Possible malware in the latest release of godot

michaelx

Hello guys,

I tested two game engines today. GDevelop and GoDot. I downloaded and installed each of them. Several hours later a strange notification from Windows popped up - asking me to make a backup copy of a certificate/private key, because Windows started to encrypt my file system (using standard EFS functionality)! I checked file system using cipher.exe and found that some newly created files already became encrypted, I removed this newly generated certificate with the help of certmgr.msc and the problem was resolved (i hope). In any case, please check your godot release for malware and trojans, because this kind of attack (using standard EFS) was detected in this year (https://blog.knowbe4.com/new-efs-ransomware-attack-uses-windows-encrypting-file-system-against-itself).

Megalomaniak

Where did you download the build from? and are you sure it didn't come from somewhere else? It could have been in any file you've downloaded. Including files in your temp folders from just internet browsing.

michaelx

From here: https://godotengine.org/download/windows

michaelx

EFS is available in all versions of Windows except the home versions.

michaelx

My OS: Windows7 Ultimate

michaelx

And I also installed one sample from godot (something about voxel 3d).

michaelx

https://downloads.tuxfamily.org/godotengine/3.2.3/Godot_v3.2.3-stable_win64.exe.zip

Maybe there are some new third-party components inside this version ?

I installed the godot engine, and one sample project (voxel 3d). After that, some program generated a personal certificate and started to encrypt my file system. My OS: Windows7 Ultimate. So, I turned off EFS.

TwistedTwigleg

Well, I can say with fairly good certainty that GodotEngine.org and the TuxFamily download does not have malware. If it did, the thousands of Godot users who have downloaded would have noticed it by now, as the Godot community is quite large and I highly doubt something like this would go unnoticed for days.

Where did you download GDevelop? Did you download it from gdevelop-app.com, which appears to be their official website (based on Google search). If you remember, where/what was the sample project you downloaded? It is possible, though I believe it unlikely, that the malware is somehow linked to that. I do think this is likely, as a Godot project doesn't have executable and unless it uses C#, I do not think you could even make a Godot project encrypt files, but never hurts to check all possibilities. Another thing to consider, as Megalomaniak mentioned, is that even your temporary folder that your web browser uses can download and execute malware programs. It is possible that something there caused the issue.

One thing I would heavily suggest doing, if you have not already, is run an anti-virus program, like Windows Defender. Never hurts to be careful, especially since a program was acting strange.

michaelx

Well, I can say with fairly good certainty that GodotEngine.org and the TuxFamily download does not have malware. If it did, the thousands of Godot users who have downloaded would have noticed it by now, as the Godot community is quite large and I highly doubt something like this would go unnoticed for days.

Ok, maybe.

Where did you download GDevelop? Did you download it from gdevelop-app.com, which appears to be their official website (based on Google search).

Yes, from gdevelop-app.com

If you remember, where/what was the sample project you downloaded? It is possible, though I believe it unlikely, that the malware is somehow linked to that. I do think this is likely, as a Godot project doesn't have executable and unless it uses C#, I do not think you could even make a Godot project encrypt files, but never hurts to check all possibilities.

This a sample project from godot.

Another thing to consider, as Megalomaniak mentioned, is that even your temporary folder that your web browser uses can download and execute malware programs. It is possible that something there caused the issue.

How google chrome can do such things? Are you talking about exploits?

One thing I would heavily suggest doing, if you have not already, is run an anti-virus program, like Windows Defender. Never hurts to be careful, especially since a program was acting strange.

I'm scanning all my disks with several anti-virus and anti-ransomware tools now. After that, I will copy all my data to the external hard drives.

Megalomaniak

every browser has temp folders where files such as say jpegs and whatnot go. Even something as mundane as a jpeg picture can be used as a container for malicious code.

https://umbrella.cisco.com/blog/picture-perfect-how-jpg-exif-data-hides-malware

TwistedTwigleg

@michaelx said: This a sample project from godot.

Hmm, so if it is from the Godot demo repository, then it is probably not the cause of the issue then.

How google chrome can do such things? Are you talking about exploits?

Yes and no, depending on several factors. There are many different ways it could be possible, but in relation to the temporary folder, it would hinge on how your internet browser has to download and store all of the data for any website you visit on your computer. When you visit a website, your internet browser downloads the HTML, CSS, Javascript, and any other files to a temporary location in memory on your computer. If the malicious program is part of the data that the web browser downloads when visiting the website, then it would be stored in your temporary folder along with the other website data. From there, all the program has to do is start itself executing, and in theory, the malicious program can access your computer.

Now, I glossed over a LOT of steps and in actuality the process is a bit more complicated, but that is the gist of one method that someone could use to have their malicious program run on the computers of those who visit their webpage. Exploits can make this process easier, and are generally needed to actually get the program in temporary memory executed initially, as often there are safety measure to make sure your browser cannot run programs in temporary memory. If you are interested in learning more, I would suggest doing additional research and reading what experts in the field have to say. Malware and malicious programs online are a complicated subject, and one that I am by no means an expert on, so please take what I have written with a grain of salt.

I'm scanning all my disks with several anti-virus and anti-ransomware tools now. It will take several days. After that, I will copy all my data to the external hard drives.

Sounds good! :+1:

michaelx

Executable files using browser's cache data to mislead antivirus tools? Interesting method. Never thought about that.

russian_malware

I also experienced issues immediately after installation. My computer screen had several blackouts and my windows defender was saying that something harmful was on my computer. the weirdest thing was that I had to uninstall it about four times to get an application that I had only installed once.

Megalomaniak

Installation of what though? Note that godot doesn't come with an installer.

---

@russian_malware Upon creating your account you should have received an account verification email. The confirmation email may have been incorrectly flagged as spam, so please also check your spam filter. Without confirming your account, future posts may also be caught in the moderation queue. You can resend a confirmation email when you log into your account if you cannot find the first verification email.