Blizzard Exempt from iOS and MacOS Security Sandbox

[Aissen]

Tweet has been deleted: https://twitter.com/i0n1c/status/738258436161449984

I deleted the tweet with the picture of the sandbox because people start hyping it up without linking the clarification.

And the "clarification" tweet: https://twitter.com/i0n1c/status/738084828202053633

For those late to the party: the sandbox bypass exception for Blizzard only affects the access() family of syscalls - probably harmless

Edit: Original tweet screenshot http://imgur.com/c8RnYjo (it's still in Google cache… for now).

[personjerry]

I Google'd and here is one result, showing at least one theoretical security vulnerability of access(): http://stackoverflow.com/a/14333217/3650441

If an attacker knows what files Blizzard is calling access() on, they could likely use this exploit and execute arbitrary code.

[mzs]

0xBuLL of 0xa bytes, dev's feelings come through loud and clear here.

[chillacy]

I recall a story of how the windows 95 team (or the like) was crazy dedicated to backwards compatibility, so they had a check to see if the user was running Roller Coaster Tycoon and if so, disabled virtual memory so the game would run.

Though I'd like to know more details, like:

* Why does blizzard need to run in the sandbox on Mac OS X? The app sandbox is opt-in (though required for App Store apps)

* Can anyone set their team ID to blizzard's?

* Are blizzard games attack vectors?

[reymus]

Here's the story Joel Spolsky wrote some time ago[1]:

> Windows 95? No problem. Nice new 32 bit API, but it still ran old 16 bit software perfectly. Microsoft obsessed about this, spending a big chunk of change testing every old program they could find with Windows 95. Jon Ross, who wrote the original version of SimCity for Windows 3.x, told me that he accidentally left a bug in SimCity where he read memory that he had just freed. Yep. It worked fine on Windows 3.x, because the memory never went anywhere. Here's the amazing part: On beta versions of Windows 95, SimCity wasn't working in testing. Microsoft tracked down the bug and added specific code to Windows 95 that looks for SimCity. If it finds SimCity running, it runs the memory allocator in a special mode that doesn't free memory right away. That's the kind of obsession with backward compatibility that made people willing to upgrade to Windows 95.

[1] http://www.joelonsoftware.com/articles/fog0000000054.html

[gutigen]

Apparently Steam games are favourite attack vector of NSA, they love exploiting Steam games on sysadmin machines.

https://www.wired.com/2016/01/nsa-hacker-chief-explains-how-...

[AimHere]

Okay, nitpick time. Your story about the game is surely wrong. Rollercoaster Tycoon was developed for Windows 95/98.

Perhaps you meant it's a later version of Windows, or the game's spiritual predecessor, Theme Park, which ran in DOS.

[mschuster91]

> * Can anyone set their team ID to blizzard's?

No, at least not for apps that are distributed on the official channels and signed with an official developer cert.

> * Are blizzard games attack vectors?

All games are, savegame manipulation is often the first step towards jailbreaking a game console.

[Negative1]

Interesting point. Never heard of any program impersonating 'Warden' for malicious purposes but it seems possible.

[mikeash]

It could be that this was done for Blizzard's iOS games, and OS X just happens to share the code.

[no_news_is]

I remember that backward compatibility story, but when I search for it I keep finding this post. :)

[pcwalton]

There are a lot of checks for specific apps in the Cocoa framework. It's pretty much what the undocumented CFExecutableLinkedOnOrAfter() is for (sometimes called in conjunction with a check for a specific bundle name).

[afandian]

Do you have examples?

[BakaRakuda]

Nobody saw this yet?

https://mobile.twitter.com/gruber/status/738149554978070529

Turns out a complete non-story.

[coldtea]

Non-story? This just confirms that Blizzard indeed got an exception.

The reason doesn't make it a "non-story" in any way.

Nobody sane expected the reason to be anything besides something like that (e.g. some evil root access plan) -- and it's still a story.

[neallindsay]

Someone should change the title on the HN story - it's just straight-up false.

[coldcode]

When I worked at Apple before Steve came back there were tons of checks in MacOS for particular versions of apps, especially for Microsoft Word and Excel, working around their buggy behavior (or their workarounds for Apple's buggy behavior, a vicious cycle). While I have no idea if this person knows anything it would not be surprising.

[coldpie]

Yeah. We port Windows applications to Mac at work. A couple years ago when Apple switched on a more stringent code signing requirement, we found many of our ports worked without the updated code signing, while some others would warn about an invalid signature. It was clear there was some internal whitelist for old, known signatures which had picked up many, but not all, of our ports. User friendly, I guess, but pretty ugly.

[frou_dh]

In Safari under Develop in the menu bar there's an item "Disable Site-specific Hacks"

[mikeash]

Horribly misleading title here. Blizzard is exempt from one tiny piece of the sandbox, namely the sandboxing around access(). Which is nearly irrelevant.

[protomyth]

Why does Blizzard need an exception while the rest of us have to deal with it as is? Exceptions to rules mean the rules are broken.

[sprayk]

Hearthstone is used for competitive play on iOS devices regularly. Would this exemption let them employ some anti-cheating functionality?

[unlinker]

This guy published an app that did jailbreak detection and some other stuff on the App Store, it was taken down, and has been rambling since then in a very very childish way about stuff like this: https://twitter.com/i0n1c/status/738286205708738560

Truth is--he knew what was going to happen, so this looks just like another excuse to rant.

[Longhanks]

He is known in the jailbreak scene as someone who cannot stay serious - he's always involved in some kind of drama.

If I recall correctly, the pangu dev team attended some of his sessions about iOS hacking and used this knowledge to create a publicly available jailbreak tool. He then started to rant about how they "stole" his technologies on twitter (see for example https://twitter.com/i0n1c/status/481020166483238912).

More about his childish public behavior related to the jailbreak scene can be read here: http://www.iclarified.com/41983/pangu-jailbreak-stops-using-...

[medecau]

Truth is your comment is ad hominem. ;)