You *can* get a virus by playing Modded Terraria..
HTML-код
- Опубликовано: 11 авг 2022
- I recently found a very interesting mod. It was a mod that contained.. malware. In this video I'm explaining how it works and how to protect yourself against dangerous mods like that.
THIS IS FOR EDUCATIONAL PURPOSES!
I am in no way teaching you how to make malware, all of the code shown in the video is beginner level code, nothing secret or too advanced.
This has been an issue since the creation of tModLoader and many people knew about it.
Music in the video: • Yoshi's Island - Flowe...
Join the Discord: / discord
We host events quite often, you can even join a Terraria playthrough public server when it's open! 
Игры
I saw some comments so let me clarify: Steam Workshop mods are checked by Steam moderators. This is more of a server problem because non steam mods that are missing get automatically downloaded from the server itself when you're joining. Also yeah I guess I shouldn't have "made a tutorial" but I just wanted to show people what's possible. I made sure that the code shown in the video is really not enough for someone to just copy paste it and do bad things with it.
I mean, hard to believe that this was just now discovered considering mods are built with c sharp right?
@@Diynn yeah it's been a thing since the creation of tModLoader
Could potentially work with some sort of "meta horror" mod tho if someone were to get around to something like that lol
@@DarkyLonewolf It could, but imo it should be safety first for something big as tmodloader, perhaps being able to manually give permissions to mods or something
fun fact: you can turn off the automatic mod downloading by going to "mod options" and turning it off there
that's actually very scary, I never knew this was possible, thank you for spreading awareness of this
hello gitgud
It's not too surprising. There's always been a chance of getting a virus with modding. Used to be more common back in the day when there weren't all sorts of launchers.
its very spooky but thats why i dont download any sus mods
Imagine if terraira don't have a mod browser like Minecraft
i knew but its not that scary
as long as you dont want them to leak your search history lol
Thank goodness most mod authors are good people.
debatable
@@nakamurash calamity discord be like
@@TheTrueD6 Same people who bullied their god-tier musician who was literally working for free, because he couldn't work any faster 🙃
@@marti2xx4
but those are because of the community not the devs?
@@NuclearRaven13 Yes, I am replying to "calamity discord be like" which is a reply to "debatable".
The 4th wall breaks would be so cool if used for good, imagine the bosses.
a boss attacking with your PC Images
and if u don't have any, then he just leaves
I am pretty sure Hellion from SGA mod does that
Devourer of Gods would never send my ip adre-
A boss finding your address and attacking you in real life
omega flowey
Had no clue that this was possible, thank you for letting us know! You're one of my favorite terraria youtubers because of your large quantity of short, quality videos!
Now players can play hardcore terraria, but if they die, their PC gets bricked! :D
lol imagine a virus that locks all your files and you can't access them until you beat calamity on ftw hardcore infernum
Good idea you know?
@@slosh26 Infernum only works on expert mode. If you do ftw you can't activate Infernum. If you enable ftw with fargo's, while infernum is on, then infernum turns itself off
@@Sprit-Shield-Productions kk
Do it now
Fun fact: it's also possible to forcefully open links in the mod code. This actually was a thing that happened to me one day where whenever I opened a world with the mod installed randomly I'd get taken to the entire Old Testament. Laughed it off after realizing as well as knowing it didn't properly damage my PC after making sure, and simply joked it as "The Bible Virus."
I had the same issue. Soo weird
Finally i can rickroll people through terraria
What was the mod?
@@cursedmailman3999 genshin impact mod
I just accidentally downloaded the mod that gave me the bible virus lol
I've actually seen this type of thing before, there's a mod that will launch Metal Gear Rising: Revengance if you get hit, so 4th wall breaking stuff is definitely possible.
yooo ive got the MGRR on hit mod installed lmao
The only mods I have ever downloaded on tmodloader are trusted mods like calamity, split and veinminer. I doubt the Devs would ever do somthing like this.
you're gucci until Scal drops your IP in chat
@Data or DOG for that matter...
@@ahsanmc the Terrarian literally blew the Cosmic Worm up. So, I don't think he can take anything rn
@@ElLucoso 1% hp left final move
Jopojelly's mods are trusted mods i think.
other thing possible other than one shot styles would be things like omega flowey 4th wall breaks where if you die to the boss the game just shuts in your face
lol true i was so surprised in my first undertale playthru when that happened
wait. does that mean people can create mods that deletes system32 upon death?
@@klpliper5783 yes
@@rubbyy does that can happen in console
@@Puss_pog if you are on stock firmware you're mostly fine from anything you play on console :D
scary! though i could see cool uses for this in, like you said, oneshot style 4th wall breaks.
I really want to see adventure maps based of this game
Getting hit plays metal gear rising revengance is a good mod
@@mannyheffley5481 is that an advertisement?
