8 ms·
“Fractureiser” malware in popular Minecraft mods and modpacks
- veave 3y agofiles-8ie,pages,dev does not resolve and 85,217,144,130 times out, so... the malware doesn't do anything anymore?
- jonas-w 3y agofrom TFA: > Until further notice, do not use the official CurseForge launcher, or download anything from CurseForge or the Bukkit plugin repository. While the control server for this malware is currently offline, any download from CurseForge or the Bukkit plugin repository in in the last 2-3 weeks should be treated as potentially malicious. This malware is unlikely to be detected by Windows Defender or similar antimalware products.
- emmelaich 3y agoWhy do they say it's unlikely? Surely defender/av products will soon be able to detect it? Or do they mean right now? Frustrating.
- Eiim 3y agoThey've said that virus scanners have started to add the malware signatures now, but I think the point was to say that "you're not fine just because you have an antivirus that would have caught it".
- 12345hn6789 3y agoMost up to date information here. https://github.com/fractureiser-investigation/fractureiser https://github.com/fractureiser-investigation/fractureiser Pretty significant find. Exercise caution if you have downloaded Minecraft mod packs since at least April.
- afarviral 3y agoThis is highly annoying/intentional timing as Minecraft 1.20 just got released but now it is tainted with fears of viruses and extra steps to mitigate. For a friend who streams minecraft content and relies on the income this is a big setback and extra-risky for them if their account secrets are stolen.
- aetherspawn 3y agoYou could play the game/mods on a burner PC or in a VM and do everything else, such as access your accounts, from a different computer. Also would be surprised if a commercial AV like Bitdefender doesn’t pick this malware up.
- BGINBarbarian 3y agoThere are scripts written by mod devs, and curseforge (the platform where mods are updated) to detect it, so that's useful.
- dmonitor 3y agoJust play vanilla for now, I guess I thought it took a hot minute to get mods updated anyway
- BGINBarbarian 3y agoMany smaller mods updated quickly. This is a) because this is not a very large update, and b) because Minecraft has pre releases and release candidates which are practically the same as the final release, so the mod can be updated before the final release of the version. Also, many mods are necessary for performance reasons, due to vanilla's performance being questionable at times.
- George83728 3y agoA lot of people use accessibility mods that suck to go without. Not having ItemScroller causes me physical pain after just a few minutes of clicking around in chests. I'm just going to stick with 1.19 and the mods I downloaded several months ago until this matter is sorted out.
- willcipriano 3y agoWhen the creator gets caught I hope he uses the "in minecraft" defence.
- duxup 3y agoWhat does that mean?
- squeaky-clean 3y agoPeople try to get around online moderation bans for calls to violence or such by saying things like "Someone needs to kick that guy's ass... In Minecraft"
- deleted 3y ago[deleted]
- SkylockeScarred 3y agoHilarious thing is, that sort of speech I think is protected by the Brandenburg Vs. Ohio. It's when it gets specific in a "do x at y" way it gets you v&.
- IIAOPSW 3y ago"Let's blow up parliament...in minecraft"
- potatoman22 3y agoDoing illegal things... in Minecraft
- userbinator 3y agoclient.jar searches the entire filesystem When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable. [1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.
- basilgohar 3y agoThis is one of the (several) modern trends of computing that I dislike severely. There are lights for all kinds of nonsense but actually useful information, like Wifi status, disk activity, and even POWER ON/OFF are removed for some misdirected sense of minimalism or style.
- twelvedogs 3y agomy issue with them is i don't need my house lit up like a christmas tree at 2am in the morning when everything is "off", i've never found having a flashing light a great way of troubleshooting when there's a lot better tools to measure disk or network usage anyway.
- serf 3y agodisk activity lights can be pretty keen when you're trying to figure out whether or not the system is entirely halted or just slogging through a heavy workload. the kind of time when a tool that is good at measuring such things won't ever even attempt to load.
- LoveMortuus 3y agoI also enjoyed the sound that the HDD made when something was happening. So even if the computer froze, the sound gave me a bit of hope. If there was no sound from the HDD and the computer froze, I just restarted the computer, abandon all hope.
- andersa 3y agoIt seems baffling that we have this massive community making mods with highly insecure raw java code, and somehow nobody thought of figuring out how to sandbox the stuff.
