TERA online has a security problem

Open

Apparently just running the game can put you at risk, because the in-game chat is vulnerable to HTML-based attacks up to and including external code (read: it can be used to spread malware). Whoops.

Sources:
https://docs.google.com/document/d/1reZz6MGHQg_IFUfX__knCQVkvbDnGv384Afj1E3QU6E/edit
https://forums.enmasse.com/tera/discussion/18877/status-of-potential-chat-vulnerability

If you're playing the game, you might want to not log in until this is sorted.

7 years ago

Comment has been collapsed.

6 Comments

AvidWriter

Wouldnt you have to CLICK any html?

7 years ago

Permalink

Comment has been collapsed.

bitcoin

I don't think so, just playing on the server is enough because it is automatically executed. That's how chat works. You don't actually accept or deny any chat messages. Anyone can say whatever they want. At least this is how I think it is. I may be wrong.

7 years ago

Permalink

Comment has been collapsed.

Nanabanana

Depends.

If it's something nasty that can get piggybacked on a known media type, then no clicking is required.
If the chat doesn't guard against embedded javascript, then no clicking is required.
If the chat doesn't guard against cross-site scripting, it can make requests to any server on the internet, which opens a whole host of possible attacks.

Finally, even if you do have to click:

Enough people are stupid enough to do so in general.
Most MMO chats I've seen have ways to link in-game items etc. in chat. Such links can potentially be spoofed, and replaced with harmful stuff.

7 years ago

Permalink

Comment has been collapsed.

Anyasia

Welp, was thinking of heading back in to check out the latest update, but I guess I'll wait. Thanks for the info. :3

7 years ago*

Permalink

Comment has been collapsed.

Avantyr

Video:
YT

7 years ago

Permalink