Timeline for Do KSP mods allow arbitrary code execution?
Current License: CC BY-SA 4.0
9 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 17, 2019 at 14:13 | comment | added | SF. | I've been in the KSP community for a couple years have yet to hear of anyone creating a malicious mod code. It's not impossible, it's simply the community is close-knit and small enough it doesn't happen. Especially that about all mods are 'one person projects', so malicious injection by contributors would not happen. (as for arbitrary code, the KOS mod allows you scripting with KSP, with quite broad 'external' capabilities as it's designed to provide communication with custom control boards, external databases etc. :) | |
| Dec 11, 2018 at 18:31 | comment | added | JDB |
Even if the author isn't a "bad guy", friendly-looking contributions to the open-source project can introduce malware if not carefully screened. For example, event-stream, which is an NPM package downloaded over 2 million times per week, was recently "hacked" to include a bitcoin miner.
|
|
| Dec 11, 2018 at 18:19 | comment | added | JDB | @Philipp - That's a pretty dangerous assumption. It's not unheard of for very popular apps/mods/etc to contain malware. The more popular a platform/game becomes, the more likely that someone will try to exploit that. The dumb criminals make their malware easy to spot. The smart ones make something useful and hide the malware within. It's a good idea to be suspicious about free software, especially if it's really good. | |
| Dec 11, 2018 at 13:46 | comment | added | Philipp | One additional thing I would mention is to only use mods which already have a good reputation in the community. It is far less likely that there is a hidden malware in a mod like MechJeb or Kerbal Engineer which half the community uses than from a new mod some unknown person uploaded a day ago. The admins of the mod repositories aren't infallible. I am not even sure they screen submissions before putting them online. It is possible they get tricked into accepting a malware mod. But when hundreds of thousands of people downloaded a mod, it would be unlikely that nobody ever noticed the malware. | |
| Dec 10, 2018 at 21:57 | comment | added | Nzall | @Kevin No, but keeping your PC up to date could stop viruses from inflicting too much damage after installing them. | |
| Dec 10, 2018 at 20:17 | vote | accept | JDB | ||
| Dec 10, 2018 at 20:17 | comment | added | JDB | Thanks, I think this answered my question. For what it's worth, it is possible to build a sandboxed mod system. For example, the Javascript running in your browser doesn't have access to your file system or to other tabs in your browser (barring something silly like a processor exploit). I was curious how much effort KSP had put into sandboxing their mod system... sounds like not much. | |
| Dec 10, 2018 at 9:47 | comment | added | Elva | If you willingly install something that turns out to be a virus, keeping your PC up to date doesn't do anything. Keeping your PC up to date prevents attackers from installing viruses, it doesn't prevent users from installing viruses. | |
| Dec 9, 2018 at 21:40 | history | answered | Nzall | CC BY-SA 4.0 |