Admin consoles: the soft underbelly of billion dollar software operations since...
Seriously, though: you almost certainly have one if you run a software business. Client side SSH certificates are your friend. If you're not able to do that, because it is really annoying, separate it from the main app and lock it down as much as possible. (Separate authentication from the main site/app's authentication scheme. Lock down access, ideally at the network level. Strongly consider two-factor auth.)
There are a few scenarios in which client-side certificates just aren't good enough by themselves.
So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything.
* But maybe it won't even show up in the logs. Maybe he was editing a file in sudo with vi and ran ":! bash". Okay, so you're a good admin and disabled that.
* Maybe he was editing crontab one day and added a one-shot script to create a nefarious account. Okay, you are a good admin and you have tripwires.
* Maybe he knows where your tripwires are. Do you honestly think you know every possible attack vector someone with legitimate sudo access could use?
It's really hard to stop an inside job. The principle of least privilege is a nice maxim, but there's a cost to figuring out exactly what the least privilege is, and there's a cost to giving someone too little privilege -- downtime when they can't fix something they're supposed to fix.
It's just speculation that someone used GM powers to do this. Most likely they tracked down a boss mass wipe ability (i.e. kills all players within 30 yards) that was incorrectly flagged as useable by players. You can then write an AddOn that uses CastSpellByID() to give you that ability.
The GM interface requires a special build of the WoW client, a specially flagged account, and a two factor auth token to login. It's pretty hard to emulate the client as opcodes are randomly shuffled based on the hash of the binary itself.
Blizzard does use client side SSH certificates according to a dev at BlizCon 2 I think. If I had to hazard a guess, I'd guess that someone laid off in [1] took some of the family jewels with them which enabled [2] and ultimately this as well.
Take a look at Authy for a reasonably easy way to add two-factor auth to your normal SSH login. It's intended for website authentication, but there is a Github project for adding it to sshd.
Good advice, but I think you're underestimating the sort of attackers going after WoW. It's not going to be some drive-by script kiddies looking for an easy target... it's people specifically targeting this game. I'd be more worried about spearphishing and social engineering.
FWIW, we used client certificates for the Beijing Olympics ticketing system. I have to admit they were a giant pain in the ass, but I still have to image they saved us more pain than they created.
I think that there's something kind of fascinating and romantic about the idea that an entire world and the ongoing social affairs of thousands of people can fit on a single server blade in the middle of nowhere.
That's what makes EVE so much more interesting to me. There's only one server. The monthly fee can be earned in-game. The economy is tied to actual dollars because it's so reliable. There have been plenty of universe-spanning conflicts that impact the entire game with genuine political drama, and the dev team steps back to let it unfold with minimal intervention.
this isn't the first time Blizzard have messed up like this: they originally set the "Game Master" access level by a bit transmitted client side, and the same socket bit twiddling could be used to get into their private alpha servers...
It's interesting to comprehend the amount of lives a hack like this will positively affect.
How many will pick up a book, or go for a walk, now that they no longer have their go-to fix of virtual reality. How many WOW addicts will have time to think "never again" and follow through.
Equivalent to all the cigarettes in the world vanishing for a few hours? Possibly. And equally as effective I say.
Chuckle. How many of those will go out and rob a liquor store? How many will perform an act of vandalism? How many will kill themselves because they are cut off from the only friends they've ever known?
While I can emphasize a bit (I used to play WoW, but "grew away from it" and now spend a large portion of my time in search and rescue and musical performance), I have to say that this is a very judgmental POV to take. You're seriously going to compare playing WoW to smoking? Even in the worst case, at least playing WoW is a step up from watching some inane TV show with no interaction. It's not like anybody suffers from second-hand MMORPG.
And you can always play moral superior: instead of reading a book, why don't they start their own company? Instead of going for a walk, why don't they run a marathon? Hell, I could see how someone could look down on the activities I choose ("why rescue idiots who got themselves into trouble? Let natural selection sort it out!" or "why perform music that's already been performed thousands of times before by better performers?"), but FFS, sometimes "wasting time" is some of the best time well spent.
I prefer to run, and I sustain an average of 8 minutes per mile in 5ks so I'm not an unfit slob. I don't run marathons though, I just run and swim for fun and exercise's sake.
I do all of this because it's fabulous stress relief, it's a great time-filler when I don't have the space/time to work (e.g. cooking/restaurants, boarding flights, random 5 minutes at places, right before bed), and WoW in particular enables me to spend time with friends no matter where they're located. I can do this in the first place because I don't do things many people do such as watching TV.
