11 ms·
“Fractureiser” malware in popular Minecraft mods and modpacks
- oefrha 3y ago> A CDN compromise or cache poisoning is not out of the question due to Curse's usage of the extremely outdated and insecure MD5 to verify downloads. If someone found an md5 preimage attack, they wouldn’t burn it on some random Minecraft players.
- barking_biscuit 3y agoIt's one of the biggest games in the world, so I can see the appeal of targeting Minecraft players, especially since a lot of them are children and don't know what's going on. I checked my sons computer for this malware yesterday, and luckily he wasn't infected, but I ran OSForensics on his computer afterwards to see if he did get infected what kind of data an attacker might be able to get, and there was all sorts of PII from myself and my wife having used that computer before at one point or another. I'm sure with such a large install base there's plenty of opportunity to steal lots of valuable info.
- Sebguer 3y agoSome of the very first reports of log4j were against Minecraft servers. If you go look at the original Github issue in which it was identified, all of the posts prior to anyone understanding its gravity were from Minecraft server operators.
- 12345hn6789 3y agoMost up to date information here. https://github.com/fractureiser-investigation/fractureiser https://github.com/fractureiser-investigation/fractureiser Pretty significant find. Exercise caution if you have downloaded Minecraft mod packs since at least April.
- afarviral 3y agoThis is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
- aetherspawn 3y agoYou could play the game/mods on a burner PC or in a VM and do everything else, such as access your accounts, from a different computer. Also would be surprised if a commercial AV like Bitdefender doesn’t pick this malware up.
- BGINBarbarian 3y agoThere are scripts written by mod devs, and curseforge (the platform where mods are updated) to detect it, so that's useful.
- dmonitor 3y agoJust play vanilla for now, I guess I thought it took a hot minute to get mods updated anyway
- BGINBarbarian 3y agoMany smaller mods updated quickly. This is a) because this is not a very large update, and b) because Minecraft has pre releases and release candidates which are practically the same as the final release, so the mod can be updated before the final release of the version. Also, many mods are necessary for performance reasons, due to vanilla's performance being questionable at times.
- George83728 3y agoA lot of people use accessibility mods that suck to go without. Not having ItemScroller causes me physical pain after just a few minutes of clicking around in chests. I'm just going to stick with 1.19 and the mods I downloaded several months ago until this matter is sorted out.
- mr_00ff00 3y agoMaybe this is a dumb suggest, but what about using a VM or second computer? I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it. And VMs take almost no technical skill to set up nowadays.
- veave 3y agofiles-8ie,pages,dev does not resolve and 85,217,144,130 times out, so... the malware doesn't do anything anymore?
- jonas-w 3y agofrom TFA: > Until further notice, do not use the official CurseForge launcher, or download anything from CurseForge or the Bukkit plugin repository. While the control server for this malware is currently offline, any download from CurseForge or the Bukkit plugin repository in in the last 2-3 weeks should be treated as potentially malicious. This malware is unlikely to be detected by Windows Defender or similar antimalware products.
- emmelaich 3y agoWhy do they say it's unlikely? Surely defender/av products will soon be able to detect it? Or do they mean right now? Frustrating.
- Eiim 3y agoThey've said that virus scanners have started to add the malware signatures now, but I think the point was to say that "you're not fine just because you have an antivirus that would have caught it".
- willcipriano 3y agoWhen the creator gets caught I hope he uses the "in minecraft" defence.
- duxup 3y agoWhat does that mean?
- squeaky-clean 3y agoPeople try to get around online moderation bans for calls to violence or such by saying things like "Someone needs to kick that guy's ass... In Minecraft"
- deleted 3y ago[deleted]
- SkylockeScarred 3y agoHilarious thing is, that sort of speech I think is protected by the Brandenburg Vs. Ohio. It's when it gets specific in a "do x at y" way it gets you v&.
- IIAOPSW 3y ago"Let's blow up parliament...in minecraft"
- potatoman22 3y agoDoing illegal things... in Minecraft
- userbinator 3y agoclient.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.
