Potential Security Exploit

[TacoTaru]

Noting that this is potential because it popped up on Reddit and was confirmed by the OF.

Security Tokens/Authenticators are useless; SE needs to fix this immediately.
Link to original post: http://www.reddit.com/r/ffxiv/commen...ainst_viruses/

Authenticators are useless against viruses due to how the launcher and login system works. Lets get this straight: Be calm, I am not trying to fear monger here. People just need to know for account security.
I shall explain a few things first.(There is a TL;DR at the end.)

Authenticator/One Time Password

The idea behind that authenticator's one time password is that it generates a password that is valid for only a few minutes and can only be verified once. Thus making it unlikely for a standard keylogger virus to bypass account security.
It creates an unrealistic scenario where a keylogger would have to perform a man in the middle attack[1] :

- Have to capture the information(Easy)

- Prevent that information from being sent to the server for verification to keep the one time password valid.(Difficult, not stealthy due to the end user visibly having an issue logging in on their end.)

- Require the hacker online to be available to view that captured information and act on it immediately to prevent from losing the time window the one time password is valid.(Difficult, unrealistic since accounts do not have a viable real world monetary value.)

While all those steps are possible it makes it difficult to pull off on a mass scale that MMO hackers prefer. However, the authenticator and one time password is only as secure as the login system that it works with.

The Launcher

The launcher is a fancy wrapper for an HTML web page that is used for the log in system. This site can be loaded in a regular web browser, but due to how it integrates with the application it does not work properly. The good news is that the log in portion of the application uses HTTPS to securely connect to Square Enix's account management system.
After the login server securely validates all the information it returns a valid session ID to the launcher. This session ID is then used by the launcher to load the FFXIV Game Client.

FFXIV Game Client

The game client is dumb in the sense that it has be told everything to launch properly and load the correct player's account. That is where the session ID comes into play. The launcher invokes the game client by executing ffxiv.exe with extra command line parameters. It appends DEV.TestSID=xxxx, where xxx is the session ID, to the launch command. Here is the issue with that. That session ID is now plainly visible with any basic process inspector such as Microsoft's Process Explorer. No special memory viewers to get this information. This means it is incredibly easy for any virus that is on the computer to obtain the information. This also means it is possible to bypass the launcher to load the game client by just repeating the same command at the command line.

The Session ID

A session ID is a uniquely generated key that is only valid for limited time window. The problem is that the session ID is valid for numerous days. I have yet to hit a limit after a few days of trying this. It has to stay valid while logged into the game, but it does not get invalidated after being logged out for a while. It also does not get invalidated by logging in and generating a brand new session ID that is different than the old one. It is also not restricted by IP address and will not require a new one time password to reuse.
Basically, FFXIV login session IDs are not expiring at the end of the session and are not limited in any way.

What does this all mean?

I was able to give only an old, supposed to be expired, session ID to a friend and they were able to log into my account and characters from an entirely different location in the world. I did not provide an account name, password, or one time password. I was also able to log into my account while my friend was logged into it at the same time with a different session ID. The only issue was that I was not able to log into any worlds because "You are already logged into the game" error 3102. This means viruses only need to grab a valid session ID of an account to log in. The hackers would be able to bypass the one time password and also effectively lock that player out from logging into a world. If the computer gets infected with a virus targeted at stealing FFXIV accounts then it is too late. No amount of changing passwords or generating new one time passwords will help.

"What can I do to keep myself protected?"

What you are already hopefully doing. Have good virus protection, do not download stuff that you are unsure of, and do not visit shady web sites.
Please see Eanae's post[2] for additional security practices.

TL;DR

The authenticator/one time password is useless against viruses and web browser vulnerabilities since session IDs are visible in plain text to any competent programmer and appear to never expire. It is only useful against scam emails that direct people to spoofed SE web pages where people dumbly type in account information.

[1] http://en.wikipedia.org/wiki/Man-in-the-middle_attack
[2] http://www.reddit.com/r/ffxiv/commen...cked_accounts/

This is a potential very serious issue. Much like the time of the mass XI hackings, be secure in your browsing habits (which you should be doing regardless, but I digress). Adblock, NoScript and be safe in case this is true.

[Izzy]

Why does everything that Square-Enix writes have to have some sort of convoluted, retarded, non-standard way of doing things? Why not just have the client itself handle all of this shit like EVERY OTHER MMO IN THE WORLD? The launcher is literally just for news and opening the game client (normally). The game client should be where you actually login.

[Vuitton]

http://www.reddit.com/r/ffxiv/commen...s_are_useless/

[Lucavi]

Why does everything that Square-Enix writes have to have some sort of convoluted, retarded, non-standard way of doing things? Why not just have the client itself handle all of this shit like EVERY OTHER MMO IN THE WORLD? The launcher is literally just for news and opening the game client (normally). The game client should be where you actually login.

