1

Introduction

Video games are truly intriguing pieces of software. They are built with cutting edge technology and employ some of the most wild and innovative logic, all while being artistically expressive and generally entertaining.

I have always been a fan of video games and can truthfully (albeit cornily) say that they have brought me where I am today. Video games served as an accelerant for my interest in computer systems, software, and security. In fact I may never have made the leap from mere scripting and web language to proper object-oriented programming had I not been dead set on coding my own video game cheats. And when one of my creations gained popularity, a strongly worded email from a small game studio scared me straight and helped encourage me to pursue a more ethical hacking career.

However, when most video game players hear “hacking” in the context of their favorite game, they only think of cheaters. Cheaters in multiplayer games may not be directly attacking their fellow players in a technical way, but they are attacking the game’s infrastructure and logic. However, it is becoming increasingly clear that hopping into a video game lobby with strangers can be a security risk. Inspired by this recent report on a botnet being spread through a 0day in Counter Strike’s multiplayer environment, I thought I’d share my experience and thoughts on the attack surfaces of video games, and video games as an entire attack surface of their own.

Ethics and Motives of Video Game Hacking

Like many other young and impressionable kids, when I first started hacking video games I only did it for the lulz. When the hit sequel to the popular iOS game “Jelly Car” was released in 2009, people scrambled to shave seconds off of their run times and make it to the top 10 worldwide leaderboard for each level. I thought it would be hilarious to boost past them with a time so ridiculous that they’d scratch their heads and wonder how it happened. So I poked around, managed to edit the level data files, and scored a record breaking 0.00001 seconds on all the levels.

Jelly Car was a fun little racing game with soft-body physics

I know from many of the peers that I met in game hacking communities and forums that this “for the lulz” sentiment was not only common, but almost exclusive. After all, we were attracted to video games for fun. A similar ideology that I encountered, was that “it’s just another way to play the game”. Anyone could have opened up those level files from Jelly Car, edited the coordinates of the finish line, and claimed that top spot. Armed with this logic, many video game hackers feel as though they’ve outsmarted the other players and for a while I failed to see how truly grotesque that mentality was.

Obviously, as I grew up I started to define a proper moral compass and saw the flaws in my misguided logic. Today, I absolutely love playing competitive video games like Counter Strike in an entirely legitimate manner and feel the same anguish I once caused whenever I encounter a cheater.

CS:GO (the only game I play these days) with in-game hacks enabled

Not everyone, however, moves on. From my experience, one thing became clear: hacking video games is a gateway drug. You find yourself learning the same techniques used by blackhats in other fields, and who better to teach you? You wander into communities with moral code akin to the wild west. You may be tempted at the sight of financial gains or your curiosity might get the better of you. So it was no surprise to me when I read that the authors of the massive Mirai botnet had been motivated by hacking Minecraft. Originally, they just DDoS’d Minecraft servers but eventually expanded their market when they saw how much cash there was to be made.

I was once acquainted with a small hacker group known as BassCode that was also a part of the Minecraft scene. At first, they had relatively good intentions, as far as hacking intentions can go. They exposed people that were charging money for Minecraft cheats that they hadn’t coded themselves. They were “skid” busters. But eventually, they just started cracking all of the premium cheats and leaking private video game exploits. And now, looking at their website’s archive.org data over the past 8 years shows a deterioration into doxing, racism, defacing, and database dumps.

The Scope of an Attack on a Video Game

A majority of hackers in video games are using in-game exploits. Much like my editing of the Jelly Car data, they are manipulating the software or the communication between their game and a central server in order to change the gameplay. Their actions are usually confined entirely to the game in progress.

This isn’t a necessary limitation, however. Let’s take a look at the “Belonard” trojan that was recently propagated through Counter Strike servers. It’s end goal and ultimate functionality was to edit a config file of the game in order to promote certain servers by placing them at the top of the list. It’s slightly more complicated than that, but there really wasn’t any motivation beyond driving traffic to their game servers. This hacker had a 0day exploit that gave them user-level disk read/write capabilities and they chose to use it only for in-game effect. No ransomware, no backdoors, no keylogger, just a meager financial and popularity boost that really never left the scope of the game.

