Attention WoW Bloggers

There is also the possibility that Evony is concealing malware: http://www.bruceongames.com/2009/07/16/is-evony-malware/

Reply

I am a student studying computer games design at uni and decided to investigate Evony.com.
Just to see what some of these games are like etc. etc.
The game is actually kind of cool (found myself addicted and even spent a little money on it).
But I started to notice HUGE bandwidth use by the site as I played.
I am not the only one either, there are comments on the evony forums about this.
This is odd because all of the client info, the animations etc. are all downloaded in one big download at the start.
There is no streaming media so I began to wonder what was going on.

To cut a long story short I decided to break the law and reverse engineer Evony’s client.
Not to cheat. Not to rip them off or even to use even a scrap of the code.
But just to poke about a bit and find out what was going on, maybe even offer them some ways to improve things.

Aside from the fact that the whole thing is very poorly constructed (it is really very beginner coder level stuff. Reminds me of a lot of
what the first year students produce for assignments) it contained some very interesting information.

Included with the client are 2 peices of tracking software that monitor your web use and which applications you have open while the client is running.
These do not install independently on the machine though due to the limitations of flash and do not actually damage anything.
But they harvest massive volumes of information. My firewall was blocking a lot of outgoing transmissions and it turns out that these
were the data trying to be sent out. So they know nothing about me. lol.
However there is a LOT of data coming IN over the ports the client uses. In otherwords it is downloading something into my cache for use later.
I have bandiwdth restriction which slows these types of tricks down and I completely clear my cache every couple of hours if I am heavily using the net.

I also noticed that all the varanbles etc. are named Civony still and that there are multiple references to UMGE.
Even a couple of folders are simply called UMGE, one of these folders contains one of the spyware programs.
So I can only guess at where the data would end up if I didnt have a good firewall.

There are also commented out sections in the code which contain references to UMGE and Lam himself, though low on details.

Thank you for reading this.

Lee

Reply

Guo Yao Qi David (David Guo’s full name) is a top hacker and is the boss of Evony. He was involved in the 1999 hacking war between China and Taiwan. And he monetised his knowledge by founding the personal firewall company Sky Net.

Here an article about David Guo as a hacker: http://shenzhen.ccw.com.cn/it/200104/0423.asp
And here is the rough Google translation (Guo Yaoqi is also known as David Guo and owns Evony):

http://translate.google.co.uk/translate?hl=en&sl=zh-CN&u=http://shenzhen.ccw.com.cn/it/200104/0423.asp&ei=p2mLS_zxAoT40wTQyLnICw&sa=X&oi=translate&ct=result&resnum=1&ved=0CAgQ7gEwAA&prev=/search%3Fq%3Dhttp://shenzhen.ccw.com.cn/it/200104/0423.asp%26hl%3Den%26sa%3DG

Reply