Bob's Game
Repo: <a href="https://github.com/bobsgame/bobsgame/" rel="nofollow">https://github.com/bobsgame/bobsgame/</a> (deleted, see edit below)<p>I looked at it a few weeks back and it's really strange. It has really weird restrictions that don't make any sense regarding the license - I'm not even sure if they even are legal. The author claims he is sharing the source but that nobody else can fork it, unless they fork it on GitHub?!<p>Anyhow, within a few seconds of reading the source you'll find that the first thing the binary does is call home to download and extract a newer .zip file from the bobsgame.com website.<p>It does this over HTTP and without any kind of signature/signing of the binary.<p>Before it actually downloads the .zip file it actually tries to grab a version number from a PHP script on the website that doesn't exist. The website instead renders some HTML. The C++ casts this HTML to a number and gets 0, so it always assumes that the website does not have a newer version of the game to download.<p>This means if someone on the local network can DNS spoof the website it will dutifully talk over unauthenticated HTTP, the attacker can actually provide a PHP script that responds with a high version number and then deliver the payload over a .zip file.<p>It's a fascinating tale!<p>EDIT: It does appear the author has been removing things =( His GitHub has been wiped clean <a href="https://github.com/robertpelloni" rel="nofollow">https://github.com/robertpelloni</a><p>If anyone is curious here is a fork of the repository I was trying to link: <a href="https://github.com/mpavlinsky/bobsgame" rel="nofollow">https://github.com/mpavlinsky/bobsgame</a>