Unreal Security Hole

Screaming Lunatic writes "There seems to be a big security hole in the Unreal engine that has been around for about 5 years. It affects servers for a number of games and operating systems, including Linux (which accounts for about 40% of UT2003 servers). Epic has been working on a patch for about 3 months. Imagine the bad publicity games would receive if a worm on the scale of Slammer had been created." A Bugtraq post from Thor Larholm of Pivx, says that Marc Rein of Epic threatened PivX with "getting our lawyers involved with this"; the TechTV article Larholm cites (the same one linked from this submission), however, contains no mention of legal action. Rein nonetheless apologized for "those completely unfortunate comments" in a followup message to Bugtraq.

Comments

Uh oh...

[Electrode]

So, how long until we see the "Monster Kill" virus begin to make the rounds?

Re:Uh oh...

[Anonymous Coward]

SEE!! I told you I was lagging!! I'm not a newb!! HAHAH I now have proof!

++AC

Re:Uh oh...

[ubugly2]

I believe it's M-M-M-Monster Kill

Links

[prothid]

More at bluesnews.

Re:Links

[prothid]

Here too.

Re:Links

[Zeinfeld]

More [bluesnews.com] at bluesnews.

I heard of Blues Clues, but Blue's news?

To play Blues News you have to find a bug
Stick it in your notebook and describe the hole you've dug
Find another pawprint, thats the second bug
Stick it in your notebook and go catch the cyber-thug
Find the last pawprint, thats the third bug
Stick it in your notebook, get your coffee mug
Sit down in the thinking chair and think, think think.
Cos when we use our minds take a step at a time you can dooo anything, and on billable hours too.

Re:Links

[Zeinfeld]

Yes, yes, mod me down, I'm offtopic, but it almost causes me physical pain to see someone get credit for a joke that was already made.

Perhaps if you did not spend your life in front of a computer screen eating soggy potato chips and warm cans of coke and had actually sung the song and danced around instead you might not write posts like Oscar The Grouch.

Re:Links

[Qrlx]

You are so right. What's so wrong with posting that little song here and getting a +5? it's +5 funny, not +5 original geek humor material that's funny. sheesh.

Re:Links

[Zeinfeld]

What's so wrong with posting that little song here and getting a +5? it's +5 funny, not +5 original geek humor material that's funny. sheesh.

It was original geek humor.

Blues Clues is written for my two year old. My version of the song was somewhat different.

Re:Links

[cicatrix1]

Um, it's not a reference to that show at all. It has been around since around the time of the original Quake's birth.. primarily as a Quake news site. It has since blossomed into an excellent overall gaming news site with probably the most intelligent gaming discussions you'll find on the Internet.

Re:Links

[IvyMike]

Seriously, you actually sang the song and danced around? If that's what it takes to get into the "up-with-people" club I guess I would rather eat the soggy potato chips and drink the warm cans of Coke than admit to that fact. Hell, I'd even rather drink warm cans of Sam's Club Diet Cola, and that stuff tastes like ass even when chilled.

I'm half tempted to try to post something that points out that your name is sort of like "Seinfeld"....

Did you know your name is sort of like Seinfeld? But with a "Z"? When you called me a grouch, didn't you really mean "zoup nazi?" Zlashdot's sort of like a site about nothing, isn't it. Not that there's anything wrong with that.

...but that would be totally obvious.

Re:Links

[patter]

It has since blossomed into an excellent overall gaming news site with probably the most intelligent gaming discussions you'll find on the Internet.

Sometimes ;). If it's about anything that's based off Halflife, it's generally about as intelligent as the post five or so up making fun of 'gamerspeak' ;P

Re:Links

[Zeinfeld]

Seriously, you actually sang the song and danced around?

No, I am following the example of the Bush Whitehouse, telling people to act as I say, not as I do.

I'm half tempted to try to post something that points out that your name is sort of like "Seinfeld"....

Oh I get it, smoketoomuch, so you better cut down a bit.

Anyway, have to go, my two year old is having problems with his Linux partition. I think he might have just deleted vmunix from the root directory.

wow

[The Other White Boy]

and here i thought ut2k3 was just really good at killing time. does this mean we can all go up on terrorism charges now since we've used a device capable of bringing down network systems? =)

Re:wow

[TheLink]

"and here i thought ut2k3 was just really good at killing time"

Yah time.com too. ;)

What If.....

[Snagle]

What If It Does Get Hit By A Worm Like Slammer? I'd have UT2003 withdrawls like a crackhead in rehab. Hurry up and patch it! But seriously, a hole thats been open for 5 years and just now been discovered and working on patching? C'mon Epic your not microsoft.

Yadda

[Anonymous Coward]

The flaw in a netshell is that if you have autodownload turned on, you don't know what you might get.

Well no shit.

So, there may be code in a level you get from a server. Whoopde doo, Basil. Do you autodownload and install browser plugins?

It's just a flaw in the complete system of downloading maps from untrusted servers. Turn AD off, get your maps from an archive you trust.

Re:Yadda

[mrpuffypants]

I find that a lot of people usually turn that bugger of autodownload off.

The problem is that Unreal, Quake, etc. aren't that efficient at sending big files when you have to "autodownload" a level. Effectively this slows down the connection for the server and makes the client have to sit at their coomputer for a long time and wait for a new map to download. Usually by the time that map has downloaded you've missed that whole round and end up downloading a brand new map again.

It's a lot easier to download stuff from Fileplanet (ick...waiting in line for a file) or elsewhere: it's faster and easier in the long run

Re:Yadda

[Sycraft-fu]

Actually, UT has a nifty solution for that. A server can redirect someone to a webserver that conatins compressed files. Now since it's a webserver, it download at the max rate of your internet connection, much faster than the stream from the server. Also the compression is pretty much 50% or better on all files. So it really doesn't take long. UT tehn decompressess and gets them ready for you.

Re:Yadda

[mrpuffypants]

Damn, that's cool. I wish Quake 3 did that.

Re:Yadda

[Qrlx]

It may not have made any sense, but that's the truth.

I play a lot of Return to Castle Wolfenstein, and every time I try to download some new map from a server hosting that map, it CRAWLS at like 2k/sec. This is on a attbi.com cable modem where I just downloaded mozilla 1.21 at 120 KB/sec.

For some reason, the server just won't open a fat pipe to you so you can download one map that everybody else has. It's probably a feature more than a bug. And the thing in Unreal Tournament 2k3 is an even better feature. I was playing this game at a friend's house and I went to some server with a map he didn't have -- lo and behold it connected me to some ftp site and I had the thing in seconds. The same thing would have taken at least 5 minutes in RtCW.

I guess the downside is -- who know's whats REALLY on that FTP site (or server hosting the map in the first place)?? Well, use antivirus, don't be an idiot, back up important stuff on a floppy. If a bug in UT2k3 is what makes you do this stuff, then you are very very lucky that this is the worst brush with disaster you've had.

Oh, and you're probably a n00b, too!

Re:Yadda

[Splab]

You are limited by the assigned rate from the server (and your self) which means you most likely are getting it down at around 4-5 kb/s (thats bytes) (in cs anyways, dont know how the lesser games handles stuff).. HTTP transfers however are running on std. stuff so youll get as much bandwith theres left on the line (or whatever some geek might be shaping you down to).

Re:Yadda

[Cirvam]

Game's tend to use UDP, not the most efficent way of transfering files. Webservers tend (haven't seen a udp based one yet) to use TCP, which is a bit more efficent. So in sheer efficency downloading from a webserver its faster then the game server. Plus as others have mentioned you usually have limits on the bandwidth usage on both the client and server side.

Re:Yadda

[doorbot.com]

I play a lot of Return to Castle Wolfenstein, and every time I try to download some new map from a server hosting that map, it CRAWLS at like 2k/sec. This is on a attbi.com cable modem where I just downloaded mozilla 1.21 at 120 KB/sec.

Most modern game servers allow the server admin to adjust your connection speed (potentially overriding the client's requested download speed -- what you set when you select "DSL" as your connection type).

On Unreal-based games the option is called "MaxClientRate" or somesuch, and would have a value such as "20000" for 20 Kbytes per second. It doesn't matter if you're fat pipe is 45 Megabits/sec; the server will limit you to reserve bandwidth for others. On Unreal Tournament, I was able to get away with 6 players on my server with a client rate of about 3000 (3 Kbytes per second) on a 12 Kbytes/sec DSL line. Pings were around what you'd get if you connected via modem.

Now, UT added a feature for the mapfile/mod/etc download as mentioned above. As I recall there was an additional rate limiter for this. It defaulted to the MaxClientRate, but could be set to another value. The server is limiting your bandwidth so the other players do not suffer.

My guess is RTCW has similar functionality.

Now, it'd probably be smarter to have a "MaxAggregateBandwidth" setting and set that to a bit below the upload speed of the DSL/Cable/etc. Then allow you, with your fat pipe, to use up any and all extra bandwidth, after all other needs are met.

