What is... gamerDNA

gamerDNA

Find out what's happening in a game you're playing

January 7, 2015

Matthew Molyett

https://secsandcyber.blogspot.com

Executive Summary

This is a detailed look into the web application gamerDNA, which is a social networking website for video game players and games database. Data about the application was collected through a combination of manually browsing the web pages, inspecting URL structures, scraping pages through a Python spider script, and inspecting the application traffic recorded in WireShark and FireBug. Based on URL structures and file extensions, the backend of gamerDNA is Ruby on Rails and php. I confirmed my understanding of the interaction traffic by creating a Python module to allow interacting with the application through automation, which is available on GitHub. Connections to gamerDNA can be made over HTTPS, and most sensitive pages try to redirect to it, but the certificate is expired.

Why gamerDNA?

To select an application I wanted to inspect, I pulled an entry off of the English Wikipedia page “List of social networking websites.” My criteria was that the site be identified as fairly mature (gamerDNA was established September 2006), have a large user base (310,000), and be near the middle of the list when sorted on page ranking. (approximately in the middle) Candidate applications needed to be in English, something I’d never used, registerable, and have a general subject matter that I’d be familiar with (gamerDNA is listed with a focus of “Computer and video games”). Before looking into the site, I read the linked Wikipedia page. All the parenthetical details are as presented in the List. The player directory on the site claims 864,576 users.

Methodology and reason

During my initial review of gamerDNA, I browsed the site unauthenticated and only via HTTP in FireFox with FireBug in a Windows XP VM. By being in a XP VM, it minimized the network chatter that I was seeing on my host system’s WireShark capture. This set up allowed me to really dive into the network actions of the gamerDNA application and learn some new tricks for using WireShark to trace.

http.request.method == "POST"

Verifying what I believed though Python was also educational, as I had to learn about making POST requests and maintaining cookies. Also, the ‘requests’ module!

Public Application Functions

gamerDNA contains provides three primary functions, a directory of Games, a directory of Players, and "NOW" which is a feed of recent activity on the application, which is all browsable by the public. Most activity and information submitted by members is publicly visible, where only real name, gender, and age can be private.

Member Application Functions

As a social networking site, gamerDNA allows the posting general public statuses, statuses related to a game being played, sharing images (with or without association to a specific game), reviewing games, and associating games and gaming consoles with themselves. These pieces of data can be aggregated into a viewing feed, called the gamerCURRENT, by selecting Players or Games to Follow. Each Player has a main homepage at [PlayerHandle].gamerdna.com

A Gamer's profile consists of four pages

1. A homepage with a status feed, recently played games, 'follower' information, and an avatar image
2. A gamer biography page with Name, Sex, Age, gaming info, and gamerDNA account info (join data, last login, profile views)
3. A games played page
4. An image hosting page

Other functions available to members

1. API key and /help/helix-api/
2. private messaging at /private.php
3. vbulletin Forums at /forums.php
4. quiz at /quizzes/
5. Warhammer Signatures at /warhammer-signature
6. Warcraft Signatures at /wrath-of-the-lich-king-signature
7. Guild hosting at /hosting/ **HTTPS only**
8. Chat

Website Identity Information

• Main webpage: http://www.gamerdna.com
• Copyright Info: "gamerDNA®, Contents are Copyright 2006–2015 PLAYXPERT LLC and Live Gamer Inc. gamerDNA and the gamerDNA Logo are trademark and property of Live Gamer Inc."
• DNS

>>nslookup gamerdna.com 8.8.8.8
Server:  google-public-dns-a.google.com
Address:  8.8.8.8
Non-authoritative answer:
Name:    gamerdna.com
Address:  208.88.178.16

• WHOIS [Full details in Appendix A]

Registrant Organization: LIVE GAMER, INC.

Registrant City: NEW YORK

Registrant State/Province: NY

Registrant Postal Code: 10012

Registrant Country: US

• GeoIP2 City

IP Address: 208.88.178.16

Location: Sunnyvale,California,United States,North America

Postal Code: 94089

• Certificate Information

CN = *.gamerdna.com
OU = PositiveSSL Wildcard
OU = Domain Control Validated
Valid (10/10/2013 0:00:00 AM GMT) - (10/11/2014 23:59:59 PM GMT)
CA Issuers: URI: http://crt.comodoca.com/PositiveSSLCA2.crt
DNS Name: *.gamerdna.com
DNS Name: gamerdna.com

• Interesting Geographic data

• From the Terms of Service:
• Choice of Law and Forum. The TOS and the relationship between you and GamerDNA shall be governed by the laws of the Commonwealth of Massachusettes without regard to its conflict of law provisions. You and GamerDNA agree to submit to the personal and exclusive jurisdiction of the courts located within the county of Middlesex, Massachussetts.
• Server Hosting based on IP:
• Sunnyvale,California
• Domain Registration:
• Registrant Organization: LIVE GAMER, INC.
• Registrant City: NEW YORK
• Registrant State/Province: NY

