Direly Important Update (Build 349)

We’ve made a pretty bad mistake with one of the more recent updates, which added some functionality to the autoupdater. We’ve been working furiously over this weekend to solve the problem, and have finally finished the work needed to solve the problem, which we’ve put into an emergency patch.​

The exploit (which we wont detail for lack of further harm) allows malicious users to inject code directly into KAG. As such, literally anything could be happening to your computer as you play. Many of the users reporting strangeness with their computers (ie the reports that tipped us off that something was awry) also report not being able to log into the forums, as their accounts have been deactivated in the database.​

Reports have come in of people’s computers randomly popping up pornography, uninstalling KAG, openning hundreds of windows, consuming large amounts of bandwidth, and other blatant troll-virus symptoms.​

Luckily, MM’s computer was attacked yesterday, and we were able to learn more about the technical side of the attacks.​

Most of the attacks have contained some reference to urls containing ‘incarnum.net’, either grahically or as a target address for intercepted encrypted outbound traffic. It isn’t clear yet if it’s incarnum launching these attacks or someone with a vendetta against him trying to marr his name - we’re working on cracking the encrypted packets to get a clue.​

We’re not sure how many computers have been affected, but regardless this patch should be the end of any new infections. Be sure to run a virus scan after installing.​

I know this falls on april 1st for some of you, but this is no joke. Patch your game.​

MM & Geti ​

 

This is not an april fools joke, there was a serious issue involving players who had somehow gained rcon access to ALL servers, regardless of password, also other issues.

 

To clarify:
The exploit was able to be performed using commands from a server to client to download data using some unprotected autoupdate functionality and cache it - its functionality that wasn't supposed to be exposed yet, to allow servers to download mods to clients. Unfortunately it was exploited to distribute viruses. If you scan /base, /cache and /downloads and nothing comes back, you should be good. It could technically be performed on any server by any member who had full RCON rights (ie not guards). We're unable to identify the source of attacks because the logging isn't up to scratch (unless we got server logs from everyone, and even then it'd be a giant task to pour over them all and find the culprit, which would probably be an alt anyway). As stated in the blog post, incarnum.net was a recurring element in the infection, on MM's computer anyway. We're unsure if pawel is involved, I'm not sure he'd be that blatant but you never can tell.