I plan to look at other games with very high install bases (100M+) in the coming weeks.
Show this thread
All Blizzard games (World of Warcraft, Overwatch, Diablo III, Starcraft II, etc.) were vulnerable to DNS rebinding vulnerability allowing any website to run arbitrary code. 
https://bugs.chromium.org/p/project-zero/issues/detail?id=1471 …
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
still no word from
@Blizzard_Ent on this Tavis? That's extremely disappointing. -
They were communicating, and then just stopped
. They didn't even notify me they were shipping a patch, I had to bindiff it. - 1 more reply
New conversation -
-
-
how can they get the process exe name from the http connection?
-
GetExtendedTcpTable()
-
so they list all network connections and filter out by remote port? is that something people normally do to workaround this sort of vulns?
- 1 more reply
New conversation -
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
uh is it just me or does that blacklist omit Edge.
-
I think Edge has localhost loopback disabled by default, but yeah, seems like it's missing
-
Also all the various in-game browsers used by e.g. Steam, Origin, ... Not to mention Brave, Vivaldi, ...
End of conversation
New conversation -
-
-
What does this mean (in English)
-
Blizzard are being dicks to security researchers is the TL;DR version.
-
Allegedly*
-
It’s not a crime and I believe tavis so not allegedly just dicks.
End of conversation
New conversation -
-
-
-
I guess all those other guys who threaten to hax me after I win have something going after all xD Maybe we should calm down on the BM
End of conversation
New conversation -
-
-
Is MacOS vulnerable to this attack? Your list of whitelisted executable names all end in ".exe", which is a windows-specific file extension.
-
(Perhaps that's just because Tavis chose to diff the Windows binary, and there'll be a macOS update too with different filenames?)
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.