How to Hack a Game Developer

New Discord server will be up soon!

Check out my game on Steam!

[mz_eth]

This is actually terrifying to me, I love the idea of playing games from creators in the community, but this makes that so much harder :(

[BitBeginnings]

Some good security practices:
1. Always verify via another method (text, email, other app) that messages asking you to download something REALLY are from people you trust.
2. VMs or Sandboxes can technically be escaped so don't think of it as a silver bullet, but it is a good step.
3. If you are to use a VM or a separate machine, make sure it is a machine/VM that you don't use for logging into any accounts
4. Wouldn't be a bad idea to run the game through Virus Total

[danielgysi]

If it makes you feel any better, you're the second game dev YouTuber I've seen fall for this. I don't recall who the first was. These attacks used to be worse though. Google Chrome's password manager used to store saved credentials in plain text so the same attack could let someone log into any websites you saved. Now I think they just save an auth token for Google that's used to download a decryption key. The suspicious activity notice you got might have been someone trying to log in using that token from an unusual location. I'm probably getting the details wrong but it's something like that. In any case, this was relatively minor so it's not worth stressing about too much

[sthenios]

The best way to stay safe is to be the only developer in your friends group.

[CatherineKimport]

Everyone talks about beefing up your own security habits but nobody ever talks about hunting malicious actors for sport

[blastingoff]

Hey man,
Just a simple suggestion;
Have a fully locked down alt that you don't access from anything you do other stuff on and then make that alt the owner of any servers you own.

This prevents stuff like this, while still allowing you to log in and make any changes you may need to make.

[kianheus]

I wasn't on the server yet but i know the pain of making one that works perfectly. Hope you and your mods can start up again and make a new server that is even better then the last. And this time I will join it!

[decoy]

I appreciate you updating not just your fanbase, but anyone else who comes across this video to download with caution! Very important online rule that many forget about or ignore

[VengefulSpectre]

It’s definitely scary. I’ve been in a similar situation before and it wrecked me for a while. My anxiety was super high for days to. It’s something at least for me that’s hard to forget about but in some ways it’s not all bad because it was a learning situation. While your server is gone you’ve gained knowledge to better help you in the future.

[NoomStuff]

As soon as you said “Sent me a game” i was like uh oh

[Smaxx]

For anyone running Windows 11 Pro, you might be able to install and run "Windows Sandbox" as a feature. This essentially works like a virtual machine, but it's based off your Windows system files (so it doesn't require any extra disk space or installation). So if I don't trust an executable, I open the sandbox (which gives you a clean Windows that runs most programs) and you can just run the game inside. Once the sandbox is closed, everything is gone. And at no point does the program inside have access to anything outside said box.

[jweare]

Sorry to hear that happened to you. Thanks for making a great video explaining what happened and how it happened to you. I’ll be teaching a unit on this in my AP computer science class in a couple weeks and I’ve decided to include your video in my lesson.

[raybelcher]

Appreciate the transparency and honesty of your post.
Good advice on running projects in a sandbox or virtual environment.

[ZeroCoolGaming]

Looking at the post, 42MB for a Unity game seems tiny. That feels like an immediate red flag

[koboldskeep]

Happened to me too last week. I was lucky I saw people discussing it on the server. I was able to reset all my passwords and log out existing sessions before any damage was done. I assume my 2FA slowed them down, or maybe I got less a dedicated crew of criminals than you did.

Thanks for taking the time to let people know about this scam.

[TXanders]

I am so sorry to hear this happen to you. Discord sadly will never do anything about this as you discussed and it's just a case to be aware of it and spread the knowledge
( so good job on the video).
You will Rebuild!

[gummby]

The idea that Discord would allow a server to be deleted without numerous layers of extra verification is absolutely bonkers to me. At the same time making it 100% irreversible without so much as a 30 day grace period is also asinine.

[Lukas-qyon]

windows should have sandboxing by default. When your friend sends you a unity game they made, it's usually self contained, it's never going to need access to your file system or other applications, they could still support game saves and preferences so long as the file system is local. So people intuitively know if it requests native access that the program is sketchy.

like image a windows popup like "this program wants native file access, games or graphical applications should not request this. YES, [NO]"

[MomsSonMaverick]

It's a good thing you had your game on steam already

[joogwoog]

how is this in my recommended 3 minutes after its uploaded. das crazy.
edit: watched the video. that really sucks man. stay strong. ✌