Slashdot Mirror
Anarchy Online and Age of Conan Vulnerabilities Fixed
dachshund writes "The Baltimore Sun reports that security firm Independent Security Evaluators has disclosed vulnerabilities in the popular MMORPGs Age of Conan and Anarchy Online. The flaws (which have since been patched) allowed a malicious user to read files from and take control of another player's computer. The full details of the attack are available, including a video (hi-res MOV) showing how the targeted player's client can be crashed, and how an attacker can save and run scripts on the victim's computer."
For AoC's sake, they shouldnt have patched the vulnerability. It would have made the game better. Can't speak for anarchy, never played.
Modding Trolls +1 inciteful since 1999
"A sword to the head may result in death. Fixed."
I can see this complaint popping up on the banned forum - "I didn't use a bot, my client was hacked!"
That game is still around? I remember the 2002 E3 where they were trying to give away the game with a 30 day pass.. Most people walked right past them like they were canvassers for Greenpeace. I was one of the few who took one, and I was bored with the game before an hour had passed.
It doesn't surprise me. With the exception maybe of blizzard, it seems most MMO games are wholly focused on preventing cheating and entirely disregard client security as a result. I would bet that many chat interfaces have gaping holes since they aren't "core" to the gameplay - plus it gives the attacker simultaneous access to the maximum number of players.
Imagine if someone nefarious had (or did) find this exploit first. Account stealing of even 10% of an MMO's playerbase would immediately compromise any financial viability of the publisher/developer. With such a high risk, why is so little time/money spent on finding these exploits?
I don't want to start running my games in a sandbox because I can't trust the industry to take care of itself.
And no mention to this at official Anarchy Online forums. Why am I not surprised?
Ahem. It was IIRC the first major MMO where they just went ad-supported and otherwise let most people pay for free. Because the player base which was willing to pay for their game, had started small and was imploding.
(And if anyone wonders why, read the two reviews on Something Awful. I can personally vouch that every single problem in there was true, and a lot more. And yes, that was after the devs had proclaimed it 110% fixed and working as intended.)
According to MMO Charts, it peaked at a mere 60,000 subscribers. Then AO subscribers hit an all time low of 20,000 (yes, I'm not missing a zero or anything), and after some major rework, it peaked again at 40,000. And went downhill again. Currently the _paying_ subscribers are around 12,000.
Not exactly a sign of a great success, if anyone asks me. In fact, that's piss-poor. The pile of turd that is post-NGE SWG still does about 10 times better. _Vanguard_ does 3-4 times better, and God alone knows why would anyone want to play that one. Heck, I haven't even heard of anyone who liked Tabula Rasa, but apparently some 7 times more people are willing to pay for that, than for AO.
Yes, apparently they have some more free accounts. I wonder how many are (A) actually played, since there is no disincentive to just let your accound active for free instead of bothering to deactivate it, and (B) how many of those are there only because it's free. I.e., as a prime illustration that you get what you pay for.
So basically, heh, let's stop waving around "very successful" and "large player base". It doesn't qualify as that by any sane reckoning. There are probably MUD's out there with a larger population base.
A polar bear is a cartesian bear after a coordinate transform.
Online games are the new entry point for exploits. With OSs being fixed and locked down, the current angle of attack are web browsers and their plugins (especially the latter gain a lot of attention lately, especially plugins that are most likely present in browsers like flash players and PDF-readers). This won't work forever either.
The next will be online games. They are fairly widely spread, they usually use standardized ports and they are also usually done with security as a minor concern, if any. I'd be especially wary of games that require a forwarded port to work properly, but any game communicating with a server is a possible attack vector.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Look at the details of the exploit: exploitation of a web browser and then privilege escalation by clobbering a trusted processes' stack because it didn't check input. The list of well used programs which have NOT seen buffer overrun attacks is pretty darn small, and it will continue to be small for as long as programmers insist on managing memory.
I'm of the opinion that managing memory is like writing a cryptography library: you should leave the task to someone who is actually capable of doing it. If you think you're capable of doing it, you're deluding yourself.
Help poke pirates in the eyepatch, arr.
Let's put this in perspective. WoW was missing some features, but the ones in the game worked pretty damned well. AO, by contrast, off the top of my head had:
- massive graphics glitches. E.g., more often than not doors would turn into a swirly graphical glitch, so you can't see what awaits you on the other side. (And virtually any mission in the game consisted of lots of rooms connected by lots of doors.)
- collision code problems where you'd suddenly fall through and start swimming in the ground. Or would run on a flat road, and suddenly you're falling from the sky. Or a few other such.
- NPCs could punch you through walls, from the next room, and you couldn't even see who or in which direction to run to find that NPC and kill it before it kills you. Running _away_ didn't work, btw. Once an NPC started punching you, putting more distance and more walls between you and it, did nothing. See the next point.
- NPCs could punch you from any distance, negating the usefulness of any kind of ranged combat, including their reason to exist of their ranged combat class. Yes, a fist had the same range as a sniper rifle. Not to mention how badly that tripped suspension of disbelief.
- massively broken class balance. And I'm not talking the "OMG, rogues are too tough" or "OMG, shamans can't be killed" arguments on WoW. Some classes, say, a healer or buffer couldn't solo at all, while a couple of other classes didn't even need a healer or buffer to do any mission. So if on WoW your only complaint is that your Priest doesn't solo as fast as a Rogue, count your blessings.
- broken faction balance. And not as in the "horde vs alliance" bickering on WoW, but as a matter of design. One faction got better money and equipment, one faction got shafted, and one faction didn't even have shops past the newbie level. You can recognize an incompetent designer by his rationalizing why an imbalance is ok to exist (e.g., "well, they're corporates, of course they should get better money and equipment",) instead of fixing it.
- boring, randomly generated missions, with no more story than "go steal the generic round item on the floor."
- ... and some of them were broken too, or their map was broken. (E.g., it wouldn't be that unusual to fall into some 6 ft deep hole in the ground and have no way to get out of it and continue the mission.)
- Not much variety there either. E.g., the stupidity that you'd be given a "stealth" or "infiltration" mission, but wouldn't get the mission token unless you killed everyone on the map.
Etc, etc, etc.
But, hey, they had painted photo-realistic anatomically-correct mooning, and the best animation of giving or receiving a blow job. And stuff like female "armour" which consisted of only 2 strips of kevlar on the sides of the body. I guess someone had taken the "sex sells" dictum to heart.
At any rate, yes, WoW may not have been 100% finished, but you can't really put an equals sign between the AO launch and the WoW launch.
A polar bear is a cartesian bear after a coordinate transform.