Metal Gear Online brought back to life by professional hackers

The problem with games designed to be played online is that they can be shut down by their publishers. Decisions that often make commercial sense for the publishers a few years down the line, but which still have an impact on any remaining players.

One such game was Metal Gear Online (MGO), which shut down in 2012, four years after it launched. Yet in 2014, the game has been brought back to life by a group of ethical hackers, working under the SaveMGO banner.

Later this week one of the researchers, Joseph Tartaro from security consultancy IOActive, will detail the techniques his crew used to get Metal Gear Online back online for its fans to enjoy.

Tartaro, who will deliver his ‘Cyber Necromancy’ talk at the Brucon conference alongside fellow security technician Matthew Halchyshak, told the Guardian that as many as 80 people are playing MGO every day thanks to the group’s work. And he predicted that other games will be resurrected in the same way.

The group’s aim was to create a server that would effectively trick PlayStation 2 and PlayStation 3 consoles into believing they were speaking with the old official server. In the case of the PS3, the researcher believes this could be the first private server to host multiplayer melees on the console.

The team started with the PlayStation discs themselves, taking a look at the executable files that make the game run.

They figured out how the code worked – reverse engineering it, and then did something similar with the network protocol determining how the consoles communicated with each other, and the now-defunct remote server that once hosted the multiplayer games.

The process was rather tedious because the original online server was no longer available, said Tartaro. The team had to use educated guesses in pushing various pieces of fake data to their consoles, and then using the responses to craft adequate private servers.

This, Metal Gear Online came back to life, initially for PS2 last year, and then for PS3 just over a month ago. In a gaming context, “cracking” is often discussed in the context of piracy, but in this case, the encryption was being cracked in order to help fans of the game play it once more.

“We broke the encryption for the network protocol, as well as the file encryption, but the network protocol was the only one necessary to get it back online,” said Tartaro.

There are a few caveats to this project. Anyone wanting to play MGO again on PS3 needs to be running a hacked console, although for the PS2, a cheat device like Code Breaker will suffice, as well as a rooted console.

The SaveMGO group is providing information about how to modify consoles on its website, but Tartaro recommends that people don’t tinker with the hardware themselves, but rather acquire a downgraded console to install the necessary custom firmware.

These issues arose largely because the SaveMGO project involved altering or patching the game files, with unsigned code unable to run on non-jailbroken consoles.

The team is hoping to find a vulnerability in the game which they could exploit to make hacked consoles unnecessary. “There’s no easy security bypass or vulnerability that I’ve found so far,” said Tartaro.

He also suggested that many other older online games could be brought back to life using similar tactics. “In the end, you’d be able to do this to any game,” he said, pointing to similar work on Pro Evolution Soccer 6 and Resident Evil Outbreak.

The obvious question: what will the original games’ publishers make of these efforts? The SaveMGO group has sent tweets to MGO publisher Konami to make them aware of the not-for-profit project, and are hopeful of avoiding a copyright fracas.

• Replica of Nintendo’s classic NES console goes on sale

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.

Russian malware used by 'privateer' hackers against Ukrainian government

The malware, known as BlackEnergy, has been used in cyberattacks to steal credit card data. Photograph: Jutta Klee/© Jutta Klee/ableimages/Corbis

A hacker tool popular across underground Russian crime networks has been used in attacks on the Ukrainian government, indicating the use of “privateers” for digital espionage, according to researchers.

The malware, known as BlackEnergy, appears to have been used in cyberattacks against Georgia during the Russo-Georgian conflict of 2008 too, but has also been operated by criminals as a means to steal credit card data.

This summer, it was tailored to hit a number of Ukrainian targets. Researchers from security firm F-Secure said Ukrainian Railways and infrastructure related to government bodies in Dnipropetrovsk, a city in the southeast of Ukraine, were in the crosshairs of the hackers. The researchers uncovered the hackers’ use of proxy servers - used to reroute internet traffic - linked to those targets’ networks.

The current “working theory” is that the attackers were carrying out hits on a wide range of targets to earn themselves a living, but were “somehow co-opted” into carrying out state espionage, F-Secure’s Sean Sullivan suggested to the Guardian. “They used to steal credit cards and now they have a different kind of buyer,” Sullivan added.

Victims were sent emails containing documents that ostensibly offered information on Russian plans to take over the world, said researchers from another anti-virus firm ESET. One appeared to be a story from the Guardian, entitled ‘Russian ambassadors: next we’ll take Catalonia, Venice, Scotland and Alaska’. Though this was a genuine article online, anyone who clicked on the associated Word file would open themselves up to BlackEnergy infection.

The malware can scoop up reams of information from victims’ PCs, including passwords and system information. “The nature of the information being gathered seems to be generic rather than targeted. This may be because the malware has roots from crimeware,” F-Secure’s report read. “The information is still useful however as such data makes it easier for the gang to plan any further attacks on the same targets.”

Sullivan said many of the targets were using an old form of anti-virus protection, where “signatures” or markers of malware are used to blacklist them and ban them from the network. The BlackEnergy hackers, just like most cybercriminals on the planet, have tweaked their code so anti-virus won’t recognise them as there is no corresponding signature.

“The attackers don’t need a lot of sophistication to get round a 2001 technology,” Sullivan said.

The so-called Quedagh gang behind the attacks has been operating since 2010, F-Secure said, but their tools have been used by various cyber criminals since 2007.

There is much suspicion around Russian government involvement in cyber attacks on foreign entities, especially those related to the current conflict in Ukraine. UK defence contractor BAE Systems reported in March that Ukraine was facing a barrage of attacks from digital spies as tensions escalated between the two countries.

The FBI is investigating whether Russia backed recent attacks on US banks, including JP Morgan, in response to sanctions imposed by the west since the Putin regime’s support of rebels in the east of Ukraine.

View the original article here

This post was made using the Auto Blogging Software from WebMagnates.org This line will not appear when posts are made after activating the software to full version.