MW2 Rumour - Hackers sending trojans to players

[IceT-Bag]

Players who bought the game legally now have another reason to be pissed off, hackers are able to send trojans via IWNET to all players connected in a game. At this point in time it is not clear what the trojan does, but it is most likely a key logger or other application to gather info from your PC (maybe to steal your STEAM account).

Another *facepalm* for P2P networking!!

Source: http://www.infinityward.com/forum/viewt ... 4&t=181646

Apparently they (|KOT| Squad) are able to hack the server and send virus/trojans to people, in the process they run aimbot in the game, and send a non tagged member to the other team to TK.

quite a story those guys are.

This was the trojan they were trying to send: TR/Crypt.XPACK.Gen

So is this IW idea of a joke when iwnet is suppose to be hack free when yet its probably less secure then a Windows 98 system with no protection?

It's possible if you host a game for a hacker client, and it's possible if you don't host a game, but are connected to a hacker hosting the game. If the game's net code is not 100% secure then it could be possible to craft special packets of data to cause buffer over-runs (stack smashing). This injects hackers code into your computer, which executes it, and hey presto you have a remote code execution hack. If the code's written well it's possible to make it secure, but stack-smashing bugs are so often overlooked.

Yet another reason we need dedicated servers.

[HanZ]

does it have to do with NAT status = UPnP function in router?
or are all players vonurable?

[IceT-Bag]

Thats not clear at this moment Hanz.

If it is done through DLL injection of the IWNET related files, then I guess it doesnt matter which ports are open/closed. I have read on the IW forums that you can still play online if you close UPnP.

[IceT-Bag]

Link suggesting it is a false-positive: http://www.mapmodnews.com/article.php/M ... Gen-Trojan

The actual trojan does exist though, hopefully this is a false-positive whereby some AV scanners are mistaking an innocent legit file for something else.

[IceT-Bag]

Update:

It is a FALSE-POSITIVE, the following quote taken from Avira (AV Software) support forum:

[Solved] TR/Crypt.XPACK.Gen Trojan- in quarantine- is computer ok?

Nicolae Moldoveanu
Avira GmbH
Date of registration: May 22nd 2006
Version: Avira Prem. Security Suite
Location: Bucharest

Yesterday, 11:45am

Hi,
The sample was re-analyzed and it is clean. The detection is already removed, just update.
Nicolae Moldoveanu
Avira GmbH

It is recommended to stay safe when playing online games....

[Godz]

Always liked Avira very low usage great for gaming

Panic over then? till the next one

[IceT-Bag]

Given that hackers have made pirated copies of the game work on IWNET without detection, I guess the threat is still there that this is a possible vulnerability with IWNET.

Worst case scenario, this scare has given some griefers a great idea for ruining this game...though they'll never ruin it as much as InsanityTard have

[IceT-Bag]

Over @ the IW forums there are now more players with other AV products saying they are also detecting a trojan. Whilst many still think this is a false-positive, it is rumoured that the 'trojan' is only detected when playing in a game with one or more individuals who are using a pirated copy.

[Porky]

the plot thickens.... muuhahahaha

[Sky]

Conspiracy theory:
IW have given code from the hacks to the AV companies and asked them to flag it as bad, haven't seen it happen with a game before but I've seen with apps, especially adobe/nero, a keygen that you've been using 18mths with no problem suddenly contains a trojan but one that doesn't install anything or do anything else for that matter. Not all AV companies will play ball but I guess it depends on how much money changes hands (if IW or Activision are corporate customers of AVG they'll probably do it for free)