FalsePositive (AntiDDOS)

OpticFusion1 / MCAntiMalware

Anti-Malware for minecraft

https://www.spigotmc.org/resources/spigot-anti-malware-detects-over-200-malicious-plugins.64982/

GNU General Public License v3.0

287 stars 29 forks source link

FalsePositive (AntiDDOS) #145

Closed OpticFusion1 closed 5 years ago

OpticFusion1 commented 5 years ago

General Troubleshooting

[X] I have checked for similar issues.
[X] I have updated to the latest version.
[X] I have checked the branches or the maintainers' PRs for upcoming features/bug fixes.

Issue

Issue Type

[X] Bug Report - The jar that causes the bug MUST be provided, otherwise the issue will be closed
[ ] Feature Request

Description

This is due to people including the Bukkit API within their plugin AdvancedTeleportation(6788).zip

OpticFusion1 commented 5 years ago

Same as the original file PotionSignsSimplefunwaytoaccesspotions(10410).zip

ghost commented 5 years ago

What does the BukkitAPI have to do with this?

OpticFusion1 commented 5 years ago

Certain files within the BukkitAPI cause this to trigger. Specifically org/bukkit/permissions/PermissionDefault in this case, though there's probably others

OpticFusion1 commented 5 years ago

Which becomes an issue when a plugin includes the BukkitAPI even though it doesn't have to

ghost commented 5 years ago

The AntiDDOS check is just checking for a classNode name lol

OpticFusion1 commented 5 years ago

the code specifically is if (classNode.name.contains("pl/polskipalacz/backdoor")) { return true; } return classNodeContainsBlacklistedWord(classNode, new String[]{"!komendy", "!op", "!pex", "!stop", "youtube.com/polskipalacz"});

Either way, for whatever reason org/bukkit/permissions/PermissionDefault is triggering it

ghost commented 5 years ago

Do you have the plugin with the virus? If yes can you send me it?

ghost commented 5 years ago

I found the bug already.

OpticFusion1 commented 5 years ago

Good, as for the malicious jar, doesn't seem like i have it anymore so i can't really do much with the check :/

OpticFusion1 commented 5 years ago

This check can't be touched until i re-find a jar with this malware, so the issue will be closed until then