This topic contains 4 replies, has 0 voices, and was last updated by  badshot 12 years, 4 months ago.

  • Author
    Posts
  • #3632

    .–.ShoCkwaVe.–.
    Participant

    recently there has been a possible spyware incodent
    that was reported by a player.

    so that everyone is aware there is a risk when you connect
    to an unknown server in version 38.

    any file that is in the mod folder of that server that you connect to
    wether it is used * or not*is auto downloaded when you connect to download the mod.

    this problem risk is now fixed in version 39

    so you all understand DeVice is running the Official shockmod server
    wich means I ShoCkwaVe the maker of this mod will be updating and developing to his server *ONLY*

    And I do confirm that his server is safe and trustworthy to play on

    how you can tell the shockmod Official server:

    DeVices sever name is : Shockmod v3.1 OS < --- OS (official server) DeVices server also has stats enabled and you will see
    myself or DeV playing there on a regular basis.

    any other servers that run older versions of shockmod
    or even the same version for that matter I will NOT vouch for
    and you run the risk to yourself that some1 may have included a file
    in the mod folder that I did not place there.

    Its always important that we protect ourselves from internet pests
    so I always scan everything using
    Tren Micro Pc-cillin 2005 Internet Security
    before submiting any files to anyone.
    ________________________________________________________

    you should always report any serious risks or security matters
    incodents such as this to an administrator or gcamp ASAP
    so that steps can be taken to ensure our wonderful game is
    never compramised.
    _______________________________________________________

    just to inform any1 my security apears to be ok

    here is a screenshot just so my back is covered in this matter.

    the only detection was an addware file wich is not a keylogger.

    glad I downloaded pestpatrol now though

    I cant be having adds on my pc 😛

    cheers

    #20139

    Willis
    Participant

    any other servers …. I will NOT vouch for
    and you run the risk to yourself…

    Big, clear wording, good to hear.

    Don’t hate me for saying this but: I recal AT bringing this concern up long ago.

    #20140

    badshot
    Participant

    Hmm, I thought about it, and think that as long as this file will not be _run_ by scorched(and as long as you don’t run it), and as long as this file can not be put into arbitrary location on hard drive(!), it is fine.

    I.e. I think that if somebody places executable file of trojan into mod folder and runs server, file will be downloaded, but will not be automatically executed (so no harm other than wasting hard drive space if you yourself don’t run it).

    Also it is necessary to check and make sure that scorched client absolutely can not write mod file outside of mods folder. Filenames received must not be trusted. I.e. if server says that filename is c:winntsystem32whatever.exe , scorched must not put file there(!). I’m is busy with my own programming work, so can’t look to make sure…

    Conclusion: __never__ execute files from mod folder.

    #20141

    Bobirov
    Participant

    This same information applies to Apoc as well. ApocHQ hosts the “official” Apocalypse mod servers which I personally will vouche for their safety and security. Any other server running Apocalypse in version 38.1b or lower, I can not gaurantee will be free from malicious data. So, if you want to play Apocalypse, I would suggest using the ApocHQ servers.

    #20142

    imported_gcamp
    Participant

    @badshot wrote:

    Hmm, I thought about it, and think that as long as this file will not be _run_ by scorched(and as long as you don’t run it), and as long as this file can not be put into arbitrary location on hard drive(!), it is fine.

    This is correct, it is NOT a problem unless you go browsing around the mods folder executing random files.

    #20143

    badshot
    Participant

    Also… it would be great to make sure that client can not write file to arbitrary location on hard disk, even if server sends some completely weird filename…

Viewing 6 posts - 1 through 6 (of 6 total)

You must be logged in to reply to this topic.