Ask HN: Is this weird folder name indication of attempted log4shell attack? | Hacker News Reader

Ask HN: Is this weird folder name indication of attempted log4shell attack?

5 pointsrolandog7 comments

A bit of context: I hadn't tested restoring my backups for more than a year, and by the end of my restoration test, I noticed a warning from Déjà Dup telling me that some files could not be restored, and to make sure that I am able to write to them.

Among the files listed were these two files (dated 2020-07-10) which had a rather eye-caching sub-folder called '_!(:!b!"v!(@!cw"f!$%!.g!4!$!=' (without single quotes):

  ~/.java/.userPrefs/net/puppygames/applet/Revenge of the Titans/_!(:!b!"v!(@!cw"f!$%!.g!4!$!=/prefs.xml

and:

  ~/.java/.userPrefs/net/puppygames/applet/Revenge of the Titans/_!(:!b!"v!(@!cw"f!$%!.g!4!$!=/rolandog/prefs.xml

The XML files do not seem out of this world:

  <?xml version="1.0" encoding="UTF-8" standalone="no"?>
  <!DOCTYPE map SYSTEM "http://java.sun.com/dtd/preferences.dtd">
  <map MAP_XML_VERSION="1.0">
    <entry key="active" value="true"/>
    <entry key="attempts.0.8" value="1"/>
    <entry key="attempts.0.9" value="2"/>
    <entry key="familiar.advancedexplosives.0.1" value="0"/>
    <entry key="familiar.advancedexplosives.0.2" value="0"/>
  ...

For additional context: I had installed the game a while ago through Steam, and recently I uninstalled my whole library to make some space for some work-related stuff, so I'm unable to run the game or make tests.

The folder name seems rather unusual to me, and I'm unsure what to make of it.

However, I just wanted to validate if this was also normal for other users.

Revenge of the Titans is using the java.util.prefs.Preferences class from the Java standard library.

Looking at the implementation here: https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e90...

If the requested directory name has certain "inappropriate" characters in it, it'll encode it using Base64.byteArrayToAltBase64, which is a non-standard base64 encoding using the alphabet defined here: https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e90...

If we decode the directory name using that alphabet: https://gchq.github.io/CyberChef/#recipe=From_Base64('!%22%2...

You can see that it was encoding the text:

  slots_1.80

Nothing to see here, other than some sloppy filename handling in Déjà Dup.

Hey, thanks so much for taking the time to do a deep dive. I'll file a bug report with the Déjà Dup devs.

If you don't mind me picking your brain: The logic behind isDirChar and dirName is not obvious to me. I understand not wanting to have a forward slash in your directory name, but the dirName function runs contrary to the goal of the isDirChar function (which in theory is stated as wanting to avoid special characters like a dot or an underscore, but it actually ends up letting through the dot, the underscore, and a lot of other characters). Or, am I reading the comments and the code wrong?

P.S. A minor observation; the alphabet on the URL has a slight typo (a backslash instead of a single quote, as one of the listed chars is an escaped quote):

  !"#$%&'(),-.:;<>@[]^`_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?

instead of:

  !"#$%&\(),-.:;<>@[]^`_{|}~abcdefghijklmnopqrstuvwxyz0123456789+?

I think your reading of the code is fine - it's not entirely logical.

* Avoiding '.', but using it in the encoding doesn't make any sense, although I'm not sure there was a good reason to avoid it in the first place.

* Avoiding '_' but still using it is somewhat reasonable, because it's used as the sigil to mark the names as alt-base64 encoded.

* The alt-base64 encoding goes out of its way handle case folding (which is a real issue on Windows and macOS) - but the same issue can occur with the unencoded names too, and that's not handled.

* isDirChar permits characters that aren't valid on all platforms, like backslash on Windows.

The Preferences class was introduced in Java 1.4 according to the docs, and there's a bug report[1] referencing the encoding behaviour in the 1.4.0 release, so it's probably been like this since the initial implementation.

> P.S. A minor observation; the alphabet on the URL has a slight typo

Bad search-and-replace. Oops :)

[1] https://bugs.java.com/bugdatabase/view_bug.do?bug_id=4696941

Nice! I was trying to figure out what the encoding was!

What’s the thinking behind a base64 encoding with double quotes?

Edit: “It is designed for use in environments where "case folding" occurs.”

That explains all the punctuation marks.

Still stupid. Directory names are not known for case folding.

Indeed. I was thinking that maybe it was trying to be compatible with WIN32 apps or something, but it seems that it's running against MS's conventions [0].

[0]: https://docs.microsoft.com/en-us/windows/win32/fileio/naming...

The Log4shell vulnerability wasn’t actively exploited prior to March 2021, so the timeline doesn’t make sense.

It looks like that’s some type of encoding. Maybe a Base16 run through a Caesarean cipher.

That being said, no sane programmer would deliberately (with deliberation) include a double quote in a legitimate directory path.

Does “rolandog” mean anything to you?

Advanced explosives seems to be a Minecraft mod. Were you developing this mod?

Are there any mods to the Titan program?

Edit: I was close … it’s Base64 run through a Caesarean.

Hi, thanks for your response.

> Does “rolandog” mean anything to you?

Yep, I think it's my username in the machine, but I think my steam username is different.

> Advanced explosives seems to be a Minecraft mod. Were you developing this mod?

I haven't installed or played Minecraft yet; so, no.

> Are there any mods to the Titan program?

Not to my knowledge! I played a couple of levels a year ago, but I never got too invested to try to find any mods.

Reply on news.ycombinator.com