Security Issues [Full details in Appendix C]

1. Website presents an expired certificate: This causes visitors to have to click through a browser warning about the identity of the site. If accessing the site requires a security click-through, users are less likely to notice a bad certificate being presented due to an ongoing Man In The Middle attack.
2. Website allows account registration and login over HTTP: This causes a created account’s password / unsalted password md5 hash to be visible in network traffic. To disallow this would prevent HTTP-only users, but allowing it amplifies the already significant security risks of password reuse.  [Full packets in Appendix B]
3. Website allows logged in users to navigate over HTTP: This causes the session cookies to be visible in network traffic. To disallow this would prevent HTTP-only users, but allowing it risks session hijacking.
4. XXXXX Redirects to an attacker specified page
1. SEE APPENDIX C
5. Fields allow for static script injection
1. SEE APPENDIX C
6. Information leak in 403 Error Page
1. SEE APPENDIX C
7. Server software in use
1. SEE APPENDIX C
8. Registration page
1. SEE APPENDIX C

Application functionality

The application functionality that I analyzed has been implemented in the gamerDNA class of spider.py. ( https://github.com/SecsAndCyber/py_gamerDNA/blob/master/src/spider.py )

Login Functions

• login.php
• logout?r=%s

Check Email

• accounts/checkEmailUniquity.php?email=%s

Make Status Post

• rails/profile/set_quote

Follow Games or Players

• rails/profile/follow/%s
• rails/profile/unfollow/%s
• rails/game/follow/%s
• rails/game/unfollow/%s

Associate or Review Games

• dna/add_game/%d
• dna/delete_game/%d
• dna/game_update/%d

Update Biographical Information

• rails/dna/save_info
• rails/dna/update_location/?location=%s

Add or Remove Images

• rails/dna/image_submit
• rails/dna/image_delete/%d

---

Author's note: Full report with appendices possibly available. Contact me if you are interested.

Extending your home network... insecurely

I reorganized my house this week and gained a private office space, though one without a coaxial jack. This makes it impossible to immediately replicate my previous setup of a whooping three feet of CAT 6 between my main workstation and the FiOS router. Unfortunately a WiFi connection isn't an option as the box isn't compatible.

Options for connecting a new room to your home network

1. Add CAT 6 Ethernet cabling: Doing this cleanly requires running cables through the walls and cutting holes for new outlet boxes with a face plate. Highly suggested if you own your house, but I'm in a rental. Pass.
2. Reuse an extra wireless router as a wireless bridge: I tried this one for a few hours (hours that the wife was not happy I was spending!) but the only router I had sitting around was an Actiontec MI424WR Rev I which is not compatible with DD-WRT firmware.
3. Power-line networking: Add a device to connect Ethernet networking over the existing power lines within the house. The guy I talked to at Best Buy recommended the Actiontec Powerline Ethernet Adapter Kit [PDF] over the WiFi extender I was looking at. At $39.99 instead of $99.99, I decided to try it.

Fast and easy...setup in less than 5 minutes

The box claims a quick and easy set-up, just plug the single adapter into the wall and wire it to the router. Plug the four port adapter into the wall near your machines and wire them up. So I did, and almost immediately my workstation was connected to the Internet... success! Or so I thought.

Verify that the network is up

Along with my main workstation, my office is home to a server which provides multimedia and intranet web hosting. Once I had Internet access, the next step was to check for the rest of the intranet machines. I navigated to http://192.168.1.1 (default MI424WR address) and the expected page pulled up, but my login failed. Double checking my password typing, the login failed a second and third time. More information needed now!

Check Windows' "Network" page

Under Printers there was a Lexmark, under Computer there was a name I didn't recognize. This is a problem, and one that needed addressed immediately! My workstation was connected to someone else's network.

**generic encryption key**

Ease of setup security hole

The problem was documented right there in the manual, the adapters come pre-provisioned with a default, generic encryption key. This is great for easy set up because you can just plug it in and go. It is bad for security because it means you can just plug it in and join any network that is already there! Turns out my neighbors already had expanded their network with a similar, compatible product. They plugged it in and it just worked. I plugged mine in and it just worked... with their existing network.

I don't understand why the manual in the box doesn't tell how to update the encryption key, it just directs you to their website. Which pretty much guarantees that a random person directed by their Best Buy clerk will never update it.

From the Actiontec website:

How do I change the encryption key on a PWR500 Powerline Adapter?
To reset and change the encryption key on the PWR500, follow the steps below:

1. Plug the Adapters into electrical outlets on the same circuit.


2. Press and hold the Security button on each unit one at a time for exactly 10 seconds. On the 10th second, let go of the button. When you release the button, the Power LED's will turn off very briefly and turn back on. The LK LED's will not turn back on at this time.


