Welcome
Security researchers Dan Caselden and Gabriel Landau at Independent Security Evaluators
recently uncovered two security vulnerabilities present in the popular new and
entertaining online game, Age of Conan, produced by Funcom. It was then determined
that the game's equally engrossing predecessor, Anarchy Online, contains the same
two vulnerabilities. These vulnerabilities allow an attacker to read arbitrary files
off of a victim's computer, crash the games during online play, and in the case of
Anarchy Online, fully compromise a victim's machine giving the attacker full control
of the targeted computer.
Consequences
The directory traversal vulnerability found in both Age of Conan and Anarchy online
allows the reading of arbitrary files off of a victim's computer. Specifically,
ASCII-based files (and even then only the first few lines) are readable by way of
this vulnerability. While this is not an end-all method for stealing files from
another computer, it provides a dangerous and unnecessary avenue for obtaining
personal or financial information through well crafted and easily executed attacks.
The obviously more severe vulnerability in Anarchy Online allows an attacker to fully
control the victim's computer. This can lead to loss of personal information,
passwords, account information, and could result in the victim's computer being
further used in attacks against other computers. In our demonstration, the victim's
user name and password for Anarchy Online are sent to the attacker, allowing them
full access to the victim's account. Characters, items, gold and even full accounts
are frequently sold online for real money, making these sorts of attacks through
online games directly profitable for attackers.
This is not ISE's first demonstration of how online games can be exploited for
profit. See Charlie Miller's work with Second Life.
How the Exploit Works
The directory traversal and arbitrary file reading exploit is simply done by creating
a hyperlink during online game play, which when clicked by a victim causes that
victim to "speak" the contents of a file, making it available to any players within
a short virtual distance of the victim.
The full compromise of a victim playing Anarchy Online is a two-step process. First,
the victim clicks an in-game link that opens up a web browser to the attacker's web
page containing seemingly innocuous content. The web page silently writes a cookie
to the victim's computer containing the actual attack payload. The victim then
clicks on a second in-game link that executes the downloaded cookie as a game
script. This cookie has been specially crafted to overflow a buffer in Anarchy
Online's script processing engine and overwrites the stack with the attacker's own
executable code.
