Hello everyone, I just want to quickly warn you guys. YouTube recommended me this video today. It seems like there is a mod that contains a malicious LUA file. Unfortunately, author of the video didn't mention any specific mod and the original author of the mod is also unknown. So, if anybody knows more about what is going on, please, let me know. Stay safe guys.
Mods off of unsafe sites have a better chance of malware but anything on the repo is checked which lowers the chances anything is possible but it would be EXTREMELY hard.
To stay safe, the better solution is to stay on the BeamNG forums. Third-party websites do not have any security moderation. (ModLand moderation is only there to remove mods when they have a copyright claim, but they don't take care of anything else.)
I saw the video this morning. But it’s not a new threat. It was possible all the time. You should at least check every mod you download from untrusted source with bitdefender. Just right click the zip and run the check. Or check for Lua files and visually check.
I'm currently working on trying to patch this, mostly because multiplayer mods exist and you don't want to join a server and get hacked.. I've got a decent working thing right now, but it's most likely far from solid. I basically replace `ffi.cast` with my own, and it does some extra checks if the second argument is of type "cdata" or a "number". It then checks whether that address is within the range of the game executable or the other imports. I did have it so it compared the address with known functions like "GetProcAddress", but I figured that since the game doesn't really cast anything within those address ranges, I might as well just restrict it to ensure you can't cast any functions or mess with variables. I can't think of any better ways, maybe my brain just isn't functioning