Solaris\Union is still in use?

[ATHF]

Found some interesting oddity in the client. Whether you believe it or not is yours to decide. Others are free to independently confirm or disprove it. Afaik this is discontinued code, but whatever.

Code: Select all

Finding A — silent PII exfiltration in Solaris/Union, APXUtils.java:790:

java


getHTML("http://unionclient.ru/exhandler.php?mac=" + getMACAdress() + "&info=" + exinfo);
A global uncaught-exception handler that ships the MAC address, the OS username, OS/JVM versions and the stack trace to a third-party domain over plain HTTP — no consent, no opt-out, no flag. 
The package is union, the class prefix APX = APXEOLOG. This is exactly the injected-caveat pattern you predicted, and it is the first thing to look for inside Replica's binary.

[ATHF]

Code: Select all

replica/internal/ (53 classes) also wires three outbound services: LiveRelayService (live gob/position relay), PvpDiscordAlertService (alertPvpAggro(..., BufferedImage) 
— sends screenshots to Discord), and OlympusService (the auth-gated inventoryItemReceived/updateCharacterPosition/setCursor private-feature surface). 
Most capable client, least suitable base for a "nothing leaves the machine" build.