Security risks?

[tayv]

I am considering a couple of programs, including Fantasy Grounds, to serve as the tool for our gaming group which has become very dispersed. However, I am very concerned about the security of these programs. As I understand it, the host must open ports to allow connection to his PC and use these tools. In doing so, what risks does the host run?

I have read postings about these programs where hackers used the open port to do some real damage. In my case, I have a wireless home network with a number of PCs. All PCs run built-in Windows firewalls and third-party virus checkers, and the whole thing is behind a wireless router using encryption. As I understand it, opening a port will allow someone to access the system and bypass routers, firewalls and other protection. Is this correct?

If so, what is the security risk to the PC hosting the session?
What are the risks to other PCs on my home network?
Are there risks to the connecting clients (whether remote or on my network)?
Finally, is there any way to reduce or eliminate the risk (including other Virtual Tabletop programs)?


Thanks,
Tayv

[Phystus]

Tayv,
FG does require an open port, but so does a web browser. It's just that firewall programs are already configured to allow a browser. The firewall will only open the port while FG is running, so shutting down the host when you're not using it is probably a good precaution.

Since you have to set your router to forward the port 1802 traffic to the host machine, it shouldn't create a risk for other systems on your network.

Someone with more background in network security than I should probably respond regarding the actual threat level, but doubt it's very high.

~P

[EugeneZ]

Hi tayv,

Security is a very difficult topic and many people make careers of figuring out how to secure a computer. It sounds like you desire a higher-than-average level of security, so I recommend you learn more about computer security so that you can decide for yourself what the best approach here is. What follows is my advice, which comes from several years of working as a sysadmin for a telecommunications company, but under no circumstances should you believe that this information or anything anyone here writes is authorative or correct. There's no replacement for good old fashioned research. That said, see below for my advice.


I am considering a couple of programs, including Fantasy Grounds, to serve as the tool for our gaming group which has become very dispersed. However, I am very concerned about the security of these programs.

To begin with, Fantasy Grounds II has not had any known exploits that I am aware of. But then again it is a low-profile target. Exploits for software are found every day for all kinds of software. This is ALWAYS a possibility.


As I understand it, the host must open ports to allow connection to his PC and use these tools. In doing so, what risks does the host run?

Opening a port means you've opened a door into your computer. However, for someone to come through that door, they still need to compromise your system in some way. Here's a quick explanation of why you need a firewall. Without a firewall, you may have a large number of open ports on your machine. An attacker can probe any number of ports until he finds one that is comprimisable. The way this is done is by attempting a digital "handshake" with the port, which will often inform the third party (the attacker in this case) what software its running. This is a problem because operating systems can (and in the case of something like Windows XP, do) have programs running on certain ports that are unpatched and thus targets for exploitation.

So, an attacker just needs to find a port he knows connects to a piece of exploitable software, execute the exploit, and then they have compromised your machine in some way. Usually this is via something called a buffer-overflow, which allows the attacker to force the execution of arbitrary code. He then creates a remote account on your machine, logs in, and does whatever he wants.

A firewall prevents this by simply not allowing third parties through ANY ports. Please note that the user above me, Phystus, is incorrect (I say this with all due respect), as a browser does not require any INCOMING ports to be open (and incoming is all we care about at the moment) because the internet does not connect to a browser, a browser connects to the internet. This is an important distinction. When you, as a browser user, initiate an outgoing connection, you are in control of where that connection goes. So we won't cover outgoing connections. But Fantasy Grounds does require an incoming connection, so, yes, in theory you are opening your machine to attack via port 1802. However, when Fantasy Grounds is not running, there's nothing listening on that port and hence the attacker is powerless. And even if Fantasy Grounds is running, the attacker needs to find a way to exploit the Fantasy Ground code. FG2 is a modern program and most likely it uses some sort of TCP/IP library that has been tested for years against attacks. So I doubt there are any simple exploits. But you must understand the risk that exploits are found all the time. A couple months ago, researchers discovered a security flaw in one of the most trusted and important protocols we use today. NOTHING is immune to exploitation.


