Une faille dans les maps customs : free virus !

Je tiens à vous mettre en garde sur ce que j'ai trouvé hier :

forum battle.net

Et un quote de DA :

Citation :

A new exploit has been circulated amongst hackers that allows for a custom map to execute arbitrary code on a client and install trojans/viruses/keyloggers outside of the warcraft III engine. So far it has targetted public dota games in particular; hackers created fake dota maps that use the same file extension/directory as DotA 6.59d, and therefore you will see the loading screen displayed in your custom game list and it is effectively impossible to take precautions against, as it has no discernible difference from joining a normal DotA game. Therefore it is highly recommend that you stop playing public dota games until blizzard can patch this exploit. They have already had it brought to their attention.'

For those who doubt how dangerous this is; by mimicing dota, anyone who has already downloaded the legitimate map will see the game displayed in the custom game screen with the proper loading image, and it finishes downloading before you switch to the game lobby screen, as it is a tiny file size. Once you enter the game, the virus will unpack itself and infect your computer, allowing malicious code to be executed at the whim of the hacker.

Props go to Maged@Battle.net forums for bringing this to attention.
http://forums.battle.net/thread.html?topic...58&sid=3000


Don't join games of DotA hosted by people you don't know. This applies to public games, TDA, etc
The best precaution you can take at the moment if you want to continue to play DotA, is to keep your Warcraft III maps folder open, and see if any new files are downloaded when you join a game. If they are, immediately leave the game lobby, before the host can start the game (and infect you), and delete the new map file. If your computer has been infected, you should run the best antivirus software you can find, and Don't log into any accounts on your computer, warcraft III, email, etc, as there is a high probability of getting your password keylogged. If you are certain your computer is infected, the only surefire way to eliminate it is to reformat your computer.

Pour ceux qui n'ont rien compris :

Une faille a été découverte avec le dernier patch bnet, permettant de lancer du code à partir des maps custom et donc de faire circuler des virus (trojan/keylogger/etc).
Il est donc fortement conseillé d'arrêter de pubber sur des hosts que vous ne connaissez pas (aucun problème avec derk ou moi même normalement) et cela concerne aussi les autres maps que dota.
Même chose pour GGC, le hack étant "dans la map", jouer sur cette plateforme ne vous immunise pas !!!

mmmmmmmh vu qu'ill y a des truc dans la map supplémentaire tu ne doit pas telecharger sur le host?

parceque si c est le cas si tu dl la .59 sur un host ca pourrait vouloir dire que c est le truc du virus


ou alors ( et c est surement ca ) je dit de la merde pour pas changer :p

Citation :

http://forums.dota-allstars.com/inde...owtopic=281341


Basically, an exploit has been discovered that allows a remote user to execute arbitrary bytecode through a wc3 map. There is a possibility to make this map have the same name and look exactly like another map, but it would actually download a virus into your computer and you would never know it.

DotA has been targeted by this attack; there are custom games which have the same preview image as DotA, and when you enter them they are downloaded before you enter the game (very small file size) thus resulting in you not knowing this is a fake map. Once the game starts, the malicious code is executed.

This means a malicious user will be able to grab everyone's cd-keys in a game, plant a keylogger in your computer, any known virus etc.

It is extremely recommended to not play any custom games with people you do not know. You should also refrain from downloading any new maps from a source that you do not completely trust, until a patch is released. Also, if you see too many people downloading a map you know they should already have, it is very possible that this is a hacked map. You should notify them and leave the game immediately.

COMODO is the only known program to prevent warcraft from running the malicious code as of now. Every other AV/firewall/anti-malware program other than that does not currently prevent this exploit from being used.

Blizzard has been notified about the issue.

EDIT: If you see someone hosting a TDA-sanctioned game with a map that seems suspicious, please by all means report it (preferably to tdabots.com) and let the host know that it is possible that the map is hacked.

Donc en gros, les maps hackées peuvent peser pratiquement rien et être téléchargées quasi instantanément, ce qui est impossible à arrêter...

Merci marl =)

J'irais peut être poster ça sur le forum dtfr (à moins que tu y ailles) pour avertir la populasse =)

J'ai tout pompé du forum-fr....

Par contre ya rien du côté de dota.fr, mais j'ai pas regardé le forum...

Gj Marl,

Merci pr l'info, genre de truc pas du tt au courant.

gj, mais ca fait peur quand même