Curseforge Compromised, has been serving mods with malicious code for months

[Barry McKockner]

Minecraft mods strike again

 

[Super Dilator Duel 3D]

With the knowledge known at the moment, if those files don't exist then that means your credentials are safe and not leaked in any way.

You can always scan your filesystem to see if it's infected with Stage 0 but Stage 0 is ultimately harmless unless it's executed. Past that rotating your passwords etc is just being overly cautious (but it's up to you and ultimately you can't be too cautious)

Thank you! I did this as well and found nothing so I'll proceed under the hopeful assumption I'm safe... Though I do still need to change my passwords. You can never be too careful, and it only takes one bad Minecraft mod to get all your most intimate shit out in the hands of some Russian scriptkiddie as we saw with Chudbuds.

What is it with Minecraft mods and being full of computer AIDS?

In addition to the reason already given (.jar files, the format used for Minecraft Java Edition mods, are basically .exes that don't get screened as thoroughly) you also have to consider how many kids are seeing modded Minecraft gameplay from their favorite YouTube/Twitch/TikTok creators and Google "minecraft mod download" or something similar on their parent's laptops with little to no proper digital literacy skills to keep them safe. That's a perfect target for any bad actor. I suspect personally that the people affected by infected Minecraft mods who aren't naive children are gamers who, while being more familiar with operating a PC than the aforementioned kids, are still probably not tech-savvy enough to know to be skeptical of their .jar files. Therefore, computer AIDS.

 

[AbduluCthuluZulu]

We didn't have this problem back when the only way to install mods was by manually copying them into your minecraf.jar. (Don't forget to delete META-INF)

 

[Flaming Dumpster]

What is it with Minecraft mods and being full of computer AIDS?

Minecraft mods are not sandboxed and their target audience is too retarded to know any better. Games like Garry's Mod implement their scripting in a Lua sandbox so generally the worst that can happen is they fuck up your game's performance.

How they ended up in this sorry state of affairs is largely historical, Notch couldn't be bothered making an interface for a safer scripting language so people hook into the guts of the engine and do crazy shit. The low level access is why these mods can do a lot but the security is basically "trust me bro".

Cities: Skylines is another game with this issue. The de facto modding method is just referencing ICities.dll and writing whatever trash you want that hooks straight into the engine. It's no better than running a random .exe off the Internet except AVs are very unlikely to pick it up, basically nobody publishes their source code and any retard can bait thousands into running their malicious DLL with one click.

Years ago I used to decompile malware people routinely posted on Minecraft Forums that used embedded Gmail credentials to e-mail the victim's lastlogin file to the authors. Best moment was when I logged into the Google account, found they had search history enabled and was greeted by a wall of embarrassing MLP clopping. I shamed that faggot on his post and they nearly banned me

Nothing has really changed, people are just smarter than that these days.

 

[Myzsterious Mizster Jones]

1. People forget that .jar files are literally arbitrary code akin to .exe files
2. Virus scanners don't scan for .jar files
3. No checks are done to make sure downloaded .jar files are secure / not tampered with (many program installers have automatic signature and checksum checks, .jar gets nothing)

This is the fault of normies for not embracing Java Web Start.

 

[AnOminous]

This is the fault of normies for not embracing Java Web Start.

Run random code off random websites? Nah. That's almost as bad as using curseforge.

 

[Myzsterious Mizster Jones]

Run random code off random websites? Nah. That's almost as bad as using curseforge.

Java Web Start allowed native-looking applications with sandboxing and easy updating, so unless you're actually getting hit with 0days, it's a much safer way to launch apps. Of course, Larry Ellison killed it.

 

[AnOminous]

Java Web Start allowed native-looking applications with sandboxing and easy updating, so unless you're actually getting hit with 0days, it's a much safer way to launch apps. Of course, Larry Ellison killed it.

It's been deprecated since 9.