- Katılım
- 31 Temmuz 2015
- Mesajlar
- 7.605
- Makaleler
- 1
- Çözümler
- 74
Windows virüsleri tespit etmez. Defender' dan bahsediyorsan o da bir antivirüs zaten. Ve ayrıca ben virüsten koruma konusunda Defender' a güvenmezdim.Antivirüslerin değil de Windows'un tespit etmesi daha önemli.
@Murat5038 Anladığım kadarıyla oyunun clientinde bulunan bir güvenlik açığı, kullanıcının bilgisayarına DDoS tarzı - smurf- bir saldırı yapılmasına neden oluyor. Ayrıca kullanıcının bilgisayarından bazı verileri zararlı bir sunucuya yüklediği ve oyun silindikten sonra dahi dosyalarının geride kaldığı tespit edilmiş.
This game uploads your data to a well known and blacklisted malware/spam/spyware server
IP:94.102.56.181 Port: 6881
Do no install this game.
The install client for this game launches DoS (Smurf) attacks on your network and ruins your connectivity, which is probably why some antivirus programs are detecting trojans from it.
Example: https://i.imgur.com/UAQqewT.png
I'm also now getting notifications of DoS (STORM) attacks and port ACK/FIN scans on my network from other IP addresses after using this program, making it very possible that it is now exploiting my system.
The peer-to-peer download connectivity of the download client is severely unsecure and easily exploitable, and you should not use it at any cost. Do not so much as run the installer for this game.
---------------------------------------------
Edit: To make matters worse, the game doesn't actually uninstall when you uninstall it from Steam. You will have to go into Steam's "common" folder and delete Conqueror's Blade manually. I checked it with WinDirStat, and all 22.5GB of data was still there.
I recommend getting a trusted "clean uninstall" program (I think CCleaner is one example) and make absolutely certain that every trace of this game is off of your hard drive.
---------------------------------------------
Edit 2: I understand that often times, things like this are considered to be "false positives." I do a lot of work in cyber security and system administration areas, and I check thoroughly to confirm whether or not these events have any truth to them.
The example I posted above shows you that the DDoS attack was attacking the network from my system, as it displays a local/private IP (that is designated to my system) instead of a public one. This is usually the symptom of an exploited host computer.
The confirmation of this event was the fact that I've only actually played the game for 20 minutes. It took me 15 HOURS to install the game because the DDoS attacks were hitting my network so hard that my download speed was ranging between 34kbps and 328kbps when normally it would be 3Mbps. I was lucky to have it reach max speeds again after disconnecting and restarting my network, then running the game's installer under a strict firewall policy.
---------------------------------------------
At the developer response: Firstly, let me be the first one to say this before the comments do. I'm really disappointed in that response. I think a lot of people are disappointed in that response.
"While I can't tell you where those attacks mentioned by you are coming from, I can assure you that they are not caused by us, our client or our launcher." - Chibs 2019
I wish that were true. Obviously, there is a security issue. The timing of the attacks are exclusive only to when your install client is launched and downloading, the attacks show my computer's IP address as the exploited host (out of 5 computers and 12 smart/IoT devices connected to the network), AND the problem suddenly goes away if I either stop running the install client or if I run it under an advanced firewall. It's very clearly your client. As far as attacks go, that's about all the proof I can possibly give you without having to re-install it, throw it under WireShark, and sit there for another 15 hours while your game compromises my network. I'm not doing that. You can have your flawless security division work on that.
I have even tested this further by launching the client on two different days at two very different times per day just to make sure it wasn't a coincidence.
Anyway. Since you take security very seriously, then I'll be glad to help you out in that regard. Here is a link that explains what DoS (Smurf) is: https://en.wikipedia.org/wiki/Smurf_attack
This will allow your team to identify and consider ways to prevent this from happening to other users of your install client. From your response, I can only assume that you either skimmed over or didn't read my earlier two edits that explain why the attack was confirmed and from your client. Therefore, I can only assume that you will not read that Wikipedia article.
I will post a brief layman's explanation for you, just in case.
"Smurf" attacks were named such because of the idea of numerous groups of attackers overwhelming a single host. For a Smurf attack to reliably occur to a host who has every port closed and UPnP disabled, the host has to be in an environment (using a program) that allows access to many, many connections at once. These connections have to have the ability to maliciously ping flood the host, meaning that the program has to have little to no security in packet detection for every single IP that is sending to the host.
In other words, Smurf attacks happen because the client is using a peer-to-peer connection that has little to no packet security.
This may sound like a crazy kind of coincidence, but... I certainly find it odd that these attacks occur only when I have your client open, and your client just happens to be a peer-to-peer install client.
Son düzenleme: