of WoW, or possibly even their computer.
It's not known how short the key generation window is, or how long the window will stay open once a user has verified their login and password. RSA SecurID keys have a 60 second key generation and use window, meaning every minute a new key is generated and must be used within that minute or else it is no longer valid. If Blizzard keeps to a 60 second key window and if on average it takes about five seconds for a user to input their key, in this scenario the attacker would have about 50 seconds to log in using your pilfered data.
As it stands no one knows the details of the new login system except for Blizzard and Vasco. We may come to learn a few little things about it in the future, but by and large it the inner workings of the token security system will be unknown.
In summation, token authentication is very secure, however a properly executed attack will still be able to circumvent the latest layer of security. Like I said in the beginning of this post these attacks are not things that Blizzard can control. Please be responsible and as I said in the beginning of this post, diligently maintain your computers. Regularly scan for viruses, trojans, malware, and please change your passwords regularly.
Blizzard Authenticator: Not For Me, Yet.
As it stands right now I'm not buying the keyfob in the near future. Yes it's only $6.50, ($7 after tax), but there is currently a very limited scope of use for the device. I'm sure D3 and SC2 will have support for it, but I'd like to be able to use it elsewhere. VPN/SSH authentication for remote connections to a company or personal network, online banking/financial work, etc.
Of course, I will most likely get one in the long term. I am a bit of a security nut and I understand that this is a very nice level of physical security. Though initially I want to see how this will all play out. After doing a bit of reading on how this form of authentication works, and chatting with a friend versed in the subject, will Blizz be able to keep the authentication servers stable enough for the amount of users logging in? My friend was very doom & gloom about the subject and felt they won't be able to.
We'll see huh?
Of course, I will most likely get one in the long term. I am a bit of a security nut and I understand that this is a very nice level of physical security. Though initially I want to see how this will all play out. After doing a bit of reading on how this form of authentication works, and chatting with a friend versed in the subject, will Blizz be able to keep the authentication servers stable enough for the amount of users logging in? My friend was very doom & gloom about the subject and felt they won't be able to.
We'll see huh?
Sunday, June 29, 2008
Saturday, June 28, 2008
Because It's Everywhere Else - Hunter Annoucements
Announced changes at WWI:
* Steady Shot will no longer clip autoshot -- the speaker acknowledged that Hunters hurt their own DPS by using their abilities - The SS/AS change is great, though I still wonder what endgame rotations will be for BM hunters.
* Pets will get "talent trees" - one utility tree, one TANKING tree, one DPS tree - This sounds very intriguing, I think it might pave the way for a BM talent revamp, and instead moving such talents as Ferocity and Frenzy to the pet tree.
* A specific ability revealed was "cornered" - your pet does an additional 20% damage when they're at 20% health - Great idea, however any hunter worth their salt makes sure they never come that close to death if they can help it. ;)
I'm sure there's more to be revealed. Still to be answered is whether or not tanking tree pets will be viable tanks through to end-game. Currently in WoW and TBC end-game instances a pet cannot be a viable tank. Even if you were to take a valid tank pet (such as a turtle, scorpid, bear, boar etc), and have them properly trained they still would pale in comparison to a tanking warrior or paladin. In a pinch groups can use a hunter pet as a tank but the rest of the party needs to be on the ball to make it work. Though there are instances when a hunter pet may not be enough to clear. One of those is Grandmaster Vorpil inside Shadow Labyrinth.
There are two tactics I've seen used against the Grandmaster. One is to drag him North and South while DPS'ing him down, the second is to simply burn Vorpil down where he stands. The North/South tactic will require the pet to run away from Vorpil -- meaning the hunter has to hit pet defensive twice -- and still attack to apply Growl when the cooldown is up -- meaning the hunter has to hit pet attack. In theory this could work but the hunter has to really be on the ball to balance their own DPS and keep the pet on the job. Burning Vorpil where he stands will not work at all. A set of properly geared players going for high DPS will blow the pet's aggro generation out of the water. Even with proper application of Misdirect and Prayer of Mending there will not be enough stacked aggro to keep up. Vorpil will break free, and all hell will break loose.
Another problem occurs in battles where the tank has to run out of flames/shadow/etc to prevent taking massive damage and/or a debuff. A pet will not do this on their own without a hunter pulling the strings, or using "Eyes of the Beast" to manually control the pet, which removes the hunter's ability to pump out DPS for the entirety of the spell.