- itsTyrion 3y agoAlso, it checks the entire system for JARs and injects it’s stage0 bootstrap!, that includes maven and gradle caches. Reading this part sent a slight cold shiver down my back. Am infected mod dev could become a new spreader
- ikekkdcjkfke 3y agoGod im sick of "everything you run runs under your full rights". It doesn't reflect reality, it may have in the 80's. Now it's impossible to know what is being executed so it shouldn't make sense that it has free reigns. IT SHOULD ASK FOR EVERY FKIN RESOURCE IT WANTS TO ACCESS
- mrguyorama 3y agoI find that SSDs have a terrible failure mode too. Everyone thinks they are "fast" so they do all sorts of file operations that would have previously been considered too slow. However, consumer SSDs are only "fast" until they run out of DRAM buffer or SLC cache. Then they slow WAY down, like slower IOPS than my spinning rust disk. That means your busy machine goes from perfectly fine to nearly locked up, because even the OS now thinks file operations are "cheap" enough to block on and rely on in all sorts of hot paths. Once that buffer or cache runs out, all those mostly extraneous IOPS just pile up, and the SSD will basically never catch up, because the technology fundamentally cannot catch up to a sustained load like that, but the load is sustained because all the software was designed with "SSDs are fast and lots of small writes will be fast" so they just keep growing the queue. Previously most of the OS would be in memory and only page out if absolutely needed. It feels like modern windows is perfectly willing to page itself out because "SSDs are fast" and have random, pointless file ops everywhere. So if your SSD gets bogged down, now your operating system basically dies too, so good luck killing whatever app(s) are causing the problem
- andersa 3y agoIt seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.
- lm28469 3y agoWhat until you learn about javascript and npm
- phendrenad2 3y agoThe same could be said about NPM, or pip, or crates. The security model is "they will probably find the backdoor before it affects me", and it's unreasonably effective.
- blacksmithgu 3y agoI'm sure people have thought about it, it's just hard, annoying, and asking a lot of mostly unpaid OSS contributors. Many mod developers are high school / college aged. Sandboxing Java code running in process requires ugly and obscure security APIs and restricts you to having to have a common modding API (Forge). Many mods use bytecode patching and would be broken completely.
- pkage 3y agoThe Linux distribution of Prism actually runs in a flatpak by default, which provides pretty OK isolation.
- deleted 3y ago[deleted]
- willis936 3y agoIt's SOP to run MC servers in a tightly constrained and patched docker container and oftentimes also on a VM. Granted, this is a large concern for clients.
- TheRealPomax 3y ago
- deleted 3y ago[deleted]
- DFHippie 3y agoTime for folks to try out Minetest, perhaps. I happen to know it has sandboxed its Lua mods to prevent just this sort of attack. I don't play it myself, but I know the person who wrote the sandboxing code. Or knew him. He passed away recently.
- UberFly 3y agoThe world of Minecraft mods has always been a bleep-show. Massive community but ignored by the developers for the most part. I'm surprised malware isn't more rampant.
- SCLeo 3y ago> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread to run the following actions: > - Create a temporary directory using Files.createTempDirectory(...) > - Iterate over FileDescriptor entries in the system clipboard (Supposedly this will be accessing the contents of the host) > - Create a shortcut that looks like the original file (using icons from SHELL32) but instead invokes the malware > - Assings this shortcut to the clipboard, overwriting the original file reference > Thus, if a user copies a file and goes to paste it elsewhere they will instead paste a shortcut that looks like their intended file, but actually runs the malware. This is just evil.
- geek_at 3y agokind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through but when they entered the higher BTC amount the recipient was replaced. Pretts smart and evil stuff
- waitforit 3y agoAt the last Advent of Code there was a person whose solution didn't pass because a part of their input was replaced by a dogecoin address https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_day_3_something_weird_with_copypasting/ https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_d...
- jsheard 3y agoAlso here, what appeared to be a bug in ImGuis clipboard handling turned out to be a crypto stealer https://github.com/ocornut/imgui/issues/4029 https://github.com/ocornut/imgui/issues/4029
- Aldipower 3y agoFractureiserFS. Maybe available in the upcoming Linux kernel. :-)