It's funny how people are incredibly judgmental about WoW but they find it incredibly impressive I read a lot of books and sustain reasonable times in runs. I find more rational reasons to play WoW (reasonably, that is, and not by ignoring people to do so) than to read. They're both hobbies. Take anything to an extreme and it's bad. But WoW overall is not as bad as the one off horror story you'll read about about parents ignoring their kids to raid.
If I remember right, there was a post on HN here a while ago about how there's a dot pattern embedded in all WoW screenshots, so they can identify who the user is even if they remove the character name from the screen.
If they have the account information on this, I have to wonder if they could actually sue someone (instead of just banning them) for using this hack?
Those screenshots are probably the victims', anyway. While Blizzard probably does have enough logging to track this down on their end, it's fairly easy to get a trial account with bogus account information, so it would be back to grabbing their IP addresses and pleading with some ISP to reveal their real identity.
Interesting, if that is in fact related to this incident it suggests that they got a copy of the Game Master(GM) private key, they are activating GM only 'features' of the game. In this case the 'kill all' aura, another feature is to imbue your weapons/armor with arbitrary stats. Saw a character doing that in 2008 or so.
Just to clarify, death in WoW is something that happens all the time. It's very unlikely that it causes anyone more than a minute worth of inconvenience in this case, and certainly less than it would to take the servers down to apply a backup.
I am... very impressed. This is some pretty bad news for the current king of MMOs. I wonder if someone finally stole a GM's account or if this is a live hack. I'm more inclined to believe someone just made off with an account but hey crazier hacks have happened.
It looks like there were some videos posted from the point of view of the hackers. Doesn't Blizzard put watermarks in each of the clients? They can track it to the licenses which people bought, and probably to the people themselves, no?
[+] [-] patio11|13 years ago|reply
Seriously, though: you almost certainly have one if you run a software business. Client side SSH certificates are your friend. If you're not able to do that, because it is really annoying, separate it from the main app and lock it down as much as possible. (Separate authentication from the main site/app's authentication scheme. Lock down access, ideally at the network level. Strongly consider two-factor auth.)
[+] [-] klodolph|13 years ago|reply
So you have folks administering the servers. A certain percentage of them need root access. One of them gets his certificate revoked and then laid off -- in that order -- but he already installed a back door account. Okay, so you're a good admin and you check the logs and make everyone use "sudo" for everything.
* But maybe it won't even show up in the logs. Maybe he was editing a file in sudo with vi and ran ":! bash". Okay, so you're a good admin and disabled that.
* Maybe he was editing crontab one day and added a one-shot script to create a nefarious account. Okay, you are a good admin and you have tripwires.
* Maybe he knows where your tripwires are. Do you honestly think you know every possible attack vector someone with legitimate sudo access could use?
It's really hard to stop an inside job. The principle of least privilege is a nice maxim, but there's a cost to figuring out exactly what the least privilege is, and there's a cost to giving someone too little privilege -- downtime when they can't fix something they're supposed to fix.
[+] [-] dsl|13 years ago|reply
The GM interface requires a special build of the WoW client, a specially flagged account, and a two factor auth token to login. It's pretty hard to emulate the client as opcodes are randomly shuffled based on the hash of the binary itself.
[+] [-] ChuckMcM|13 years ago|reply
[1] http://massively.joystiq.com/2012/02/29/blizzard-announces-l...
[2] http://kotaku.com/5933454/blizzard-network-breached-change-y...
[+] [-] trafficlight|13 years ago|reply
https://www.authy.com/
https://github.com/authy/authy-ssh
[+] [-] eli|13 years ago|reply
[+] [-] spindritf|13 years ago|reply
What are those? We're talking key-based ssh authentication? Or something else?
[+] [-] TazeTSchnitzel|13 years ago|reply
Of note, if you do use a client-side SSH cert, disable username and password auth.
[+] [-] wdr1|13 years ago|reply
[+] [-] jpxxx|13 years ago|reply
[+] [-] bsphil|13 years ago|reply
[+] [-] Alex3917|13 years ago|reply
[+] [-] jiggy2011|13 years ago|reply
In MMO terminology "server" seems to refer to a single self contained game world.
[+] [-] aesopiate|13 years ago|reply
[+] [-] brown9-2|13 years ago|reply
[+] [-] blibble|13 years ago|reply
http://www.ownedcore.com/forums/world-of-warcraft/world-of-w...
this isn't the first time Blizzard have messed up like this: they originally set the "Game Master" access level by a bit transmitted client side, and the same socket bit twiddling could be used to get into their private alpha servers...
[+] [-] Ogre|13 years ago|reply
Could be a similar sort of thing, or it could be a hack.
[+] [-] niggler|13 years ago|reply
[+] [-] ihsw|13 years ago|reply
[+] [-] brador|13 years ago|reply
How many will pick up a book, or go for a walk, now that they no longer have their go-to fix of virtual reality. How many WOW addicts will have time to think "never again" and follow through.
