4 ms·

Ask HN: Is this weird folder name indication of attempted log4shell attack?

• pyuser583 5y ago
  The Log4shell vulnerability wasn’t actively exploited prior to March 2021, so the timeline doesn’t make sense. It looks like that’s some type of encoding. Maybe a Base16 run through a Caesarean cipher. That being said, no sane programmer would deliberately (with deliberation) include a double quote in a legitimate directory path. Does “rolandog” mean anything to you? Advanced explosives seems to be a Minecraft mod. Were you developing this mod? Are there any mods to the Titan program? Edit: I was close … it’s Base64 run through a Caesarean.
  • rolandog 5y ago
    Hi, thanks for your response. > Does “rolandog” mean anything to you? Yep, I think it's my username in the machine, but I think my steam username is different. > Advanced explosives seems to be a Minecraft mod. Were you developing this mod? I haven't installed or played Minecraft yet; so, no. > Are there any mods to the Titan program? Not to my knowledge! I played a couple of levels a year ago, but I never got too invested to try to find any mods.
• rianmcguire 5y ago
  Revenge of the Titans is using the java.util.prefs.Preferences class from the Java standard library. Looking at the implementation here: https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e902ba9ce0df3ab1add/src/java.prefs/unix/classes/java/util/prefs/FileSystemPreferences.java#L890 https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e90... If the requested directory name has certain "inappropriate" characters in it, it'll encode it using Base64.byteArrayToAltBase64, which is a non-standard base64 encoding using the alphabet defined here: https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e902ba9ce0df3ab1add/src/java.prefs/share/classes/java/util/prefs/Base64.java#L115 https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e90... If we decode the directory name using that alphabet: https://gchq.github.io/CyberChef/#recipe=From_Base64('!%22%23$%25%26%5C%5C(),-.:;%3C%3E@%5B%5D%5E%60_%7B%7C%7D~abcdefghijklmnopqrstuvwxyz0123456789%2B?',false)Decode_text('UTF-16BE%20(1201)')&input=ISg6IWIhInYhKEAhY3ciZiEkJSEuZyE0ISQhPQ https://gchq.github.io/CyberChef/#recipe=From_Base64('!%22%2... You can see that it was encoding the text: slots_1.80 Nothing to see here, other than some sloppy filename handling in Déjà Dup.
  • pyuser583 5y ago
    Nice! I was trying to figure out what the encoding was! What’s the thinking behind a base64 encoding with double quotes? Edit: “It is designed for use in environments where "case folding" occurs.” That explains all the punctuation marks. Still stupid. Directory names are not known for case folding.
    • rolandog 5y ago
      Indeed. I was thinking that maybe it was trying to be compatible with WIN32 apps or something, but it seems that it's running against MS's conventions [0]. [0]: https://docs.microsoft.com/en-us/windows/win32/fileio/naming-a-file https://docs.microsoft.com/en-us/windows/win32/fileio/naming...
  • rolandog 5y ago
    Hey, thanks so much for taking the time to do a deep dive. I'll file a bug report with the Déjà Dup devs. If you don't mind me picking your brain: The logic behind isDirChar and dirName is not obvious to me. I understand not wanting to have a forward slash in your directory name, but the dirName function runs contrary to the goal of the isDirChar function (which in theory is stated as wanting to avoid special characters like a dot or an underscore, but it actually ends up letting through the dot, the underscore, and a lot of other characters). Or, am I reading the comments and the code wrong? P.S. A minor observation; the alphabet on the URL has a slight typo (a backslash instead of a single quote, as one of the listed chars is an escaped quote): !"#$%&'(),-.:;<>@[]^`_{|}~abcdefghijklmnopqrstuvwxyz0123456789+? instead of: !"#$%&\(),-.:;<>@[]^`_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?