Promoted servers being hacked into a game's list (Credit Dr.Web)

In similar fashion, the slimey BassCode crew that I mentioned earlier started adding what was known as a “lastlogin stealer” to the Minecraft hacks that they were cracking and releasing. While I cannot say with certainty that nothing else was injected, they were initially caught using the full user-level read/write privileges inherited by Minecraft to collect a single file that contained the decryptable credentials of the currently logged in Minecraft account. Another case of in-game hackers venturing out of the game and into the private data of another player just for game-related gain.

Video Games as an Attack Surface

We used to tweak our game client's code to avoid rendering dropped items and then drop thousands of individual items in front of someone else to crash their game

Video game data gets weird. Very rarely are we exposed to so many different types of data that originate from an untrusted peer. Whether its updating the coordinates of an in-game box that you’ve decided to move, the creation and direction of a bullet projectile, or announcing to an entire Minecraft server that you just instantly dropped 2560 diamond swords on the ground, your actions have an incredibly varied impact on other people’s software.

And yes, I know what you’re thinking. Video game servers do have security. Client data gets sanitized, verified by the server, and it’s all transported in predictable, custom designed packets. Sometimes, video games have peer to peer data transfer but usually your game is getting all of its data from a trusted server. However, just because the server is trusted, doesn’t mean the content should be. In similar fashion, XSS attacks are most effective when placed on a trusted website.

I believe that a more significant blackhat attack distributed through video games will happen in the near future. It won’t take long for a video game hacker to realize that they can do so much more damage than promoting their custom servers or for a traditional blackhat to see the potential exploits in old video games.

Gamers hold onto their favorite games dearly, and many old multiplayer games have thriving online servers without receiving any updates in years. Major game design companies have recently been proving to the community that they will do absolutely anything to squeeze revenue from fans and discontinuing updates for games but keeping them online as revenue streams is not going to be rare. Security-conscious people would never open an untrusted PDF file with a 5 year old version of Adobe Reader, but may not think twice about booting up their favorite old game and playing with strangers.

For the past week, I have been slowly and steadily enjoying a new CTF website, TargetPractice. I finally completed their Android crypto/reverse-engineering challenge, Dead Drop, and wanted to share my workflow and experience with this fun exercise.

Warning: This is a complete write-up and will contain spoilers and solutions.

To start, I did a dry run of the application to see what its all about.

It is a simple 6-digit pin code blocking entry to whatever the next component of the application is. Its likely that we can just circumvent this and see whats next, so lets decompile the apk file and start poking around.

The first thing I like to do with decompiled Android code is pull all of the strings out and search for interesting tidbits. I found a URL when searching for http connections.

I decided to monitor the applications network traffic and see if that connection gets made before or after entering a pin.

> emulator @Pixel_2_XL_API_28 -tcpdump C:/dev/TargetPractice/emulator_capture.cap

Sure enough, there's an exchange. The application sends an RSA public key and the server responds with an encrypted PIN and encrypted flag.

Okay, lets take a look at where this public key is being generated. To do this, I want to see the flow of code when the application is launched, and also when a pin is attempted. I used my personally developed live debugger to monitor which java methods were being called while the application was being run. The Dead Drop app appears to have been coded in kotlin, but both java and kotlin are converted to the same dalvik instructions. The application launch looks like this:

and the PIN attempt looks like this:

There's a lot going on here... but one thing that immediately caught my eye was the repeated writePrivateFile() method. I took a look at the code for it and it takes two strings as parameters. One can assume that they'd be file name and data. I used my debugger to output the arguments and restarted the app.

Sure enough, it writes a public key and a private key that it must have generated as well as the encrypted pin and the encrypted flag that it received from the server. At this point, it might be possible to just decrypt the pin or flag and be done with it but I tried for a long time and was unsuccessful. I decided to return to my original goal of just bypassing the pin screen. When further examining the method trace of entering a pin, I noticed that something was being decrypted via AsymmetricEncryption.decrypt(). Lets log the result of that function every time it is run:

Well what do you know.... There's the pin! And using it brings you straight to a screen with the unencrypted flag! Success!

Big thanks to TargetPractice for this challenge. It was definitely a fun CTF and I look forwarding to completing their others!

In this quickstart guide, we will be learning about the role of object deserialization in security. Deserialization is featured in most major languages and when implemented improperly, either by the language itself or by the application being written, can be a fruitful attack surface. CVE-2017-5941 is an example of flawed implementation of deserialization in the node.js JavaScript framework.

