ID Officially Announce Doom 4

In a somewhat surprising move, ID Software today announced they had begun development of Doom 4. This is not particularly earth shattering in itself given the spate of recent rumours to this effect, however the reason it surprised me was that ID Software are already fairly far into a project named ‘Rage‘ which appears to be a post-apocalyptic vehicle slash first person shooter based on ID Software’s Tech 5 Engine, currently in development. Whilst is would not be unusual to ID to be working on two games at the same time using the same engine (Quake 4 / Doom 3 anyone?), given the rumours circulating about a new Quake game, I didn’t think we would be seeing another Doom game so soon.

Judging by the Careers page, the extra staff ID Software are taking on for this project will be require ‘applicable skills’ for developing for PC, Xbox 360 and PS3 platforms indicating ID Software are looking to make this a multi-platform game in much the same way as Doom 3 which was also released on the Xbox. This is, however, just early supposition on my part at this stage.

Doom 3 was criticised for being too dark, too broody, too linear and having too little variation. I disagree, having found it atmospheric and a lot of fun to play, but what worries me, is where ID takes us from here. Quake 4 didn’t really do it for me, I preferred Doom 3 for a number of reasons. The story was simpler and more elegant as was the environment. Whilst being a colonial marine and interacting with other marines and military equipment was fun in Quake 4; it felt a little over done and I never really bought into the whole Quake universe past Quake 2. There were, however, moments which I genuinely enjoyed not just because they brought something fresh into the ID-style FPS genre but also because they were quite unexpected. (Those that have completed Quake 4 will know of the Hospital section I am referring to!)

Doom 3 really was a no brainer in that it was classic Doom style game play with a modern engine, I will be decisively underwhelmed if ID are planning to just update the graphics for Doom 4.

When the file extension… is not the file extension.

I was bemused to read on bbc news earlier that a trivially simply ploy stung half a million file sharers. The concept is nothing new having been started a fair few years ago by virus / malware writers and adopted by Copyright enforcement agencies in recent years. Do the anatomy of a decentralised file sharing system, anyone can seed a file. Once this seeded file is made available to the peer-to-peer network it either becomes advertised to a localised central file distributor (referred to as a Super Node or Server) or is found during a spider search query run by another user logged into the peer to peer network. If these files are topical or sought after, they can be transferred onto a different node (client) rapidly. There they are stored in the second user’s ’shared’ directory where more people can download it.

Once a seeded file has been downloaded and spread over a few tens of nodes the rate at which it can be downloaded by others increases almost exponentially with a cascade like effect. Other people of the peer to peer network are lured into downloading this file based on the number of people who have it therefore assuming it must be genuine and would be comparatively quick to obtain. Couple this with a topical or sought-after song / album or file aimed at the masses (who statistically would contain a fair percentage of PC-illiterate users and those with a penchance for agreeing to all the pop ups they come across) means these files explode across networks.

This malicious file in question appears to have masqueraded as a MP3 by Girls Aloud. Given the fact that on running the file pops up a message saying the computer requires a codec to play the song and tries to direct you to a website in order to download it, most computer users would stop and reexamine what they had just downloaded. People that brazenly proceeded and downloaded the malicious ‘codec’ package had spyware installed on their system which would ‘bombard’ users with pop ups. Also, the download file would spawn copies of itself within the User’s shared folder under different names to try to make itself attractive to a greater audience.

But what happened? How were people tricked into downloading an MP3 file but ended up running a malicuous program? The answer to this lies in the file type. Broadly speaking, there are two ways in which a file can be opened:

1) via script or binary execution (e.g. .exe, .com, .vbs, .java, .scr … and some others)

2) via program read from an external application (e.g. .txt, .doc, .wav, .mpg, .avi …. and MANY more.)

MP3 files (Moving Picture Experts Group version 1 audio layer 3) are the latter, upon execution, Windows searches through its list of known file extensions stored in the registry to see what it should do. It instantly finds the entry for MP3 and sees this type of file is handled by a media player like Windows Media Player, WinAMP, iTunes etc etc. Windows then executes the media player which, on loading, opens the MP3 file specified in the command line argument, decodes a block, fills its buffer and starts to play. Unless a clever trick like a buffer overflow is used, which have historically been responsible for security breaches in various Windows programs as well as console homebrew development, this renders all ‘program read’ type files harmless*. As such we have to look elsewhere for the source of this problem.

That brings us nicely to the point I wanted to raise in this post, file extensions and more specifically, security vulnerabilities in their implementation. Recent versions of Windows from XP (and possibly earlier, I can not remember) have automatically hidden the file extension by default leaving the user to distinguish between file types by iconographic representations. Whilst at times this is both cleaner looking and more functional, it does present an interesting security problem, what if there are two file extensions? Window will quite happily truncate the file .xxx from a file name leaving the first extension, despite the fact Windows ignores anything before the final .xxx . As a result, if you name a file SomethingInteresting.mp3.exe, in its default state, Windows will happily display the file as SomethingInteresting.mp3 but will execute the file as an EXE when double clicked. Obviously, if you quieried the file by right clicking on it and selecting properties you would be immediately told what type of file it is, but most people will take the file at face value.

Luckily there is a very simple way to gaurd against such black magic, in Windows XP and Vista** in the file browser, goto the Tools menu and select Folder Options.

In this dialog, uncheck ‘Hide extensions for known file types’ and click Apply followed by clicking Apply to all folders.

And that’s it! A simple check box and some common sense now separates you from being lured into downloading fake or malicious files.

* Some files like some movies can have containers which direct the media player or operating system to web pages. It is not just media files which are vulnerable but this is a completely different topic.

** In Vista you may have to enable the classic menu