0

I found a random link on a forum linking to localbattle.net, at the same time I was running a local server on localhost. When I went to localbattle.net, my local server page appeared! The certificate was invalid, and the "Your connection is not private" warning screen appeared. Can that site see the content of my local server (page)? And is it a my client's issue, their server's issue, or my local server's issue?

  • 1
    Just from the name, it seems to be related to Blizzard's Battle.net. The name "localbattle.net" implies it points to your local battle.net installation. – MechMK1 Jul 20 at 11:07
  • Actually, nevermind I found the answer. It's because that site resolves to 127.0.0.1 i.e. localhost, just like how Google can resolve to 172.217.25.142. – facepalm42 Jul 20 at 11:08
  • @facepalm42 what is wrong with Google resolving to a public IP address? – multithr3at3d Jul 20 at 20:09
  • This also works with something.com. – facepalm42 Jul 23 at 7:27
3

This domain is used by Blizzard (battle.net) for some communication between their web pages and a server running in localhost.

Thus, when the web page wanted to communicate with the local install, it would direct a request to https://localbattle.net:22886/ were the game would be running a webserver. As they owned the domain, they would have issued a publicly valid certificate for that domain, which could then be embedded in the game, while they couldn't have obtained a certificate for 127.0.0.1 or localhost.

Do note however that this was still the wrong thing to do. Since the private key needed to be shared within the game, the private key isn't really private, and such certificate MUST be revoked by the CA within 24 hours of knowing about it (section 4.9.1.1 of the Baseline Requirements).

The public certificate running locally was originally reported by Tavis Ormandy and -after Hanno Böck reported it to mozilla and the CA- the certificate got revoked, after which Blizzard issued an update that installed a local (non-CA) certificate into the root trust store. Then they briefly used a new certificate, issued by digicert which also got revoked, and added to the OneCRL.

The whole story is explained quite well on this mozilla.dev.security.policy thread. If you want to dig up more, you can also read this Reddit thread, and the Blizzard post explaining their change to use a self-signed certificate.

2
$ dig 8.8.8.8 localbattle.net
...
localbattle.net.        86400   IN      A       127.0.0.1

The above shows that the name resolves globally to 127.0.0.1, i.e. localhost. It is unknown why the setup is this way and the question does not provide sufficient context to find out.

  • @MechMK1: not from the hosts file but from DNS. Updated to show that also google DNS resolves to this. – Steffen Ullrich Jul 20 at 11:10
  • @SteffenUllrich Yeah, I just tried it with 8.8.8.8 – MechMK1 Jul 20 at 11:11
  • 1.1.1.1 is the same: nslookup localbattle.net 1.1.1.1 Server: one.one.one.one | Address: 1.1.1.1 | Non-authoritative answer: | Name: localbattle.net | Address: 127.0.0.1 – facepalm42 Jul 20 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.