Re:Yadda

[FuriousBroccoli]

Do some research before you post some garbage like this. You can only download UnrealScript bytecode and map/texture files from the autodownload, each of which are impossible to infest with anything malicious or DDOS related.

Re:Yadda

[FuriousBroccoli]

To clarify, from the security bulletin: "The only limit for an attacker is that hacked package files cannot be distributed via UCC servers and then sent to the client because, naturally, the server will crash when it reads them. 8-) (furthermore you cannot use first the original package file and then replace it with the hacked file because your server will refuses to send the map to the client, but I don't know why...)."

Re:Yadda

[Sycraft-fu]

The way that the UT server, and other servers, work is that they transmit data toa client at a fixed rate. The game has a maximum allowable rate, 20000 bytes/second/client in UT. The server operator may then cap that rate lower, many cap it to 10000 bytes/second or less. The clent then can ask for (and will recieve) a lesser rate. Now this rate applies not only to in game play, but to file transfers as well.

Now, UT's solution for file transfers is to allow webserver redirection. It can be a webserver on the same host, but doesn't have to be. In fact, it is often better if it isn't. A T1 line is sufficient to serve up a deceantly sized game provided client rates are clamped to 5000-10000, but that leaves litte exra bandwidth for downloads. Redirecting to a public server that has the files and more bandwidth is a better solution.

The compression is Unreal specific, it does not use any kind of compression simply because the game must have teh aility to decompress teh files to do any good. They developed a compression that work very well on their file formats. The game will download the compressed file, and tehn automatically decompress and use it.

I am not here to argue with you how you think it SHOULD be, I am telling you how it is. The fact of the matter is that if UT streams the files through the connection to teh client, they are uncompressed and stream at the client's requested data rate, or teh server's maximum rate, whichever is less. If you desire faster transfers and/or compressed files you MUST redirect to a webserver.

Watch out!

[Joe the Lesser]

Slammer_Worm is on a killing spree!
Slammer_Worm is on rampage!
Slammer_Worm is dominating!
Slammer_Worm is unstoppable!
Slammer_Worm is Godlike!!!

Re:Watch out!

[Student_Tech]

hmm, like the Doom for sysadmins, kill of processes, or the BOFH version of Doom were if you got killed your machine hung.

Re:Watch out!

[Jack William Bell]

Heh! I laughed out loud at that one! I have mod points too, but you were already maxed.

Re:Watch out!

[shamilton]

Slammer_Worm is WICKED SICK!!!!!!

sh

PS. damn lameness filter.

Let's not overreact here...

[I'm a racist.]

Lots of software has security holes. Games are no different... the difference with games is that they are not targets. It's interesting that this one was spotted, but it's no real surprise.

The poster mentions Slammer. The difference between Slammer and this is that Slammer affected "mission critical" systems, and there are pretty easily demonstratable monetary losses attributed to that worm.

In the case of Unreal, there are not many (if any) businesses (or lives) depending on this software. Hypothetically, someone who hosts games for a fee would get some complaints from customers. But really, a lot of the people affected would be "home users". And, let's face it, home users (including those running Linux) are really vulnerable to all kinds of attacks. This is just a drop in the bucket...

Of course, it'd still suck to get fucked over by this security flaw (just like all the others).

Re:Let's not overreact here...

[Screaming Lunatic]

I agree, UT2K3 is not mission critical. I was trying to draw similarities.

The hole can be used to launch a DDOS attack. Over the last 5 years, there have been tons of games built on the Unreal engine. I haven't seen specific numbers, but the number of Unreal servers and the number of SQLServers out there in the wild is probably comparable. University students running Unreal servers have big pipes.

Games use UDP extensively. Slammer used UDP.

There are about 15 different games that need patching. How many of those servers will get patched after it is released? There was a patch for Slammer before it hit.

Re:Let's not overreact here...

[Atomizer]

Yeah, just think the Unreal worm hits, and suddenly office productivity increases all over the world.

Re:Let's not overreact here...

[Splab]

Uhm.. you guys are waaaaaaaay off here. You're all taking a look at it in a political / our medical db is important nuf to be nuked...
There are 2 kinds of people (doing that stuff)
1. The true hackers/phreakers/whatever they are called - They write programs to show off and put light on a big issue.
2. Script kiddies - They are the ones who just copies off what those from the 1. group did and are those who once in a while knocks big systems down.
The reason why game servers doesnt get knocked down so often (once in a while someone drops off a few) is its usually script kiddies doing havoc - And when they are bored doing drag n drooling in that shiney i-face those from the first group made they'll go back to gaming. At least they'd figured out that knocking over something they are going to use isn't all that smart...
By the way - Shouldnt people be looking into why the slammer was realeased in stead of just saying "Yeah Im an ultra cool sysadmin I figured out ALLL LLL by me self to close that port". It had no payload, no real use - and in fact 2 bugs afaik. How many of you out there has started an investigation to how the fuck that little sucker got on your network in the first place? Any of you actually went over your "trusted" sites and thought of fixing holes? I think the slammer was an experiment that accidentically got released before it was done.

Re:Let's not overreact here...

[Lord Ender]

"There are about 15 different games that need patching. How many of those servers will get patched after it is released? There was a patch for Slammer before it hit."

I would guess that all of the games get patched. Unlike databases, games are not compatible between versions. When game patches come out, nobody can play unless they have the same patch level. This forces everyone to upgrade or not play.

Re:Let's not overreact here...

[drinkypoo]

This is not always true, though it USUALLY is. What is more important is that each of these companies is using a customized version of the engine, and often those customizations are in the engine itself, not just some add-on DLL like it should be done, so the engine (or an engine component) cannot simply be updated by Epic and have it end up everywhere; the fix will doubtless have to be incorporated into some of those licensed engines differently.

Re:Let's not overreact here...

[sfe_software]

...and often those customizations are in the engine itself, not just some add-on DLL like it should be done, so the engine (or an engine component) cannot simply be updated by Epic and have it end up everywhere

There's often good reason for this. Many times there are customisations that couldn't easily or efficiently be done by just 'adding a DLL' to the Unreal (or whatever) engine. Actually modifying the code to do what you need is quite often faster than adding a plugin-style hook in the form of a DLL in some pre-determined place that the engine designers designated. And with games, every little speed gain counts...

Games are, inherently, vulnerable to this type of attack. It's difficult to stop this without it having been a concern at design time... if you don't design with security in mind, it's very difficult to bolt it on later. Games usually concentrate on frame-rate, features, polygons-per-second or whatever other things will help the game to sell. I doubt that "secure" is a feature that pushes many gamers to purchase one game over another, so naturally (by the way the market works) security is not of top priority in the games that sell.

Re:Let's not overreact here...

[Clovert Agent]

That's a rather naive line of thinking. Slammer did _collateral_ damage - ATMs knocked offline, 911 call centers affected, MS authentication servers downed - not because they were infected SQL servers, but becaused their networks were DDOSed by the packet flood of other infected hosts.

The same packet flood coming from ANYWHERE would have the same effect. The issue is the number of vulnerable hosts out there. If the number is high enough, the danger is real.

Re:Let's not overreact here...

[cowbutt]

In the case of Unreal, there are not many (if any) businesses (or lives) depending on this software.

That may be the case, but how many employees run the clients on their employers' networks? Quite a few, I'd wager. Each of those clients is a potential entry point for an intruder to exploit and do who-knows-what.

Expect to see security officers/network admins clamping down harshly on folks running "unapproved" applications, such as games. Yes, even on the techies. I've been suspicious of multi-player network games for some time, and this event confirms my concerns.

My only hope is that the blackhat community haven't been aware of this for the year or more that some security researchers have been. I'm not optimistic though. This also demonstrates why full disclosure is important - if those security researchers had disclosed when they found out, people could have abandoned Unreal-based games until a fix was released, as opposed to continuing to run dangerous client software and leaving themselves exposed without even knowing it.

--

Re:Let's not overreact here...

[karlm]

Yes, there was a July patch against Slammer/Saphire, but there was a patch released in October that re-introduced the vulnerability (Schneier goes into detail about it). You had to be neither too diligent nor too lacking in dilligence in order to avoid Slammer/Saphire. Patching at the enterprise level is also quite a different thing. MS also has a very bad reputation for patchs that break things. (A big sign of design flaws rather than implementation flaws.)

, does UT usually run as root/in the System security context?

Re:Let's not overreact here...

[Zathrus]

I would guess that all of the games get patched. Unlike databases, games are not compatible between versions

Uh... wrong on both counts.

I have my UT2k3 patched to the current level, but I can still play on original, unpatched servers -- although I doubt any client running the original code can connect to a patched server. The UT2k3 team seems to be better about this than id Software and Q3, where if you don't have the same patch level as the server, well, too damn bad.

