Starcraft 2 Issue - Caching Fault

[WilliamC]

Hi,

Standard http would use port 80, since its standard http.

Our caching providers have removed the hash file. Can you please check if it is working now ?

Regards,

William

[Abreare]

Still not working.

The download is most coming via HTTP, however I cannot tell you if it is on port 80 or not.

Downloading the following two files using Exetel gives difference checksums. Downloaded on a clean ISP, they will be identical. People have observed cases where they have obtained a clean copy of the file and uploaded it to a self-owned server, only to find that they cannot even download a clean copy from their own, non-caching server.

http://maged.lordaeron.org/sc2/mapcache ... d5693b.zip
http://maged.lordaeron.org/sc2/mapcache ... 5693b.s2mv

The correct SHA-256 hash SHOULD be the file name i.e. 6402(etcetc). The hash I received LAST NIGHT was 22BE6FC73EC7EB795D744032758EC6E499A8CC3B545D692D98F987AE051A7107. The hash I get RIGHT NOW is 4F3D0CF04B98678EEB370C39DAB5EA1589A2E1F8D0FDF41A6AD518D63C7FBCDF. As discussed in the threads below, this was previous legit content but is no longer. This has been verified for other users of other ISPs.

As a workaround, some users have been able to download copies of other's cache folders and then play successfully. This does not work currently but I did not check last night as my copy of those files had not completed.

Please note this is a SERIOUS security issue. Malicious sites taking advantage of this behavior can poison content from legitimate sites assuming the malicious content is what is first cached by your proxy. From the SC forum threads:

Orcon Security Advisory

Title: Proxy Cache Poisoning
Impact: Critical
Announced: March 10, 2010
Reporter: Maged (Maged@lordaeron.org)

Description

While troubleshooting an unrelated bug with the Orcon proxy server, it was discovered that the proxy server does not respect the same origin policy for caching files. To exploit this, an attacker can grab an executable file and modify it to contain malicious code. As long as the beginning of the file and it's size remain the same, the attacker can upload the malicious file to their own webserver and have an Orcon user download it, poisoning the cache if no Orcon user has downloaded the real file from the real server. At this point, the real server appears to be serving malicious code.

Recommendation to Orcon:
Disable the proxy server IMMEDIATELY. If you would like to continue using a proxy, please follow the standards.

Recommendation to Orcon Users:
Whenever possible, try downloading files over SSL. You can typically do this by adding an s after the http in a URL. For example: http://www.example.com/goodfile.exe -> https://www.example.com/goodfile.exe

References

# http://forums.battle.net/thread.html?to ... 7&sid=5000

Send this to Orcon immediately, please.

(Note that when I tried to get those files via SSL as he suggests, I recieved a SSL error)

Many more details available:
http://forums.battle.net/thread.html?to ... 0&pageNo=1
http://forums.battle.net/thread.html?to ... 0&pageNo=1

[Abreare]

Further info:

As for the info they want, this is the file that is currently cached:
http://usb.depot.battle.net:1119/4f3d0c ... fbcdf.s2mv

This is the file that's being effected (as well as the one on my server):
http://usb.depot.battle.net:1119/640243 ... 5693b.s2mv

As a workaround, blacklisting battle.net from the cache should do it.

[raugaj]

yeah still not working for me

[redda2]

Hi,

I'm having the same problem. In Melbourne/ADSL1.

Can someone fix this problem ASAP? The beta ends in 5 days. I mean I pre-ordered SC2 for $50 to get a beta key and I haven't been able to play for the last two weeks. I just assumed it was Blizzard's fault, but I just realised its Exetel's problem.

I really need to play as SC2 beta ends on the 7th of June and after that we have to wait for 2 months until release.

Cheers.

[WilliamC]

Our caching suppliers have now informed they are bypassing usb.depot.battle.net. please let me know how this goes.

[cdonges]

Still broken for me.

[cdonges]

It does work fine teathering a virgin mobile phone though so I am pretty sure it's a problem on exetel's side.

[WilliamC]

Further info:

As for the info they want, this is the file that is currently cached:
http://usb.depot.battle.net:1119/4f3d0c ... fbcdf.s2mv

This is the file that's being effected (as well as the one on my server):
http://usb.depot.battle.net:1119/640243 ... 5693b.s2mv

As a workaround, blacklisting battle.net from the cache should do it.

I am seeing if we can get this done.

Regards,

William

[WilliamC]

Hi,

They have reported the removal of Battle.net from the cache but have not removed the hash yet.

However they asked for some feedback anyway.

Regards,

William

[Abreare]

Unfortunately I can't provide further feedback as last night I connected my computer to a different ISP and downloaded the content.

I have requested people on the battle.net forums to test for you.

[raugaj]

mine seems to be working now, just tested 1v1.

[redda2]

I'll test later on tonight, when I get home.

[redda2]

Can confirm its working

[stickmatrix]

i was having this issue during patch 13 til blizzard fixed it on their end.