What is Object Deserialization?

Understanding deserialization requires a basic understanding of object-oriented programming. Most modern programming languages allow for improved efficiency by using the concept of an object. The basic structure of an object is programmed, including its functionality and any details that can vary, just once (into what is called a class). This code can then be re-used when multiple versions of this object are needed, ultimately improving efficiency. There are many more benefits to using objects that don't need to be covered for exploring deserialization. If object-oriented programming is a new concept to you, it can help for this guide to think of an object as a filled out form. The software application can print off as many forms as it wants, and fill them out differently.

Deserialization is the act of reversing serialization. Serialization is a complex type of encoding. Much like we base64 encode URL parameters and cookie data, programming languages serialize objects so that they can be transported under constraint. When receiving a serialized object, a programming language or application will process it and convert it back into an object in memory. This is where things can go awry.

CVE-2017-5941

CVE-2017-5941 is a deserialization exploit in the node.js JavaScript framework. Node.js is used very widely across the web in modern web applications, and any version that has not been patched and utilizes deserialization is susceptible to attack.

CVE-2017-5941 takes advantage of the conversion moment in deserialization, where the serialized object has been processed and is being put into memory. It does this by serilaizing an "immediately invoked function" into the object.

Immediately Invoked Functions

JavaScipt syntax includes a way to call a function at the same moment it is defined. The syntax is simply appending two parenthesis, "()", after the definition. Example:

function(){
alert("I am an example function!");
}()

Now lets draft a function that we might want to execute on a target:

function(){
require('child_process').exec('ls /', function(error, stdout, stderr) { console.log(stdout) });
}()

Exploiting CVE-2017-5941

So we know that code can be executed when a function is defined, but its not ever supposed to be the user's role to define functions. Javascript, however, allows functions to be placed inside regular variables. If a web application is serializing user input as a variable (this could be as simple as a variable called first_name that takes a value from a form field), we can modify the data transmission to send an immediately invoked function with our payload instead of the expected value type for the variable.

However, it is important to realize the role of deserialization at this point. Simply sending an immediately invoked function to a server won't accomplish anything. If the payload isnt deserialized, it never gets treated with the respect of "real code". Much like cross-site scripting, or injection attacks, deserialization exploitation is the result of unintentionally running user input as functional code. However, unlike cross-site scripting or injection attacks, this capacity is a necessity. The entire purpose of deserialization is to transport code and data that is intended to be re-entered into the application as functional code.

Conclusion

This truly unique ability to leave and enter your programming language's interpretation layer is what makes serialization/deserialization in all languages worthy of investigation as an attack surface. Many major languages have had deserialization exploits and there are likely to be new and creative ways to break this system in the future.

Abstract

For this project, I have compared the effectiveness of various feature sets from League of Legends (LoL) game data in classification tasks. Data for individual LoL matches were scraped from the North American match history servers. A decision tree, k-nearest-neighbors model, and multi-layer perceptron neural network were each configured and tested on their ability to identify player ranks when presented with game data. I used 13 different feature sets with each classifier and compared the results. The neural network always outperformed the other two models and the best feature set was the creep score intervals, gold earned intervals, and vision ward placement/destruction. The worst feature set was the losing team’s KDA by itself.

Read Paper

In this guide, we will take a look at a few exploits that target remote keyless entry (RKE) systems in modern vehicles. We will learn the theory behind the generic rolljam attack and also implement a specific attack on Subaru vehicles. Read Guide

"What's the wifi password?" is today's "Where is the bathroom?": the first question asked by guests of an unfamiliar location. I myself have asked this of many friends and this past week had noticed a security weakness in their routers. For those using NETGEAR brand routers, there is a simple pattern within the default WPA2 passwords that increases viability of WPA2 hash cracking. Read Guide

ReDroid started as an apktool wrapper and became a simple workspace tool for Android disassembly projects. It automates disassembly and reassembly of apps via Smali, allows for branching, and automates the signing and installing of recompiled apk files There's still a lot of work to do, and I will continue to update occasionally while I continue my DHS assignment. ...continue reading "ReDroid v0.7 Release"

In this guide we will observe one of Java's most dangerous vulnerabilities, CVE-2012-1723. We will analyze the conditions of the vulnerability and work through an example of practical exploitation through a drive-by attack. Read Guide