Newsletter
Join thousands of people who receive the latest breaking cybersecurity news every day.
The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.
The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.
Share this article:
35K+ players were exposed to an auto-updater that planted a trojan that choked performance for fellow modders and Colossal Order employees.
The developer of several popular mods for the Cities: Skylines city-building game has been banned after malware was discovered hidden in their wares.
The modder, who goes by the handle Chaos as well as Holy Water, reportedly tucked an automatic updater into several mods that enabled the author to deliver malware to anybody who downloaded them.
It started last year, when Chaos launched a “redesigned” version of Harmony: a core framework project that most Cities: Skylines mods rely on to work. The author went on to similarly rework other popular mods, and he listed his Harmony redo as a core download: in other words, players would be forced to download it to get dependent mods to work.
But an automatic updater was subsequently discovered, hidden away in Chao’s Harmony version – an updater that enabled the modder to deliver malware to the devices of those who downloaded it. As well, the author reportedly poisoned other mods with malicious code that bogged down game-play, forcing players to download yet more tainted mods that Chaos had created as “solutions.”
According to a pinned post on the Cities: Skylines subreddit, some, but not all, of Chaos’ mods have been removed from the Steam Workshop, and the author’s accounts have been suspended.
The subreddit moderator who posted the warning on Saturday – kjmci – urged players to scrub their systems of anything published by Chaos.
“We recommend in the strongest possible terms that you unsubscribe from all items published by this author and do not subscribe, download, or install any mods, from any source, that may be published by this individual in future,” according to the subreddit post.
Valve has reportedly yanked several of the mods that feed into the automatic updater and has banned Chaos’ most recent accounts. However, as NME reports, the modder’s downloads now number around 35,000, meaning that the devices of tens of thousands of gamers have potentially been infected.
Chaos had developed several forks – i.e., modified and reuploaded versions – of popular mods from well-known creators, including Harmony, Network Extensions and Traffic Manager: President Edition.
Lacing Harmony with malware is particularly pernicious, given that it’s one of the mods that Chaos “redesigned.” Chaos listed the modified version as a core download, as in, a dependency for other mods that players would have to download in order for other dependent mods to work.
Among other functions, Harmony dishes out a patching library to mods that need it and hot-patches older Harmony versions – older versions that, according to Steam’s community page, are still in use by various mods.
“Users install Harmony (redesigned) for a particular reason, suddenly they get errors in popular mods. The solution provided is to use [Chaos’] versions,” kjmci told NME. “Those versions gain traction and users, and people come across them instead of the originals… and see Harmony (redesigned) marked as a dependency. Users install Harmony (redesigned) with the [automatic updating code] bundled with it. Suddenly you have tens of thousands of users who have effectively installed a trojan on their computer.”
The automatic, malware-delivering updater was found buried in Chao’s version of Harmony, according to what kjmci told NME. The moderator opts for anonymity because they’ve been targeted by Chaos in the past, they told the publication.
Besides inflicting the trojan on unsuspecting players, Chaos also reportedly planted malicious code that targeted fellow modders and employees of the game’s developer, Colossal Order.
This particular flavor of malware crippled game performance, according to kjmci. The resulting crummy game-play motivated users to download so-called “solutions” that Chaos advertised to help clear up the issues.
Following their fans’ complaints about the sluggish performance, the developers of the targeted mods investigated and discovered the malicious code.
Just because Valve pulled Chaos’ accounts doesn’t mean the modder won’t be back to spread more malware. As NME notes, a loophole in the workshop rules for Steam – Valve’s digital distribution service – could allow the author to keep working on mods from another account even if his current accounts stay banned.
Besides which, just because Chaos was banned doesn’t mean that the damage is done. It could, in fact, get a lot worse, kjmci said: “What’s been implemented would let him cryptolock a bunch of machines, create a botnet (and DDoS his enemies?) or mine cryptocurrency.”
Distributed denial-of-service (DDoS) attacks are far from novel in the gaming world. Last month, for example, a massive Minecraft tournament styled after the Netflix blockbuster Squid Game known as “SquidCraft” was attacked with a DDoS attack that took down the sole (and state-owned) internet service provider in Andorra.
John Bambenek, principal threat hunter at digital IT and security operations company Netenrich, noted that malware in games or in game mods – or even in pirated/cracked games, for that matter, is a fairly common tactic, “one that often involves American and European actors.”
He told Threatpost on Monday that using a supply chain tactic to get into more victims is “a fairly new tactic,” but unsurprising, given that “our discussion of the potential massive risks of supply chain attacks have inspired new actors to adopt them.”
Casey Bisson, head of product and developer relations at code and security provider BluBracket, told Threatpost on Monday that this is a “classic software supply chain attack similar to what we’ve seen elsewhere,,” the difference being how close it gets to the consumer end user.
“There’s lots of open source and commercially sourced software components that go into the apps and games on our mobile devices, but those supply chains are shorter and less complex relative to the components that can go into the software on servers or network devices,” Bisson said via email. “But ‘shorter and less complex’ supply chains are still vulnerable.
“Code is a vast and unprotected attack surface, and there’s no class of software that’s immune from attack. The more consumers feel these attacks on their personal mobile devices, the more they’ll demand protections.”
Companies can get ahead of consumer demands by implementing automated security practices to ensure product safety, he suggested.
Join Threatpost on Wed. Feb 23 at 2 PM ET for a LIVE roundtable discussion “The Secret to Keeping Secrets,” sponsored by Keeper Security, focused on how to locate and lock down your organization’s most sensitive data. Zane Bond with Keeper Security will join Threatpost’s Becky Bracken to offer concrete steps to protect your organization’s critical information in the cloud, in transit and in storage. REGISTER NOW and please Tweet us your questions ahead of time @Threatpost so they can be included in the discussion.
Share this article:
The year’s 1st Chrome zero-day can lead to all sorts of misery, ranging from data corruption to the execution of arbitrary code on vulnerable systems.
Since 2017, the attacker has flung simple off-the-shelf malware in malicious email campaigns aimed at aviation, aerospace, transportation and defense.
Hours before the Superbowl and two days after the FBI warned about the ransomware gang, BlackByte leaked what are purportedly the NFL team’s files.
This site uses Akismet to reduce spam. Learn how your comment data is processed.
Join thousands of people who receive the latest breaking cybersecurity news every day.
35K+ @CitiesSkylines players exposed to an auto-updater that planted a trojan that choked performance for fellow mo… https://t.co/hD1wFnOLDL
7 mins ago
Get the latest breaking news delivered daily to your inbox.
The First Stop For Security News
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
