Bob's Game
Repo: https://github.com/bobsgame/bobsgame/ (deleted, see edit below)I looked at it a few weeks back and it's really strange. It has really weird restrictions that don't make any sense regarding the license - I'm not even sure if they even are legal. The author claims he is sharing the source but that nobody else can fork it, unless they fork it on GitHub?!Anyhow, within a few seconds of reading the source you'll find that the first thing the binary does is call home to download and extract a newer .zip file from the bobsgame.com website.It does this over HTTP and without any kind of signature/signing of the binary.Before it actually downloads the .zip file it actually tries to grab a version number from a PHP script on the website that doesn't exist. The website instead renders some HTML. The C++ casts this HTML to a number and gets 0, so it always assumes that the website does not have a newer version of the game to download.This means if someone on the local network can DNS spoof the website it will dutifully talk over unauthenticated HTTP, the attacker can actually provide a PHP script that responds with a high version number and then deliver the payload over a .zip file.It's a fascinating tale!EDIT: It does appear the author has been removing things =( His GitHub has been wiped clean https://github.com/robertpelloniIf anyone is curious here is a fork of the repository I was trying to link: https://github.com/mpavlinsky/bobsgame