Forum and game security discussion

[Leopold "Shaqan" Mutter]

fully integrated portal, wow this is cool stuff! 
_____________________

I am happy that I could finally change my password easily (one sent by AW Staff  ages a go contained "@" which could not be entered into AW login prompt without copy-paste) but I have smallish concern with overall security..

Some security flaw in BBoard forum software could put players in game at serious risk..altered passwords and stolen accounts..  It would be somewhat safer if forum software would be developed by AW devs themselves, perhaps not so feature rich but it would make harder for script kiddies to exploit latest code flaws which happened to become public

[dale "dalewj" ofj]

I agree with the unit, passwords in SMF can never be considered   safe

[Paul "Cuey" Darkmane]

Yeah same here,i am concerned with passwords being the same for forum and for game... was there not mention in the past of forum mods being chosen from game players to mod the forum? ... do these players/mods have access to players passwords for the forum and in turn to their game accounts if they are the same pass's? ... just a thought

[Alyx "Daisy" Johnson]

From the info about the board software:

All passwords are encrypted for security reasons and cannot be retrieved, however, they can be changed or reset in the event that a password is forgotten.

and

As a quick fix an administrator can change a members password

so (if any mods have been chosen) only an Admin can change the password for the board, and no one can see it (not even admins)

[Event "Janе" Horizon]

Yeah same here,i am concerned with passwords being the same for forum and for game... was there not mention in the past of forum mods being chosen from game players to mod the forum? ... do these players/mods have access to players passwords for the forum and in turn to their game accounts if they are the same pass's? ... just a thought

The assumption being made here is that Dedicated Logic are storing passwords in open text form, rather than the standard checksummed one-way-you-cannot-extract-its-content format.


The maximum an ADMINISTRATOR can do is change the password and/or delete the account - there is no indication a MODERATOR will also be administrators.

[Paul "Cuey" Darkmane]

Ok thats good news.

[dale "dalewj" ofj]

"encrypted for security reasons"  means very little if you dont know the enxcryption level and any time the same password is used in 2 different programs you have a security problem.   plain and simple

[The "Fifth" Entity]

I'm not an expert, i only know the basic principles, but it seems actually your safety is in your own hands here, depends on you more than on anything else.

What is stored in the database (which is accessible both for the game and the forum) is the encrypted password (password hash) not the human-readable password itself (and i don't have to ask the devs if this database is stored on a different server than the forum, simple logic tells me that's how it works).
Now, the same password hash travels over public internet from your PC to the game server each time you login into the game.
Suppose someone manages to monitor this traffic or succeeds in hacking into the forum - in both cases the result is exactly the same: the hacker will have your password hash.

Yes, in certain cases the password hashes can be de-crypted. If the hacker succeeds in this he will have your original (plain-text) password that can be used for logging into your game account.

Problem here is not so much where and how the password hashes are held, the root of the problem is password length and complexity. If your password is 8 symbols or less, a common dictionary word and only contains lower case characters (no digits and/or special symbols) it's not 100% safe even with the best encryption.

Solution is simple - if your password is too short and simple, change it, make it safe.

________________________________________________


Now the password changing procedure. What exactly happens when passwords are changed?

If you change your password yourself, your old password is asked first, encrypted, sent to the server which will compare this hash with the hash stored in it's database. If this operation succeeds the old password hash is overwritten with the new password hash. Nowhere in the whole process is the encrypted password decrypted into human-readable form.

If it is administrator who changes your password for you, the administrator password has to be entered first, all the rest is the same. It's the administrators responsibility to have a good, safe password on his account.

[Leopold "Shaqan" Mutter]

SMF 2.0.1 had an exploit capable of elevating user privileges (by SQL injection). True, it needed certain preconditions (certain PHP versions with built-in security flaw present, running the forum)

Considering how many automated script bots exist "out there", this forum is destined to be a target, especially because RCE game is connected to it.

question 1. Is the alteration of user passwords been tied to Administrator account itself or capabiliy is tied to privileges of that level?
                   Fact of encryption is meaningless if intruder has capability of simply resetting and altering passwords
question 2. Could AW Devs create backup system? Something like: Separate website in separate web server, without any fancy scripting. Just plain HTML site where you could type in your username into edit box, enter some code string to next edit box, push the "panic" button which would block the account.
a) code string being sent to prearranged email not being tied to AW account
b) Ability to lift the block reserved to AW Support only

This way player could set a block on his/her own ingame account, in case of stolen/changed password (some random trojan in player´s computer could be reason for stolen password as well)

[dale "dalewj" ofj]

on my walk today i came up with this thought for the devs

Your securing your game with a peice of software you didn't write.  does that make you feel secure?

