gamerDNA
Find out what's happening in a game you're playing
January 7, 2015
Matthew Molyett
https://secsandcyber.blogspot.com
Executive Summary
This is a detailed look into the web application gamerDNA, which is a social networking website for video game players and games database. Data about the application was collected through a combination of manually browsing the web pages, inspecting URL structures, scraping pages through a Python spider script, and inspecting the application traffic recorded in WireShark and FireBug. Based on URL structures and file extensions, the backend of gamerDNA is Ruby on Rails and php. I confirmed my understanding of the interaction traffic by creating a Python module to allow interacting with the application through automation, which is available on GitHub. Connections to gamerDNA can be made over HTTPS, and most sensitive pages try to redirect to it, but the certificate is expired.
Why gamerDNA?
To select an application I wanted to inspect, I pulled an entry off of the English Wikipedia page “List of social networking websites.” My criteria was that the site be identified as fairly mature (gamerDNA was established September 2006), have a large user base (310,000), and be near the middle of the list when sorted on page ranking. (approximately in the middle) Candidate applications needed to be in English, something I’d never used, registerable, and have a general subject matter that I’d be familiar with (gamerDNA is listed with a focus of “Computer and video games”). Before looking into the site, I read the linked Wikipedia page. All the parenthetical details are as presented in the List. The player directory on the site claims 864,576 users.
Methodology and reason
During my initial review of gamerDNA, I browsed the site unauthenticated and only via HTTP in FireFox with FireBug in a Windows XP VM. By being in a XP VM, it minimized the network chatter that I was seeing on my host system’s WireShark capture. This set up allowed me to really dive into the network actions of the gamerDNA application and learn some new tricks for using WireShark to trace.
http.request.method == "POST"
|
Verifying what I believed though Python was also educational, as I had to learn about making POST requests and maintaining cookies. Also, the ‘requests’ module!
Public Application Functions
gamerDNA contains provides three primary functions, a directory of Games, a directory of Players, and "NOW" which is a feed of recent activity on the application, which is all browsable by the public. Most activity and information submitted by members is publicly visible, where only real name, gender, and age can be private.
Member Application Functions
As a social networking site, gamerDNA allows the posting general public statuses, statuses related to a game being played, sharing images (with or without association to a specific game), reviewing games, and associating games and gaming consoles with themselves. These pieces of data can be aggregated into a viewing feed, called the gamerCURRENT, by selecting Players or Games to Follow. Each Player has a main homepage at [PlayerHandle].gamerdna.com
A Gamer's profile consists of four pages
A homepage with a status feed, recently played games, 'follower' information, and an avatar image
A gamer biography page with Name, Sex, Age, gaming info, and gamerDNA account info (join data, last login, profile views)
A games played page
An image hosting page
Other functions available to members
API key and /help/helix-api/
private messaging at /private.php
vbulletin Forums at /forums.php
quiz at /quizzes/
Warhammer Signatures at /warhammer-signature
Warcraft Signatures at /wrath-of-the-lich-king-signature
Guild hosting at /hosting/ **HTTPS only**
Chat
Website Identity Information
>>nslookup gamerdna.com 8.8.8.8
Server: google-public-dns-a.google.com
Address: 8.8.8.8
Non-authoritative answer:
Name: gamerdna.com
Address: 208.88.178.16
Registrant Organization: LIVE GAMER, INC.
Registrant City: NEW YORK
Registrant State/Province: NY
Registrant Postal Code: 10012
Registrant Country: US
IP Address: 208.88.178.16
Location: Sunnyvale,California,United States,North America
Postal Code: 94089
CN = *.gamerdna.com
OU = PositiveSSL Wildcard
OU = Domain Control Validated
Valid (10/10/2013 0:00:00 AM GMT) - (10/11/2014 23:59:59 PM GMT)
CA Issuers: URI: http://crt.comodoca.com/PositiveSSLCA2.crt
DNS Name: *.gamerdna.com
DNS Name: gamerdna.com
Interesting Geographic data
Security Issues [Full details in Appendix C]
Website presents an expired certificate: This causes visitors to have to click through a browser warning about the identity of the site. If accessing the site requires a security click-through, users are less likely to notice a bad certificate being presented due to an ongoing Man In The Middle attack.
Website allows account registration and login over HTTP: This causes a created account’s password / unsalted password md5 hash to be visible in network traffic. To disallow this would prevent HTTP-only users, but allowing it amplifies the already significant security risks of password reuse. [Full packets in Appendix B]
Website allows logged in users to navigate over HTTP: This causes the session cookies to be visible in network traffic. To disallow this would prevent HTTP-only users, but allowing it risks session hijacking.
XXXXX Redirects to an attacker specified page
SEE APPENDIX C
Fields allow for static script injection
SEE APPENDIX C
Information leak in 403 Error Page
SEE APPENDIX C
Server software in use
SEE APPENDIX C
Registration page
SEE APPENDIX C
Application functionality
Login Functions
Check Email
Make Status Post
Follow Games or Players
Associate or Review Games
dna/add_game/%d
dna/delete_game/%d
dna/game_update/%d
Update Biographical Information
Add or Remove Images
rails/dna/image_submit
- rails/dna/image_delete/%d
Author's note: Full report with appendices possibly available. Contact me if you are interested.