I have read postings about these programs where hackers used the open port to do some real damage. In my case, I have a wireless home network with a number of PCs. All PCs run built-in Windows firewalls and third-party virus checkers, and the whole thing is behind a wireless router using encryption. As I understand it, opening a port will allow someone to access the system and bypass routers, firewalls and other protection. Is this correct?

Not quite. If your wireless router uses encryption (there are many types, ranging from awful to pretty decent) then opening a port does NOT circumvent this encryption. That is, if my assumptions are correct and you mean wireless encryption. I highly doubt your router encrypts wired connections coming from the Internet. Because that would mean you can only access sites that know about your encryption scheme. So an attacker using your public IP from the internet does not hit any encryption, regardless of whether you have any open prots or not. A wireless attacker trying to target your router wirelessly from the street will have to break teh encryption, also regardless of whether you open ports or not. Make sense?


If so, what is the security risk to the PC hosting the session?
What are the risks to other PCs on my home network?
Are there risks to the connecting clients (whether remote or on my network)?
Finally, is there any way to reduce or eliminate the risk (including other Virtual Tabletop programs)?


Thanks,
Tayv

So, the big question: what are the risks. That's hard to assess. As I mention above, one risk you face is that with an open port and FG2 running, a very smart and determined attacker could potentially discover a way to "hack" your system. This is incredibly unlikely because FG2 is a closed-source application, has a VERY low security profile, and appears to be written using mdoern libraries. I believe this covers both third-party risks from attackers unaware of your specific situation as well as your own players (who you must assume are already comprimised) trying to exploit FG2 after connecting using FG2's communications against it.

Frankly, if you have a wireless connection at all, I personally believe that is a much higher risk for you than opening a port to Fantasy Grounds. Let me know if you have any more questions or if something I said didn't make sense.

[Phystus]

Yep, good point about a browser only opening an outgoing port. My bad.

~P

[Dachannien]

For lack of a better analogy, imagine a bank with a huge row of bank teller windows each protected by bulletproof glass with one of those speaking vents in them. Some of the windows have bank tellers behind them, while others just have a "closed" sign.

This bank is your computer, and each bank teller window is a port. Each teller is a program running on your machine listening for incoming connections at one or more ports.

Now, if someone wants to rob your bank (i.e., hack your box), they can't just go up to one of the closed windows. There's no teller there to listen, and they can't jump over the counter. They have to go up to a teller, determine whether they're vulnerable, and convince them to hand over the loot. If there's a weakness in the system, it's the teller's fault. In other words, in order to hack your system, one of the programs listening on a port has to be vulnerable.

What a firewall does (such as ZoneAlarm or Windows Firewall) is set up a fake wall in front of some or all of those windows so that someone coming into the bank doesn't see the teller windows at all. If all of the windows are hidden, they may not even realize there's a bank there. This is sometimes called being "stealthed". There could be a vulnerable teller standing behind the window, but without access to the window, they can't be exploited.

When you run FG, it's like a teller showing up for work and parking themselves behind their assigned window (number 1802). When the teller shows up, the guy who manages the fake walls (the firewall) may ask you whether you want the fake wall removed from in front of that window (this is what ZoneAlarm does with the popup bubble that asks if you want to allow or deny a program to act as a server). If you say yes, then the fake wall is moved, and customers (your players connecting with their computers running FG) can go up to the teller and do business.

If FG isn't running, you generally don't have anything to worry about. While your firewall may leave the port unstealthed, there's no program listening there (i.e., the port, or teller window, is closed). If FG is running, then the only thing to be concerned about is whether there is a vulnerability in FG that would allow an attacker to do damage. So far, we've never heard of any such vulnerability, and even if there were, so few people run FG compared to any of numerous known-vulnerable programs that it would be a waste of time for an attacker to check for it.

EugeneZ's explanation is much more thorough than mine, but I thought an analogy might help if you're unfamiliar with networking.

