Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Fractureiser” malware in popular Minecraft mods and modpacks

prismlauncher.org

Post reply on HN
Print view View original

41–50 of 106 posts

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#41

Post by ninth_ant »

aezart wrote: post #39
erik wrote: post #38

Earlier quoted context omitted.

This isn't Godot specific at all is it? A very large amount of game modding involves running unrestricted code.

That's quite possible, I'm not super into the modding scene. I guess my default assumption is that mods should be running through some sort of scripting interface that doesn't have access to things like the filesystem.

When developers add an official modding interface, then it usually works the way you've suggested. They get access to much of the internal API and a sandboxed environment.

Many mods though, work by just subverting the game by replacing components with custom-made ones. This allows substantially more customization.

In Minecraft, both types exist. The first type are called "data packs" or "resource packs" and would not be subject to this attack. The latter type involves swapping in new .jar files and running them directly, which is unsupported by the developer and gives basically unrestricted access.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#42

Post by twelvedogs »

basilgohar wrote: post #18
userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

This is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.

my issue with them is i don't need my house lit up like a christmas tree at 2am in the morning when everything is "off", i've never found having a flashing light a great way of troubleshooting when there's a lot better tools to measure disk or network usage anyway.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#43

Post by pdntspa »

andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

What's amazing to me is you have an entire modscene of young or amateur programmers uploading binary code to god-knows-where and this is the first time this sort of thing has happened (that I can recall)

What's the security like on Steam workshop? Or Nexusmods? Gaming and modding is still rife with lots of little "here download my exe from this forum post and give it a run please".

Pretty much every game I play modded ends up with some kind of support framework DLL that tons of other mods build from. I am amazed that that has still not really blown up in our faces here in 2023.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#44

Post by jabbany »

userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

Time to get one of these: https://www.retrokits.de/index.php/hdd-clicker-hdd-sound-sim... ;>)

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#45

Post by George83728 »

dmonitor wrote: post #6
afarviral wrote: post #3

This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.

Just play vanilla for now, I guess I thought it took a hot minute to get mods updated anyway

A lot of people use accessibility mods that suck to go without. Not having ItemScroller causes me physical pain after just a few minutes of clicking around in chests.

I'm just going to stick with 1.19 and the mods I downloaded several months ago until this matter is sorted out.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#46

Post by FixArt »

aezart wrote: post #36
andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

I foresee this being a big problem for the Godot game engine as it gains popularity. There's absolutely no sandboxing or "safe mode" or anything when loading extra resource packs, and any resource or scene file can have an embedded script which executes upon loading.

[dead]

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#47

Post by malkia »

pixl97 wrote: post #37
userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

Guess we have to run promontory [0] at all times to see what's going on [0] https://learn.microsoft.com/en-us/sysinternals/downloads/pro...

it takes heavy toll, but even then it might not be enough due to it's driver altitude. Some tips here - https://techcommunity.microsoft.com/t5/ask-the-performance-t...

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#48

Post by serf »

twelvedogs wrote: post #42
basilgohar wrote: post #18

Earlier quoted context omitted.

This is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.

my issue with them is i don't need my house lit up like a christmas tree at 2am in the morning when everything is "off", i've never found having a flashing light a great way of troubleshooting when there's a lot better tools to measure disk or network usage anyway.

disk activity lights can be pretty keen when you're trying to figure out whether or not the system is entirely halted or just slogging through a heavy workload.

the kind of time when a tool that is good at measuring such things won't ever even attempt to load.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#49

Post by [deleted] »

pkage wrote: post #26
blacksmithgu wrote: post #22

Earlier quoted context omitted.

I'm sure people have thought about it, it's just hard, annoying, and asking a lot of mostly unpaid OSS contributors. Many mod developers are high school / college aged. Sandboxing Java code running in process requires ugly and obscure security APIs and restricts you to having to have a common modding API (Forge). Many mods use bytecode patching and would be broken completely.

The Linux distribution of Prism actually runs in a flatpak by default, which provides pretty OK isolation.

[deleted]

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#50

Post by kaba0 »

andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

Funnily enough, it would simply never work on a mobile OS — it’s the desktop OSs that are at the optimistic 90s levels of security, still.
Post reply on HN