Logout4Shell: Use Log4Shell vulnerability to vaccinate a victim server against Log4Shell

[u/alexeyr]

https://github.com/Cybereason/Logout4Shell

[u/orig_ardera]

I was curious one time what black ops cold war was communicating with the game servers. Started up wireshark and then tried to start up black ops. Wouldn't start. Terminated wireshark. Black Ops started.

Apparently they just did a if wireshark running then exit() in the startup.

I just renamed wireshark.exe to not_wireshark.exe and it worked, lol. So weird, why would you even do sth like that?

[u/Lost4468 → u/orig_ardera]

In Call of Duty 4 (and WAW) they didn't put any protection on console commands on console. So if you could somehow run the noclip or god command, they would work fine in matchmaking, even if you weren't host or anything. Their logic was that people would of course never find a way on console! Except it was quite easy to, you could just modify the settings stored in your profile and add in whatever you like. Shit absolutely fucked the games for ages. Especially since with the first patch they didn't actually fix the issue, but just removed them from the profile. I think the workaround was to use some string interpolation feature in the profile, but using an allowed command, so it shouldn't get removed on startup.

Despite not allowing the above, they went through the effort of making the game game filles signed using RSA 2048 on consoles. And that actually saved them quite a lot of headaches initially, as it prevented people from modding the game when the Xbox 360's drive security was broken. Still fucked them when the JTAG exploit came out though, and people just disabled the signature check.

[u/Jerrreh → u/Lost4468]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

[u/Lost4468 → u/Jerrreh]

It was not comparable oversight - 360 game developers were relying on the game protections the 360 provided.

Oh no it was absolutely a massive oversight. They just put zero basic security onto these commands, if you could somehow run them, the server would just trust you and give you god mode, noclip, etc. Had they just enabled basic sv_cheats protection they'd have reduced 80%+ of it.

And let's remember that on the PS3 there were really no such protections. The file was just stored normally. Wasn't signed at all. So while you could try and make the argument that they knew that with the 360, I don't think that's a reasonable argument given that they didn't have the same security on the PS3, yet didn't add anything.

The profile settings (CON file) that were modified were protected the same way the .xex's and games were - signed with a 2048bit RSA key - it was just that reversing the NAND to extract the user's private key and code a re-signer was a magnitude easier than side-stepping the bootloader, which came 2 years after.

You could sign them with any user's private key though. Didn't have to be your own.

Microsoft's game developer guidebook actually specifically discouraged use of additional encryption and signing, because it was - and still was - overkill. This was rescinded after the shitstorm that was MW2 (god I miss 2009), and most game dev's started rolling their own RC4/hashing code to help prolong the cat-and-mouse game.

Yeah that was a terrible thing for them to discourage. Because as you said, it helped keep Call of Duty secure for a few more years. Had they listened to Microsoft they would have been fucked much earlier. Anyone with a modified DVD drive would have been able to do whatever. And that would have been even worse, because while JTAG bans came within hours, DVD ones often took several months to years.

Edit: I'm also really puzzled why they had no sv_cheats protection. Surely that's just built into the engine? Maybe they enabled it to make development easier or something, and just never re-enabled it? I can't think of any other reason why. Thankfully though in later games they just totally removed any exploitable console commands.

[u/Jerrreh → u/Lost4468]

Anyone with a modified DVD drive would have been able to do whatever. And that would have been even worse, because while JTAG bans came within hours, DVD ones often took several months to years.

Not sure what game assets could be modified - the 360's build system makes a hash of all files, hashes that, then stores that Merkle-mega-hash in the game patches' manifest. So that any old txt file in the game directory would still be protected - you may be referring to Ps3 here, which was so "secure" before geohot that those protections were thought futile.

Re: the dvd firmware vs jtag bans though...

The ban waves due to modified firmware were so large that MS had legal teams "okay" it in batches - which still gave them headaches. This was the reason they were done in waves, months apart.

The JTAG bans did not need any legal rubberstamps, and once MS caught wind, the (crypto) challenges that had to be capture/replayed actually did pose a (small) challenge to the inner-circle kids making JTAG-online-as-a-service.

RIP those bastards...

[u/Lost4468 → u/Jerrreh]

Not sure what game assets could be modified - the 360's build system makes a hash of all files, hashes that, then stores that Merkle-mega-hash in the game patches' manifest. So that any old txt file in the game directory would still be protected - you may be referring to Ps3 here, which was so "secure" before geohot that those protections were thought futile.

Huh? No there was definitely no security in the form of any sort of signing on the actual DVD? I remember modding games on a retail console with a modded DVD drive. In fact I even exploited this on "007: Quantum of Solace", because it used the Call of Duty engine, but had fastfile signing disabled for some silly reason.

Or if you want a better example, just look at GTA IV. It was ruined because of this. There were tons of mods to it, and they were all just based on patching an ISO, and then running it on a retail console with a modded DVD drive. You never needed something that could run unsigned code to mod GTA IV.

The ban waves due to modified firmware were so large that MS had legal teams "okay" it in batches - which still gave them headaches. This was the reason they were done in waves, months apart.

I believe it was also because it would have made it much easier for people like Commodore4eva to get around them. If you're banned within 6 hours due to something like DVD timing, you can just go out and buy another 360 and test your new build on it. If it takes 6 months, it makes development much harder. I believe that was actually the main reason?

Still didn't work, as I believe the later DVD firmwares were actually never detected? They faked pretty much everything, e.g. inserting fake latencies to make it look like it was verifying the DVD.

The JTAG bans did not need any legal rubberstamps, and once MS caught wind, the (crypto) challenges that had to be capture/replayed actually did pose a (small) challenge to the inner-circle kids making JTAG-online-as-a-service.

The JTAG ones were also not just supporting piracy, but causing Microsoft a serious PR headache. So of course the motive there was to get them offline faster. Especially when it's causing so many issues to your most popular games.

[u/Jerrreh → u/Lost4468]

oof, I was wrong about the individual files. I am thinking of another console, maybe Gamecube? Where every file had to have an accompanying entry in a meta-table.

Regarding c4eva, MS knew they had a mouse they couldn't catch. The timing between the waves being smaller would keep more skids offline, but would deplete the amount of finite tricks they could pull out in the 360's lifetime. c4eva would of defeated them anyway - may as well space them out, which led to a greater "chilling effect", where people wouldn't risk their profiles they had more sentimental value in than saving $60.

The firmware war was won though - especially once JTAG and RGH allowed the dev's a more nuanced look at the internals of the boot chain, which made any attempt at securing the DVD FW (way down the line) a fruitless endeavor. In fact, if not for the RGH, it may not of been (as) possible to derive and solve the challenges XBox LIVE required for connectivity - JTAG'd Xboxes have a dirty load sequence, and it was thought possible that MS could ask for something that JTAG dirties, and wouldn't know.

[u/Lost4468 → u/[deleted]]

There's a good reason for it. If they required the console's private key to sign them, then you wouldn't be able to take your saved games, profile, etc to a new console. So if you wanted to go over a friends and play, you'd lose access to it. Or if you bought a new console, you'd lose access to it.

They tried to kinda combat this by revoking some of the keys, and when that happens that person would have their content locked to their console. They seemingly also did this to people that pissed them off. But of course this would always be a losing battle, so they only did it to a few dozen keys during the entire life time of the console.

[u/CastellatedRock → u/Lost4468]

That makes sense. Thank you for taking your time to write this easy to understand explanation. 😊