Databases often require the same -- in Oracle there is a COMPATABILITY parameter in the init files. You can set it to various versions to ensure compatability to an old version of the client or ODBC drivers. Set it to a higher version though, and the old clients won't connect.

Bugtrak Post

[Anonymous Coward]

A.C.K.W PoStErS

On February 5th, Luigi Auriemma of PivX Solutions released a tightly packed
advisory detailing multiple vulnerabilities in the Unreal network gaming
engine developed by Epic Games. These vulnerabilities affect both clients
and servers who are playing the plethora of games that are using the engine,
and has been readily exploitable for 5 years.

The press release:
http://www.pivx.com/press_releases/ueng- adv_pr.htm l

The advisory itself:
http://www.pivx.com/luigi/adv/ueng-adv.tx t

Following both industry and personal standards, PivX gave Epic Games a
duration of 30 days to (at the very least) respond to our private
notification to them. After nothing had happened during that month we
prepared to release the advisory, yet once the press asked Epic Games for
comments they were suddenly very responsive. Promises to work closely with
us on the vulnerability and advisory were made and we managed to hold down
the press for several months after this. 60 days passed after this, without
any collaberation, honest effort or actual contact from Epic Games.

We released the advisory after 90 days had passed from the original vendor
notification. 90 days, in which we were played like fools, in which Epic
Games had ample time and sufficient opportunity to react and work with us on
a coordinated release. 90 days in which Epic Games, from the best of our
comprehension, had archived our communications in the thrash, during which
we received no serious communication except for crisis handling at the
originally planned release time.

On February 6th, BluesNews (among many others) could cite a quote from Mark
Rein, Epic Games Vice President:

"I won't sugar coat this. We f***ed up on this. Yes this is real and yes
this was brought to our attention and yes we should have fixed it by now."
http://www.bluesnews.com/cgi-bin/board.pl?a ction=v iewthread&threadid=39954

On February 11th the tides have changed, and TechTV are reporting public
legal threats from that same person:

"This is slanderous," he says. "They've taken this too far. We're getting
our lawyers involved with this."
http://www.techtv.com/news/security/story/ 0,24195, 3417248,00.html

I fail to see how Mark Rein on one hand can publicly announce this to be a
real threat that they should have fixed earlier, and on the other hand can
announce the advisory to be false and malicious statements. There is no
slander or libel in any aspect of this, and the only imaginable outcome that
Mark Rein must have been aiming for by his declaration of layer involvement
is to silence future security research on Epic Games products through the
promise of unfounded barratry. As we know from precedents in the past, this
approach to security is counterproductive at best and encouraging for
underground security research at worst, and I can only hope for an official
retraction of this policy by Epic Games once other employees have had half a
minute to think about the implications and example that Mark Rein is setting
forth.

In the past, I have received better nonresponsive treatment by Microsoft
when their security handling was at its worst. Contrary to the vast
improvements that Microsoft has gone through over the last year and a half,
Epic Games did not even start to acknowledge the problem properly before a
full public disclosure had been made on February 5th.

I believe that Luigi, and all of PivX, has handled this issue in a
courteous, proffessional and ethical manner, and the uncoordinated release
that was its outcome stems from a direct result of a nonresponsive vendor
that at best is plainly ignorant and at worst acts directly against the best
interest and security of its own customers.

Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher

Latest PivX research: Multi-Vendor Unreal Engine Advisory
http://www.pivx.com/press_releases/ueng- adv_pr.htm l

Re:Games are worse than drugs.

[leviramsey]

Am I the only one to see a whole generation being wasted by such games like CS? I know ppl who play it 12 hours a day, god damn it! If someone would compare the degeneration of health/brain etc from CS vs. Grass, I bet CS would win.

When you play CS, you're supporting terrorists!

$250/hr to play games?

[EvilStein]

"threatened PivX with "getting our lawyers involved with this""

No, let's not let the lawyers get involved. THey make enough per hour as it is - we don't need to pay anyone $250/hr to play Unreal Tournament for "case notes."

Wait.. then again, lawyers in Unreal Tournament games. Hrm. It could be an all-out fragfest on a level that nobody could have ever imagined before. I like that idea!

Re:$250/hr to play games?

[goatasaur]

Shit, spawn camping would be forgivable in that case.

Re:$250/hr to play games?

[sean23007]

Or you could claim to be a lawyer... "Yes I deserve $250/hour to play UT !"

I really like Rein's comment

[rasteri]

"I won't sugar coat this. We f***ed up on this. Yes this is real and yes this was brought to our attention and yes we should have fixed it by now."

I get the feeling that I'll be in my cold, cold grave before Microsoft starts releasing statements like this :)

But seriously, it's nice to see a large company admitting it has "F***ed up".

Re:I really like Rein's comment

[sean23007]

Can you imagine how much more vehemently people would jump on Microsoft if they said something like that?

40% of UT2003 servers run on Linux. Basically, on a site like Slashdot, that makes them immune to criticism. No offense, but this is all pretty hypocritical (and mod me down to redundant if you like, as this has been said before in a hundred other threads).

Re:I really like Rein's comment

[commodoresloat]

We f***ed up on this. Yes this is real

I thought it was unreal?

Re:I really like Rein's comment

[Osty]

But seriously, it's nice to see a large company admitting it has "F***ed up".

Epic is not a large company by any means. Certainly not in comparison to the Microsofts, Suns, and IBMs of the world, and not even within their own gaming market -- they're positively dwarfed by the big guys like EA, Acclaim, Infogrames/GT Interactive/Atari/whatever they're calling themselves now, etc. No, Epic is what a game development company should be -- small, dedicated, and highly focused on one thing at a time, similar to Id (which is also an extremely tiny company, as these things are measured).

However, it's great to see these relatively small companies having so much influence in a market. Id and Epic literally own the FPS market, considering there are very few shooters that don't use technology from one or the other.

Re:I really like Rein's comment

[bafu]

I realize you are just a little troll who was modded up by a confused moderator, but your post did fill me with a bit of nostalgia which, in turn, inspired me to do a little searching. So, here we are:

Can you imagine how much more vehemently people would jump on Microsoft if they said something like that?

Unfortunately, I can't find much info about how Microsoft responded to their first vulnerability, but, if this account of their reaction to a subsequent problem (from the RISKS-FORUM Digest Saturday, 7 Dec 1985 Volume 1: Issue 27) is any indication, I'd have to assume that it was at least as bad as Epic's first response was. You are probably right: if /. had been around back then, Microsoft would have been in for yet-another-undeserved tongue-lashing over this!

A COMMERCIAL WORM

Just a few days after I wrote "Electronic AIDS, Part I," I read a column in the WASHINGTON TIMES, the conservative (Moonie-owed) daily newspaper. One of the reporters has a computer. He had purchased a newly released program from Microsoft Co., called "Access." Understand that Microsoft supplies the disk operating system which is used by the IBM PC, the most popular microcomputer. In other words, this is no backyard company. It is one of the two or three software giants in the U.S. (Its owner is under age 30, which tells you something about who is pinoeering the microcomputer revolution.)

As he was setting up his computer to take advantage of this telecommunications program, a warning flashed on his screen: "The weed of crime bears bitter fruit. Now trashing your program disk." Wham! He lost all his files -- probably a couple of year's worth of work. Sure, he was probably smart enough to have made back-up copies, but think of the risk. And what if it had been a worm that kept silent for a few years, infecting all of his back-up disks?

He called Microsoft, and they gave him the runaround. They told him that they were not responsible. Some programmer had put in the worm in order to zap program pirates, but the journalist insisted that he was an original buyer. Tough luck, they told him. Obviously, they didn't know that he was a reporter.

Then he published his article. All of a sudden, the victim was not some average buyer. He was big trouble. Things started moving. INFOWORLD (Oct. 28) reports that Microsoft has admitted that a programmer put in the worm, but without permission. The offending text has now been removed, we are assured. But what if it had sat in the master for three years? HERE IS THE PREMIER FIRM IN THE SOFTWARE BUSINESS, AND IT HAD AN UNAUTHORIZED PROGRAMMER INSERT A WORM. This is not idle speculation. It has already happened, verfiying my hypothetical scenario within a few days after I published it.

Can you imagine the absolute havoc that a dormant worm or virus could create if it were imbedded in all updates of Microsoft's masters of PC DOS and MS DOS, the operating systems for all IBM microcomputers and IBM compatible microcomputers? It could cost the U.S. economy billions, and some microcomputer-dependent firms wouldn't survive. Any Microsoft spokesman who says, "it's impossible; it could never happen" has to explain how it already did happen to "Access."

[BTW, I dunno why the author went on about worms and viruses in connection with nonreplicating malicious code... I guess it was in the spirit of their special "worms and viruses issue"? True, the whole purpose of the risks forum was to discuss risks, and the current problem was being used to illustrate the potential for worse problems. But, still, to call it a worm in all caps...]

Here's a post that included the original Washington Times column, for anyone else who found the hyperbole of the above article a bit too much.

