HACKER Q&A
📣 rolandog

Is this weird folder name indication of attempted log4shell attack?


A bit of context: I hadn't tested restoring my backups for more than a year, and by the end of my restoration test, I noticed a warning from Déjà Dup telling me that some files could not be restored, and to make sure that I am able to write to them.

Among the files listed were these two files (dated 2020-07-10) which had a rather eye-caching sub-folder called '_!(:!b!"v!(@!cw"f!$%!.g!4!$!=' (without single quotes):

  ~/.java/.userPrefs/net/puppygames/applet/Revenge of the Titans/_!(:!b!"v!(@!cw"f!$%!.g!4!$!=/prefs.xml
and:

  ~/.java/.userPrefs/net/puppygames/applet/Revenge of the Titans/_!(:!b!"v!(@!cw"f!$%!.g!4!$!=/rolandog/prefs.xml
The XML files do not seem out of this world:

  
  
  
    
    
    
    
    
  ...
For additional context: I had installed the game a while ago through Steam, and recently I uninstalled my whole library to make some space for some work-related stuff, so I'm unable to run the game or make tests.

The folder name seems rather unusual to me, and I'm unsure what to make of it.

However, I just wanted to validate if this was also normal for other users.

  👤 rianmcguire Accepted Answer ✓
Revenge of the Titans is using the java.util.prefs.Preferences class from the Java standard library.

Looking at the implementation here: https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e90...

If the requested directory name has certain "inappropriate" characters in it, it'll encode it using Base64.byteArrayToAltBase64, which is a non-standard base64 encoding using the alphabet defined here: https://github.com/openjdk/jdk/blob/4f607f2adac3798c16a62e90...

If we decode the directory name using that alphabet: https://gchq.github.io/CyberChef/#recipe=From_Base64('!%22%2...

You can see that it was encoding the text:

  slots_1.80
Nothing to see here, other than some sloppy filename handling in Déjà Dup.
👤 pyuser583
The Log4shell vulnerability wasn’t actively exploited prior to March 2021, so the timeline doesn’t make sense.

It looks like that’s some type of encoding. Maybe a Base16 run through a Caesarean cipher.

That being said, no sane programmer would deliberately (with deliberation) include a double quote in a legitimate directory path.

Does “rolandog” mean anything to you?

Advanced explosives seems to be a Minecraft mod. Were you developing this mod?

Are there any mods to the Titan program?

Edit: I was close … it’s Base64 run through a Caesarean.