Why NetHack?

There's a lot of software out there to explore, so a good first question is why would I pick NetHack as a place to focus my security research? A few reasons:
  • It's open source, making research easier.
  • I was already somewhat familiar with the code as I was the CS department administrator for NetHack during my time at Brown.
  • It's hosted on public servers like nethack.alt.org and hardfought.org, meaning it's theoretically a target for real attackers.
  • It had a history of publicly disclosed security issues, which suggested that it was possibly a good project to research and also that, if I found anything, the developers would be supportive.
  • It is written in C (K&R even!), and was written predominantly at a time when common security practices (like strlcpy or snprintf) were not really top-of-mind for programmers.
  • Many researchers are focused on software that offers bug bounties. We all have to eat, after all. Open source games like NetHack don't offer bounties, nor could they, really, given their development models. As a result, they were basically getting ignored by the security community.
  • It's one of my favorite games! I enjoy playing it and it's always more fun to work on something you care about.
One more thought on the public servers: as much as I enjoy the game stand-alone, it's significantly better played online. Sure, it's a single person game, but the servers add game logging, global metrics, tournament play, shared bones files, cloud hosting of your saved games, and more. It would be a real loss to the community if these servers ever had to come down because they were pwned by the North Koreans to mine bitcoin, or whatever. If I could do something to make these servers safer, it seemed worth doing.

Comments

Post a Comment

Popular posts from this blog

Dungeon Crawl Stone Soup

Dungeon Crawl Stone Soup , aka DCSS, aka “crawl”, is an open source Rogue-like game, available at https://github.com/crawl/crawl . Public DCSS servers ( crawl.kelbi.org , crawl.develz.org , crawl.akrasiac.org , underhound.eu , crawl.beRotato.org , lazy-life.ddo.jp , webzook.net , crawl.xtahua.com , crawl.project357.org ) allow users to play DCSS without compiling it or installing it on their own system. On these servers, before starting a game players can upload their own .crawlrc configuration file. These files can include Lua 5.1 scripts, and the global environment for these scripts includes the load and loadstring functions. load and loadstring can be used to load not just other Lua scripts, but also valid or invalid Lua bytecode. Although Lua 5.1 includes a perfunctory bytecode verifier, there are known weaknesses in that verifier which have been well documented in the security community.
Read more

DoSing a Public NetHack Server

What AFL found During fuzzing (as described here ), AFL reported a hang on this .nethackrc line: MENUCOLOR=0+++++++++++++++++++++++++++++++++++++++++=blue This line is saying that if a menu item matches the regular expression (in this case, one or more ‘0’ characters), then that line should be colored blue in the UI. Only one ‘+’ character is needed to express this, but if you string many ‘+’ characters together, NetHack will hang. I was also able to reproduce the hang with MSGTYPE and AUTOPICKUP_EXCEPTION lines. So why does it hang? NetHack 3.6/3.7 has a pluggable API for regular expression engines in sys/share . Three implementations of this API are included in the source: posixregex.c – Uses the POSIX API from /usr/include/regex.h , which is implemented via the platform’s libc. This is the default on Unix. cppregex.cpp – Uses the C++ standard library available in <regex> , which is implemented via the platform’s libc++. This the default on Windows. Obviously, ...
Read more

NetHack 3.6.6, or, How to Glitch NetHack

The NetHack DevTeam released NetHack 3.6.6 on March 8, 2020, primarily to address CVE-2020-5254 , which  I reported to them on March 3. Although most of my report was focused on security--and indeed I was able to get full remote code execution (RCE) on pre-release NetHack 3.7 (but not 3.6.5)--I actually thought the more interesting finding was how to exploit the bug as a glitch.
Read more