3. Then on one of the units, press and hold the Security button for exactly 3 seconds. On the 3rd second, release the button. When you release the button, the Power LED will begin to flash.


4. Now on the other unit, press and hold the Security button for exactly 3 seconds. On the 3rd second, release the button. When you release the button, the Power LED will turn off and back on breifly, and then the LK LED should be lit on both units. Provided the LK lights on both units are lit, the encryption key has been changed and the two Adapters are now connected on the same Powerline network with a new encryption key.

Flare-on update

I made it to the sixth piece of the Flare-on challenge before life kept breaking up work on it into 20 minute blocks. Things to learn before I could do it: my copy of IDA 6.1 can't create signatures for x64 binaries, what a static linked/stripped ELF is, how to identify syscalls, and how to manually map the LibC source onto a static linked ELF.

Well, after accomplishing these steps I located the user code in challenge 6 and managed to quickly extract an apparently base64 encoded buffer. When I decoded it, I thought it was garbage. Fast forward over two weeks, turns out that was exactly correct. It is executable code though! OMG!

Hopefully these week I'll find time to see what the code does.

FLARE-on Challenges approximately seven hours in

I don't know how much I can say about the content of the FLARE-on challenges, and I wouldn't want to post spoilers anyway. Currently, I'm about seven hours of effort in and some of that was spent resurrecting an old virtual machine.

Five of the seven challenges down, I absolutely recommend these for anyone wanting to work their reversing chops. In presenting the challenge, Mike had claimed that you would see a whole gambit of reversing targets. He was not joking.

If you take on the challenge you might see malicious PDFs, .NET binaries, obfuscated PHP, Javascript, x86, x64, PE, ELF, Mach-O, and so on.
-Mike Sikorski-

I've so far been stumbled up by trying to work on x64s in a 32 bit VM, having the wrong version of .NET running in an internet-disconnected box, and needing to get an XP VM with the exactly right version of 3rd party exploitable software to capture a running exploit.

Good times! Let me end with this awesome screenshot from winning Challenge 5.

FLARE On Challenge - first impressions

At the beginning of the week, FireEye released APT28: A Window Into Russia’s Cyber Espionage Operations. (PDF) Just like then-Mandiant's APT1 report from February 2013, this paper provides an incredible in-depth look at the world of nation state computer network operations (or hacking in media terms). Reading this report drove me to read up more on FireEye, which landed me on Mike Sikorski's June 2014 announcement of the FireEye Labs Advanced Reverse Engineering (FLARE) team.



Along with the creation of the new team, Mike was also announcing a reversing challenge/ candidate screening: FLARE On Challenge. Now, the challenge has completed, but most of my hobbyist reversing tends to be attacking shareware protection so I figured I'd check it out.

Set up

First, it was time to dust off my virtual machines. Never execute reversing challenges, hack-mes, or live malware on your physical machine. That is just begging for a problem.

TERMS & CONDITIONS page of the challenge even includes a warning

I updated the tools in my 32 bit machine and executed file C1.exe. Which did nothing at all, the file is a 64 bit self extracting zip. So I do a quick scan of it in IDA64 and then run it... which just pops up a EULA, which is available online too. Oddly enough, I actually stopped to read it, which is what led to this blog. I was shocked by how odd it was so much that the EULA display is still up in that vm.

2. Restrictions.  Licensee will not allow any third party to): (i) reverse engineer or attempt to discover any source code or underlying ideas or algorithms of the Software

Emphasis is mine. Copying it to here caused me to re-read it and I now see that the EULA is forbidding me from allowing anyone else to reverse it, rather than forbidding me, but still. I was given a piece of software as an explicit reverse engineering challenge with a license that forbids me from allowing someone to reverse it?

Who Reads These Things Anyway?

I really doubt the intention of the EULA was actually to be read by the participants, rather it is a CYA popup so that the lawyers can point out that they had warned you. The warning being that it contains this gem:

4.   WARNING: (a) Dangerous Malicious Code - The Software contains dangerous malicious computer code that will cause damage to Your or others computers and/or networks if not used properly.  Licensor is not responsible for the misuse or accidental misuse of this Software and the End-User accepts all responsibility for any damage incurred by the End-User. (b) Safe Environment - The Software should not be run without a safe environment that can easily be restored to a prior state, such as a virtual machine.  The End-User agrees that in no case shall the Software be used by the End-User on production systems or systems that contain sensitive or valuable information. (c) Prohibition on Connecting this Software to the Internet - The End-User agrees that the Software will not be used on systems connected to the Internet due to the risks posed to the machine running the Software as well as the risks posed to the greater Internet.