All the server's will be fixed in a jiffy.

[$$$$$exyGal]

These exploits won't be around for long. As opposed to website administrator's, Unreal administrator's care about their sites not going down. I'm serious.

--sex

Re:All the server's will be fixed in a jiffy.

[Phroggy]

These exploits won't be around for long. As opposed to website administrator's, Unreal administrator's care about their sites not going down. I'm serious.

You've got a good point here. The problem with worms like Code Red and Nimda is, the patches have been available for months, but the server admins are simply incompetent, and haven't installed them (still!). In many cases, there is no "admin"; the owner of the business paid some paper-MCSE to set it up a long time ago, and they'd have to pay somebody to come back and do maintenance.

This won't be a major issue with an Unreal exploit. Since there is no ppatch yet, it may take awhile for all the servers to get patched, but they will get patched.

I got another Code Red hit today:

209-105-180-216.wireless.eisg.net - - [11/Feb/2003:03:28:04 -0800] "GET /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858% ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858%uc bd3%u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531 b%u53ff%u0078%u0000%u00=a HTTP/1.0" 400 328

Re:All the server's will be fixed in a jiffy.

[zcat_NZ]

It's not that they care or not..

UT server doesn't get installed by default as part of NT or Win2K.

The vast majority of nimda hits are from home users who clicked "install everything" when they first set up windows, and don't even realise they've got a web server running.. .. and yeah, there's probably a few clueless admins that never patched. This is more true for slammer than nimda though..

Re:All the server's will be fixed in a jiffy.

[romland]

Actually, that's not necessarily a machine that is infected with Code Red, the machine could merely have been hacked by someone doing vulnerability scans; or even worse, the guy is doing vulnerability scans from his own machine (doubtful).

I actually checked whether the machine was infected, and as far as I could tell, it wasn't.

Not just unreal...

[Anonymous Coward]

Think about it. There are literally thousands of internet based applications in use every day, and they range from the obscure to the common on a wide variety of operating systems.

Just because your favorite (or even least favorite) app hasn't had a major hole found in it that doesn't mean it isn't there. You might be running a time-bomb on even the most secure of your systems and not even be aware.

Of course this is all obvious to anybody who has been online for a while.

Philosophy�

[insecuritiez]

It's been a question for years whether bug finders should go public with bug finds or contact the company directly as to the flaws and the extent of their risk. I think the Open Source community agrees that places like bugtraq and open forums are the best way to discuss holes and security risks. Although Mark Rein was a little over-reactive and zealous M$ and other companies should make more effort to help their users find bug reporting easy -- in an open environment. This would really speed up the patching process (the priority at least) as well as the overall quality of knowledge available to the users affected and the company whose product is at fault.

Re:Philosophy�

[NegativeK]

It's been a question for years whether bug finders should go public with bug finds or contact the company directly as to the flaws and the extent of their risk.

Interesting, from what I read on the BugTraq mailing list, a lot of people give the companies a window of opportunity to fix the bugs, or work with the bugfinder to locate and fix the bugs. I believe this is very reasonable. If the company shows obvious steps to fix the problem, then when you do inform others of the bug, the hole should already be patched. In this case, the bugfinder gave the company _three_ _months_ to fix the bug - during which the bugfinder was given the run around. When this happens the only decent thing to do is to warn the general community as to the issue, and force the company to do something - assuming the company will.

It's unfortunate, but...

[Anonymous Coward]

I think this adds some teeth to the popular notion that gamers, or at least the majority of them are, terrorists. Plain and simple. They are a threat to the security of the principles we hold dear in the United States of America, and the Right Honourable Prime Minister George Williamson Bush, Junior should consider binding legislation against anyone suspected of being in a gamer-terrorist cell.

Epic Rebuttal

[Anonymous Coward]

A.C.K.W PoStErS

Thor,

I have sent your company an apology for those completely unfortunate
comments that I sincerely regret. We did provide an official statement
and I was not, at the time, aware that my verbal reaction, in a moment of
shock and surprise, was being captured for the article.

The comment was a complete over-reaction to seeing the list of games
including future games that have not yet been published. It had nothing
to do with the security issues themselves, the validity of the report, or
the way Pivx presented it to us. Pivx gave us more than fair enough
warning of the bugs and we simply failed to fix them in the allotted
time. We released a statement last week to the Unreal community
indicating that "we fucked up" in not addressing these concerns within
the given time and that we were already testing a patch with the security
issues corrected. In addition the official statement we gave pointed out
that we were fixing the holes and that the Pivx report was fair and
accurate. Licensees were already provided with the source code for the
security fixes.

Again this was a moment-of-stupidity reaction and I sincerely apologize
to Pivx and the entire security community. Epic has already stated that
we will take these matters far more seriously in the future.

Mark Rein,
Epic Games Inc.

Visit us at http://www.epicgames.com

Four words...

[swordgeek]

Good. On. Mark. Rein.

He admitted that they screwed up. (or fucked up, as the case may be.) He lost it when pivx when public. Then he apologised for losing it, and admitted that pivx was entirely in the right.

This is about as much news as the bug itself. Not much.

Re:Four words...

[yomegaman]

He apologized, big deal that costs nothing. He acted like a total jerk with the lawyers bit, ignored the bug for three months, and it's still not fixed after all this time. What's so praiseworthy about that?

Re:Four words...

[swordgeek]

I'm not trying to elevate him on a pedestal here, but I just don't want to see him vilified. He screwed up. Big deal. He flipped out on ONE comment out of several. Big deal. He had the decency to apologise. Not a huge deal there either. None of this is a big deal. He seems like a decent guy. That's all.

On the other hand, I'd like to see someone squeeze an apology out of John Romero. :-)

Re:At least they're being frank...

[The Bungi]

Didja RTFA? The guy is specifically citing how Epic behaved worse than Microsoft used to before they cleaned up their act.

And you get modded as insightful... oh well.

Aha!

[Anonymous Coward]

that's why I've lost so many matches! Somebody is executing malicious code that screws up my aim and makes me play like crap.

Re:Aha!

[saskboy]

This could explain my friend's sub par play recently. Thanks /.! Another gaming mystery solved. My friend will be so happy.

Re:Aha!

[sporty]

Sorry to tell you this.. but the exploit was trying to help you, not hurt you. :\

Re:Aha!

[NamShubCMX]

Yea yea...

"your friend"...

Re:Aha!

[saskboy]

Hey, for once, I wasn't stretching the truth...

Wilma Flintstone Is My Cousin

[Acidic_Diarrhea]

"website administrator's"

First off, it is website administrators. Second, that's a huge generalization. I think that someone running a website that they rely on for their livelihood (a web-based market which is owned and operated by the same person, for instance) is just, if not more, interested in keeping his or her server up as your typical UT junkie. I'm not taking anything away from UT junkies, I'm trying to give website admins a bit more credit. You're making a huge generalization and one that I don't believe is true.

BFD. You can do the same thing to the 10k CS

[BoomerSooner]

Servers out there. Simply create UDP packets and sent them to 10000 servers and they will all respond to the place you want to DoS. Games are no safer than any other piece of Internet connected piece of software.

This should definately get more attention now and in the future. The innocence of the internet is long dead (long live the king [of porn]).

Re:BFD. You can do the same thing to the 10k CS

[dolo666]

"Games are no safer than any other piece of Internet connected piece of software."

I'd go one step further and suggest games are *less* secure than regular software since the dev team has many more issues to deal with other than regular software, with less time and less operating money, especially for PC games. Console game seem to have a lot more operations cash lying around, but I can't understand why. Likely it's because PC games attract more resourceful people who sell themselves short? Hard to say.

The half-life (pardon the pun) of games is also much less than regular software. The rush to buy a game might last a few months, while in contrast software like Photoshop has a continual demand that is unbending. And Microsoft could release a program with a little flashing textbox and sell a billion copies at $400 a pop. It's sick.

Games are also flukes at times, too. Who would have ever thunk CS would be so damn popular? I remember being on the first servers and we all thought it was cool but we never had a notion it would blow everything else away.

The problem with security for games like CS is that it was passed off by two other companies (id to valve and then to the CS team), so you've got a pretty confusing situation to take grasp of with all that passing of the security buck. I don't think the makers of CS are at all in the same league as John Carmack, but it doesn't seem to matter in the wake of HL/CS sales, does it?

Re:BFD. You can do the same thing to the 10k CS

[Alpha_Nerd]

I would think that that would not be much of a problem. I believe all of the netcode is Half-Life code, and hasn't been modified by the CS team.

Re:BFD. You can do the same thing to the 10k CS

[Osty]

The problem with security for games like CS is that it was passed off by two other companies (id to valve and then to the CS team), so you've got a pretty confusing situation to take grasp of with all that passing of the security buck. I don't think the makers of CS are at all in the same league as John Carmack, but it doesn't seem to matter in the wake of HL/CS sales, does it?

