67.215.65.132:41

[Taehl]

Why is my plant game, which has no network code whatsoever (nor does it include LUBE or require("socket")), suddenly trying to contact 67.215.65.132:41? It never did this before today...

[bartbes]

I can assure you it's not part of the code, not any code I've seen anyway. However, after some googling I found port 41 is a protocol for "Graphics" (great description!) and a few trojans. Maybe the love executable was hijacked? I'd suggest running a few scans.

EDIT: Actually, I did a reverse DNS, and that ip traces back to OpenDNS.

[Taehl]

I've checked with MSE, rkill, SUPERAntiSpyware - they all found nothing. Also, Love is the only program doing this.

I know the IP is OpenDNS (which I use). Apparently that's the IP of the page it gives you when it fails a DNS lookup. But the question remains, why is Love trying to talk to it?

[bartbes]

I decided to grep the source:

Code: Select all

$ grep "socket" `find . -not -path "./src/libraries/*" -and -not -path "./platform/*" -and -not -path "./.hg/*"`
./src/love.cpp:#include "libraries/luasocket/luasocket.h"
./src/love.cpp:	love::luasocket::__open(L);

I did some other greps, etc, I can't find anything that might be dialing out. Does this happen with every game, how did you trace it to love, any other info you have?

[Taehl]

It happened about thirty seconds after I ran my plant game. I say "happened" because while it did it seven times in rapid succession around the time I started this thread, I can't coax it to do it again. I didn't think to try any other games while it was happening, unfortunately. Maybe it has logic to attempt a connection, and then sleep for some amount of time?

I traced it to Love because my firewall (COMODO) pops up an alert whenever any program that hasn't been previously whitelisted attempts network access (asking if it's to be allowed, or it should continue being blocked). It's also worth noting that the attempted traffic was outgoing, and used IPv6 (how strange).

[thelinx]

Sounds like a fluke to me.