(Update) New malicious code causes certain Minecraft players to be at risk of malware

unknown.png

Minecraft players might find themselves at risk for a malware that's spreading. According to Avast, 50,000 accounts have fallen victim to a malicious code which infects your computer and reformats users' hard drives. Supposedly, this malware isn't complex at all, but the issue is that people were able to upload this virus via Minecraft skins, and onto the official Minecraft site, where many people go to in order to download skins for their characters. With a 75 million playerbase, there's a multitude of users that could be potentially affected, although only younger users are more likely to download skins, therefore leaving them the most susceptible to downloading the malware. There's a handful of specific skins, such as the ones above, that have the malware script attached, but it would be the safer option to not download any skins at this time. Claims are being made that if an affected user joins a host that you're on, it can also affect you as well and put you at risk, though this is unverified.

Affected users that wound up downloading an infected skin began receiving unusual messages in their inbox on the Mojang site, such as,

“You Are Nailed, Buy A New Computer This Is A Piece Of Sh*t”
“You have maxed your internet usage for a lifetime”
“Your a** got glued”

There's also a variant that can affect "tourstart.exe" on your computer, which causes massive performance issues to your PC, especially on startup. Avast claims that they've protected over 15,000 threats by removing the harmful software, or preventing it from downloading. At the time of writing, the issue has not been resolved, but Mojang is currently working to address this problem.

:arrow: Source

Edit: The Minecraft official Site has responded to the problem and have fixed this issue.

This is now resolved, but we wanted to explain what happened and the measures we’ve put in place to protect our community.

Any Minecraft: Java Edition player can upload their own custom skin in the widely-used PNG file format to our webservice at minecraft.net and this will then appear on their character in-game. PNG files can contain things other than an image, such as metadata, which includes information on what tool created it, when it was made, who made it, etc. This meant that PNG files could be created containing code in this inert part of the skin file. However, this code would not be run or read by the game itself.

While your antivirus software might detect this code and alert you to its presence, the code would not be able to run by itself. Additionally, even if you found the code within the file and chose to run it, your antivirus software should detect and block the attempt.

To further protect our players, however, we deployed an update that strips out all the information from uploaded skin files other than the actual image data itself.

Supposedly, the claims by Avast were false, and that code hidden in the skins couldn't actually be executed, according to Minecraft developers. Regardless, any potential for such a problem to occur with the Java version has been fixed.
 

MFDC12

Well-Known Member
Member
Joined
Oct 12, 2007
Messages
819
Trophies
1
Age
32
XP
899
Country
United States
The only reasons for using Java *ever* is easy portability since it runs on a VM, ease of coding due to rich libraries and the possibility of embedding your software online, but even that advantage is diminishing with the advent of C# and .NET. I can't think of a single instance when a video game would ever benefit from being coded in Java unless it's explicitly coded with the intention of running on mobiles or as a portable game across various platforms, most ambitious titles always lean towards C since it allows them to run much closer to the metal. Of course it's a matter of preference, both languages have the same roots, really, but personally if I can avoid a VM, I always will, even if it only gives me a small percentage of a performance boost. Sure, Java makes debugging easier since you're debugging for a fixed environment, but it just doesn't sit well with me. Programming is becoming increasingly separated from the hardware and I personally see that as a huge negative.

So, a couple things - I am in agreement with you about game programming specifically, if these thoughts are game programming specifically we are in agreement of course it is better to use something like c/c+-. But I feel that you are talking outside the game development realmn too, in which case I feel you are misguided in your thoughts.

Companies who develop enterprise software hire java and .net developers for a reason. They don't need as close to access to hardware or "run close to the metal", the software doesn't require it. Game developers are most likely for sure going to hire someone to work in c++ over anything. Hardware companies are probably going to choose a c developer, and people with assembly knowledge. Again, right tool for the right job.
 
  • Like
Reactions: Flaflo

Shadowfied

Well-Known Member
Member
Joined
Dec 6, 2014
Messages
2,405
Trophies
1
Age
28
XP
3,666
Country
I would love to know how they managed to run the code... If anyone has any info about it
They didn't. If you read the edit in OP you can see that there actually really never was an "issue" at all.
They just added malicious code into the PNG files, and the game didn't "sanitize" them. Obviously the game nor the computer will ever try to execute a part of a PNG, let alone the file itself.
 

Foxi4

Endless Trash
Global Moderator
Joined
Sep 13, 2009
Messages
30,825
Trophies
3
Location
Gaming Grotto
XP
29,822
Country
Poland
So, a couple things - I am in agreement with you about game programming specifically, if these thoughts are game programming specifically we are in agreement of course it is better to use something like c/c+-. But I feel that you are talking outside the game development realmn too, in which case I feel you are misguided in your thoughts.

Companies who develop enterprise software hire java and .net developers for a reason. They don't need as close to access to hardware or "run close to the metal", the software doesn't require it. Game developers are most likely for sure going to hire someone to work in c++ over anything. Hardware companies are probably going to choose a c developer, and people with assembly knowledge. Again, right tool for the right job.
I was specifically talking about this from the perspective of Minecraft. It might look like square rainbow vomit on the screen, but back in the day it was pretty advanced, all things considered. Voxel-based graphics are generally very taxing on the GPU which necessitates as short API's as humanly possible. Nowadays we have GPU's capable of double-digit teraflops of compute, not to mention WebGL and other high level environments that basically allow a VM to bounce such calculations directly to the GPU, but way back when this was hardly optimal. You're right though, high-level managed code exists for a reason and there are tools for all kinds of jobs, I just happen to be of the opinion that when it comes to game dev you don't want to waste resources needlessly.
 
  • Like
Reactions: Ryccardo

Dontwait00

Unknown
Member
Joined
Sep 3, 2017
Messages
272
Trophies
0
Age
31
XP
701
Country
Italy
Omg! Didnt know that Minecraft was that "powerful" on pc.. Wonder if could this affect others consoles, like Android or N3DS...
 
D

Deleted User

Guest
Omg! Didnt know that Minecraft was that "powerful" on pc.. Wonder if could this affect others consoles, like Android or N3DS...
I don't think it would affect consoles since it can't execute .exe's, but for Android, it could, they can do many shit for it.
 

Site & Scene News

Popular threads in this forum

General chit-chat
Help Users
    Xdqwerty @ Xdqwerty: good night