“Fractureiser” malware in popular Minecraft mods and modpacks

Post by throwaway290 » Thu, Jun 08, 2023, 12:19 PM UTC

pdntspa wrote: post #43

andersa wrote: post #14

It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.

What's amazing to me is you have an entire modscene of young or amateur programmers uploading binary code to god-knows-where and this is the first time this sort of thing has happened (that I can recall) What's the security like on Steam workshop? Or Nexusmods? Gaming and modding is still rife with lots of little "here download my exe from this forum post and give it a run please". Pretty much every game I play modde…

Post by kaba0 » Thu, Jun 08, 2023, 12:28 PM UTC

throwaway290 wrote: post #82

kaba0 wrote: post #50

Earlier quoted context omitted.

Funnily enough, it would simply never work on a mobile OS — it’s the desktop OSs that are at the optimistic 90s levels of security, still.

Not for long, since EU is mandating sideloading most games will bypass security checks on mobile too.

Post by pluijzer » Thu, Jun 08, 2023, 1:01 PM UTC

geek_at wrote: post #63

SCLeo wrote: post #61

> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread…

kind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through bu…

Post by jsheard » Thu, Jun 08, 2023, 2:03 PM UTC

waitforit wrote: post #71

geek_at wrote: post #63

Earlier quoted context omitted.

kind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through bu…

At the last Advent of Code there was a person whose solution didn't pass because a part of their input was replaced by a dogecoin address https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_d...

Post by blibble » Thu, Jun 08, 2023, 2:15 PM UTC

geek_at wrote: post #63

SCLeo wrote: post #61

> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread…

kind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through bu…