Least Privileges + Games = Microsoft Achilles Heel?

Ok. So if you are a regular reader of my blog you know I have went off on a few tangents about least privilege in the past. Let's see, what are a few of the topics I have talked about:

• Developing with Least Privilege
  
• Complaints on the lack of intelligence for runas
  
• Found a HUGE hole in credential management for runas
  
• Gave out some kewl XP registry hacks to limit application access in a SIMPLE way (read: can be defeated)
  
• Discussed how to spawn external processes securely in Windows, limiting access to a user's security context with CreateProcessAsUser()
  
• Discussed how to programatically use restricted tokens to execute a Process
  
• Discussed Least Privilege as one of my 8 Rules of Information Security
  
• Explained why I believe Longhorn has the wrong stance when it comes to user security, and should be adopting a least privilege stance for ALL users
  
• Discussed problems I found with least privilege in XPSP2
  
• And most recently talked about the fact Microsoft isn't setting a very good example when it comes to least privilege by running as Administrators when they shouldn't.
  

Today I want to discuss something that is more practical when it comes to issues with least privilege, and things Microsoft is going to need to do about it.

If anyone reads my blog from the division that publishes Microsoft games, listen up!

I want to discuss least privilege, and games.

For least privilege to be taken seriously, and be used correctly, it has to work everywhere, all the time. It has to be easy for the user to use, adopt and run without affecting their computing experience. If you make it to hard, they simply won't do it.

This is EXTREMELY paramount for kids. You know.. the little people in your house that know more about computers than you, and can kill more terrorists than the US Army Rangers because of the sheer amount of online training with CounterStrike and all the other fun games out there.

Well, if you can't make their gaming experience work with least privilege, little Johnny will never accept the computer the way it is... and you got a problem.

What am I talking about? Well today I stumbled across a knowledge base article on Microsoft's site which discusses how a problem in the CD verification routines prevent some games from functioning on XP. Especially when fast user switching is involved.

Ok, so the immediate reaction is "this is a software issue with the CD verification software". Yep. But its more than that. This isn't Joe Smith's personal Q-Bert game we are talking about here. These are Microsoft's published games. Here is the list provided in the knowledge base article:

• Microsoft Age of Mythology
  
• Microsoft Age of Mythology: The Titans
  
• Microsoft Age of Empires II: The Age of Kings 2.0
  
• Microsoft Age of Empires II Expansion: The Conquerors
  
• Microsoft Age of Empires II Gold Edition
  
• Microsoft Baseball 2001
  
• Microsoft Casino
  
• Microsoft Classic Board Games
  
• Microsoft Combat Flight Simulator 2: WWII Pacific Theater 1.0
  
• Microsoft Combat Flight Simulator 3: Battle for Europe
  
• Microsoft Crimson Skies
  
• Microsoft Dungeon Siege 1.0
  
• Microsoft Flight Simulator 2004 – Century of Flight
  
• Microsoft Flight Simulator 2002
  
• Microsoft Flight Simulator 2002 Professional Edition
  
• Microsoft Flight Simulator 2000
  
• Microsoft Flight Simulator 2000 Professional Edition
  
• Microsoft Freelancer
  
• Microsoft Golf 2001 Edition
  
• Microsoft Halo: Combat Evolved
  
• Microsoft Impossible Creatures
  
• Microsoft Links LS 2000
  
• Microsoft Links 2001
  
• Microsoft MechCommander 2.0 1.0
  
• Microsoft MechWarrior 4: Vengeance
  
• Microsoft MechWarrior 4: Mercenaries
  
• Microsoft Metal Gear Solid
  
• Microsoft Midtown Madness 1.0
  
• Microsoft Midtown Madness 2 2.0
  
• Microsoft Motocross Madness 2 2.0
  
• Microsoft NBA Inside Drive 2000 1.0
  
• Microsoft NFL Fever 2000 1.0
  
• Microsoft Pandora's Box 1.0
  
• Microsoft Rise of Nations
  
• Microsoft StarLancer 1.0
  
• Microsoft Train Simulator 1.0
  
• Microsoft Zoo Tycoon
  
• Microsoft Zoo Tycoon: Complete Collection
  
• Microsoft Zoo Tycoon: Dinosaur Digs Expansion Pack
  
• Microsoft Zoo Tycoon: Marine Mania Expansion Pack

So why do you care? Because one of the recommended solutions is to log on as Administrator to play the game! COME ON PEOPLE... NEVER RECOMMEND TO RUN USER MODE APPS AS ADMINISTRATOR!

Thats like telling Linux geeks to run Quake as root. Please, please do. I need another rooted box.

Let me give you an example of WHY this is a bad idea, based on a recent experience I had.

I am a big fan of the game Wolfenstein: Enemy Territory. I don't have a lot of time to play games, but when I do, ET is at the top of my list. Recently I joined a server which wasn't playing very nice. I have the ability to download maps turned on. On this particular server instead of it playing nice and downloading the maps I needed, it somehow forced the game to ShellExecute a http request, shutting down the game and tried to lauch the default web browser. HELLO? See anything wrong here?

Lucky for me my intrusion prevention system I wrote kicked in, noticed that a game was trying to call a web browser and promptly stopped the action from occuring. But what MIGHT have happened if I didn't have my IPS running? If I would have had a vulnerable IE browser (I don't run IE so even without the IPS this attack would have failed since FireFox is my default browser), they could have kicked off an attack sequence by directly forcing me to the malicious URL. Now imagine if I was also an Administrator when this occured. Uh oh. Big time problems.

So please listen up. Telling someone to run ANYTHING that is NOT REQUIRED to have admin access should be shunned. Stop it. Don't do it. If you believe that you HAVE to be an administrator, rethink the game and try to find ways to isolate only those specific functions that require elevated privileges.

Now, I am not a game developer, and I could understand that low level hardware access typically requires higher privileges. But I was always under the impression that this was what DirectX was for. To expose low level access to user mode in a safe way. But other than the hardware control, I can't even fathem why you would need admin privileges to play a game.

To be fair, some of these games were written before the big security push at Microsoft. And many of them are games Microsoft bought from outside the company. But if you are going to talk the talk as it comes to least privilege, all your apps need to take this into account in the future Microsoft. And that includes game.

Actually, I would consider games to be one of the areas you need to be MOST concerned about. CSO/CIO in major corporations will have layered defenses to help protect against vulnerable and exploitable software. Little Johnny's computer probably won't. And all we need is another couple of thousand zombies thanks to a weakness like this in the next version of Microsoft's <insert game of the week here >

Posted by SilverStr at July 29, 2004 10:17 AM | TrackBack