Equivalent to all the cigarettes in the world vanishing for a few hours? Possibly. And equally as effective I say.
[+] [-] npsimons|13 years ago|reply
While I can emphasize a bit (I used to play WoW, but "grew away from it" and now spend a large portion of my time in search and rescue and musical performance), I have to say that this is a very judgmental POV to take. You're seriously going to compare playing WoW to smoking? Even in the worst case, at least playing WoW is a step up from watching some inane TV show with no interaction. It's not like anybody suffers from second-hand MMORPG.
And you can always play moral superior: instead of reading a book, why don't they start their own company? Instead of going for a walk, why don't they run a marathon? Hell, I could see how someone could look down on the activities I choose ("why rescue idiots who got themselves into trouble? Let natural selection sort it out!" or "why perform music that's already been performed thousands of times before by better performers?"), but FFS, sometimes "wasting time" is some of the best time well spent.
[+] [-] silencio|13 years ago|reply
http://us.battle.net/wow/en/character/nordrassil/Spink/advan... is my main WoW toon (already level capped for the current just-released expansion and raiding), with weeks of /played time.
http://www.goodreads.com/review/stats/2444699-jane is the last couple of years worth of books I've read. How many people do you know read 50+ books a year?
I prefer to run, and I sustain an average of 8 minutes per mile in 5ks so I'm not an unfit slob. I don't run marathons though, I just run and swim for fun and exercise's sake.
I do all of this because it's fabulous stress relief, it's a great time-filler when I don't have the space/time to work (e.g. cooking/restaurants, boarding flights, random 5 minutes at places, right before bed), and WoW in particular enables me to spend time with friends no matter where they're located. I can do this in the first place because I don't do things many people do such as watching TV.
It's funny how people are incredibly judgmental about WoW but they find it incredibly impressive I read a lot of books and sustain reasonable times in runs. I find more rational reasons to play WoW (reasonably, that is, and not by ignoring people to do so) than to read. They're both hobbies. Take anything to an extreme and it's bad. But WoW overall is not as bad as the one off horror story you'll read about about parents ignoring their kids to raid.
[+] [-] njharman|13 years ago|reply
Statistically, Zero. Trust me, they are all madly typing on forums, mashing refresh, trying to find out / talking about what happened.
> How many WOW addicts will have time to think "never again" and follow through.
A few.
[+] [-] tomjen3|13 years ago|reply
Who the fuck are you to tell people how they get their enjoyment out of life?
[+] [-] negamax|13 years ago|reply
Mayans knew this.
[+] [-] bravoyankee|13 years ago|reply
[+] [-] tibbon|13 years ago|reply
If they have the account information on this, I have to wonder if they could actually sue someone (instead of just banning them) for using this hack?
[+] [-] ben0x539|13 years ago|reply
[+] [-] adrianpike|13 years ago|reply
[+] [-] Havoc|13 years ago|reply
[+] [-] VMG|13 years ago|reply
[+] [-] sespindola|13 years ago|reply
As some of the MMORPGs have multi-million dollar economies, they'll need to increase their PCI level compliance.
This reminds me of Charlie Stross's Halting State[1].
1: http://en.wikipedia.org/wiki/Halting_State
[+] [-] beedogs|13 years ago|reply
I hate this kind of crap.
[+] [-] mtgx|13 years ago|reply
[+] [-] fchollet|13 years ago|reply
Nothing too impressive to this "hack"...
[+] [-] ChuckMcM|13 years ago|reply
No doubt this is related to this problem :http://kotaku.com/5933454/blizzard-network-breached-change-y...
[+] [-] djbender|13 years ago|reply
[+] [-] unknown|13 years ago|reply
[deleted]
[+] [-] lazyjones|13 years ago|reply
[+] [-] sonnyhe2002|13 years ago|reply
[+] [-] lutusp|13 years ago|reply
1. Wait -- was I just teleported into my favorite South Park episode?
2. I can't wait to see the civil lawsuits for psychological injury against the perpetrator of this outrage.
3. Don't these people do nightly backups? It's not as though WOW isn't an important cybernetic resource meriting industry best practices.
[+] [-] ben0x539|13 years ago|reply
[+] [-] unknown|13 years ago|reply
[deleted]
[+] [-] Evbn|13 years ago|reply
[+] [-] flexxaeon|13 years ago|reply
This is kinda funny.
[+] [-] theevocater|13 years ago|reply
[+] [-] EGreg|13 years ago|reply
[+] [-] sbarre|13 years ago|reply
WoW forums appears to be down too..
[+] [-] podperson|13 years ago|reply