[EugeneZ]

That's an excellent analogy Dachannien, thanks! Probably helped a thousand times more than my muddled jargon. I'll have to remember that one.

[Griogre]

I have to agree EugenZ, that is a very good analogy, Dachannien. I also second EugenenZ's comment that by far the bigger security risk is your wireless setup. Wireless setups even with encryption are simply not secure.

If you are comfortable running a wireless router then the risk of properly opening your router and PC firewalls to port 1802 port forwarding the port to your PC and running an FG server is less than that of running a local wireless network. However, as was already pointed out, there is always *some* risk. The risk can be managed better with properly configured firewalls and up to date security software as well as making sure your OS and other application software have the latest patches.

Another analogy you often hear about how ports work is the old fashion operator controlled telephone switchboard of the 40’s where the board would ring, the operator would answer and determine who the call was for, and then operator would plug in a line to connect the incoming call with the right person.

The board ringing is anything from outside your local network calling trying to connect on an open port. The operator is your firewall(s) determining if a connection should be made or if it was just a crank call (hacker) or wrong number (random net noise usually) and the lines the operator connects to the ringing board is the port forwarding to the right application expecting the connection.

[tayv]

My thanks to all of you for answering. These were very detailed replies and I appreciate the time you took to post them.

If I understand this correctly, even with a port open, unless there's a listener on that port, and unless that listener (in this case Fantasy Grounds) has an exploitable flaw, then I should be safe with these programs, especially if I open the port only when needed and close it afterward. (So, just having a port open doesn't necessarily expose me to risk?)

As for the wireless network, I've had that for 3 years and never had any security problems; I invited all my friends with wireless laptops to try and unless I gave them the key they'd never get through. Not that a hacker couldn't, but beating the encryption key seems more problematic than going through a door that's already open and trying something nasty.

Many thanks again for the explanations.

[azbo]

beating WEP is just a matter of "listening" long enough. unfortunately if someone within range of your WEP/WPA encrypted network they just need to watch a certain volume of traffic before the key is exposed. the more traffic on your LAN the faster they "see/hear" enough packets to unlock the key. Never think for an instant that your wireless lan is safe.

The best thing to do is turn off the wireless (this can be done by logging into the router) when people are not using the network wirelessly and advocate wired connections when possible.

The other thing you can do in some routers is key the specific mac addresses into the router though I believe this can be spoofed as well.

[Davorious]

Having been a victim of a hacker that exploited my Fantasy Grounds rule, I can tell you that it can happen. According to the logs on my router, it took some time for him to exploit this opening but he was finally able to access my computer. I lost the computer that hosted the account, another computer that shared a network drive, my off-line storage, and a laptop that I used to test the repair/cleaning that I attempted before I gave up and trashed everything. Total loss, just over $2000 and 2 TB of saved data.

I have found two ways to protect myself that might make you feel better. First, I only activate the rule when I am hosting a game. When I am done, I close the hole. Second, when I am done with the computer, I turn it off. I was hacked just after Christmas and have had no additional problems since then following these precautions.

[Trenloe]

That's a shame you've had issues and lost data. But, if you only had a port forwarding rule for port 1802 on the router, the router firewall was running and the port forwarding was just port 1802 on the WAN IP address (router public IP address) to port 1802 on your computer and nothing other than Fantasy Ground was listening on port 1802, then I honestly don't know how this hacker did any damage - let alone the damage you mention.

