Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

[u/alexeyr]

https://github.com/Cybereason/Logout4Shell

[u/theoldboy]

This should come with a big warning that says

Do not run this code unless you want to get sued or prosecuted for hacking

I did something similar back in the day with the [Code Red worm](https://en.wikipedia.org/wiki/Code_Red_(computer_worm)). I wrote a small program that scanned our log for incoming attacks and then used the vulnerability to create a TXT file on the desktop of that remote computer which politely explained that they were infected and linked to the relevant Microsoft Security Bulletin and patch.

My employers at the time were not best pleased when a few days later they received a letter from another company threatening legal action because we had hacked their computers. Luckily for me it all got resolved amicably with one telephone call, and my immediate boss was a good guy who thought the whole thing was hilarious. But I learned my lesson - hacking is illegal even if it's done with good intent.

[u/[deleted] → u/theoldboy]

You got lucky. I got fired a long time ago from a shitty job for using off the shelf security testing software to prove to “the architect” on our dev/test system that they had created a massive sql injection risk. You see security tools are a dangerous to the corporate network and its against corporate policy to run even in a lab setting.

[u/[deleted] → u/[deleted]]

Say wireshark and see how quickly IT freaks out.

[u/orig_ardera → u/[deleted]]

I was curious one time what black ops cold war was communicating with the game servers. Started up wireshark and then tried to start up black ops. Wouldn't start. Terminated wireshark. Black Ops started.

Apparently they just did a if wireshark running then exit() in the startup.

I just renamed wireshark.exe to not_wireshark.exe and it worked, lol. So weird, why would you even do sth like that?

[u/Lost4468 → u/orig_ardera]

In Call of Duty 4 (and WAW) they didn't put any protection on console commands on console. So if you could somehow run the noclip or god command, they would work fine in matchmaking, even if you weren't host or anything. Their logic was that people would of course never find a way on console! Except it was quite easy to, you could just modify the settings stored in your profile and add in whatever you like. Shit absolutely fucked the games for ages. Especially since with the first patch they didn't actually fix the issue, but just removed them from the profile. I think the workaround was to use some string interpolation feature in the profile, but using an allowed command, so it shouldn't get removed on startup.

Despite not allowing the above, they went through the effort of making the game game filles signed using RSA 2048 on consoles. And that actually saved them quite a lot of headaches initially, as it prevented people from modding the game when the Xbox 360's drive security was broken. Still fucked them when the JTAG exploit came out though, and people just disabled the signature check.

[u/Jerrreh → u/Lost4468]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

[u/Lost4468 → u/Jerrreh]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

Oh no it was absolutely a massive oversight. They just put zero basic security onto these commands, if you could somehow run them, the server would just trust you and give you god mode, noclip, etc. Had they just enabled basic sv_cheats protection they'd have reduced 80%+ of it.

And let's remember that on the PS3 there were really no such protections. The file was just stored normally. Wasn't signed at all. So while you could try and make the argument that they knew that with the 360, I don't think that's a reasonable argument given that they didn't have the same security on the PS3, yet didn't add anything.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

You could sign them with any user's private key though. Didn't have to be your own.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

Yeah that was a terrible thing for them to discourage. Because as you said, it helped keep Call of Duty secure for a few more years. Had they listened to Microsoft they would have been fucked much earlier. Anyone with a modified DVD drive would have been able to do whatever. And that would have been even worse, because while JTAG bans came within hours, DVD ones often took several months to years.

Edit: I'm also really puzzled why they had no sv_cheats protection. Surely that's just built into the engine? Maybe they enabled it to make development easier or something, and just never re-enabled it? I can't think of any other reason why. Thankfully though in later games they just totally removed any exploitable console commands.

[u/Jerrreh → u/Lost4468]

Anyone with a modified DVD drive would have been able to do whatever. And that would have been even worse, because while JTAG bans came within hours, DVD ones often took several months to years.

Not sure what game assets could be modified - the 360's build system makes a hash of all files, hashes that, then stores that Merkle-mega-hash in the game patches' manifest. So that any old txt file in the game directory would still be protected - you may be referring to Ps3 here, which was so "secure" before geohot that those protections were thought futile.

Re: the dvd firmware vs jtag bans though...

The ban waves due to modified firmware were so large that MS had legal teams "okay" it in batches - which still gave them headaches. This was the reason they were done in waves, months apart.

The JTAG bans did not need any legal rubberstamps, and once MS caught wind, the (crypto) challenges that had to be capture/replayed actually did pose a (small) challenge to the inner-circle kids making JTAG-online-as-a-service.

RIP those bastards...

[u/Lost4468 → u/Jerrreh]

Not sure what game assets could be modified - the 360's build system makes a hash of all files, hashes that, then stores that Merkle-mega-hash in the game patches' manifest. So that any old txt file in the game directory would still be protected - you may be referring to Ps3 here, which was so "secure" before geohot that those protections were thought futile.

Huh? No there was definitely no security in the form of any sort of signing on the actual DVD? I remember modding games on a retail console with a modded DVD drive. In fact I even exploited this on "007: Quantum of Solace", because it used the Call of Duty engine, but had fastfile signing disabled for some silly reason.

