It was only a matter of time. Now, CSO Online reports that a flaw in the game development platform Unity — specifically the Unity Web Player — could allow malicious actors to bypass its cross-domain policy and access everything from email accounts to social media profiles without the need to authenticate login details. While this is worrisome for the 600 million potential victims worldwide, the plug-in problem points to a bigger issue: Third-party tools, libraries and components often have too much access and too little security. With malware creators wising up to the sheer number of vulnerabilities present in both new and legacy software developments, players and companies alike need a new game plan for staying safe.
United We Fall?
As noted by CSO, the Unity engine is used by a host of developers to create Web-friendly 3-D content that displays across mobile devices, desktops, gaming platforms and Internet browsers such as Internet Explorer, Firefox, Chrome, Safari and Opera. To access any Unity-based Web apps, users must install the Unity Web Player, which contains a cross-domain policy designed to prevent access to any resources from other domains.
However, Finnish security researcher Jouko Pynnönen found a hole in the plug-in that allows a malicious app to change the rules and access outside sites. Pynnönen built a proof-of-concept app on the Unity platform and then demonstrated that he could access users’ Gmail accounts as if they were already logged in and active. Such an exploit requires users to download and install the malicious app, but the consequences are far-reaching. Pynnönen believed Unity didn’t take the problem seriously until he released the vulnerability and now claims an “improved security response” is being developed.
Tip of the Iceberg
The Unity flaw offers an excellent proof of concept for one of the most worrisome problems facing companies today: the use of third-party or open-source software in mission-critical applications. Consider the case of VPN service Hola, which developed a browser plug-in to bypass region locks on Web-based content. Not only has the company come under fire for using the networks of those who use its free product as exit points for paid subscribers, according to another article from CSO Online, but this “poorly secured botnet” comes with several exploitable flaws that malicious actors could use to gain code execution or even escalate privileges on a victim’s computer.
Another case in point is CMS giant WordPress, which powers almost 25 percent of the top 10 million websites across the globe. According to Infosecurity Magazine, over 100,000 WordPress sites were compromised thanks to a plug-in vulnerability, with Google blacklisting more than 11,000 domains. In fact, recent research from the IBM Managed Security Services (MSS) Threat Research Group found that 20 percent of the 50 most popular plug-ins for WordPress were vulnerable.
The problem? Sheer diversity of development. In effect, there’s no guarantee that any of these software developers have expertise in IT security or have taken the proper steps to test their creations before setting them loose on the market. What’s more, WordPress runs on open-source PHP code, giving malicious actors a massive attack surface if they decide to go after the CMS.
Building on Plug-In Security
Ultimately, companies need a new strategy when it comes to third-party security. Just because a plug-in is popular or comes attached to a big-name software tool is no guarantee of safety or rigorous testing. Instead, businesses need to develop robust testing plans that cover plug-ins, libraries and all third-party components to help limit the chance of unpleasant surprises such as unauthorized logins or code execution. In many cases, companies don’t have the manpower for this new security tactic in-house. Leveraging a trusted partner to provide cloud-based security testing is one way to bridge the gap without breaking the bank.
The new Unity flaw puts players at risk, but that’s just a start. Companies across the globe face the specter of “game over” flaws in some of the most popular plug-ins available. Bottom line? It’s time for a new game plan.