What it all boils down to is a pet is simply AI run by whatever code has been programmed by Blizzard Devs, and you as a hunter have no real control over it. Sure you can toggle use of some pet talents like Growl and Bite or use a spell like Kill Command, but in the end pets currently do not have the ability to churn out enough threat to stay ahead of players unless they intentionally hold back their damage output. That will not work because the longer a battle goes, the higher the risk becomes of the entire raid running out of mana and wiping.
This could change with WotLK, but how much of a chance remains to be seen. As it stands now, I don't believe BigRedKitty could take his boar into a raid against Arthas and have his little piggie hold enough aggro to allow the entire raid go full bore (hoho, boar/bore). It's possible that endgame for WotLK will be the same as it's always been for hunter pets, to just maximize their DPS and don't bother with tanking.
I really hope that's not the case though, as I'd love to see the class and their pets become more of a utility knife.
* Steady Shot will no longer clip autoshot -- the speaker acknowledged that Hunters hurt their own DPS by using their abilities - The SS/AS change is great, though I still wonder what endgame rotations will be for BM hunters.
* Pets will get "talent trees" - one utility tree, one TANKING tree, one DPS tree - This sounds very intriguing, I think it might pave the way for a BM talent revamp, and instead moving such talents as Ferocity and Frenzy to the pet tree.
* A specific ability revealed was "cornered" - your pet does an additional 20% damage when they're at 20% health - Great idea, however any hunter worth their salt makes sure they never come that close to death if they can help it. ;)
I'm sure there's more to be revealed. Still to be answered is whether or not tanking tree pets will be viable tanks through to end-game. Currently in WoW and TBC end-game instances a pet cannot be a viable tank. Even if you were to take a valid tank pet (such as a turtle, scorpid, bear, boar etc), and have them properly trained they still would pale in comparison to a tanking warrior or paladin. In a pinch groups can use a hunter pet as a tank but the rest of the party needs to be on the ball to make it work. Though there are instances when a hunter pet may not be enough to clear. One of those is Grandmaster Vorpil inside Shadow Labyrinth.
There are two tactics I've seen used against the Grandmaster. One is to drag him North and South while DPS'ing him down, the second is to simply burn Vorpil down where he stands. The North/South tactic will require the pet to run away from Vorpil -- meaning the hunter has to hit pet defensive twice -- and still attack to apply Growl when the cooldown is up -- meaning the hunter has to hit pet attack. In theory this could work but the hunter has to really be on the ball to balance their own DPS and keep the pet on the job. Burning Vorpil where he stands will not work at all. A set of properly geared players going for high DPS will blow the pet's aggro generation out of the water. Even with proper application of Misdirect and Prayer of Mending there will not be enough stacked aggro to keep up. Vorpil will break free, and all hell will break loose.
Another problem occurs in battles where the tank has to run out of flames/shadow/etc to prevent taking massive damage and/or a debuff. A pet will not do this on their own without a hunter pulling the strings, or using "Eyes of the Beast" to manually control the pet, which removes the hunter's ability to pump out DPS for the entirety of the spell.
What it all boils down to is a pet is simply AI run by whatever code has been programmed by Blizzard Devs, and you as a hunter have no real control over it. Sure you can toggle use of some pet talents like Growl and Bite or use a spell like Kill Command, but in the end pets currently do not have the ability to churn out enough threat to stay ahead of players unless they intentionally hold back their damage output. That will not work because the longer a battle goes, the higher the risk becomes of the entire raid running out of mana and wiping.
This could change with WotLK, but how much of a chance remains to be seen. As it stands now, I don't believe BigRedKitty could take his boar into a raid against Arthas and have his little piggie hold enough aggro to allow the entire raid go full bore (hoho, boar/bore). It's possible that endgame for WotLK will be the same as it's always been for hunter pets, to just maximize their DPS and don't bother with tanking.
I really hope that's not the case though, as I'd love to see the class and their pets become more of a utility knife.
We're No Strangers To Love..
I've got a number via http://www.grandcentral.com that I've succeeded in setting up a voicemail rickroll.
Sunday, June 22, 2008
Day Old Goods.
This shelf, at a market in an upper-middle class area, used to be constantly full. Now with the economy this is regularly picked clean daily. Interesting what occurs as prices rise.
Subscribe to:
Posts (Atom)
Posts
