TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

I Found Malware in a BeamNG Mod

175 点作者 davikr15 天前

8 条评论

lionkor14 天前
I worked on BeamMP[0][1], for 5 years, both as a project manager and lead developer for the server and client. BeamMP is a wildly popular multiplayer mod for BeamNG (1M registered players, always at least 3k concurrent players, also it&#x27;s AGPL licensed). I left the team this year, but I can tell you: Mods, if they manage to break the sandbox in any way, can do <i>anything</i>, and the BeamNG sandbox will never be perfect. To their credit, the BeamNG devs have hired people from the community who do a lot of security research, and they have found numerous issues and fixed them before they could be exploited.<p>We have seen prototypes that can make network requests out of the sandbox, call winapi functions, and do anything else with the same privileges as the game, which, worst case, is admin because players like running things as administrator. All of <i>those</i> exploits are fixed, now.<p>The issue remains one of the largest problems in the community, and sites that are well known for distributing mods with malware (which is pretty common) are at the top of Google search results.<p>BeamMP allows mods on servers, which causes clients to download and then execute code from those mods. That&#x27;s a huge attack vector and BeamMP has been working hard to warn users and to come up with ways to prevent problems; but without funding (BeamMP is free) there is a limit on what can be done. The infrastructure costs already are sky high for supporting the crazy amount of users they have.<p>Sadly, everyone involved loves NDAs - I can only hope that companies start doing writeups, but I doubt it. So that&#x27;s all the inside info I can give ;)<p>[0] <a href="https:&#x2F;&#x2F;beammp.com" rel="nofollow">https:&#x2F;&#x2F;beammp.com</a><p>[1] <a href="https:&#x2F;&#x2F;GitHub.com&#x2F;BeamMP">https:&#x2F;&#x2F;GitHub.com&#x2F;BeamMP</a>
评论 #43855750 未加载
评论 #43858395 未加载
评论 #43864005 未加载
评论 #43877008 未加载
评论 #43857105 未加载
davikr15 天前
This is the second time (we know of) BeamNG.drive being exploited due to bad security practices - the first time, disabling ASLR [0], leading to Disney being hacked, this time, disabling CEF sandboxing. It is weird to see them go out of their way to disable conventional security features on their product.<p>[0]: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=41063489">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=41063489</a>
评论 #43852914 未加载
评论 #43852609 未加载
评论 #43853947 未加载
评论 #43854659 未加载
TZubiri14 天前
Unrelated, on mobile, background is quickly oscilating colours giving an epileptic vibe
评论 #43856067 未加载
评论 #43859945 未加载
abhisek14 天前
Still trying to understand - Did the mod developers intentionally shipped malicious code or they were compromised by some external attacker to target the downstream users?
评论 #43854364 未加载
Cloudef14 天前
Why is CEF used without sandbox?
everdrive14 天前
But did the malware do anything significant through proton to the host OS?
lopanapol14 天前
nice
fifteen150614 天前
I hate malware. I found two Android apps using an obfuscator loaded via JNI (libjiagu_64.so) which crashes on startup (on GrapheneOS) and I am at a loss at what to do next which doesn&#x27;t involve send reports into the void hoping it reaches an human with the time, skills and willingness to check what is really going on.<p>Summary: <a href="https:&#x2F;&#x2F;user934.com&#x2F;2025&#x2F;04&#x2F;29&#x2F;investigating-suspicious-behavior-in-savefamily-savefamilygps-and-the-libjiagu_64-so-library&#x2F;" rel="nofollow">https:&#x2F;&#x2F;user934.com&#x2F;2025&#x2F;04&#x2F;29&#x2F;investigating-suspicious-beha...</a>
评论 #43855523 未加载
评论 #43856386 未加载