It seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.
What until you learn about javascript and npm
“Fractureiser” malware in popular Minecraft mods and modpacks
91–100 of 106 posts
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#92Earlier quoted context omitted.
I have cpu, network, memory, and i/o graphs in my desktop panel for this reason. MATE desktop but I bet there are equivalents everywhere.
Don't they get covered up by useful stuff?
multimonitors are cheap and if you're not gaming or doing intensive things most CPUs and onboard graphics can handle em just fine.
2 monitors for stuff i'm doing, and a 3rd for discord / email / system stats
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#93Earlier quoted context omitted.
That’s absolutely false — sideloading has nothing to do with security checks, especially not sandboxing. A sane system should not be compromised no matter where the executable is from.
> A sane system should not be compromised no matter where the executable is from. So, you're saying a sane system should not run arbitrary code I tell it to run? Which is different from iOS security model how? (If not, please explain how your hypothetical magic OS resists compromise without limiting instructions it would execute)
You are running code on your CPU in ring 0 all the time? No. The same way a sandbox gives a whitelist approach to security — this app by default should have no filesystem access. It does want to open a file — ask the user whether it should be able to or not.
Security is upheld, user control is given, everyone is happy.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#94Earlier quoted context omitted.
Don't they get covered up by useful stuff?
multimonitors are cheap and if you're not gaming or doing intensive things most CPUs and onboard graphics can handle em just fine. 2 monitors for stuff i'm doing, and a 3rd for discord / email / system stats
How do you manage with only three monitors...?
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#95Earlier quoted context omitted.
> A sane system should not be compromised no matter where the executable is from. So, you're saying a sane system should not run arbitrary code I tell it to run? Which is different from iOS security model how? (If not, please explain how your hypothetical magic OS resists compromise without limiting instructions it would execute)
You are running code on your CPU in ring 0 all the time? No. The same way a sandbox gives a whitelist approach to security — this app by default should have no filesystem access. It does want to open a file — ask the user whether it should be able to or not. Security is upheld, user control is given, everyone is happy.
Well if we are talking sandboxing, Windows has it and this malware specifically has sandbox escape functionality for that purpose.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#96Earlier quoted context omitted.
This might be a bit nitpicky but resource packs just replace assets without scripting capabilities, and datapacks do let you run commands which are Turing-complete but they aren’t really a great programming language because you can’t do things like loops in a normal way
Graphical mods are still mods. You don't need scripting for a mod to be a mod. It just has to modify the base game.
I’m not saying it doesn’t count, just pointing out some differences
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#97client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.
Also, it checks the entire system for JARs and injects it’s stage0 bootstrap!, that includes maven and gradle caches. Reading this part sent a slight cold shiver down my back. Am infected mod dev could become a new spreader
God im sick of "everything you run runs under your full rights". It doesn't reflect reality, it may have in the 80's. Now it's impossible to know what is being executed so it shouldn't make sense that it has free reigns. IT SHOULD ASK FOR EVERY FKIN RESOURCE IT WANTS TO ACCESS
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#98client.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.
I find that SSDs have a terrible failure mode too. Everyone thinks they are "fast" so they do all sorts of file operations that would have previously been considered too slow. However, consumer SSDs are only "fast" until they run out of DRAM buffer or SLC cache. Then they slow WAY down, like slower IOPS than my spinning rust disk. That means your busy machine goes from perfectly fine to nearly locked up, because even the OS now thinks file operations are "cheap" enough to block on and rely on in all sorts of hot paths.
Once that buffer or cache runs out, all those mostly extraneous IOPS just pile up, and the SSD will basically never catch up, because the technology fundamentally cannot catch up to a sustained load like that, but the load is sustained because all the software was designed with "SSDs are fast and lots of small writes will be fast" so they just keep growing the queue.
Previously most of the OS would be in memory and only page out if absolutely needed. It feels like modern windows is perfectly willing to page itself out because "SSDs are fast" and have random, pointless file ops everywhere. So if your SSD gets bogged down, now your operating system basically dies too, so good luck killing whatever app(s) are causing the problem
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#99Earlier quoted context omitted.
You are running code on your CPU in ring 0 all the time? No. The same way a sandbox gives a whitelist approach to security — this app by default should have no filesystem access. It does want to open a file — ask the user whether it should be able to or not. Security is upheld, user control is given, everyone is happy.
Well if we are talking sandboxing, Windows has it and this malware specifically has sandbox escape functionality for that purpose.
What kind of sandbox does Windows have? All I could find was about a pro/enterprise feature but even that has to be explicitly started and I doubt minecraft users used that.
Not having admin rights is almost uselessly crude as a “sandbox”.
Re: “Fractureiser” malware in popular Minecraft mods and modpacks
#100> A CDN compromise or cache poisoning is not out of the question due to Curse's usage of the extremely outdated and insecure MD5 to verify downloads. If someone found an md5 preimage attack, they wouldn’t burn it on some random Minecraft players.
It's one of the biggest games in the world, so I can see the appeal of targeting Minecraft players, especially since a lot of them are children and don't know what's going on. I checked my sons computer for this malware yesterday, and luckily he wasn't infected, but I ran OSForensics on his computer afterwards to see if he did get infected what kind of data an attacker might be able to get, and there was all sorts of PII from myself and my wife having used that computer before at one point or another. I'm sure with such a large install base there's plenty of opportunity to steal lots of valuable info.