@@mannyheffley5481 Metal Gear Rising Revengeance is a game made by Platinum Games, not a mod
@@pierresun3394 I think they meant that each time you get hit in Terraria, MGR:R starts up. That is as long as you have the game installed
This is a big flaw, there should be a setting that while disabled, removes any dangerous functionality from mods.
be careful out there gamers, thanks for making the vid!
Hi mars
You right though
I mean imagine anarchy players abuse it
Oh hey Mars
@@Puss_pog did you watch the whole video?
this can't happen on a modless anarchy server lol
I was aware of that possibility, but I thought that the tModLoader Devs at LEAST blocked the fork exec exploits(which you would probably never need anyways even under total conversion mods, maybe if you made a networking overhaul to make the game better for multiplayer but even that should be possible through the normal modding API)...
and maybe the changing of environment variables(though that might be needed by some devs), and allow writing into dedicated folders only(relative to game and world folder, and to "my games/terraria" but that is exceedingly difficult to achieve on a cross OS environment)
like responsible people would...
This is incredibly helpful to know, I will make sure to be extra careful with what mods I download from now on.
On the other hand, I agree that this could be useful for fourth wall breaks and such if used responsibly by modders, so ideally that will be the only way people use this.
Hopefully the devs make some sort of safety system to prevent this.
I’m glad you made this video. I constantly played with Terraria mods on my old computer and wasn’t even aware this was a thing lol
I thought it was common sense that video game mods as a whole can be harmful to your PC. This video didn't even show any examples let alone show if it's a noticeable problem in tMod specifically.
he could run a VM and show us the mod without the risk of exposing his pc to viruses.
@@canyoudont9777 yeah but how can he find one?
@@laff__8821 what stupid question is that? he just can.
@@laff__8821 a VM (Virtual Machine) is easy to download and setup, i think windows has a built in VM something.
I remember downloading a mod before that mentions that it will add tons of bosses and items to the game. But it just sent me to a RUclips video talking about the Bible...
WAIT WAS THAT WHY I GOT A BIBLE RUclips VIDEO OUT OF NOWHERE
Bruh what mod
This amuses me greatly. I mean, of all the things you could do with a virus, sending someone some religious propaganda? LOL....
For those wondering: yes this is possible with almost anything you download
I have seen a 1.3 mod that would give a threat on your desktop after beating a boss from the mod
Which mod is this? It might be on 1.3 now and i'd love to track it down
@@oeuftheoeuf It’s been so long I don’t know the name but there is a Reddit post that talks about it
@@Fawful05 any idea where the reddit post is?
@@oeuftheoeuf reddit
@@oeuftheoeuf its the terraria sub reddit
One use for this I saw was a mod that opens Metal Gear Rising: Revengeance whenever you die
It would be kinda funny if someone made a miss that would delete itself unsubscribe itself if you did something very specific so you just have to redownload it again
imagine someone just made it auto-unsubscribe when you download it. Then you will never be able to download the mod lol
I'll nerd out for a moment so excuse me:
While still (I think) possible to unsubscribe the mod through steam's api, deleting the mod on load seems impossible to do since you aren't able to delete files that are being used/open (by you or another process). I don't know tmodloader's internals but if they inject code then it might be possible since the mods won't be in use technically but that doesn't sound like how it works.
@@L0V3V4MP1R3 I mean, if an application can uninstall itself why can't a mod?
Rubby: So this mod can actually infect your PC without you knowing it..
Also Rubby: *Happy music* : )
there is both an upside and a downside to telling people about this: they will be protected, but others can use this info and find out that they can make a malware mod
I highly doubt anyone to whom the idea never occurred that this would be possible would really both be capable of actually making a virus themselves and actually want to do it, given it's not exactly hidden that Terraria mods use an actual programming language.
@@HaveYouHeardOfManedWolves thing is, most people would not have tought this was allowed by the engine. This could attract malicious modders
@@rompevuevitos222 "allowed by the engine"? It's not like it's some game implemented scripting language, this is actual C# it's using, anyone who could conceivably write a virus can tell that being able to execute arbitrary code in a language complete enough to write entire programs in is a big enough opening in security to make a virus as long as they can get said virus to that point.
@@HaveYouHeardOfManedWolves that is the thing, most mod engines would not just give you the raw language, they would provide an API of sorts to act as intermediary, which can be tweaked to prevent this kind of stuff ot at least to make it safer
@@rompevuevitos222 I've never seen a community-made modding API that doesn't just use an actual programming language, so given how rare official mod support is I'm fairly certain the vast majority of modding systems are purely implemented with actual programming languages
No way, you’ve also played oneshot, man so many creators I watch have actually played oneshot, and I’m so happy about it since oneshot is such a small game!
