Security researchers at Check Point Research have published a report about GodLoader, a malware loader using Godot as its runtime to execute malicious code and infect unaware users with known malware. Based on the report, affected users thought they were downloading and executing cracks for paid software, but instead executed the malware loader. Check Point Research published a report As the report states, the vulnerability is not specific to Godot. The Godot Engine is a programming system with a scripting language. It is akin to, for instance, the Python and Ruby runtimes. It is possible to write malicious programs in any programming language. We do not believe that Godot is particularly more or less suited to do so than other such programs. If you downloaded a Godot game or the editor from a reliable source, you don’t have to do anything. You are not at risk. We encourage people to only execute software from trusted sources – whether it’s written using Godot or any other programming system. If you downloaded a Godot game or the editor from a reliable source, you don’t have to do anything. You are not at risk. For some more technical details: Godot does not register a file handler for .pck files. This means that a malicious actor always has to ship the Godot runtime (.exe file) together with a .pck file. The user will always have to unpack the runtime together with the .pck to the same location and then execute the runtime. There is no way for a malicious actor to create a “one click exploit”, barring other OS-level vulnerabilities. If such an OS-level vulnerability were used then Godot would not be a particularly attractive option due to the size of the runtime. .pck .exe .pck .pck This is similar to writing malicious software in Python or Ruby, the malicious actor will have to ship a python.exe or ruby.exe together with their malicious program. python.exe ruby.exe Good security practices We would like to take this opportunity to remind users about some good security practices when it comes to downloading and executing software. Only download and execute software (including game mods) from trusted sources:

Official project website. Confirm it by checking the URL, and verify with a search engine that this seems to be the most frequently referenced website for this software.
Trusted distribution platform: Steam, Epic Games Store, Windows Store, Google Play, Apple Store, etc.
People you know, after confirming that they are who they claim to be if the communication is text-based (see below).


On Windows and macOS, verify that the executable is signed (and notarized, on macOS) by a trusted party.
Be wary of executing cracked software, which is a prime attack vector for malicious actors.
Be wary of executing software even from people you know, if you can’t confirm that their account hasn’t been compromised. A very common attack vector targeting specifically game developers is for Discord accounts to get hacked, and then malicious actors use them to send malicious downloads to their friends in private messages (“hey will you try my game?”). Make sure to confirm the identity of your contacts before executing such software. Only download and execute software (including game mods) from trusted sources:

Official project website. Confirm it by checking the URL, and verify with a search engine that this seems to be the most frequently referenced website for this software.
Trusted distribution platform: Steam, Epic Games Store, Windows Store, Google Play, Apple Store, etc.
People you know, after confirming that they are who they claim to be if the communication is text-based (see below). Official project website. Confirm it by checking the URL, and verify with a search engine that this seems to be the most frequently referenced website for this software.
Trusted distribution platform: Steam, Epic Games Store, Windows Store, Google Play, Apple Store, etc.
People you know, after confirming that they are who they claim to be if the communication is text-based (see below). Official project website. Confirm it by checking the URL, and verify with a search engine that this seems to be the most frequently referenced website for this software. Trusted distribution platform: Steam, Epic Games Store, Windows Store, Google Play, Apple Store, etc. People you know, after confirming that they are who they claim to be if the communication is text-based (see below). On Windows and macOS, verify that the executable is signed (and notarized, on macOS) by a trusted party. Be wary of executing cracked software, which is a prime attack vector for malicious actors. Be wary of executing software even from people you know, if you can’t confirm that their account hasn’t been compromised. A very common attack vector targeting specifically game developers is for Discord accounts to get hacked, and then malicious actors use them to send malicious downloads to their friends in private messages (“hey will you try my game?”). Make sure to confirm the identity of your contacts before executing such software. Reporting security issues We thank Check Point Research for following the security guidelines of responsible disclosure, which let us confirm that this attack vector, while unfortunate, is not specific to Godot and does not expose a vulnerability in the engine or for its users. If you would like to report a security vulnerability or concern, please send an email to security@godotengine.org. security@godotengine.org By Godot Security Team By Godot Security Team Also published here here Photo by Ümit Yıldırım on Unsplash Ümit Yıldırım Unsplash

Unsplash

Google

Check Point

Make

GodLoader Malware Loader: What You Need to Be Aware of

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

A Look at Games Made With Godot XR (December 2024)

'Vibe Coding' Is Now In The Collins Dictionary - But What About 'Technical Debt'?

New Google AI Studio Build: A FREE AI App Builder

Google, aka Alphabet, Delivers Its First Twelve Digit Revenue Quarter

108 Stories To Learn About Cybersecurity Tips

10 Ways to Mitigate Cybersecurity Risks and Prevent Data Theft

A Look at Games Made With Godot XR (December 2024)

'Vibe Coding' Is Now In The Collins Dictionary - But What About 'Technical Debt'?

New Google AI Studio Build: A FREE AI App Builder

Google, aka Alphabet, Delivers Its First Twelve Digit Revenue Quarter

108 Stories To Learn About Cybersecurity Tips

10 Ways to Mitigate Cybersecurity Risks and Prevent Data Theft

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps