Page 1 of 1

Bzflag app data cache and/or server being used as spam server?

Posted: Mon Aug 21, 2017 2:49 pm
by yarro
I noticed that my computer was acting suspiciously and in trying to use system restore the bzflag folder (I think it is the persistant profile as I had uninstalled bzflag) system restore would not roll back due to that folder, repeatedly.

Other coincidences was a bitly hack trying to have me sign up my email address to re-serve mail (they where pretending it was a job but the link was likely a bitly infection vector).

Add to that a suspicious question a user in game asked about my handle being the name I use or if I had another appropo nothing at all (perhaps the hack needs your authenticated user profile to use the client server architecture of the game).

Other related odd stuff are established connections on my machine when I connect to the isp and before I am running services.

Add it up and you may have a malicious modification of my appuser local data in the bzflag folder.
As it is persistent unistalling it would not fix it but you would need to delete the folder.

You might want to keep a look out for users asking about user data in game as well, if you want to id the culprits.

Just a heads up to the developers and anyone interested in the issue, I have a copy of the folder I can send if you want it.

Re: Bzflag app data cache and/or server being used as spam server?

Posted: Mon Aug 21, 2017 5:18 pm
by allejo
Did the BZFlag folder have non-BZFlag stuff in it? What did you sign up for that needed your email? Who asked your handle and what server?

Re: Bzflag app data cache and/or server being used as spam server?

Posted: Mon Aug 21, 2017 9:20 pm
by yarro
Apocalypse XVII was the server but It was last week so a lot of logs to review, and they are't mine so I'd have to ask.
I can zip the folder and send it but don't know if any of the files are unrelated.
BZFS0221_1-Servers was a file that was not in a new install of bzflag but perhaps I fired up a server by accident and it left this behind?
The email was unsolicited so it was someone who acquired my address. some type of phishing.
The odd thing was the app data folder was blocking system restore so I have to wonder why that would be and why my system had become unstable, would seem the app data might be involved due to the restore issue, I know that backup resotre can be an attack vector as well.
My never know, though.

Re: Bzflag app data cache and/or server being used as spam server?

Posted: Mon Aug 21, 2017 10:02 pm
by blast
BZFS0221_1-Servers is the cached list of servers for 2.4.x (which uses the protocol string BZFS0221). To be fair, System Restore was at least pretty garbage in XP days (maybe better now?) and I don't think I've ever had it work. It either didn't fix the problem, or it just broke the system completely (though, again, this was with XP).

Re: Bzflag app data cache and/or server being used as spam server?

Posted: Mon Aug 21, 2017 11:11 pm
by yarro
OK, well on 7 It seems a lot better.
Indicates something going on with the app data but perhaps my computer failed on shutdown and left an unstable state.

just seemed odd so I made a post.

Re: Bzflag app data cache and/or server being used as spam server?

Posted: Tue Aug 22, 2017 4:45 am
by JeffM
That folder contains data downloaded by bzflag during online play, it will not be part of the install.