Live2D: A Safety Trainwreck | Undeleted Recordsdata

2023-03-03 12:12:22

Translations of this text are welcome. If you recognize Japanese or every other language, be happy to
contact me. The markdown supply for this text is here.

Replace: the vulnerability found right here has been assigned CVE-2023-27566.

Live2D Cubism is a well-liked 2D puppet animation software program most recognized for its use
by VTubers^{and in sure cellular video games. As a way to load the fashions generated by the software program,

builders want to incorporate their proprietary “Cubism SDK,” for which there isn’t a different. On the

coronary heart of this SDK is “Cubism Core,” a small C library chargeable for parsing and loading MOC3 information,

the format Live2D Cubism makes use of to retailer the 2D puppets. Sadly, Cubism Core is a deeply flawed

and probably unfixable piece of software program.}

For those who’re simply within the code, jump to the bottom.

For those who don’t really feel like studying the entire thing, please not less than have a look at the
Key Takeaways.

An Introduction to MOC3

MOC3 is a proprietary binary format that accommodates an inventory of offsets to sections containing information for
the 2D puppet, comparable to meshes and adjustable parameters. This format is successfully a uncooked dump of C
arrays and structs. Whereas ugly and obtuse, it does work, and it needs to be potential to jot down a protected
loader for such a format. MOC3 information don’t include the precise textures.

Reversing MOC3

A minimal MOC3 file wants solely two elements: a header, with the magic string “MOC3” together with
a model and endianness; and a Part Offset Desk. The Part Offset Desk accommodates offsets
to the sections within the file, and its entries are saved as a signed 32-bit integer. The Part Offset
Desk intently follows the Structure of Arrays paradigm.

After some poking and prodding, I discovered the precise format of MOC3 information and used the
ImHex hex editor to discover all of the properties.

ImHex helps patterns, scripts that will let you outline buildings and different components of a binary
format. This made it easy to craft an interface to learn and edit the sections of MOC3 information.

The ensuing sample file is about 400 strains lengthy, actually shorter than I used to be anticipating. One notable
MOC3 part is the Rely Information Desk, which specifies the variety of components for the arrays of every
sort of object saved within the file.

MOC³ingbird: The Safety Downside

Cubism Core will not be even a remotely protected resolution for loading MOC3 information, regardless of at present being the
solely resolution! Altering entries within the Part Offset Desk reveals that it’ll blindly add no matter
offset is given to the MOC3 information’s base tackle, that means that a rogue MOC3 file might simply instruct
Cubism Core to overwrite any reminiscence inside ~2 GiB of the place the MOC3 information is situated. The entire file
is successfully a write-what-where primitive^{. Along with that, the Rely Information Desk will not be

bounds checked both, so one might simply specify that there are 500,000 parameters in a 8,192

byte MOC3 file. General, it’s far too straightforward to go “off the rails” in Cubism Core.}

MOC³ingbird is an easy MOC3 file crafted to crash the official Live2D viewer and any third
social gathering software program that makes use of Cubism Core. It doesn’t include a payload, but it surely seemingly might simply be
modified to execute one. Actually, the screenshot above exhibits the sections of the MOC³ingbird
exploit.moc3 file.

Faulty by Lack of Design?

The MOC3 format, whereas technically usable, is an unmitigated catastrophe, and Cubism Core has far too many
issues to require expensive licenses
for manufacturing use. Though it’s potential that the format is deliberately but poorly designed, it’s
more likely that was not designed in any respect. It appears as if fields and sections have been merely added to
the format every time wanted, with out regard to correct implementation. After all, there are answers that
permit for this to be achieved in a considerably cheap method, the only of which might be to make use of a
commonplace serialization format like JSON, MessagePack, CBOR, or Protocol Buffers. Sadly, I think the
builders at Live2D averted this, hoping {that a} proprietary format would hold others from competing with
their merchandise.

The tip results of these selections and “not selections” is an opaque, insecure mess that seemingly can’t be
cleaned up with no full rewrite. I actually don’t care whether or not they have been merely negligent or
motivated by a want for rising revenue; exposing customers to such easy, simply averted vulnerabilities
is unacceptable.