For being one of the first CS players, you sure have your timeline screwed up. Id never had anything to do with CS. I assume you mean that Id licensed the Quake 1 engine to Valve, who then modified the fuck out of it to create Half-Life, who then created and published the modification SDK, which was then used by the original volunteer team to create CS, which was eventually picked up by Valve. Similar to the progress of Team Fortress, which started as a Quake 1 modification, then the TF team was picked up by Valve to create Team Fortress 2 based on Half-Life, and who did the Half-Life based Team Fortress Classic, meant mostly as a proof-of-concept for the Half-Life mod SDK.

TheCarmack is a god, but he and the Counter-Strike team are in completely different arenas. TheCarmack and others at Id are generally more interested in doing the infrastructure for games (thus the proliferation of games based on the various Quake engines, while the Id-created games tend to be fairly straight-forward and more or less boring), while the Counter-Strike team is more along the lines of what Legend or Digital Etremes is to Epic, or Raven software is to Id -- they create content (Wheel of Time, Unreal 2, various Quake-based games, etc), while the engine developers (Id, Epic) create the infrastructure. It seems to be a very profitable relationship for both parties, and is highly indicative of the way the game industry is moving -- some companies compete to create infrastructure (a la Windows vs. Linux), while other companies use that infrastructure and compete by making games (a la Microsoft Office vs. OpenOffice).

Re:BFD. You can do the same thing to the 10k CS

[Osty]

Half-Life was based on the Quake 2 engine. Which still has a surprising number of network security issues considering the constant attacks when it was released.

Nope. This is a popular misconception, based on the release dates of Half-Life and Quake 2. Half-Life was based on the Quake 1 codebase, and while they did add functionality that Quake 2 also had (hardware acceleration, though glquake did that too, colored lighting, one or two other things), they did a lot more as well, like skeletal animation. However, at its core, Half-Life was still based on Quake 1. Id Software has said as much (search that page for "Half-Life", you'll come up with "Remember this engine is the foundation for what Valve did with Half-Life, and the software and OpenGL rendering is still as fast as it ever was.").

Re:BFD. You can do the same thing to the 10k CS

[Zwets]

"Console game seem to have a lot more operations cash lying around, but I can't understand why."

Because console games make vastly more money than PC games. This is caused by a combination of factors, like piracy, PC's being harder to use, getting obsolete much faster, having more diverse hardware and hence being buggier, and the fact that you're not half as comfortable sitting behind your desk with your mouse and keyboard as you are with a controller on the couch.

Re:BFD. You can do the same thing to the 10k CS

[D iz a n k Meister]

Damn. That's a lot of info. Were you a CS major in college or something?

Re:BFD. You can do the same thing to the 10k CS

[FallLine]

TheCarmack is a god, but he and the Counter-Strike team are in completely different arenas. TheCarmack and others at Id are generally more interested in doing the infrastructure for games (thus the proliferation of games based on the various Quake engines, while the Id-created games tend to be fairly straight-forward and more or less boring), while the Counter- Strike team is more along the lines of what Legend or Digital Etremes is to Epic, or Raven software is to Id -- they create content (Wheel of Time, Unreal 2, various Quake-based games, etc), while the engine developers (Id, Epic) create the infrastructure. It seems to be a very profitable relationship for both parties, and is highly indicative of the way the game industry is moving -- some companies compete to create infrastructure (a la Windows vs. Linux), while other companies use that infrastructure and compete by making games (a la Microsoft Office vs. OpenOffice).

I agree that both the infrastructure and the providers of "content" are important. That said, although CounterStrike is one of my all time favorite games by a large margin, I don't think it is fair to put the CounterStrike development effort on the same level that the original HalfLife and other similar heavy licencees are even. What they did was innovative. They had a good idea and they did a pretty good job at implimenting it. However, their marginal improvement in playability over and above halflife is primarily derived from their idea and what little tweaking they did. Not only did they not have to do much coding, but the amount of art work and just general effort exerted to make it a success was pretty minimal. The fact is that most of that work was already done for them by Id software and the halflife team. That's not to say that I don't appreciate what they did. It is pretty impressive that such a small team could be the (necessary) catalyst (ok, maybe that's overstating the case a bit...) to create such a sensational hit and I think they deserve whatever benefits accrue to them, but I think you slight both the real infrastructure providers (e.g., Id) and the real content creators (e.g., Valve) by putting CS's efforts on par with the likes of them. Most of the heavy lifting was done by Id and Valve--CS is just a mod and a fairly lightweight, albeit important, one at that.

Re:BFD. You can do the same thing to the 10k CS

[t0ny]

the reason consoles make more money is manyfold-

1. there is less development cost. You are working on a hardware platform that is a known quantity, and dont have to take into account 100 different video cards and 100 different sound cards, and 50000 different motherboards.

2. little Jimmy is more likely to get $60 for his platform game than Tom the college student is to spring $60 for the newest PC game. However, the price of PC games is steadily increasing, so soon $60 may be the norm.

3. Less support costs. Since you cant add a patch to a buggy PS2 game, once it leaves your hands the only support you need to provide is your $2/minute hint line. But than again, because of #1 its less likely you will release with major bugs (hopefully)

4. higher bar- PC games tend to be selling to a more demanding audience. For example, crappy and derivative games will not sell well in the PC world, where they will generally win Game of the Year in the console world. 10-yr-olds generally dont know (or care) that they are playing a derivative work.

Re:BFD. You can do the same thing to the 10k CS

[Osty]

Damn. That's a lot of info. Were you a CS major in college or something?

Would you believe I was? (different definition of "CS", of course) To be honest, I never really liked Counter-Strike all that much. I really don't like a game where I play for 10 seconds, die, and then wait 5 minutes for everybody else to die. If I wanted that little excitement, I'd rather go autocross my car (spend a day at the track for 3 minutes of track time, yay!).

For my entertainment dollar, TeamFortress has always been the way to go. And not that crap they call "TeamFortress Classic", either, but the original Quake 1 mod (TF around version 2.5 or so was the sweet spot). I mean, really, TFC screwed everything up! The scout was too slow, the hwguy could move while shooting (wtf!), they totally butchered canalzon (Best. Map. EVAR!), etc. But now I'm ranting ... (oh for the glory days of the 24/7 canalzon server, Holy Hand Grenade, playing canalzon with Ramirez, one of the map authors. brings a tear to my eye)

Re:BFD. You can do the same thing to the 10k CS

[Osty]

You make good points, but I didn't want to associate Valve as a content creator, as they also did a lot of framework work in the Half-Life engine -- Half-Life is not simply Quake 1 with new graphics and possibly some gameplay additions (like Wheel of Time was to Unreal, or SiN was to Quake 2, or FAKK2 was to Quake 3, etc). In that vein, the Counter-Strike team is similar to (but lesser than) those development houses -- most everything is already there for them in the framework, they just supply some gameplay tweaks and new graphics, and stamp out a game. Lines blur, of course (where does American McGee's Alice fall in the Framework v. Content division? Or what about Deus Ex v. Unreal or Anachronox v. Quake 2?), but there seems to generally be two types of content providers -- those that don't need to highly modify the engine, and those that do. Counter-Strike, TF, WoT, FAKK2, etc (even Daikatana, which is pretty sad considering it took so long to release, yet didn't really add much to the genre) fall into the former category, imho. Half-Life, Deus Ex, Anachronox, Alice, etc fall into the latter.

Modifiable games are cool, because it gives people an entrance into the game development world. However, when game developers are hiring mod developers to create games, you end up with games that many times are little more than modifications (not that this is a bad thing, of course). There are exceptions (Steven Polge, now of Epic, for example -- wrote the first decent bot for Quake, the Reaper Bot, and now does most (all?) of the AI work for Epic's UT franchise; Zoid, of Quake 1 CTF fame and the linux ports of Quake 1/2, now works at Retro Studios, and helped create Metroid Prime; the TeamFortress guys that were hired by Valve to create the vaporware stand-alone TeamFortress 2, etc), but every rule has exceptions.

Unreal Security Hole

[teeker]

Just like I've always said!! Windows is incredibly insecu.. ehh...

Um...oh. never mind.

Movie Idea

[OwlofCreamCheese]

Now they should make a movie, where some kid installs this on his dad's computer at work, and his dad just HAPPENS to be the scientist involved in working the computers that controls nuclear weapons, and they have to play unreal, and if they loose: the world will be destroyed, so they put the kid in some virtual reality suit so he can get inside the game and play for real and save the day. oh come on! its as good a plot as any other videogame based movie, think of that and really tell me honestly that wouldn't be the plot of any unreal movie that came out....

Re:Movie Idea

[johny_qst]

Okay. Honestly, that would not be the plot of any unreal movie that came out...
Better now?

Re:Movie Idea

[anubi]

Kinda like "War Games", eh?

In all seriousness though, I think this topic indicates how likely such a thing could happen.