[Jarod "Brickwit" McBrickerton]

The option to block your own account whenever you want to prevent it from being stripped/abused/whatever would be nice, but it should require more than just the login name or else anyone who guesses properly can lock anyone else's account. This is where a secure login name, one that's different from any other name connected to AW, is a "best practice" for such things but far too many people don't adhere to strong security guidelines because it is easy to forget. And even if the game required a unique login name compared to toon and forum account names, if anybody beside you is able to log into your account they are also able to lock you out of your own account. That's better than having all of your skills, items, and AWD stolen, but it might take a while before AW Support would be able to sort out the issue, verify that you are the rightful account holder, change your login/password combination, and let you back into your account.

Though it's not the easiest method for the devs, the cleanest way to prevent such problems is to ensure maximum security in the communication links between the game, the forum, and players' computers. Hopefully they have the skills necessary to either ensure the security of the forum software by modifying it themselves or have some way of creating the communications links themselves with full security measures.

[Event "Janе" Horizon]

I have had a look for SMF 2.02 security issues and cannot see any mention of SQL injection vulnerabilities. The main  vulnerabilities reported are "remote" vulnerabilities (i.e. HTML injection and Cross Site Scripting) - these impact the end users (us) rather than the local SMF server.


This excludes any use of user customized controls (i.e. controls imported into SMF by Dedicated Logic from 3rd parties).


We also need to remember that currently AWA (and most likely AWS) is not a RCE - it is a sandboxed game where there is no game mechanism  to withdraw value. Hence the game will obey the First Law of Sandboxing: Items can be changed from one form to another, however they ultimately cannot be created or destroyed.
The loss of control to your account could be annoying (i.e. your avatar can be stripped of all items) - however, returning the items back to the rightful owner is  a loss-less exercise (i.e. neither the rightful  account holder nor Dedicated Logic will incur a financial impact).

[Alyx "Daisy" Johnson]

Having worked in security from both sides, I can tell you that the password here needs to be different to your ingame one - if not, change it NOW - don't waste time reading the rest of this post, it can wait.

Well shit. Looks like the password here syncs with ingame. While it's a nice feature to be able to set your own ingame password, it should be different from forum

Assume that this password will be hacked - people are trying to find vulnerabilities, and attacking any avenue available. People are lazy, and will use the same password on multiple sites, exposing themselves to further damage should the password be stolen. If you can't cope with a different password for every site, consider using different ones for different levels - a forum password (that would just be an annoyance if it were breached), a personal info password (for email and such) and then different passwords for your major ones - bank accounts, health accounts, etc - ones that would cause major headaches if they should be discovered.

Find your password in a dictionary? throw it out - no good
Leet speak (change 1 letter for a number, L for 1 etc) - throw it out - no good
Add a number at the end? throw it out - no good (getting the idea yet?)

There are 4 items to put into a password - lowercase, uppercase, numbers and symbols. A secure password has all 4. Try to incorporate them all.
use a password manager if you must (but be aware those can be hacked too) - lastpass has 2 factor authentication, so is a good choice. I haven't looked at others, but if they don't have 2 factor, then they are as vulnerable as the next password

2 factor authentication should be used whenever possible - If you tried to log onto my gmail account, you would then need the word/code that google sends to my phone.

But, after saying all this, the biggest weakness in the whole chain is the human one.
password for chocolate
Social engineering

As a security consultant, this was by far the easiest way to get info. The next most successful was freebies - a few small (256k) USB drives, given away as "Corporate Gifts" was one of the easiest ways to get in (trojans hidden ready to autorun when the drives were plugged in), so the security of passwords on a forum such as this is not a great concern. Just be aware of the possibilities, and don't get carried away - Just because you're paranoid, doesn't mean anyone really cares about you.

[Event "Janе" Horizon]

Having worked in security from both sides, I can tell you that the password here needs to be different to your ingame one - if not, change it NOW - don't waste time reading the rest of this post, it can wait.

Changing you password here - changes your in-game one to the same time to the same value.

And your password now must contain both an upper cased letter and a number (along with being at least 8 characters long)

However, I absolutely love sites that use two factor authentication ... my favorite kind is one where you have a password and a secret phrase. To log in you need your user id, password and then are required to enter three randomly selected characters from the secret phase. Key loggers and other hateful stuff fail under that criteria.

[Leopold "Shaqan" Mutter]

I have had a look for SMF 2.02 security issues and cannot see any mention of SQL injection vulnerabilities. The main  vulnerabilities reported are "remote" vulnerabilities (i.e. HTML injection and Cross Site Scripting) - these impact the end users (us) rather than the local SMF server.

one sample
http://www.exploit-db.com/exploits/18214/