“Fractureiser” malware in popular Minecraft mods and modpacks(prismlauncher.org) |
“Fractureiser” malware in popular Minecraft mods and modpacks(prismlauncher.org) |
> Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made.
> The process is roughly as follows:
> - Start a repeating thread to run the following actions:
> - Create a temporary directory using Files.createTempDirectory(...)
> - Iterate over FileDescriptor entries in the system clipboard (Supposedly this will be accessing the contents of the host)
> - Create a shortcut that looks like the original file (using icons from SHELL32) but instead invokes the malware
> - Assings this shortcut to the clipboard, overwriting the original file reference
> Thus, if a user copies a file and goes to paste it elsewhere they will instead paste a shortcut that looks like their intended file, but actually runs the malware.
This is just evil.
But only if the user has a high balance on their own wallet.
At least one person fell for this when they made a small test-transfer which went through but when they entered the higher BTC amount the recipient was replaced. Pretts smart and evil stuff
https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_d...
When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable.
[1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.
No need to have uncontrolled diagnostic feedback when you can make it be exactly what you want in a much more rich/dense format. Clicking doesn't tell you much compared to time traces of read and write activity, drive temperature, and page fault rate.
To actually be useful more information would need to be carried: different rates (by colour, brightness, or a simple bar of variable length), an indicator per drive if multiple, ...
It is also the reason I like mechanical relays in car. You can hear the startup sequence and listen if something is wrong.
Once that buffer or cache runs out, all those mostly extraneous IOPS just pile up, and the SSD will basically never catch up, because the technology fundamentally cannot catch up to a sustained load like that, but the load is sustained because all the software was designed with "SSDs are fast and lots of small writes will be fast" so they just keep growing the queue.
Previously most of the OS would be in memory and only page out if absolutely needed. It feels like modern windows is perfectly willing to page itself out because "SSDs are fast" and have random, pointless file ops everywhere. So if your SSD gets bogged down, now your operating system basically dies too, so good luck killing whatever app(s) are causing the problem
[0] https://learn.microsoft.com/en-us/sysinternals/downloads/pro...
MATE desktop but I bet there are equivalents everywhere.
https://github.com/fractureiser-investigation/fractureiser
Pretty significant find. Exercise caution if you have downloaded Minecraft mod packs since at least April.
If someone found an md5 preimage attack, they wouldn’t burn it on some random Minecraft players.
What's the security like on Steam workshop? Or Nexusmods? Gaming and modding is still rife with lots of little "here download my exe from this forum post and give it a run please".
Pretty much every game I play modded ends up with some kind of support framework DLL that tons of other mods build from. I am amazed that that has still not really blown up in our faces here in 2023.
There's a lot of hinky stuff out there that doesn't quite reach the level of "malware", just potential fun.
specialized "Visual Studio" extensions are worth looking hard at too.
Which is especially surprising considering the sheer insanity of Minecraft modders and hackers.
Sandboxing Java code running in process requires ugly and obscure security APIs and restricts you to having to have a common modding API (Forge). Many mods use bytecode patching and would be broken completely.
Granted, this is a large concern for clients.
People thought of sandboxing the stuff, but the people thinking of that and the people making the mods aren't the same people and the people making the mods would rather be able to do things outside a single API.
If so how is it really any different from just regular nodejs packages or Python packages?that’s a risk developers seem to ignore.
Or are your talking about scripts being added for modding purposes like Minecraft? If so that’s a pretty good point, would be nice to have godot implement some sort of sandboxed system you can use. Not sure what the term would be or how that would even work.
I thought it took a hot minute to get mods updated anyway
Also, many mods are necessary for performance reasons, due to vanilla's performance being questionable at times.
I'm just going to stick with 1.19 and the mods I downloaded several months ago until this matter is sorted out.
I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it.
And VMs take almost no technical skill to set up nowadays.
Either way though, no matter how you sandbox Minecraft, at least your Minecraft account is going to be vulnerable.
This wouldn't even be a good way to protect yourself, because the useful things are all tied to the game account, which would be inside the VM.
Data does not persist though, so maybe create a setup script to install mods combined with cloud syncing for saving game state.
https://learn.microsoft.com/en-us/windows/security/applicati...
Also would be surprised if a commercial AV like Bitdefender doesn’t pick this malware up.
The beauty of the LEDs is that they were directly electrically connected which means they were unaffected by malware in any way.
--
[1] though for anything I care about I still RAID1² everything
[2] with devices from different sources, to reduce the chance of both dying at the same time (or the second dying before the first is replaced and the mirror rebuilt)
Still though, isn’t Minecraft streaming mostly single player? I assumed latency is the big concern with VMs.
Although I also have very little gaming experience, I can imagine for very good players even slight delays are widely noticeable.
but btw Minecraft is Java, right? So technically it’s on a VM anyway lol. (I know, not really the same, making a joke)
2 monitors for stuff i'm doing, and a 3rd for discord / email / system stats
the kind of time when a tool that is good at measuring such things won't ever even attempt to load.
So thick black tape it is. (Can't do anything about this voice screaming the headset's status though.)
LEDs that are too bright on my laptops get similar treatment. I try to leave them a bit visible, enough to see in a dark room whether they are on, but the laptop not sending light including when it's suspended is more important.
Only if your system is working fine.
Only if you are okay with switching the context.
'Flashing lights' aren't the best troubleshooting tools, but they are OOB and works constantly. Frantically flashing HDD LED would say you about why the system froze for a couple of seconds way sooner when you oculd launch some performance monitor things.
Many mods though, work by just subverting the game by replacing components with custom-made ones. This allows substantially more customization.
In Minecraft, both types exist. The first type are called "data packs" or "resource packs" and would not be subject to this attack. The latter type involves swapping in new .jar files and running them directly, which is unsupported by the developer and gives basically unrestricted access.
A sane system should not be compromised no matter where the executable is from.
So, you're saying a sane system should not run arbitrary code I tell it to run? Which is different from iOS security model how?
(If not, please explain how your hypothetical magic OS resists compromise without limiting instructions it would execute)
Security is upheld, user control is given, everyone is happy.
Not having admin rights is almost uselessly crude as a “sandbox”.
More recently, I've been following https://github.com/microsoft/win32-app-isolation which seems incredibly interesting! If they can pull it off, we will have mobile-os like security on windows, finally, after all these years.
It has been my #1 feature request for windows for so long... I almost can't believe it's actually happening.