There was a movie put out about some underground hacker group determined to take over the world using proprietary software whose ulterior motives were kept secret from the public.

If I remember right, the software links could be triggered by finding and clicking on a small pi on an affected screen.

I think the movie title was "hackers" but I am not sure.

Re:Movie Idea

[Iamthefallen]

Yeah it was with that chick from that other movie about a bus that had to speed around
a city, keeping its speed over fifty, and if it's speed dropped, it would explode!

I think it was called The bus that couldn't slow down.

Re:Movie Idea

[JBird]

The movie you are talking about is "The Net" starring Sandra Bullock.

Re:Movie Idea

[Iamthefallen]

It does look as a dig at ya, sorry, but it was just the perfect place for that Simpsons reference :)

http://grouchu.8m.com/simpsons.html

Like the Slapper Worm?

[Anonymous Coward]

Being a fairly regular UT2003 player I can honestly say there are not nearly as many servers out there as open MS SQL boxes. There are maybe a 1000 or so boxes at any one time running servers and the traffic is generally low.

So... this is the sound of a thousand gamers...

[saskboy]

Switching to Quake III.

Just when me and my friends were putting the finishing touches of our college residence Unrealy Tourny level :-(

Patch it! Patch it quick, I have to snipe! A day without "M-mmmonster KILL" ringing in my ears, is a day not worth waking up for.

Re:So... this is the sound of a thousand gamers...

[cap'n foolsy]

if you have to snipe to get "monster kill" ringing in your ears, then you dont have enough fans watching you play ;)

Re:Games are worse than drugs.

[Phroggy]

When you play CS, you're supporting terrorists!

And everybody knows smoking pot is as American as apple pie?

Unreal players discussing the security hole

[joe_bruin]

GG
NEW MAP!!!!!!!!!!!!!!!!!!1111
GG EVARYBODY
ZEROSTUD IS A CHEATER
YEAH, I
OMFG UR TEH LAMER
SHUTUP, U CAMPING FAG
[FGP]-Killaz-X -0- LAG!
NO LAG U SUX
NO FUCK YOU
I GET 20 PING
U GUYS HERE ABOUT TEH SECURITY THING??!
GG
NEW MAP
LATZ, IM GONNA PLAY CS
FUCK YOU
KILLING SPREE
UR CHEATING
KICK HIM
STFU U LAMR, YUO SUK
VOTE ON NEW MAP

Re:Unreal players discussing the security hole

[Pike65]

You know the really annoying thing? UT2003 has the bots talking like this (at least they do in the demo - I may be talking shit for the full version).

Who in the hell thought that it would be good idea to take the most annoying facet of the playing online and then turn it into a game feature?

I nearly cried when the bots started shouting "Ownage!" at each other. You can almost here the numerics in every word.

/me shudders

There's nothing like getting "M-M-Monster Kill"...

[jo_ham]

..when the only weapons you have are a pair of Enforcers.

Those damn guns are just too fantastic not to use. High rate of fire (when you have two), good accuracy, no splash damage to yourself in a fire fight, pretty dangerous if you can keep your cross hairs on your opponent's head.

Lobbing the Gravity Vortex or flying a Redeemer missile into a large bunch of players to get the M-Kill seems like cheating!

Convenient Too!

[BadBlood]

What's really amazing about this flaw is that GameSpy and it's ilk unwittingly offer thousands of IP addresses from which possible DOS attacks may originate. Part of running an Unreal server involves sending "heartbeats" to the master servers of your choice advertising your IP so that other players may easily connect.

No port scanning any IP ranges to determine what services available is needed.

That's like Microsoft providing a web page showing which IIS servers are still affected by code red and showing their IP's.

Re:Convenient Too!

[DASHSL0T]

That's like Microsoft providing a web page showing which IIS servers are still affected by code red and showing their IP's.

Given how well they did with patching their network over Slammer, I think the list would start with:
127.0.0.1

oh, and to address the actual topic...

[jo_ham]

Guns, rocket launchers, women: good

Worms, security holes, f'ing smiley face proxy mines, Microsoft: bad

mmmkay?

Re:oh, and to address the actual topic...

[Cid Highwind]

Thos effing smiley-faced proxy mines RULED!

Aaah, what I wouldn't give for a good game of Chaos Q2 right now...

It was bound to happen...

[Lukano]

With all these knuckleheads with too much time on their hands, trying to find as many holes, exploits and bugs in commercial and os software... It's about time they finally started popping up in games and entertainment as well. I find it rather funny that this hasn't happened more often, but I suppose that if you were to break it down, people who are hardcore gamers are probably a fair bit more knowledgable about exploits and the like than your average sysadmin.

(I'm serious! And you know it's true... even if you deny it!) :)

Hehe

[Anonymous Coward]

IT'S A TRAP!

[/Admiral Akbar]

*Unreal* Security Hole....

[AtomicBomb]

It can't be real ;-)

Uh, anyone remember the Quake1 hole

[Rooked_One]

that carmack left in there with an ip specified specifically from id software would allow complete control? Basically, the server watched for a packet from a specific server and would do anything it wanted.

Dear slashers, please forgive epic

[t0qer]

Well after 2 years of unemployment, toqer is getting into the game house business. That's right, 40 computers T1, the works. I know that my users will be 10 times smarter than the average corporate user and 1/2 the age!
(dum bum bum)

Joking aside, from personal experience I say we're all doomed to open mouth insert foot once in a while, and Marc Rein is no exception. Before you disagree with me or mod me down, let me remind you all of what a *ASSET* epic has been to the gaming community.

Unreal is cross platform, no waiting, it was there pretty much day 1. You can play UT2003 on win or lin.

In regards to my future business, epic has THE BEST licensing compared to EA, Valve, Activision and blizzard, their license is basically "You buy it retail, go ahead and load it on your rental computer" The afformentioned companies want indefinite license fee's and Epic doesn't.

Despite home PC gaming being the best, I know the gamehouse community will grow because not everyone can afford 50 P4 3ghz with hyperthreading. As long as the gamehouses keep their technology ahead the the "home curve" they will become a dominating force for showcasing games, a marketing tool if you will. Epic understands this and wants to see this happen.

Epic has been good to the gaming community, and since Marc was grown up enough to apoligize, we should be grown up enough to forgive him.

Sorry I can't stop talking about the gamehouse thing....Since I know some dev's (Even Carmack at ID) read slash, hopefully if I get modded up enough they'll read this.

To: EA, Valve, Activision and blizzard
Your indefinite contracts suck. Gamehouses are Synonymous with arcades with one vital difference... You do not provide the actual hardware. The owner of the facility provides hardware at a HUGE cost. Try pricing a gamehouse built on Dells sometime and see, the monthly cost of lease / and or buy is crazy. Don't be cheap about it either, price all top of the line and see what you come up with.

The thing you guys don't see is that gamehouse could be the new retail outlet for your games. Licensing shmicening, send me a box of your product to sell on consignment, and I GUARANTEE I would sell out those boxes faster than any single fry's or compusa store. Just find 1 gamehouse to TRY it with as an experiment, see if you sell more.

Re:Dear slashers, please forgive epic

[Zakabog]

I don't really get your post. It's about $1,000 to setup a good PCs for gaming.

You can get a 1.73 GHz Athlon XP 2100+ (all you need for a gamehouse) with a 30 gig hard drive (you're not storing MP3s or movies, just saving games to disk, you can save 28 full 1 gig games with that much space), GeForce 4 Ti4600 (not top of the line but this is buying in bulk you're not

Athlon XP 2100+ with motherboard, $118
30 Gig hard drive, $49
GeForce 4 Ti4600 $209
Cheap 52X CD-ROM Drive $17
10/100 Ethernet card $5
Some Creative Labs card (just gonna have headphones anyway) $10
19" (18 viewable) monitor, max res 1600x1200 @75Hz $160
Case with 400W PSU $20
Logitech Mouseman Dual Optical $30
Generic Keyboard $10
These prices are from pricewatch.com so they're not random numbers I made up.

No floppy needed (you buy just one for the gamehouse and if you ever need it just put it in a computer)

Total: $628

If you set a $1,000 limit you have $372 left over to do whatever upgrades you want (larger monitor, better video card, faster processor, none of these are needed though and the computer will be able to play all games very nicely in a decent resolution for a year before you should upgrade again, and the upgrade will be just that, you would only need a better video card and faster processor.

$18,840 for 30 computers, less since you're buying in bulk, then the rental of the building, not much a couple hundred a month, some pretty fast SDSL connection like $200 a month. Another $5,000 for a great server from dell ($2,500 if you build it yourself, my friend does game hosting these are actual prices he spends on computers that can host 10 games at one time lag free even when they're full.) You don't need any 3 GHz P4s straight from dell anyway, I know this because I'm really getting a gamehouse and I did alot of research into it (including pricing, my original PC price was about $20,000 for 25. You make alot of money selling computers, hardware, software and stuff like that. If it was really insanely expensive to get computers do you think any of these places would still be in buisiness? If they're buying dells and not building their own and selling them too then they deserve to lose money, not EA's fault that you've got stupid management.

