The 'Godot Virus' GodLoader

Security firm Checkpoint Security have just released a terrifying report about malware being spread using the Godot game engine, something called GodLoader. Although terrifying sounding in both description and name, it's nowhere near as bad as it sounds and you do not need to worry if you have Godot or a Godot game installed, unless you do some very very very questionable things from a security perspective.

Key Links
-----------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------

[Alex_Wilman]

This just in: programs can, in fact, be viruses.

[cacheman]

Security firms love to come up with marketable names and exaggerate their findings. It's honestly tiring.

[vogonp]

Minecraft, being a Java based program, has been used to execute malicious code as well.

[DisturbedNeo]

“Pirate downloads crack and runs it without checking it first, gets infected with virus”

Lol. It’s always a relief to hear an everyday occurrence making headlines. Means it’s a slow news day and not much is happening.

[magnetomage]

Sure, it's not something you want to ignore... But you're 100% on this Mike, as someone who has spent years in software development... This is not a particularly new or novel risk

[hanzofuma]

If you already have 5 kernel level anticheats installed on your system you can skip this video

[StiekemeHenk]

Just. Check. What. You. Download.

People be downloading cracks, cheats and more without checking if it's really that. 🤦‍♂️

[johanngambolputty]

Oh, when you said that antivirus was maybe not scanning pcks, then it finally made sense why someone would bother trying to distribute malware this way. I initially assumed this would have been a supply chain attack, with malicious extensions/plugins or something, but this is much less interesting.

[paulsaulpaul]

You mean my Winzip keygen might be a virus?

[JakobKobberholm]

One of my main issues with Godot, is that all resources can contain scripts and it has no way of running scripts in a sandboxed environment.

This has been a huge issue for me during development, as I want users to be able to generate maps and other resources, such as player characters, animations, tokens, sound effects etc, but if I use any native Godot resource type, Godot will automatically run any script that is included with the full privileges of the running application.

This makes it trivial to write a script that hacks the other clients as soon as they load your custom character. Best case scenario is that you use it for cheating in the game, but more worrying is if it uploads all documents from the client's computers to a file sharing service or extracts passwords and cookies from your browser cache.

The solution is to store all information in non-native file formats, such as JSON and recreate the resources on the client at runtime, but this has significant costs, both in terms of development effort and in computer processing power required.

[jeanmakesgames]

I can't even imagine the amount of people on youtube that gonna make clickbait title on this topic...Thanks for covering the topic - as always - in a good way! :)

[redtango]

yeah, can't you do the same thing with Unity, Auto IT, Java, and every language out there? not fair they singled out Godot, true it just happened this particular malware used Godot, but where are all the other reports from the billions of other malware loaders out there?

[izeckx]

Good ol' "Don't go into shady websites to get paid software for 'free'."

[..]

That page full of AI slop really inspires confidence in their research.

[cccornel]

Insert End of the World movie trailer with people running for their lives....

[hightidesed]

this is really just pointing out the main issue with windows based software,
which is that there are no fine grained permissions in place, any program can write almost anywhere on the filesystem, access any type of hardware like microphone / camera, etc.
and make network connections to anywhere it likes.

it was great for simplicity in the past, but it should really be phased out by now.

[AntaresVids]

In practice, methods for bypassing security barriers that require you to already be on the other side of the barrier have proven to be of limited use.

[ohgodwhy-gf]

"Indie Game Engine Wars Episode V: Unity strikes back."

After Unity's disastrous installation fee backlash, big part of the community went to Godot. The year is 2024 and GMTK jam's top game engines indicates that for the first time ever, Godot was the most used engine finally surpassing Unity.

Unity's new CEO, new board of directors and the changes on the fees and promises for the future weren't enough to recover most indie developer's trust, but in the heart of the darkness, greedy never sleeps, they come up with one last plan to kill Godot once and for all: pay the press to tell the general public that has little to no knowledge how things work that Godot IS VIRUS and it will be the end of your PC! Be very afraid of paying for anything that says it was made using Godot! If nobody pays for Godot games anymore because of fear of virus, indie devs will have to run back to Unity...

Godot team strikes back with their full might saying: "nah, uh, chill bro"

Would that be enough to calm the minds of the general consumer? We will have to wait for the next episode of Indie Game Engine Wars!

[fcolecumberri]

So... since Godot Games are programs and programs can be hacked; then Godot Games can be hacked (exactly like any other program).
This IS a nothing burger, you can hijacking any .dll or .so with metasploit. That .dll/.so can be part of a game or any other thing. This is nothing new.

[Kīīng-Skull]

Godloader ?


Seems such a Heavy word.


Better na.e for a Planetry Destruction weapon.