Because Japan. Every other MMO in the world doesn't come from Japanese guys who couldn't code their way out of 5-door minivan. Tell me, SE: how are the revered old ways of your glorious Nippon treating you right now?

[The Blackrose]

http://www.reddit.com/r/ffxiv/commen...s_are_useless/

It hasn't been debunked. There are still the two major problems of the session id not expiring on logout (ever?) and a secure credential being passed as a parameter on the command line instead of another route (secured by hash in a randomized memory buffer).

 

[Tajin]

Jesus LOL

[Azninvazion]

You would think that SE would be much more careful with account security after that debacle 2 years ago.

http://www.escapistmagazine.com/news...-Enix-Accounts

Edit: Bonus points if it was a similar security hole.

[Damane]

dear god the shitstorm is never ending for 14 it seems

[Obsidian]

Why does everything that Square-Enix writes have to have some sort of convoluted, retarded, non-standard way of doing things? Why not just have the client itself handle all of this shit like EVERY OTHER MMO IN THE WORLD? The launcher is literally just for news and opening the game client (normally). The game client should be where you actually login.

The client still needs to send your info to the server to authenticate your login. Otherwise there would be no login. The problem is how that information is being passed to the server for validation, not that the information is being passed in the first place.

[Deadgye]

Nah, it's not even a problem of how it's being passed. There are two problems.
1. How [allegedly] easily visible it is on the client side.
2. How it doesn't expire in a timely manner.

Even if both of these were fixed, it wouldn't protect you 100% from session hijaking. If you have a virus on your computer it's your own damn fault. The one-time password was never a protect-all against having a virus on your computer.

[Tsuneo]

You can actually view the session ID with Task Manager if you enable the command line column. In regards to how long they take to expire, the SID I was messing with doesn't seem to work anymore after 4-5 days.

[skyrant]

Why does everything that Square-Enix writes have to have some sort of convoluted, retarded, non-standard way of doing things? Why not just have the client itself handle all of this shit like EVERY OTHER MMO IN THE WORLD? The launcher is literally just for news and opening the game client (normally). The game client should be where you actually login.

Almost every modern MMO uses HTML Login/Authentification, Interface and even Auction House. GW2 is a great example on how to fuck up a game with a shitty HTML Auction House. The Login is also handled by a HTTP server even though it seems to be in the game client.

You can use Wireshark to find out what they actually do.

[Izzy]

Almost every modern MMO uses HTML Login/Authentification, Interface and even Auction House. GW2 is a great example on how to fuck up a game with a shitty HTML Auction House. The Login is also handled by a HTTP server even though it seems to be in the game client.

You can use Wireshark to find out what they actually do.

You've named one, not "almost every modern MMO".

Industry leader Blizzard does not use HTML launcher based logins for any of their 3 blockbuster games (if you want to count D3 as a blockbuster game).

[5erade]

1. Download& Install: Process Explorer from the Microsoft site (google it)

2. Open Process Explorer and under View > Select Columns check the command line option

3. Find your FFXIV.exe process (you've already logged into the game at this point).

4. Right click > Properties > Copy the text in the command line box.

5. Create a .txt file and type @echo off for the first line and on the second line paste the command line info.

6. Save it as .bat file.

**I have like no programming knowledge or how to use .bat files efficiently so whether or not @echo off even needs to be there is beyond me.

viola you can now auto-login

[Lucavi]

You've named one, not "almost every modern MMO".

Industry leader Blizzard does not use HTML launcher based logins for any of their 3 blockbuster games (if you want to count D3 as a blockbuster game).

My account got hacked 3 months after I quit WoW, so yeah, I wouldn't file Blizzard under the "does everything right to prevent character stealing" section.

[Sonomaa]

My account got hacked 3 months after I quit WoW, so yeah, I wouldn't file Blizzard under the "does everything right to prevent character stealing" section.

they have authenticators, thats pretty much industry standard these days for popular games

[Gulkeeva]

My wow character still sitting around after several years, still has everything O_o

Haven't had any "hacked account" issues over many years I've played, no authenticator. The only game I've technically had my account hacked, was in Ragnarok online beta, when someone hacked the character database, and logged on as GM's and caused chaos (not like characters mattered when you could play around as a GM) >.>

Wonder if anyone remembers that...

[Shwtym]

1. Download& Install: Process Explorer from the Microsoft site (google it)

2. Open Process Explorer and under View > Select Columns check the command line option

3. Find your FFXIV.exe process (you've already logged into the game at this point).

4. Right click > Properties > Copy the text in the command line box.

5. Create a .txt file and type @echo off for the first line and on the second line paste the command line info.

6. Save it as .bat file.

**I have like no programming knowledge or how to use .bat files efficiently so whether or not @echo off even needs to be there is beyond me.

viola you can now auto-login

where do you place the file once it is made?

[Dammerung]

where do you place the file once it is made?

Doesn't matter. All you're doing with that is telling your computer to launch the game with the same parameters that using the launcher would do.

[PewPew]

Well this is good to know o-o