And what are you talking about with retail games? These places are fully able to sell retail games, who says you can't have a store that sells video games and doubles as a gamehouse? Your "idea" to "let" these places sell video games is kind of umm stupid. It's already happening, but here's an even better idea, we should make stores in the Mall, maybe call them like Game Stop or Electronics Botique or something trendy like that, and these places can sell video games and stuff. It'd be so cool since most people do their shopping in the mall, these places would make tons of money! Man I hope those game developers are reading this my idea is revolutionary!

Re:Dear slashers, please forgive epic

[Zathrus]

Which part of "don't go cheap" did you not understand?

If he's setting up a game house, he's not going to go with anything even close to your specs... because he has to offer something better than what most people will have, including most gamers.

That means a P4 3 GHz, a Radeon 9700 Pro, a gig of memory (which you forgot to price at all - that PC isn't going to do much with no memory), and XP (which you also forgot to price).

These prices are from pricewatch.com so they're not random numbers I made up

You may as well have. Nobody that has a clue buys stuff from the lowest priced vendor on Pricewatch. All you'll get is shitty vendors selling shitty equipment. Go someplace like Newegg, Monarch, or Mwave (or a local shop) and single source everything. You'll pay a bit more, but you'll get equipment that's not been RMA'd three times already, you'll have a company that actually takes returns, ships on a timely basis, and essentially doesn't jack around.

I'd agree on not buying Dells (gack), and the various other bits, but it still isn't as cheap as you suggest if you want top of the line rigs.

As far as selling games -- yes, he can sell them... but he needs to get an in with a distributor, otherwise he has to buy them at retail to sell them at above retail. Ditto for the computer equipment (although buying from someplace like Newegg and then selling at retail will give you a decent cushion by itself).

TechTV re-wrote their story

[marnerd]

I read the old version, and it definitely did mention "slander" and "lawyers". Shame on TechTV for deleting the evidence and on Epic for the comment.

Kudos, however, to Epic for later retracting it.

Re:TechTV re-wrote their story

[evil_one]

Since then Tech has edited it again - Probably so that they don't look like boobs.

ummmm...

[pimpinmonk]

Imagine the bad publicity games would receive if a worm on the scale of Slammer had been created

If there's as many Unreal Servers as MS SQL servers and as many firewalls forwarding the ports, then something's just not right with the internet world...

Then again, many things are not right with the internet world [shrugs]

Frag out! It's Slammer time!

[digitalgimpus]

The past 15 years of life all in one.

Re:At least they're being frank...

[sgtsanity]

It's called context. When Epic found out, they assigned a programmer to it. That guy screwed up. However, Epic isn't afraid of critiquing their own performance. Ever since the security error was widely publicized (about a week ago), Epic has been nothing less than forthcoming about the magnitude of the error.

It's a very understandable situation, one that's happened before even to good companies. They didn't try to cover it up, or call it a feature. They've just been working their pants off trying to get out a patch that fixes the problem w/o causing even more havoc.

How long does it take to fix a bug

[The Analog Kid]

its only a game so how long does it take to fix bug like this, for a game? It shouldn't take that long its not an operating system. Well I guess we can say that Microsoft isn't the only company with bugs left unfixed.

A Generation Already Wasted

[Myriad]

Am I the only one to see a whole generation being wasted by such games like CS? I know ppl who play it 12 hours a day, god damn it! If someone would compare the degeneration of health/brain etc from CS vs. Grass, I bet CS would win.

Frankly, if you're someone who routinely writes "ppl" in place of "people" you're already demonstrating such severe degeneration of health/brain that you may already be a lost cause.

Sooo...what I wanted to say is that I hope that someone f**k the game-servers up so badly that these trapped gamerz can see what life has to offer!

Might I suggest you take some of the same advice you give to these "gamerz" and check out what life has to offer. It appears to be passing you by.

Clueless middle people at Epic led to this

[speeding_cat]

It is likely that this whole f#ck up was caused by clueless middle people at Epic. Those that have no frigging clue about what security people do in situations like this. I am pretty sure they also could not be bothered to research the consequences of their silence.

Hopefully this story gets more publicity so that even the least informed ones get a clue that ignoring vulnerabilities is a BAD thing to do!!!

Re:At least they're being frank...

[Anonymous Coward]

Did you RTFA (READ THE FUCKEN APOLOGY)?

I came across it when it came in my inbox from Bugtraq. Just try to imagine Steve Ballmer, in a very public forum literally saying "we fucked up". I thought it was one of the most amazing acts of humility I've ever seen from someone who is probably worth millions. Also, the TechTV article linked from the PivX letter citing "public legal threats"... ummm... doesn't contain any legal threats. I'm assuming that he made them on the air on TechTV.

Also, as Rein explained in his apology, his initial reaction was to the fact that PivX was implying that 4 games which were not even released yet were insecure; which is a conjecture on PivX's part, and which could potentially damage the sales of those games even if the holes were fixed. His initial reaction was that this was libel, and he was correct.

This conjecture was not properly disclosed in the original disclosure, which means if the developers for these games were to show that their code was in fact patched against these vulnerabilities, it is in fact libel.

And you get modded up to +5.... oh well.

pwned!

[Oshuma.Shiroki]

Now I guess when someone says they '0wnz j00' they might really mean it. ;)

I knew it I knew it I knew it!

[ellem]

-- There was no way I was geting sniped in my fly hiding spot on the side of the Red Tower. I mean what Blue guy would even be looking there? Had to be a bug of some kind! --

Imagine

[Noksagt]

Imagine the bad publicity games would receive if a worm on the scale of Slammer had been created.

I wouldn't mind seeing which bank used unreal servers in their ATMs :)

Re:Imagine

[Alarion]

damnit...

now my employer is going to find out I have been using the ATMs phat pipe to host my clan's UT2k3 server :(

Re:Imagine

[Alarion]

no shit sherlock

Please head directly to the "sarcastically funny" line.. they are administering shots today.

videogame security

[hibiki_r]

This not very different from the Gamespy vulnerability posted here about a month ago. This vulnerability also lets the attacker crash the server instead of just using it for a DDOS attack. What do you guys think it's more likely, that a script kiddie will use a l337 h4ck to try to DDOS yahoo, or taht he'll just try to take down every unreal server on the internet?

I just wonder if this was caused by a drunken programmer that decided that avioding a handshake would optimize the network code, or by just a network programmer that didn't even know what a handshake is. If this happened in my company I'd wish it was the former, not the latter.

It just goes to show you....

[Dolemite_the_Wiz]

...how lazy game manufacturers are now a days and how little they care about game issues until something like this happens.

Dolemite

Re:in other news

[buck_wild]

"Champaign of Beers"

Sounds like you drink Miller too.

Damn, and I just thought it was RedHat...

[ChrisKnight]

Many moons ago I used to host a dedicated Unreal Tournament server named "Mr.Toad's Wild Ride". It was on a P3-550 running RedHat 6. The only Linux box in my cabinet, all the other servers were FreeBSD.

One day my network went to crap, and I found that the switch had been overloaded with bogus MAC addresses. Turns out someone had hacked the Unreal Tournament box and put a very nasty packet sniffer on it. (Thank the gods for ssh.)

I had always assumed it was just the default state of a RedHat 6 box that had been easily cracked.

-Chris

hahahaha

[Mustang Matt]

So funny because it's true.

I guess most Unreal tournament players are sub-adults.

Could work for Kazaa, against RIAA

[Ilan Volow]

Kazaa's next legal defense will be that their software is not a file-sharing service but really an instant messaging server with a security hole that can be exploited to give access to a user's hard drive.

virii

[Whitecloud]

what about the 'unlimited nukes' virus? Or the auto targeting lightning gun.

Sounds like a reflection attack...

[wirelessbuzzers]

- Local and remote denial of service.
- Distributed denial of service (flooding remote computers with data packets to freeze it).
- Bounce attacks with spoofed UDP packets

This bit sounds an awful lot like the GameSpy reflection attack: you send them a forged UDP packet asking for some resource, they send out 400 times as much data to the poor bloke whose IP you put on it. Rinse, lather, repeat and you have yourself a pretty big DRDOS (not the guys MS killed, rather a Distributed Reflection Denial Of Service).

Original Usenet Thread

[Anonymous Coward]

Coutesy of Google Groups

chroot + firewall?

[anonymous cupboard]

It is impossible to know if any application may be vulnerable on any kind of box, but on Linux, we have a chroot 'jail' to run apps in (very good for servers they may serve too much) and iptables which can strictly limit the allowable ports.

If you really want to be paranoid, you can run a server inside a User Mode Linux VM which is only a little slower than a real box (only the system calls are emulated, not the instructions) and iptables on all IP connections into and out of the box.

It wouldn't solve every problem, but it would reduce the ill-effects of most worms.