Well. That is fun. Of course VMWare Player can't snapshot so this is going to require a bit more setup before I continue.

Restoring the Public Trust and Reforming the National Security Agency

Over the past year, there has been significant discussion in the media, amongst private circles, and even in the silence of the Intelligence Community about the revelations of Edward Snowden. Conversations about them have ebbed and flowed from whether the NSA was properly implementing the law, whether the law was properly scoped, whether the law was Constitutional... and so on and so on. This discussion was all focused around the Section 215 of the PATRIOT Act and FISA 702 data collection, which regrettably constituted a trivial sized minority of intelligence work and other internal documents compromised by the breach. I mention all this not because it is the basis of my current thoughts, but a vital piece of background that must be acknowledged.

Additional background necessary to the discussion is the past abuses of the intersection of law enforcement and intelligence. On the behalf of FBI, the NSA monitored international telegraph messages that entered or exited the United States, a project that was codenamed SHAMROCK. SHAMROCK was the continuation of a wartime censorship program that, when it was questioned, GEN Lew Allen, the Director of NSA, terminated it voluntarily. Another program from the same time was Project MINARET, in which the communications of “persons of interest” were monitored. Initially these persons were risks to the safety of the President following the assassination of Kennedy, but then expanded into drug traffickers and eventually into domestic dissidents. Rather than be deeply buried, this background information is publicly available from NSA itself. I first learned of these two cases from the baseline oversight training that NSA makes its employees take every single year.

Nationally, we all benefit from the work of the NSA in many ways. Not greatest among their responsibilities, though most controversial, is support to law enforcement, including counter terrorism. This is the relationship that makes the efforts of those hard workers potentially dangerous to the American citizen. It is such a minor aspect of the impact of NSA that we must be careful about how we proceed, lest we discard the valuable intelligence baby with the privacy risk bathwater. Effective intelligence is vital for our legislators and other policy makers, but it doesn't have to come at the cost of citizen privacy.

To have situational awareness about global militaries, militias, governments, and negotiations, the United States requires a significant infrastructure to support such generation of signals intelligence (SIGINT). That SIGINT infrastructure provides vast opportunities for abuse if it were to be misused against the American populace. As such, it is of vital importance that misuse and abuse be pro-actively prevented and the American populace sufficiently reassured of their safety from it. Two of the current missions of the NSA must be ended: support to law enforcement and counter terrorism. If any SIGINT is actionable against United States citizens, in any manner, then the entire infrastructure poses a real, potential threat to the American populace.

To continue the critically important contributions of the National Security Agency through the 21st century requires the trust and support of the American populace. Because of the increasingly intertwined nature of foreign intelligence related and civilian communications, the use of non-warrant collected data in any court, hearing, arbitration, or the like fundamentally compromises the Constitutional authorization of signals intelligence. Only by explicitly guaranteeing the invalidity of non-warrant collected signals evidence in all American jurisdictions, at every level, for all regulatory and law enforcement purposes can signals intelligence successfully continue into the future.

Unlike the Cold War, American communications travel over the same links as foreign communications. This causes a dilemma for intelligence generation as it means that when foreign communications are recorded, domestic communications may be recorded incidentally. Without an explicit law forbidding any evidentiary use, then the incidental recording of American communications is a danger to citizen liberty. By disconnecting intelligence and all sorts of law or regulatory enforcement, the American people could authorize deeper data analysis for intelligence. Important diplomatic, military, and policy making discoveries could be made such as robust cyber-intrusion attribution and tracking. Such important protective measures will never, and should never, be allowed if the data can be scanned for or used as evidence of crime. The situational awareness provided to legislators and policy makers lead to better, more accurate laws and regulations, even if the data itself is “worthless.”

By: Matthew Molyett
Matthew is a former NSA Cryptologic Computer Scientist and current Congressional Candidate for the 3rd Maryland seat. While employed for the government, he experienced the extensive training on NSA authorities and oversight, as well as the responsibilities placed upon affiliates to comply. The bulk of his activities consisted of performing direct malware analysis through sophisticated reverse engineering techniques and built explicit adversary knowledge through supporting investigations/operations and by collaborating with analysts across the organization. Matthew documented malware findings in technical reporting to enhance a common understanding of an intruder's techniques, tactics, and procedures for the purpose of discovery, mitigation, and exploration. This specifically included developing signatures to detect and mitigate adversary threats to U.S. Information systems.

cross posted from http://blog.everyoneforcongress.us

2014: The year in which I...

I am starting on a whole new adventure, one in which I will utilize my cybersecurity background and experience. It is a radically different direction than previously travelled and so this blog will go silent for a while.

Thank you, dear readers. I appreciate the thousands of page views on my thoughts and school work. I will likely be taking 2014 off from school work while pursuing this adventure. Happy new year, a year in which you should also try something new.