Privateness Apocalypse

The blatant disregard for correct safety practices proven by Live2D seems even worse when you think about
that a good portion of their userbase, i.e. VTubers^{, go to nice lengths to guard their privateness.

Doxing^{was and continues to be a big downside in that group, and dangerous actors might simply take

benefit of those vulnerabilities to be able to deploy spy ware on unsuspecting customers’ computer systems.}}

So Why Publish This?

I actually don’t really feel that Live2D will repair any of their issues with out important pushback, and
reporting these issues on to them wouldn’t depend as “important.” Live2D seems closely invested
in secrecy and safety by obscurity, somewhat than transparency and actual “non-hopeful” safety,
as evidenced within the FreeLive^{incident amongst different anecdotes I can not disclose. There isn’t any doubt

in my thoughts that, if this text weren’t revealed, a cybercrime group would ultimately uncover these

flaws and exploit them in secret, whereas Live2D’s customers would don’t know what can be taking place.}

It’s as much as their customers and their group to push for them to repair these points, or swap to open
options like Inochi2D. It doesn’t matter whether or not Live2D likes this or not.

Anticompetitive Practices

Earlier within the article I discussed that there was no different to the Cubism SDK for loading MOC3
fashions. Whereas the straightforward assumption could possibly be made that the format is simply too opaque and complicated for many
builders to determine, there’s probably another excuse.

5.1.9 Different Restrictions

The Buyer could not use the Output File with software program(s) or middleware(s) that compete with or might
compete with the Software program or every other software program(s) or middleware(s) produced by Live2D;

from the Live2D EULA

In case you’re unsure you learn it proper, or for those who don’t perceive it, Live2D’s EULA prohibits folks
from utilizing the fashions they create (with Live2D’s expensive, licensed editor
software program) with a hypothetical, safer Cubism Core substitute. For those who use their editor software program, you
are in actual fact required to make use of their insecure, proprietary SDK.

If you’re a developer of software program utilizing Live2D’s, I encourage you or your employer to vote together with your
pockets and never help these practices. In case you want further encouragement, let me remind you:

The Buyer could not in any other case interact in any acts which Live2D judges inappropriate.

And let’s additionally scroll down a bit…

7.4 If this Settlement is terminated pursuant to Part 7.1, the Buyer shall promptly destroy the
Software program, all copies thereof, and all Spinoff Work together with the Output Recordsdata and every other derivatives
arising from use of the Software program.

It’s fairly plainly said that Live2D can fairly actually destroy your small business at any time.

It’s also unclear if individuals who obtain a Live2D mannequin from a third-party can be sure to such phrases
(probably not, since they by no means signed the settlement, assuming they haven’t put in the Live2D Cubism
Editor on their very own).

Let’s learn some extra restrictions…

The Buyer could not launch any software program code or content material of the Software program included within the Software program of
the Output File beneath a license that’s not from Live2D;

I can affirm that MOC3 information don’t include any hint of the editor software program, actually not any code anyway.
Actually, I simply confirmed you possibly can craft a MOC3 file from scratch, with out taking something from the editor.

Illegal Provisions?

These giant license agreements are likely to include heaps of “you have to” and “you have to not” that will not even
be authorized the place you reside. I look ahead to them trying to implement their “No Reverse Engineering”
provision in Europe, however I digress. Not less than they acknowledge this:

5.1 Restricted Acts

Live2D reserves all rights not expressly granted to the Buyer on this Settlement.
Until relevant legislation offers the Buyer extra rights however this limitation, the Buyer
could use the Software program solely as expressly permitted on this Settlement.

Key Takeaways

It’s NEVER protected to open untrusted information or fashions with Live2D functions.
- At worse, Live2D fashions could possibly be carrying spy ware, ransomware, or another malware.
You CANNOT be certain whether or not a Live2D mannequin is protected or not, which suggests you CANNOT
safely settle for Live2D fashions from anybody on-line.
- There isn’t any software program that may confirm the integrity of a Live2D mannequin, and Live2D
  will seemingly try to forestall the event of such software program.
Live2D the corporate engages in anticompetitive practices that shouldn’t be supported.
It is best to help free, open options to Live2D’s software program.