Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Fractureiser” malware in popular Minecraft mods and modpacks

prismlauncher.org

Post reply on HN
Print view View original

71–80 of 106 posts

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#71

Post by waitforit »

geek_at wrote: post #63
SCLeo wrote: post #61

> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread…

kind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through bu…

At the last Advent of Code there was a person whose solution didn't pass because a part of their input was replaced by a dogecoin address

https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_d...

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#72

Post by charcircuit »

circuit10 wrote: post #64
ninth_ant wrote: post #41

Earlier quoted context omitted.

When developers add an official modding interface, then it usually works the way you've suggested. They get access to much of the internal API and a sandboxed environment. Many mods though, work by just subverting the game by replacing components with custom-made ones. This allows substantially more customization. In Minecraft, both types exist. The first type are called "data packs" or "resource packs" and would not…

This might be a bit nitpicky but resource packs just replace assets without scripting capabilities, and datapacks do let you run commands which are Turing-complete but they aren’t really a great programming language because you can’t do things like loops in a normal way

Graphical mods are still mods. You don't need scripting for a mod to be a mod. It just has to modify the base game.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#74

Post by birracerveza »

pdntspa wrote: post #43
andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

What's amazing to me is you have an entire modscene of young or amateur programmers uploading binary code to god-knows-where and this is the first time this sort of thing has happened (that I can recall) What's the security like on Steam workshop? Or Nexusmods? Gaming and modding is still rife with lots of little "here download my exe from this forum post and give it a run please". Pretty much every game I play modde…

>What's amazing to me is you have an entire modscene of young or amateur programmers uploading binary code to god-knows-where and this is the first time this sort of thing has happened (that I can recall)

Which is especially surprising considering the sheer insanity of Minecraft modders and hackers.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#75

Post by autoexec »

twelvedogs wrote: post #42
basilgohar wrote: post #18

Earlier quoted context omitted.

This is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.

my issue with them is i don't need my house lit up like a christmas tree at 2am in the morning when everything is "off", i've never found having a flashing light a great way of troubleshooting when there's a lot better tools to measure disk or network usage anyway.

monitoring the presence of disk and network activity in general was a lot more useful when computers only did things when you told them to and only made connections to remote hosts when you explicitly requested it. Never knowing what your devices are doing or who/what they are communicating with without having to launch a full scale investigation was nice.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#76

Post by SamuelAdams »

mr_00ff00 wrote: post #12
afarviral wrote: post #3

This is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.

Maybe this is a dumb suggest, but what about using a VM or second computer? I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it. And VMs take almost no technical skill to set up nowadays.

Windows 10 has built in sandboxing now, might be worth checking out. I’m not sure if it’s available on Home and Pro editions though.

Data does not persist though, so maybe create a setup script to install mods combined with cloud syncing for saving game state.

https://learn.microsoft.com/en-us/windows/security/applicati...

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#77

Post by itsTyrion »

userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

Also, it checks the entire system for JARs and injects it’s stage0 bootstrap!, that includes maven and gradle caches. Reading this part sent a slight cold shiver down my back. Am infected mod dev could become a new spreader

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#78

Post by justsomehnguy »

twelvedogs wrote: post #42
basilgohar wrote: post #18

Earlier quoted context omitted.

This is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.

my issue with them is i don't need my house lit up like a christmas tree at 2am in the morning when everything is "off", i've never found having a flashing light a great way of troubleshooting when there's a lot better tools to measure disk or network usage anyway.

> when there's a lot better tools to measure disk or network usage anyway.

Only if your system is working fine.

Only if you are okay with switching the context.

'Flashing lights' aren't the best troubleshooting tools, but they are OOB and works constantly. Frantically flashing HDD LED would say you about why the system froze for a couple of seconds way sooner when you oculd launch some performance monitor things.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#79

Post by h2odragon »

pdntspa wrote: post #43
andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

What's amazing to me is you have an entire modscene of young or amateur programmers uploading binary code to god-knows-where and this is the first time this sort of thing has happened (that I can recall) What's the security like on Steam workshop? Or Nexusmods? Gaming and modding is still rife with lots of little "here download my exe from this forum post and give it a run please". Pretty much every game I play modde…

Generally the misadventures have been limited to attacks against individuals in personal bitch fights, and overzealous copy protection / license enforcement schemes from paranoid (people selling Xplane planes forex).

There's a lot of hinky stuff out there that doesn't quite reach the level of "malware", just potential fun.

specialized "Visual Studio" extensions are worth looking hard at too.

Re: “Fractureiser” malware in popular Minecraft mods and modpacks

#80

Post by willis936 »

basilgohar wrote: post #18
userbinator wrote: post #10

client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.

This is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.

We didn't have rainmeter back when hard drives were used as boot drives. I have a pretty large set of windows performance monitor and HWInfo readouts running on all of my windows machines with modified versions of the simpleperfmeter and now rainformer skins.

No need to have uncontrolled diagnostic feedback when you can make it be exactly what you want in a much more rich/dense format. Clicking doesn't tell you much compared to time traces of read and write activity, drive temperature, and page fault rate.

Post reply on HN