Update: Elder Scrolls Online May Have Day One Vulnerability

[Fanghawk]

Update: Elder Scrolls Online May Have Day One Vulnerability

All games developed by Bethesda since 2001 carry a security exploit that may put Elder Scrolls Online's launch at risk.

Update: Since The Elder Scrolls Online is being developed by ZeniMax Online Studios <a href=http://elderscrollsonline.info/news/about-game-engine>and uses "its own unique engine", there is little chance this particular vulnerability will exist in the finished game.

There are two generally accepted facts when it comes to Bethesda's RPGs: <a href=http://www.escapistmagazine.com/articles/view/editorials/reviews/previews/10239-The-Elder-Scrolls-Online-Preview-Mud-Crabs-Joe-DiMaggio.2>They feature vast worlds that players can explore for hours, and <a href=http://www.escapistmagazine.com/news/view/112719-Bethesda-Sometimes-Doesnt-Fix-Entertaining-Bugs>those worlds will be filled with various bugs. Such quirks are par for the course in single-player games, but they could create all-new problems for the MMO setting of Elder Scrolls Online. A security analyst poking around the developer's back catalog has discovered a vulnerability within Bethesda games stretching back to 2001. While the exploit was relatively harmless for single-player titles, the same code within Elder Scrolls Online could subject players to security and privacy risks when it launches later this year.

This exploit is a format string vulnerability, which allows users to manipulate the game's running stack. By activating specialized functions using the developer's console, players can display information hidden in the program's memory or, with a few keystrokes, crash the game to the desktop. The exploit has been tested using Morrowind, Skyrim, and even Fallout 3, although abuses would be understandably rare in single-player games. Trouble is, if Elder Scrolls Online uses the same code, potentially any user could access the functions of other systems, or perhaps the server itself.

So let's say the exploit is included in Elder Scrolls Online: What's the worst that could happen? The most likely answer is an increased risk of DDoS attacks on servers, which would prevent anyone from being able to play their recently purchased game. One could also activate administrative privileges for their characters, or even more concerning, display the account passwords of other players. That said, now that the exploit is public knowledge, hopefully Bethesda can patch any offending code before its game reaches the public. Not only would that make the launch easier on players and staff alike, but it would prevent an MMO launch disaster <a href=http://www.escapistmagazine.com/news/view/117262-Server-Issues-Mar-Diablo-IIIs-Launch>comparable to Diablo III in its scope.

Source: Joe's Security Blog, via <a href=http://www.warcry.com/news/view/123950-The-Elder-Scrolls-Online-In-Danger-of-Code-Exploit-Armageddon-at-Launch>Warcry

Permalink

 

[MephistosCousin]

Allow me to quote what i said on the Facebook comment section on the article.

"ELDER SCROLLS ONLINE IS NOT BEING DEVELOPED BY BETHESDA! JUST PUBLISHED BY IT! (They do however have most creative control over it)."

 

[Limos]

This game is not made by Bethesda.

This game is not built in the same engine as any of the previous games.

This is a very silly article.

 

[Tradjus]

As other posters above have indicated, this article is absolute bunk.
I really feel that this one should be removed, it's so obvious too anyone with even a passing knowledge of these games that there is no way that this vulnerability will be present because the games are being developed by different companies with different engines, unless this vulnerability is present on the Hero Engine used too develop SWTOR as well? ( It isn't )

 

[Parakeettheprawn]

This game is not made by Bethesda.

This game is not built in the same engine as any of the previous games.

This is a very silly article.

Exactly. The game is being built from the ground up by Zenimax. TES engine would not work well in an MMO set up.

 

[Jayemsal]

Remove the article, it is nothing but bunk.

I've seen better journalism in a KKK newsletter.

 

[synobal]

That is some pretty wild speculation, not to mention baseless. Also does this mean the Elders scrolls MMO is coming out soon?

 

[Frostbite3789]

"ELDER SCROLLS ONLINE IS NOT BEING DEVELOPED BY BETHESDA! JUST PUBLISHED BY IT! (They do however have most creative control over it)."

Bethesda published games are also known for being so VERY bug free!

See: New Vegas. Brink.

 

[ohnoitsabear]

"ELDER SCROLLS ONLINE IS NOT BEING DEVELOPED BY BETHESDA! JUST PUBLISHED BY IT! (They do however have most creative control over it)."

Bethesda published games are also known for being so VERY bug free!

See: New Vegas. Brink.

That's not the point. The point is that the odds of this specific security vulnerability being in there are slim to none, because there's no reason to believe that this game would have any of the vulnerable code, seeing how it's being made by a different developer and (almost certainly) using a different engine.

 

[RicoADF]

This game is not made by Bethesda.

This game is not built in the same engine as any of the previous games.

This is a very silly article.

Not silly, plain and utter stupid. Seriously does no-one working at the Escapist have any idea how game development, game engines and publishers work? Urge to wander off to a competent website....... rising.

Captcha: brush your teeth - fine if you say so captcha.... jerk

 

[Ticklefist]

Okay fine. A Wordpress blogger can crash his Bethesda games with a console command. I believe it. MMOs don't give players access to the console so it's a moot point. Really, no effort was spent investigating the likelihood of this claim before this article was posted.

 

[tangoprime]

I hear that the previous few Elder Scrolls games also had a zero day exploit players could ue to alter the game to their benefit, called a console. Since it was in the others, it's likely to be in ESO too, right? Players could thus potentially exploit this "console" to level themselves, add items, and even kill other players or npcs!

^ Logic used by the article. Seriously, I'll add my +1 to the request to have this article removed.

 

[Ed130 The Vanguard]

I think I've played around with game stacks trying to get mods or quests to complete, it isn't that big of a deal.

Bethesda games have a history of being moddable and having dev functions like the console available for players to fiddle with.

I with the other posters on this. This article isn't very good.

 

[Neverhoodian]

In other news...

Spoiler

Come on News Room, you're better than this.

 

[Legion]

+1 to the "Why is this even news?" crowd.

Different developer
Different engine
Different type of game

There is no logical reason to assume this kind of exploit has any possibility of being used.

This comes across as sensationalism purely for the sake of generating views.

 

[carlh267]

Wait, I thought Bethesda was only-

Allow me to quote what i said on the Facebook comment section on the article.

"ELDER SCROLLS ONLINE IS NOT BEING DEVELOPED BY BETHESDA! JUST PUBLISHED BY IT! (They do however have most creative control over it)."

Well, guess I was right. If anything, the problem ToSO will have on launch is not having enough servers to meet demand, like we have been seeing recently with the more infamous Simcity and Diablo 3 debacles.

 

[Price0331]

I logged in just to add to the other crowd that this is a completely baseless and terribly researched article. Really brings down my perceptions of The Escapist, different engine and dev team entirely for ESO. Come on, if I was Bethesda's PR team, I would be pretty upset at you guys.

 

[NLS]

Yep, different developer and different engine. The article should just be removed or be marked with a huge disclaimer stating its nothing but pure and terrible speculation, before some other "news site" picks this up and starts spreading it around.

 

[Xyebane]

Does anyone really think you are going to have access to the developer console for ES:O like you do in the single player games? Really?

 

[James Joseph Emerald]

Yeah... in future, maybe you should ensure your articles are based on a bit more than the random musings found on some guy's blog.