As a mod dev, yep. Known about this for quite a while. Even sketchier before the 1.4 release and workshop support since the only moderation would've been tmodloader devs
You know, someone still can use it to do nasty stuff. Last month gmod workshop was ravaged because of mods with hidden ad player scripts.
Tbh, this could make for a good creepypasta/horror Terraria mod
As long as the mod would properly clarify it's gonna do some freaky deaky 4th wall shit
Imagine you lose to a powerful boss, so you get off of terraria to see your background now says "Puny Mortal, you cannot defeat me and you cannot escape!" That would be genuinely terrifying
if that happened to me i would just be mildly annoyed due to the fact that i have to change it back
alright that's it (turns on the cheat mods)
DoG has infected your pc.
Casually installs god items
@mlg noob i need dog desktop goose now
Finally the most effective boss attack of making you play bloons TD 6
wow its really cool that you showed exactly how too inject a virus into a terraria mod, this isnt gonna backfire.
He didn't? Anybody can do this stuff.
@@darnellcousland5576 He didn’t? Did you watch the video?
@@edcellwarrior Yes , ANYONE CAN SEARCH THIS UP. Like , It's not DANGEROUS , Its a basic topic.
Thank You for the Heads Up ☺️☺️☺️ Really do Appreciate what you doin for the community. But what do bg though it do be vibin.
Me dumb, but found it Tysm though
That wallpaper one could be fun. Say: defeat a boss for the first time and it changes your background to one featuring that boss? That would require coding that for windows, mac, and potentially several window managers / desktop environments for linux. Likely people would only bother with the windows, mac, and maybe gnome and kde.
Reminds me of Angry Planes for GTAV. That contained malware and it was very popular.
tbh, any steam game can have virus mods in the workshop, so becareful while playing stream game mods
let them realize virus have been possible ever since tmod was a thing at first
The wallpaper thing did immediately make me think of OneShot so.
yeah that said I wouldn't be that sad to see it go in favor of higher safety.
when the breaking the 4th wall thing came up the first thing i thought of was oneshot
Now you just gave me the idea to make people download a mod that jumpscares them with goatse every 3 minutes.
I think that if a mod is uploaded that contain anything that gathers from the web that it should be flagged and the dev would need to check it to make sure that it isn't a virus.
This kind of reminds me of that Gmod incident where the author of their mod went rouge and decided to spread a certain 'hole' jumpscare... that could be possible here.
it was disgusting
See the difference is, this isn't as dangerous as this, garry's mod runs on a scripting language called gLua, security threats are non-existent, while this is modded through C#.
wait, what happened?
Thanks for the info!
Time to make a "3D Terraria" mod that just launches Minecraft if it's installed on the computer.
I kid, I kid. It would be pretty funny, though.
jokes about how bosses will just delete your pc
*realizes it is possible*
Same can be said for almost any game modding.
Oh man I love Oneshot and how it messes with your PC. You're right, a 4th wall breaking mod like that would be pretty spooky
imagine opening a game and then your wallpaper changes accordingly to the game you are playing!! that would be sickk
Now I want to see a mod with a boss where it creates a text file you have to modify like imscared to defeat it
ily so much for referencing oneshot
I bet the RUclipsr Dani would make a mod where all it does is download an image file of a thicc bean on to your computer.
terraria but when you die your wallpaper gets slightly more red everytime
and changes before dying so the redness works kinda
That can be said about any game you can mod, though. The question is how well the platform that hosts mods is being moderated
I think mc had a similar issue
Maker of the coralian's tombstone made a line of code that crashed the game if certain other mods were in it.
I think it was called a malware or something
Imagine a Calamity add-on that downloads a LORDE to your desktop and it behaves like that annoying goose extension
imagine doing all this code for just changing wallpapers 💀
Is there a link to the mod shown in the video? The content added is super cool and I want to add it to my modded playthrough!!!!
This can really only be a oneshot type thing or malicious or I guess just somewhat trolling
That makes me a little worried about the new Calamity Mod World Gen fix mod I just installed.
you will be fine dont get worried over nothing
what remix of flower garden is that bro it SLAPS
this concept applies to mods of a lot of other games as well
thanks i started playing mods yesterday and i didnt know that
SGAmod did create a txt file and open it when you beat last boss, they also said that they can even delete the game folder
I think there is an option in Tmodloader settings to not download unsigned mods from servers. Open up your game, go to Tmodloader settings and it should be there.
Does this setting make is so that mods that are harmful will not be allowed to download?
@@user-nj6mz3kk4l No. It means the mods must be signed by the author, or maybe just signed by anyone. Not sure about the details. If "signed by the author", then you know that this code comes unmodified from the author. The author crypto signs the release with his private and password protected signature - the signing is verified via the use of the author's publicly available code signing counterpart with tmod loader. I am guessing, so don't take my word for that. You would need to perform a security audit on tmod to see how it's done and if it is done correctly.