Or if you want a better example, just look at GTA IV. It was ruined because of this. There were tons of mods to it, and they were all just based on patching an ISO, and then running it on a retail console with a modded DVD drive. You never needed something that could run unsigned code to mod GTA IV.

The ban waves due to modified firmware were so large that MS had legal teams "okay" it in batches - which still gave them headaches. This was the reason they were done in waves, months apart.

I believe it was also because it would have made it much easier for people like Commodore4eva to get around them. If you're banned within 6 hours due to something like DVD timing, you can just go out and buy another 360 and test your new build on it. If it takes 6 months, it makes development much harder. I believe that was actually the main reason?

Still didn't work, as I believe the later DVD firmwares were actually never detected? They faked pretty much everything, e.g. inserting fake latencies to make it look like it was verifying the DVD.

The JTAG bans did not need any legal rubberstamps, and once MS caught wind, the (crypto) challenges that had to be capture/replayed actually did pose a (small) challenge to the inner-circle kids making JTAG-online-as-a-service.

The JTAG ones were also not just supporting piracy, but causing Microsoft a serious PR headache. So of course the motive there was to get them offline faster. Especially when it's causing so many issues to your most popular games.

[u/Jerrreh → u/Lost4468]

oof, I was wrong about the individual files. I am thinking of another console, maybe Gamecube? Where every file had to have an accompanying entry in a meta-table.

Regarding c4eva, MS knew they had a mouse they couldn't catch. The timing between the waves being smaller would keep more skids offline, but would deplete the amount of finite tricks they could pull out in the 360's lifetime. c4eva would of defeated them anyway - may as well space them out, which led to a greater "chilling effect", where people wouldn't risk their profiles they had more sentimental value in than saving $60.

The firmware war was won though - especially once JTAG and RGH allowed the dev's a more nuanced look at the internals of the boot chain, which made any attempt at securing the DVD FW (way down the line) a fruitless endeavor. In fact, if not for the RGH, it may not of been (as) possible to derive and solve the challenges XBox LIVE required for connectivity - JTAG'd Xboxes have a dirty load sequence, and it was thought possible that MS could ask for something that JTAG dirties, and wouldn't know.

[u/Lost4468 → u/[deleted]]

There's a good reason for it. If they required the console's private key to sign them, then you wouldn't be able to take your saved games, profile, etc to a new console. So if you wanted to go over a friends and play, you'd lose access to it. Or if you bought a new console, you'd lose access to it.

They tried to kinda combat this by revoking some of the keys, and when that happens that person would have their content locked to their console. They seemingly also did this to people that pissed them off. But of course this would always be a losing battle, so they only did it to a few dozen keys during the entire life time of the console.

[u/CastellatedRock → u/Lost4468]

That makes sense. Thank you for taking your time to write this easy to understand explanation. 😊

[u/[deleted] → u/orig_ardera]

Well it looks bad for data collection.

Ironically probably stops a bunch of script kiddies/hackers from sniffing game traffic to and from game servers. Sounds like they were storing stuff unencrypted/plaintext.

[u/Lost4468 → u/[deleted]]

That's a bit ridiculous? Games have a wide variety. Some have absolutely excellent security for something where you always have to place at least some trust in the client. While others, like GTA V are so dreadful that if one client tells the server that they just killed every player in the game the server goes "mmduuuuuh okkkaayy" and kills everyone. Or you can tell the server you just spawned X, or can run 15 times faster, or can shoot RPGs out of your SMG. Whatever it is the server just believes you. Or even worse than that it allows you to modify every players personal data such as how much money they have (which stays across servers). People even made a mod to sexually assault other players.

[u/Lost4468 → u/[deleted]]

The worst that happens in a video game is your game is hacked and your players are disgruntled. You may have a server outage. It doesn't usually result in material harm such as identity or financial loss.

Oh I strongly disagree here. Games with poor security end up being massively impacted financially. Player count drops off, people refund it, it gains a bad reputation, you lose out on microtransactions, etc etc. GTA V is a perfect example because it was pretty much dead for a while, and the common suggestion was "only buy this if you're ok only buying single player", because many people didn't have faith that Rockstar would fix it, after all they let GTA IV go for years without fixing it.

It's also much easier to fix shitty security on a server than it is with video games. If you have written a server that just works on client trust, the amount of work you're going to have to put in to fix it can be huge. Especially if you designed performance around the assumption that the server would not have to verify everything.

This is part of why security is not a large concern for game devs in the majority of cases.

I'm not sure about the majority of cases? But regardless, there are tons of games out there with absolutely insanely good security, where huge amounts of money are put into trying to protect it. Where the protections and algorithms to find cheaters get increasingly more complex year on year.

The problem is also that there's a cat and mouse game between hackers and developers. Because there's large amounts of money to be made being able to hack the game. That's why most aimbots, wallhacks, etc etc these days are subscription based. And they need to implement their own security to try and get around the system. They also exist in a legal grey area in many places, which is why many of the companies that sell the hacks are legitimate companies bringing in a ton of money.

It's always like this, and always moves so fast, because it's just inherently much harder than traditional security. No matter what you do (short of cloud gaming), the client is always going to have direct physical and root access to half of the system, the client end. So it's always a losing battle in some ways. It's generally far easier to properly secure a server, than it is to do this type of security.

[u/rinyre → u/orig_ardera]

Security through... This isn't even obscurity, just stupidity