I hope you don't say that because Microsoft runs it? Prior to MSN moving
to an entirely web based format, it use to be the MSN Gaming Zone (and
formerly MS Internet Gaming Zone). Microsoft's game code was buggy to
say the least and dice manipulation was very possible at the time. I
created a series of exploits for a number of their games, but the
Backgammon dice hack was the most notable. I doubt I was the first
person to discover the flaw, but I was the first person who went looking
for flaws with the sole purpose of sending them to MS to have them
fixed. I did demonstrate the flaws to a public audience.
That was just over a decade ago, and just for shits and giggles I dug up
the email I sent (minus the code attachment) that finally got Microsoft
to start acknowledging and fixing the problems. They did eventually
resolve the dice problem, but I can't tell you if their current software
is exploitable or not. But just because it says Microsoft don't assume
their code isn't exploitable:
Subject: Dice Exploit Program and Info
Date: Sat, 26 Jun 2004 16:39:22 -0600
From: Michael Petch <
mpe...@capp-sysware.com>
Reply-To:
mpe...@capp-sysware.com
To: Zurich <
webm...@memberplushq.com>, Wendy <
zma...@microsoft.com>
Hello Wendy and Zurich,
Attached to this email is a copy of the Dice Manipulation program
as well as the added feature of showing the information that can
be used to cheat in Cribbage as well. My full contact information is in
the ZIP file. Anyone you give this information/file to is free to
contact me.
To use this program create a new program directory anywhere on
your system. The unzip (I use Winzip to create the archives) the
contents of the file into that directory.
You must then follow the instruction in the README file inside the
archive. Failure to follow the instructions will mean the software will
not function. If there is any problem installing and or using this
software, my contact information in the README.txt file (Contained in
the Zip file)
The readme file in the ZIP file also discusses what Messages in the
protocol in Backgammon are being exploited. However below is a more
verbose description designed for non developers that may also be of
use.
Actually if a developer replaces "Message X" with "Message 0x105", and
"Message Y" with "Message 0x106" in the information below, it details
exactly what the weakness is, and how it was exploited. I should point
out that I did two versions of this hack. The first one didn't work as
well, but it was still effective and is also mentioned. The first
version didn't require modification of the DLL.
The DLL contained in the ZIP file (Backgammon.dll) simply disables the
request for the dice (message 0x105).
========================
As for the ease of fixing the dice hack. Actually probably much easier
than you realize. In non technical terms this is how the zone currently
does things:
When a player clicks the dice to roll - Message X is sent
to the server requesting a pair of dice. Message Y is then sent
from the server to BOTH clients simultaneously saying Player[n]
rolled roll1 and roll2.
------
Hack #1) My first hack I made no modification to the zone code (dll's).
What I tried on a hunch was - When I receive Message Y from the server
telling me what my rolls are - what happens if I change the values
before the backgammon client displays (and processes them). In fact this
is exactly what I did. I intercepted Message Y modified the data packet
before delivery to MY backgammon client with the rolls I wanted and
Voila dice hack. The reason the original version showed my opponent the
original roll was because Message Y was sent to his client from the
server (And I could not alter what the server sent). My opps client is
sent a message when I make a move with my manipulated dice, but doesn't
seem to make a validity check that what I was sent from the server as
rolls corresponds to my actual moves.
Hack #1 Fix) When a player makes moves - the opponents backgammon client
should validate that the move made corresponds with the roll from the
server. Error checking and validation is the root cause for hack #1. I
can't believe that such a validation check would be very difficult at
all.
-------
Hack #2) Originally I didn't intend to modify Zone DLL's. People kept
asking me if the dice could be manipulated and have the rolls appear
properly. I wasn't actually interested in pursuing this originally, but
changed my tune when I realized an interesting anomaly regarding Clients
sending Messages to the server. What I learned was that I can send a
message ABCD to the server. This message is not understood by the server
or the clients but I can still send it. When the server receives Message
ABCD from my client it sends that Message back out to all the kibbers
and all the players. It doesn't seem to care what it is sending. This
got me to thinking - what if I send out a message to the server that is
known - and sure enough it blindly (or pretty much) sends it out to all
the clients.
Well imagine this. Imagine modifying the backgammon client to not send
out Message X when the person requests a dice roll. This requires a 1
byte change in the backgammon.dll. So if you run this modified dll when
you click on the dice they just keep rolling and rolling and rolling
(like they do for a while when there is lag). The dice stop rolling when
the server receives the actual dice rolls (Message Y).
Okay, so I have not sent out message X for a dice request. But what I
decided to try is - Send Message Y to the server (This is the message
the server sends telling everyone what a player rolled). I learned how
to create a valid Message Y and populate it (Actually not complex at
all) with the dice rolls I want.
SO what does this mean. Well since the server isn't really checking the
contents of messages and sends them to all the players and kibbers, it
doesn't care that I just sent a hacked Message Y to the server and
happily sends it out to my opp and the kibbers. What this means simply
put is that I avoid asking the server to roll any dice for me, and I
generate the dice rolls and send them to the server which in turn sends
them to my opp and the kibbers.
Hack #2 Fix) I think this is rather simple. Don't allow Message Y (Which
should only be generated by the server in response to Message X) to be
sent from the backgammon clients (of the players or the kibtzers). If
this check were done, then the server would take appropriate action
(appropriate action is usually to boot the player from the room - just a
boot, no grey box - just a boot).
This in my opinion is very simple check and would easily thwart this
hack.
----------
In general The server (and clients) require more validation checks to
make hacking less likely. For instance kibbers can send messages to the
server that get sent out to all the people at the table. At present it
appears you can send a message (as a kibber) to the server that says
player x resigns to player y (This may have been fixed just recently -
as this was one of the attacks by the script kiddies in May). The server
should check that messages from any one are in fact a valid context
(Kibbers should not be able to successfully send messages that only
apply to the players etc)