…
I thought this was just like, common knowledge that something like this could be a threat.
Servers warn you before auto downloading mods right?
If not someone needs to get in contact with someone else to get this major security oversight attended to.
Im reminded by the 4th wall break from the Varia mod (R.I.P. Varia)
Varia mod has been ported to 1.4 by ennway so basically. Its back
Theyve even made custom title screen music for the mod
as someone who has made a small mod before, and tried to publish it, no. its not like mods are instantly brought to the workshop, the moderators have to check it first. it would take a decade before someone found a way to sneak in a virus into a mod, and somehow make it so that people will be interested and download it.
can you give link of wallpaper thats really cool
Imagine all the OneShot And Doki Doki mods you can make with this
I once had a mod that opened a bible reading video on my browser every time the game loaded the thing. Never figured which mod was causing this, since I was playing a big modpack
I actually knew about this long time ago but yee i dont usually join random ppl from terraria discord to help them with a boss fight
I learned about this from that mod that launches MGR when you get hit/die i can't remember which
fr tho even if you ask about the modlist, they can just exclude the malware mod from the list, either by photoshop or just lying.
when people want to be scummy, they will go miles to be scummy.
Discovered it a few years ago, while making Ban Hammer mod for a certain untrustworthy person. Found out I could do literally anything. Wipe the game installation, for example
Thanks for tutorial! Now i need to ask my friend to make program that randomly clicks every minute
now I want a mod that changes my background to a random cool calamity mod thing
If you actually want that it is probably possible to have game stats output into a file that a program reads and changes your background accordingly.
time to make true terraria hardcore (formats your drive when you die)
Damn bro now I will think before downloading, thanks
I don't play modded Terraria because I think the base game has enough content and merit that it doesn't warrant needing more content but also this kind of vulnerability is possible with any game that supports modding officially or unofficially, granted it can be harder to execute depending on the game but anything can typically be executed within the confines of a mod. I don't think that anyone would realistically use this knowledge to do anything harmful because yes these mods on official platforms like the steam workshop are monitored and will be taken down eventually if these exploits are found and can also be stopped or just avoided relatively easily even if you are unaware of these vulnerabilities. Don't be scared of this knowledge but its always good to be mindful that these things do exist not just for Terraria but for any game that can be modified in any way and that's every single one.
Maybe they could have a 2 types of mods:
-Ones that can't efect your pc in any way that you can just upload
-And ones that can breake the fourth wall but to upload them they have to be checked by a moderator to make sure theyre safe (but that way most likely it would take weeks if not months for the mod to get uploaded)
any mod can affect your pc, no exceptions. It is not possible to have an external mod that can't change anything, because then it would be useless.
this is also the case with minecraft so this is why people always warn you to always watch out on what you load into your computer
honestly i'm surprised people are actually finding this as something new
the game literally lets me compile hidden c# at runtime and send it to trusting friends, which makes it obvious on how to exploit it
the only real "patch" tmodloader can do is just giving a pre-download warning for a mod (which would be really good)
I once tried genshin mod in terraria, its very light even lighter than luiafk and all it do is just bring me to a youtube video "genesis" everytime I boot up tmod
I mean, a bit of a common sense. You're allowing arbitrary code execution through C# code(that has some really low level access).
The moment anything runs code that is not the original from the program, it can be used for viruses and malicious code
Wait a minute should I only be worried if I play in servers because I usally just play by myself on we’ll known mods like calamity, thorium, ect
That begs the question. Why can mods execute shell commands?
Mod that deletes google when you open the wiki
i think it's very funny when you take damage and Metal Gear Rising op
ens
While you can, most if not all AVs will catch any known malware and delete it before it can run..
there is a mod that open Metal Gear Rising Revengence every time you get hit
good job, now people can watch this and use it as a template for making a virus
Doesn't tmod test the mods before allowing you to publish them?
it's the same with most modding softwares, people just don't come to think that running a mod is almost identical to running an exe file.
edit: somthing i do is if it's not a file i 100% trust ill decompile it and have a quick look through it before running it
The OS could also be checked (can it?) and viruses for each platform could be downloaded and run.
Can you talk about the glitch where you can’t buy anything?
if i ever learn how to make mods in terraria a [DDLC] like mod is coming
Glad most developers aren't evil
A mod that does nothing except create a text file named "bruh" when you die to Plantera.
So much respect for this video, like bro is smart and uses that for spreading awareness
Instead of just reporting the 'supposed mulware' ? Because there are tmodloader moderators. Or such mod doesn't exist and this is just a clickbait
@@ItzTonkla no its real i got virused in my last pc before in 2019
If malice didn't exist, this would be a good way for mods to break the fourth wall.
Damn, good thing you didn't tell anyone they could do this
You can legit just search this up , its not even harmful , where will you learn to make malware?
@@darnellcousland5576 I'm making a joke