Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Fractureiser” malware in popular Minecraft mods and modpacks

prismlauncher.org

Post reply on HN
Print view View original

61–70 of 106 posts

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#61

Post by SCLeo »

> Anti-sandbox tricks

> Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made.

> The process is roughly as follows:

> - Start a repeating thread to run the following actions:

> - Create a temporary directory using Files.createTempDirectory(...)

> - Iterate over FileDescriptor entries in the system clipboard (Supposedly this will be accessing the contents of the host)

> - Create a shortcut that looks like the original file (using icons from SHELL32) but instead invokes the malware

> - Assings this shortcut to the clipboard, overwriting the original file reference

> Thus, if a user copies a file and goes to paste it elsewhere they will instead paste a shortcut that looks like their intended file, but actually runs the malware.

This is just evil.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#62

Post by zelphirkalt »

basilgohar wrote: post #18
userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

This is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.

I like my Lenovo X200 with all its glorious light indicators, some of which one can even see when the lid is closed. I wish modern laptops would have those again.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#63

Post by geek_at »

SCLeo wrote: post #61

> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread…

kind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice

But only if the user has a high balance on their own wallet.

At least one person fell for this when they made a small test-transfer which went through but when they entered the higher BTC amount the recipient was replaced. Pretts smart and evil stuff

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#64

Post by circuit10 »

ninth_ant wrote: post #41
aezart wrote: post #39

Earlier quoted context omitted.

That's quite possible, I'm not super into the modding scene. I guess my default assumption is that mods should be running through some sort of scripting interface that doesn't have access to things like the filesystem.

When developers add an official modding interface, then it usually works the way you've suggested. They get access to much of the internal API and a sandboxed environment. Many mods though, work by just subverting the game by replacing components with custom-made ones. This allows substantially more customization. In Minecraft, both types exist. The first type are called "data packs" or "resource packs" and would not…

This might be a bit nitpicky but resource packs just replace assets without scripting capabilities, and datapacks do let you run commands which are Turing-complete but they aren’t really a great programming language because you can’t do things like loops in a normal way

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#65

Post by circuit10 »

squeaky-clean wrote: post #15
mr_00ff00 wrote: post #12

Earlier quoted context omitted.

Maybe this is a dumb suggest, but what about using a VM or second computer? I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it. And VMs take almost no technical skill to set up nowadays.

It's been years since I've done it so maybe it's much better now, but getting games to run properly in a VM was a huge hassle for me. In the best cases 3d acceleration was slow, often it just wouldn't work at all.

It’s not better now, unless you can do GPU passthrough

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#67

Post by stravant »

geek_at wrote: post #63
SCLeo wrote: post #61

> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread…

kind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through bu…

It gets even better, those malware even dynamically generate replacement wallets, finding ones that have similar starting and ending characters to the target one so that the victim can't easily recognize that the wallet has been replaced.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#68

Post by andai »

userbinator wrote: post #23
dspillett wrote: post #20

Earlier quoted context omitted.

For a modern OS a some inductor LED for drive activity would just be constantly flashing at different rates. Something is always writing to a log somewhere, just on the OS itself. To actually be useful more information would need to be carried: different rates (by colour, brightness, or a simple bar of variable length), an indicator per drive if multiple, ...

Mine stays almost completely quiet most of the time, because I've trimmed the stuff running in the background to an absolute minimum.

On which OS?

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#69

Post by dspillett »

userbinator wrote: post #23
dspillett wrote: post #20

Earlier quoted context omitted.

For a modern OS a some inductor LED for drive activity would just be constantly flashing at different rates. Something is always writing to a log somewhere, just on the OS itself. To actually be useful more information would need to be carried: different rates (by colour, brightness, or a simple bar of variable length), an indicator per drive if multiple, ...

Mine stays almost completely quiet most of the time, because I've trimmed the stuff running in the background to an absolute minimum.

I've done that in the past, back when I was running Linux on very slow & apparently somewhat fragile solid state devices on a netbook, and when trying to keep traditional drives as quiet as possible in a desktop pretending to be a server that was on all hours, but for the most part I leave logging on and not overly buffered these days. SSDs are quiet and reliable¹ ATM.

--

[1] though for anything I care about I still RAID1² everything

[2] with devices from different sources, to reduce the chance of both dying at the same time (or the second dying before the first is replaced and the mirror rebuilt)

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#70

Post by Gordonjcp »

thanatos519 wrote: post #55
userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

I have cpu, network, memory, and i/o graphs in my desktop panel for this reason. MATE desktop but I bet there are equivalents everywhere.

Don't they get covered up by useful stuff?
Post reply on HN