Re:At least they're being frank...

[twakar]

Actually, I'm Frank and I am sick and tired of people wanting to be me :)

actually probably not in Half-Life

[Barbarian]

Way back in the days of Quake 1, there was a problem with Quake 1 servers--if you sent a spoofed connect packet (20 bytes) to them, they would response with like 5000 bytes to the source address.. this is a case where it magnifies amount of traffic from the original source. There was a program called quakewar that exploited this. They fixed this for QuakeWorld, Quake2, 3, and all games based off these (Half-Life is based off QuakeWorld and Quake).. basically instead of responding with all the information necessary for the client to get in sync with the server, they send back a random number (a string actually about 8 bytes) that the connecting client must in turn send back. If the server never receives this, it won't proceed to send lots of data to the source address. I did a bit of stuff with a simple quakeworld proxy before so I'm sure about how this handshaking happens for Quake protocol games. Sure you can get all 10000 Half-Life servers to response to someone, but it won't be much more data than you could send out yourself. I assume the Unreal problem is that it doesn't do this little handshaking to make sure the source is real.

right in the advisory too

[Barbarian]

http://www.pivx.com/luigi/adv/ueng-adv.txt

Wonderful the server has accepted a connection with only one simple,
empty UDP datagram 8-)
In fact the real problem is that there is no handshake present for
management of any real connections, and we must remember that the
handshake is used by all the multiplayer games in the world; QuakeIII,
Half-Life, etc... are only an example (ok Half-life has a bug in the
handshake but at least it is implemented and then again nobody is
perfect...)

Customer service as a last resort

[Clovert Agent]

I'm very disappointed that many ISVs only get serious about security when someone rats to the press. As a member of the press, I'm all for it :) but it's still disappointing.

Rather like those investigative shows on TV which examine cases of customers getting raw deals, often for years, from vendors/shops/etc. But when the journos arrive, they're all smiles and terribly-sorry-we'll-make-it-all-better, paying off that one customer and still ignoring the many who are still being screwed the same way.

Why does it have to get to the stage of negative publicity before firms get a clue about customer service? Commercial reasons, obviously - customer care is overhead - but it's still sad.

L-L-Ludicrous Kill...

[T-Kir]

...HOLY SHIT!

Which I suppose is what people would have been saying if a major exploit was ever created/and spread to their machine.

Fix already released

[Da Fokka]

A first security patch solving the main issues has been released to the liscensees about a week ago. The second one was released yesterday and solves most other issues.
It's been around for a long time but as far as I know this security issue hasn't been abused yet.
Of course the fact that Epic released patches doesn't mean that all the games using Unreal have been patched yet.

Re:Fix already released

[phreakmonkey]

It's been around for a long time but as far as I know this security issue hasn't been abused yet.

You, clearly, do not run a dedicated Unreal Tournament server. Or maybe you thought the occasional "runaway-process" that eats all your memory and disk-space before crashing was just a random benign bug?

I had to run ucc-bin in an unprivledged environment and put "ulimit" guard rails around it on my linux server to keep it from taking the OS with it when it was attacked. Now it's just the game that crashes.

And then, when I had a cron job to detect and bring the server back up- some very unscrupulous players would use the crash-and-restart "feature" to kick other players off the server and have their friends rejoin.

So- now when some id10t crashes the server, it stays down for up to 4 hours. That way the skr1pt k1dd13s get bored and go f--- up someone elses server.

No, I'd say it's been abused. Any dedicated server operator has known about these holes for years. It's nice to see it get acknowledged. There isn't an original UT patch yet. Now let's just hope there's a patch BEFORE there's a whole new slew of exploits.

- PM

Xploit this bug to run Linux on a unchiped xbox ?

[tempmpi]

One of the exploits allows you to run your own code on the machine running an unreal engined game. It should be possible to exploit this bug on the xbox with Unreal Championship, too. That would a way to run unsigned code on a unmoddified xbox. Unreal Championship would be something like a boot cd for linux.
As far as I know Xbox games are running at Ring 0 for speed reasons, so it should be possible to get complete control over the xbox and run Linux or other code without a modchip. Other networked games could have similiar problems, so that scheme could work with other networked games too.

Flash Gordon Is My Cousin

[Acidic_Diarrhea]

No, it is not true. You're giving 40% - that's too high a percentage to say that "all" don't care. Perhaps if you want to generalize and you've got 90% participation in the generalization, then I would agree. And you say "pretty much everyone" - where are you getting these figures? Have you gotten any statistics or are you just making shit up? Ah yes, you are just making shit up.

And why are you saying I am in shitty company? I'm not a website adminstrator you fucking moron.

Yet another link . . . .

[Badgerman]

Saying there isn't going to be a lawsuit

Figure I'd toss in my 1/50 of a Euro at current exchange rates.

I don't know if this necessarily applies but...

[StressGuy]

The one reason I was hesitant to play Unreal Tournament on the web was because there seems to be no way to stop it from automatically downloading new maps.

I routinely scan all my downloads if I'm not familiar with the server.

Old news

[I)_MaLaClYpSe_(I]

This was already announced on the full-disclousure mailing list days ago. If I had estimated, that this was such an interesting story for the average slashdotter, I would have submitted it as a story long before it was released on bugtraq.

Ill know better next time.

Re:Games are worse than drugs.

[lovepot]

I don't know anyone who plays CS without grass ;)

Old, very, very old news

[dark-br]

Date: November 26, 2002
Released: January 16, 2002
Version: All up to current.
Bug: Server status port replies to spoofed UDP packets
with large amount of data.

Affected Games:

Quake
Quake 2
Q3: Arena
Half-Life
Counter-Strike
Sin
Soldier of Fortune
Daikatana
Unreal Tourn.
Quakeworld
Unreal
Rune
Gore
Tribes
Tr ibes 2
Serious Sam
Serious Sam 2
CC: Renegade
Global Operations
Jedi Knight 2
Battlefield 1942
America's Army
Unreal Tournament 2003
Return to Castle Wolfenstein
Medal of Honour Allied Assault
SoF2 Double Helix
SoF2 Double Helix Demo
Alien vs Predator 2
NeverWinter Nights
V8 Supercar Challenge

UDP is a connectionless protocol of which the source ip and port can easily be spoofed. If you've read the introduction, you can probably
see where I'm going with this.

The BF1942 status port will reply an amazing amount of requests, and although I have only personally tested this to 50 kbytes/sec, I
dont see any reason why you couldn't go even higher.

When these requests are received, the reply is sent to the source host which, in this case, we have spoofed. This causes a huge packet flood
to your victim, therefore you now have your DoS.

When tested, a single upstream of 4 k/s to the BF1942 server yielded over 550 k/s being sent to the victim host. When the victim's host
receives these packets on a UDP port which is open (commonly found to be 135 (MS/DCE RPC), 53 (DNS), and so on), the downstream to that connection will be flooded. If you sent to an unreachable port on the victim's host, the victim's stack will respond with "Unreachable"
responses which will also flood their upstream.

A personal firewall will such as ZoneAlarm will not prevent this DoS, as it is simply a flood of information being sent directly to the victim's computer. To stop this DoS from reaching the victim, the port you specify would have to be blocked before reaching their system. Ports you would find particularly useless would be ones that are commonly blocked by ISPs before reaching the customers: (139/NetBIOS, and so on). A firewall will only prevent the victim from responding with ICMP Unreachable packets.

* Packets can be sent steadily, no wait time needed for refresh.

This is an attack that can easily flood any system slower than the game server, and do it anonymously because the UDP packet source is spoofed to that of the victim. This is very similar to the "smurf" attack that was used in the late 20th century. =)

The attack does not only affect the bandwidth of the host and the victim, but it also tends to eat up a nice chunk of memory and CPU power on the server.

This low amount of required upstream would allow a simple modem user to send a hefty DoS to a T1 or higher.

Due to the fact that Battlefield 1942 servers tend to require a lot of bandwidth to operate, you are very likely to find that nearly any server will have more than enough bandwidth to handle the task. EA has many of their servers hosted on OC3 lines.

In many ways, this exceeds the severity of the smurf attack method.

Example theory of risk:

T1 (1.54 mbps) FULL DoS:
1 server needed @ ~220 k/s or more (a 20 player server will do).
1 - 2 k/s* upstream needed from attacker (~14.4 baud modem)
A single user dialed up at 14,400 bps can topple a T1.
A single dial-up at 56k (31.2kbit up) could DoS 2 T1s at a time.

Worst of all Proof-of-concept code is at the wild =/

Defeating Spoofing

[GC]

More information at Securityfocus. This is the remote exploit which seems to be a UDP amplifier.

If all ISPs actively put in anti-spoofing filters on all their routers then this type of denial of service attack could be greatly reduced as blackhats would only be able to spoof IPs & UDP services to their own segments.

But no, most ISPs probably take a router out of the box, type a few commands and take it into production.