Ask HN: Is this weird folder name indication of attempted log4shell attack?

5 points

4 years ago

A bit of context: I hadn't tested restoring my backups for more than a year, and by the end of my restoration test, I noticed a warning from Déjà Dup telling me that some files could not be restored, and to make sure that I am able to write to them.

Among the files listed were these two files (dated 2020-07-10) which had a rather eye-caching sub-folder called '_!(:!b!"v!(@!cw"f!$%!.g!4!$!=' (without single quotes):

  ~/.java/.userPrefs/net/puppygames/applet/Revenge of the Titans/_!(:!b!"v!(@!cw"f!$%!.g!4!$!=/prefs.xml

and:

  ~/.java/.userPrefs/net/puppygames/applet/Revenge of the Titans/_!(:!b!"v!(@!cw"f!$%!.g!4!$!=/rolandog/prefs.xml

The XML files do not seem out of this world:

  <?xml version="1.0" encoding="UTF-8" standalone="no"?>
  <!DOCTYPE map SYSTEM "http://java.sun.com/dtd/preferences.dtd">
  <map MAP_XML_VERSION="1.0">
    <entry key="active" value="true"/>
    <entry key="attempts.0.8" value="1"/>
    <entry key="attempts.0.9" value="2"/>
    <entry key="familiar.advancedexplosives.0.1" value="0"/>
    <entry key="familiar.advancedexplosives.0.2" value="0"/>
  ...

For additional context: I had installed the game a while ago through Steam, and recently I uninstalled my whole library to make some space for some work-related stuff, so I'm unable to run the game or make tests.