[damned]

hi davorious - im very interested in this. can you share the logs? obfuscate your ip's with find/replace. very few routers will provide much meaningful info. are you sure it was fg that was the entry point? if so these logs would be of great assistance in fixing whatever vulnerability was exploited.
imho it is very likely that all applications are exploitable - however in most cases these exploits are found by reverse engineering or by brute force application of thousands and thousands of malformed packets. i think its incredibly unlikely someone would do the former to fg - the latter is certainly possible...
many firewalls can do something called stateful packet inspection - that is they dont just look at where a packet is coming from and where it is going to. they also look at what is happening inside that communication. if the firewall sees too many incorrect communication attempts it can be configured to start dropping/blocking packets. unfortunately for spi to work someone has to teach the router what a normal converstaion looks like for each application - and i doubt there are any firewalls aware of fg.
far and away the most common form of entry into someones system today is via a trojan deliverred by malware/javascript/prompt/download - often from hacked websites or p2p services. many firewalls do not block these type of attacks. most antivirus applications fail to block a huge number of these attacks.

hi tayv - on the wireless topic - your wireless is indeed hackable - even wpa2 is hackable by a number of tools. fortunately your wireless has only a limited range whereas any open port on your system can be targeted by almost anyone anywhere around the world.
another solution for you is to use a free vpn connection like hamachi to run your game inside of. you do then also have to trust hamachi arent up to anything sinister, and havent themselves been hacked.

[ddavison]

Having been a victim of a hacker that exploited my Fantasy Grounds rule, I can tell you that it can happen. According to the logs on my router, it took some time for him to exploit this opening but he was finally able to access my computer. I lost the computer that hosted the account, another computer that shared a network drive, my off-line storage, and a laptop that I used to test the repair/cleaning that I attempted before I gave up and trashed everything. Total loss, just over $2000 and 2 TB of saved data.

I have found two ways to protect myself that might make you feel better. First, I only activate the rule when I am hosting a game. When I am done, I close the hole. Second, when I am done with the computer, I turn it off. I was hacked just after Christmas and have had no additional problems since then following these precautions.

What makes you think the opening of Port 1802 or allowing FantasyGrounds.exe through your firewall allowed a hacker to compromise your system?

If you left port 1802 open when you were done running FG, then what could possibly happen? Without an application listening on that port, any traffic or data sent to that port would be ignored by the host computer. Normally, hackers try to locate a listening application on an open port and then try to exploit a buffer overrun weakness that allows them to run new code. A hacker could not create a listener unless they already had an exploit running on the inside of your network already. If that was the case, they could have used any open port to communicate. Why wouldn't they simply use port 80 or one of the other ports that are always open?

The most common way a consumer gets hacked when they have a firewall set up and running is by downloading and running a trojan horse application. These are often times linked with pirated versions of games, cracks and exploits and they compromise the user's system while seeming to provide the user with a benefit. Once you've installed or launched it, you basically told your system to allow it to run with your security level. They can install other applications like key-loggers (to record all your keystrokes.. i.e. password, user ids, bank account numbers, etc), send data to listeners outside your network, broadcast your vulnerability to hackers, etc.

1. Keep your firewall enabled and only open ports for applications you need to run.
2. Don't open wide ranges of ports. Just the specific port
3. Don't run software you get from untrusted sources.
4. Use the alias feature so you aren't broadcasting your external IP address to everyone

You should be fine.

[Davorious]

I don't have the logs anymore. In my attempt to clear out his path, I have spent many hours resetting the data.

The logs showed that I was getting port scanned over and over again. This an a combination of DOS attacks against my IP address.

The final log showed a rule match with my firewall rule. This is what got me checking my system for file acces. I found an additional admin account on my computer with matching date time stamps to the logs. It started as a trojan but wrote itself to my the bios on my motherboard, video card, and the flash on my router.

Don't know why I was targeted as I am not associated with any agency, company, or university.

Just know that I can't completely obliterate the coad he loaded.

I do know that when I booted my computer after reloading Windows Vista and patching, that the splash screen and background still show an illegal copy of Windows 7. I reloaded Windows Vista as Microsoft now has a limit on the number of times you can reactivate a copy of Windows 7; even if this happens do to reinstallation on the same machine.

In regards to ddavison, that is also what I thought. After reviewing the logs, they showed that this went on for over a month. I suspect it was a both. Until the rules match happened, I was safe. Don't know how he entered after the rules match. Wish i did, as I would consider this into my current and future security concerns.