Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Fractureiser” malware in popular Minecraft mods and modpacks

prismlauncher.org

Post reply on HN
Print view View original

31–40 of 106 posts

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#31

Post by Eiim »

emmelaich wrote: post #25
jonas-w wrote: post #11

Earlier quoted context omitted.

from TFA: > Until further notice, do not use the official CurseForge launcher, or download anything from CurseForge or the Bukkit plugin repository. While the control server for this malware is currently offline, any download from CurseForge or the Bukkit plugin repository in in the last 2-3 weeks should be treated as potentially malicious. This malware is unlikely to be detected by Windows Defender or similar antima…

Why do they say it's unlikely? Surely defender/av products will soon be able to detect it? Or do they mean right now? Frustrating.

They've said that virus scanners have started to add the malware signatures now, but I think the point was to say that "you're not fine just because you have an antivirus that would have caught it".

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#32

Post by willis936 »

blacksmithgu wrote: post #22
andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

I'm sure people have thought about it, it's just hard, annoying, and asking a lot of mostly unpaid OSS contributors. Many mod developers are high school / college aged. Sandboxing Java code running in process requires ugly and obscure security APIs and restricts you to having to have a common modding API (Forge). Many mods use bytecode patching and would be broken completely.

It's SOP to run MC servers in a tightly constrained and patched docker container and oftentimes also on a VM.

Granted, this is a large concern for clients.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#33

Post by gibspaulding »

mr_00ff00 wrote: post #12
afarviral wrote: post #3

This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.

Maybe this is a dumb suggest, but what about using a VM or second computer? I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it. And VMs take almost no technical skill to set up nowadays.

A second computer is actually a pretty typical setup for streaming. One PC actually runs the game, and a capture card sends the audio/video output to a second PC that runs your streaming software.

Either way though, no matter how you sandbox Minecraft, at least your Minecraft account is going to be vulnerable.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#34

Post by themoonisachees »

andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

The page this post links to is for the prism launcher, a 3rd-party launcher that enables a lot of very useful features such as automatic mod installs. Crucially, it is distributed as a flatpak with sane default permissions, which means that pretty much all linux users are safe (turns out even the ones not using flatpak were safe because they borked their unit file but still).

People thought of sandboxing the stuff, but the people thinking of that and the people making the mods aren't the same people and the people making the mods would rather be able to do things outside a single API.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#35

Post by themoonisachees »

mr_00ff00 wrote: post #12
afarviral wrote: post #3

This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.

Maybe this is a dumb suggest, but what about using a VM or second computer? I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it. And VMs take almost no technical skill to set up nowadays.

VMs are no-go for gaming, unless you are willing to do dedicated gpus. Reminder that most people streaming minecraft do not know what a vm is to begin with :)

This wouldn't even be a good way to protect yourself, because the useful things are all tied to the game account, which would be inside the VM.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#36

Post by aezart »

andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

I foresee this being a big problem for the Godot game engine as it gains popularity. There's absolutely no sandboxing or "safe mode" or anything when loading extra resource packs, and any resource or scene file can have an embedded script which executes upon loading.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#37

Post by pixl97 »

userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

Guess we have to run promontory [0] at all times to see what's going on

[0] https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#38

Post by erik »

aezart wrote: post #36
andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

I foresee this being a big problem for the Godot game engine as it gains popularity. There's absolutely no sandboxing or "safe mode" or anything when loading extra resource packs, and any resource or scene file can have an embedded script which executes upon loading.

This isn't Godot specific at all is it? A very large amount of game modding involves running unrestricted code.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#39

Post by aezart »

erik wrote: post #38
aezart wrote: post #36

Earlier quoted context omitted.

I foresee this being a big problem for the Godot game engine as it gains popularity. There's absolutely no sandboxing or "safe mode" or anything when loading extra resource packs, and any resource or scene file can have an embedded script which executes upon loading.

This isn't Godot specific at all is it? A very large amount of game modding involves running unrestricted code.

That's quite possible, I'm not super into the modding scene. I guess my default assumption is that mods should be running through some sort of scripting interface that doesn't have access to things like the filesystem.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#40

Post by sporedro »

aezart wrote: post #36
andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

I foresee this being a big problem for the Godot game engine as it gains popularity. There's absolutely no sandboxing or "safe mode" or anything when loading extra resource packs, and any resource or scene file can have an embedded script which executes upon loading.

Do you mean this would be an issue with regards to using their asset store/3rd party plugins for your game?

If so how is it really any different from just regular nodejs packages or Python packages?that’s a risk developers seem to ignore.

Or are your talking about scripts being added for modding purposes like Minecraft? If so that’s a pretty good point, would be nice to have godot implement some sort of sandboxed system you can use. Not sure what the term would be or how that would even work.

Post reply on HN