- TheRealPomax 3y agoThis severely downplays how much work adversaries put into making sure that despite your best efforts, their payloads will make it through.
- blacksmithgu 3y agoI'm sure people have thought about it, it's just hard, annoying, and asking a lot of mostly unpaid OSS contributors. Many mod developers are high school / college aged. Sandboxing Java code running in process requires ugly and obscure security APIs and restricts you to having to have a common modding API (Forge). Many mods use bytecode patching and would be broken completely.
- pkage 3y agoThe Linux distribution of Prism actually runs in a flatpak by default, which provides pretty OK isolation.
- deleted 3y ago[deleted]
- willis936 3y agoIt's SOP to run MC servers in a tightly constrained and patched docker container and oftentimes also on a VM. Granted, this is a large concern for clients.
- themoonisachees 3y agoThe page this post links to is for the prism launcher, a 3rd-party launcher that enables a lot of very useful features such as automatic mod installs. Crucially, it is distributed as a flatpak with sane default permissions, which means that pretty much all linux users are safe (turns out even the ones not using flatpak were safe because they borked their unit file but still). People thought of sandboxing the stuff, but the people thinking of that and the people making the mods aren't the same people and the people making the mods would rather be able to do things outside a single API.
- deleted 3y ago[deleted]
- DFHippie 3y agoTime for folks to try out Minetest, perhaps. I happen to know it has sandboxed its Lua mods to prevent just this sort of attack. I don't play it myself, but I know the person who wrote the sandboxing code. Or knew him. He passed away recently.
- UberFly 3y agoThe world of Minecraft mods has always been a bleep-show. Massive community but ignored by the developers for the most part. I'm surprised malware isn't more rampant.
- SCLeo 3y ago> Anti-sandbox tricks > Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made. > The process is roughly as follows: > - Start a repeating thread to run the following actions: > - Create a temporary directory using Files.createTempDirectory(...) > - Iterate over FileDescriptor entries in the system clipboard (Supposedly this will be accessing the contents of the host) > - Create a shortcut that looks like the original file (using icons from SHELL32) but instead invokes the malware > - Assings this shortcut to the clipboard, overwriting the original file reference > Thus, if a user copies a file and goes to paste it elsewhere they will instead paste a shortcut that looks like their intended file, but actually runs the malware. This is just evil.
- geek_at 3y agokind of reminds me of the very subtle malware found in a modified version of a bitcoin wallet that would lay low but when you copy-paste a BTC address in the recepient field, the malware replaces the clipboard with their own address in hopes you don't check it twice But only if the user has a high balance on their own wallet. At least one person fell for this when they made a small test-transfer which went through but when they entered the higher BTC amount the recipient was replaced. Pretts smart and evil stuff
- stravant 3y agoIt gets even better, those malware even dynamically generate replacement wallets, finding ones that have similar starting and ending characters to the target one so that the victim can't easily recognize that the wallet has been replaced.
- waitforit 3y agoAt the last Advent of Code there was a person whose solution didn't pass because a part of their input was replaced by a dogecoin address https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_day_3_something_weird_with_copypasting/ https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_d...
- Aldipower 3y agoFractureiserFS. Maybe available in the upcoming Linux kernel. :-)
- oefrha 3y ago> A CDN compromise or cache poisoning is not out of the question due to Curse's usage of the extremely outdated and insecure MD5 to verify downloads. If someone found an md5 preimage attack, they wouldn’t burn it on some random Minecraft players.
- barking_biscuit 3y agoIt's one of the biggest games in the world, so I can see the appeal of targeting Minecraft players, especially since a lot of them are children and don't know what's going on. I checked my sons computer for this malware yesterday, and luckily he wasn't infected, but I ran OSForensics on his computer afterwards to see if he did get infected what kind of data an attacker might be able to get, and there was all sorts of PII from myself and my wife having used that computer before at one point or another. I'm sure with such a large install base there's plenty of opportunity to steal lots of valuable info.
- Sebguer 3y agoSome of the very first reports of log4j were against Minecraft servers. If you go look at the original Github issue in which it was identified, all of the posts prior to anyone understanding its gravity were from Minecraft server operators.