> Something not commonly seen in JVM malware that is present here is a class titled VMEscape. It checks if its in a sandboxed windows environment by checking if the current user is WDAGUtilityAccount, which is part of the Windows Defender Application Guard. If this condition is met, an attempt to escape the sandbox system is made.
> The process is roughly as follows:
> - Start a repeating thread to run the following actions:
> - Create a temporary directory using Files.createTempDirectory(...)
> - Iterate over FileDescriptor entries in the system clipboard (Supposedly this will be accessing the contents of the host)
> - Create a shortcut that looks like the original file (using icons from SHELL32) but instead invokes the malware
> - Assings this shortcut to the clipboard, overwriting the original file reference
> Thus, if a user copies a file and goes to paste it elsewhere they will instead paste a shortcut that looks like their intended file, but actually runs the malware.
This is just evil.
But only if the user has a high balance on their own wallet.
At least one person fell for this when they made a small test-transfer which went through but when they entered the higher BTC amount the recipient was replaced. Pretts smart and evil stuff
https://old.reddit.com/r/adventofcode/comments/zb98pn/2022_d...
When HDDs used to be the norm, that would raise an obvious audiovisual signal that something isn't right. Unfortunately with almost everyone using SSDs these days, and the loss of activity indicators[1] on a lot of machines, it would be barely noticeable.
[1] I suspect that it's also in the interests of "officially sanctioned" malware to hide its presence.
No need to have uncontrolled diagnostic feedback when you can make it be exactly what you want in a much more rich/dense format. Clicking doesn't tell you much compared to time traces of read and write activity, drive temperature, and page fault rate.
To actually be useful more information would need to be carried: different rates (by colour, brightness, or a simple bar of variable length), an indicator per drive if multiple, ...
It is also the reason I like mechanical relays in car. You can hear the startup sequence and listen if something is wrong.
Once that buffer or cache runs out, all those mostly extraneous IOPS just pile up, and the SSD will basically never catch up, because the technology fundamentally cannot catch up to a sustained load like that, but the load is sustained because all the software was designed with "SSDs are fast and lots of small writes will be fast" so they just keep growing the queue.
Previously most of the OS would be in memory and only page out if absolutely needed. It feels like modern windows is perfectly willing to page itself out because "SSDs are fast" and have random, pointless file ops everywhere. So if your SSD gets bogged down, now your operating system basically dies too, so good luck killing whatever app(s) are causing the problem
[0] https://learn.microsoft.com/en-us/sysinternals/downloads/pro...
MATE desktop but I bet there are equivalents everywhere.
https://github.com/fractureiser-investigation/fractureiser
Pretty significant find. Exercise caution if you have downloaded Minecraft mod packs since at least April.
What's the security like on Steam workshop? Or Nexusmods? Gaming and modding is still rife with lots of little "here download my exe from this forum post and give it a run please".
Pretty much every game I play modded ends up with some kind of support framework DLL that tons of other mods build from. I am amazed that that has still not really blown up in our faces here in 2023.
There's a lot of hinky stuff out there that doesn't quite reach the level of "malware", just potential fun.
specialized "Visual Studio" extensions are worth looking hard at too.
Which is especially surprising considering the sheer insanity of Minecraft modders and hackers.
Sandboxing Java code running in process requires ugly and obscure security APIs and restricts you to having to have a common modding API (Forge). Many mods use bytecode patching and would be broken completely.
People thought of sandboxing the stuff, but the people thinking of that and the people making the mods aren't the same people and the people making the mods would rather be able to do things outside a single API.
If so how is it really any different from just regular nodejs packages or Python packages?that’s a risk developers seem to ignore.
Or are your talking about scripts being added for modding purposes like Minecraft? If so that’s a pretty good point, would be nice to have godot implement some sort of sandboxed system you can use. Not sure what the term would be or how that would even work.
I thought it took a hot minute to get mods updated anyway
Also, many mods are necessary for performance reasons, due to vanilla's performance being questionable at times.
I'm just going to stick with 1.19 and the mods I downloaded several months ago until this matter is sorted out.
I’m not a malware expert by any means, but I am pretty sure VMs are extremely hard for malware to escape when it isn’t expecting it.
And VMs take almost no technical skill to set up nowadays.
Either way though, no matter how you sandbox Minecraft, at least your Minecraft account is going to be vulnerable.
This wouldn't even be a good way to protect yourself, because the useful things are all tied to the game account, which would be inside the VM.
Data does not persist though, so maybe create a setup script to install mods combined with cloud syncing for saving game state.
https://learn.microsoft.com/en-us/windows/security/applicati...
Also would be surprised if a commercial AV like Bitdefender doesn’t pick this malware up.
If someone found an md5 preimage attack, they wouldn’t burn it on some random Minecraft players.
