Another exploit - Wholly Unsecured Database

[Deadgye]

If the packets being sent are basically plaintext, then encryption does make the system more secure. It would be due to having to specifically create an event and find the corresponding packet to know what you need to send, instead of being able to just watch and find out all the commands easily. That is the one situation I can think of where encryption alone will increase security. However I haven't paid enough attention to this whole thing to know if SEs shit was as bad as lolplaintext.

However, you NEED to authenticate these commands. And if you don't encrypt the authentication then what's the point.

[Nicostrato]

Depends on the obfuscation method but I don't think you're seriously evaluating the statements. See my example above. I think you're considering the probability that obfuscation makes a target stand out by trying not to stand out (example - blank SSIDs), and that's not really going to my example at all.

Also your best case seems to basically take the position of O(29385902385923n) = O(n), which masks the fact that in this case we want to increase ω(n) (from memory here, forgive me if I'm using the wrong notation) so that we reduce the chances of a successful attack being carried out.

Don't confuse this with things like security theater. Techniques like port-knocking (however flawed they may be) don't even register on the scale of impact to the authorized user, but add a few orders of magnitude to the complexity for the random attacker, and without foreknowledge of the layer, make a target appear less vulnerable.

Do they stop a dedicated, focused attack? Eventually not, but it increases the likelihood of being able to see (and stop) the attack in progress.

If you'd like to continue to debate this I'm welcome it. If you'd rather just make blanket assumptions on the Internet and pretend you've always been right, then I'll just move on.

My fucking brain just exploded.

[lilbubbles]

Depends on the obfuscation method but I don't think you're seriously evaluating the statements. See my example above. I think you're considering the probability that obfuscation makes a target stand out by trying not to stand out (example - blank SSIDs), and that's not really going to my example at all.

Maybe you made a post and it didn't go through or I'm retarded and can't read, because I don't see an example above.

I also wasn't pretended to be right, I invoked the NIST as an authority. If you can prove NIST wrong, you will be rich.

The only example you list is port knocking which doesn't even exist in the world of production. It's a nice way to cover your tracks as part of a rootkit on a production system

If the packets being sent are basically plaintext, then encryption does make the system more secure. It would be due to having to specifically create an event and find the corresponding packet to know what you need to send, instead of being able to just watch and find out all the commands easily. That is the one situation I can think of where encryption alone will increase security. However I haven't paid enough attention to this whole thing to know if SEs shit was as bad as lolplaintext.

However, you NEED to authenticate these commands. And if you don't encrypt the authentication then what's the point.

I can literately teach a child how to break through encryption. You don't need to know or care how the data is encrypted. You wait for a packet to be sent, scan for that in memory, find out what writes to that memory, follow the code backwards and you got the unencrypted data. Hook into that function, and you see the full stream of unencrypted data being sent. Takes 10 min tops.

Real world example. Game compresses the data to make it hard to see, compression library has a vulnerability, attack gets control of the server that way. The game hurt itself by adding fake security.

They just need to validate the commands, like you said. It is that simple. Don't try to hide anything, just assume the attackers can see everything because they can.

[Yabby]

Well they did that in XI, for whatever that's worth.

Obfuscation *alone* isn't security. Obfuscation is still useful to enhance security.

My company is paying a firm for penetration testing right now. They've asked us for a bunch of information to help them identify our systems and help them proceed with the testing. Defeats the purpose IMHO.

It does. This isn't a true pen test if they are asking for this type of information up front. For the few years I've been doing this, getting most of the information can be done by a simple phone call to the right person.

[OnlyAura]

Here's the thing about obfuscation: It is neither necessary nor sufficient to achieve actual security. Validating client commands ON THE SERVER is both necessary and sufficient. Hence: obfuscation is useless.

As lilbubbles mentions, it's trivial to hook into the function that has unencrypted packet data right before it sends it but before it encrypts it, or right after it receives it and decrypts it.

the only thing encryption is useful for is preventing unauthorized parties from reading your data: aka, privacy as lilbubbles stated on the previous page.

[Raineer]

Instead of debating whether encryption is useful to security (personally I think it's adding another screen door to the screen door already on your house), look at it another way.

Development takes resources, resources are limited. You can put time into one thing. Choose authentication or encryption.

One masks the problem (perhaps very well, perhaps not), the other fixes the problem.

[Grieverbk]

This isn't a true pen test if they are asking for this type of information up front.

If they are performing a White or Grey Box test, this is not uncommon.

For the few years I've been doing this, getting most of the information can be done by a simple phone call to the right person.

If they were performing a social engineering vector as part of their test, this would be the case.

[Ezek]

Bans are going out for people that abused the leve turn in exploit. Only time will tell if the same will happen to people that used matless crafting.

[Day]

good.

[Rocl]

now to ban the people who killed clearly bugged twintanias and we'll be good

[Sephiroth]

They didn't ban those who killed bugged Titans so why would they ban those?

[Rocl]

because yoshi-p didn't brag only 100 ppl would beat titan obviously

[Mistress Stowastiq]

Bans are going out for people that abused the leve turn in exploit. Only time will tell if the same will happen to people that used matless crafting.

I wonder if he means matless crafting too in the answer below:
http://forum.square-enix.com/ffxiv/t...=1#post1452776

Since we are on the topic of cheating, there is another thing I wanted to mention. Recently, a player uploaded a video of them using a third party program. While this cheat was already addressed by us, they made it seem like the cheat was still an ongoing issue. Honestly, this is an interference of our business because it has a huge negative impact on the community. Please note that we will not be taking these actions lightly and plan to take action if it gets out of hand.

While it is okay for players to upload in-game videos of ARR, we never approved the videos of players using third party programs. We appreciate your cooperation regarding this matter.

[Vendog]

Lol rocl is so butt hurt over the twintania thing.

[Fievel]

Lol rocl is so butt hurt over the twintania thing.

lol

[Seravi Edalborez]

Lol rocl is so butt hurt over the twintania thing.

nah he jelly

[Kipling]

I wonder if he means matless crafting too in the answer below:
http://forum.square-enix.com/ffxiv/t...=1#post1452776

When I read that I figured they were referring to the guy who used Cheat Engine to change item codes (Since we know that was fixed before most people even saw the video/were aware of it), but I wasn't sure myself.

[Drakath]

Well, for the record, I just happened to be beside someone that completed 100 leves in a matter of seconds (they got all the achievements at the same time), so shit isn't fixed lol

[Mistress Stowastiq]

When I read that I figured they were referring to the guy who used Cheat Engine to change item codes (Since we know that was fixed before most people even saw the video/were aware of it), but I wasn't sure myself.

Hmm. Well he mentioned that he had to be delicate about what he said because it would just make it easier for ppl to cheat.

I think he is referring to that levy vid with the level up spam because it made the biggest commotion in OF. People kept posting new threads the OF, getting them deleted and thus, thinking no one dealt with it when they actually had but did not let the community know. I did get the sense of his utter frustration with the whack a mole they are playing daily.

While they are hiring more staff or implementing a system by which they can separate queries by the game they came from, I bet it also will help if we put "FFXIV" on the title any GM requests or reports because it looks like the Dragon Quest debacle was embarrassing.

@Drakath, you sure they just didn't buy or hoard all their turn in items and do them at once?

[lilbubbles]

Sometimes it can take time to properly fix the exploit(a rushed fix can be worse), as long as they are able to log and send out bans I am happy.