13

Video game mods have been used in the past to launch attacks, and deliver payloads to computers. Can the Steam Workshop be used as a delivery vector for malware?

What kind of files can a Steam Workshop Skyrim mod made of? How far can they go in modifying Skyrim? Barring exploits in the game engine itself, what is the limit in the amount of files they can write and read, etc.?

Improve this question
7
  • 2
    Not sure why the downvotes, it's a legitimate question. If the mods are programmed using a limited scripting language, like Garry's Mod (Lua) or Starcraft 2 ("Galaxy," a C-based scripting language) mods, then there is little to worry about. If however the mods are essentially overwriting core file to run real code (like Fallout 3 or Minecraft mods), then there is a real danger of downloading malicious code, especially if the mod is not open-source.
    – BlueRaja - Danny Pflughoeft
    Commented Feb 15, 2012 at 19:45
  • 1
    Even with a limited scripting language, the mods could potentially take advantage of holes in the game's security itself. This question is too broad to be answerable in a generic way; rather, separate questions should be opened for specific mods.
    – Invader Skoodge
    Commented Feb 15, 2012 at 19:48
  • 2
    I would argue that given its delivery system (subscriptions that can be changed at any time) the POTENTIAL for threat is important, and the individual threat of any given mod is completely irrelevant.
    – Ashterothi
    Commented Feb 15, 2012 at 19:50
  • 1
    @Strix: Yes, that is always a concern with downloading a mod, or connecting to a server, or doing literally anything on the internet (or even nothing at all). But it is much more of a concern if the mod can just run arbitrary code on your machine, without having to exploit anything.
    – BlueRaja - Danny Pflughoeft
    Commented Feb 15, 2012 at 19:52
  • 1
    @BlueRaja-DannyPflughoeft That distinction doesn't make this a good question.
    – Invader Skoodge
    Commented Feb 15, 2012 at 19:55

3 Answers 3

Reset to default
7

I'm sure they're vulnerable in some way, as hardly any software is free of potential exploits, however, I havn't heard of any active exploits in Gamebryo games. As far as i know, mods have no way of interacting with anything outside of the game. Some tools, such as SKSE and ScriptDragon, make it possible for them to access configuration files in their directories, but that shouldn't be a big concern. Also, remember that the CK is not the only way to make .ESP files. Many programs have been vulnerable to maliciously-modified files. I would say the risk is fairly low, but it is not non-existent.

If you deeply care about security, I would advise against immediately downloading new mods, and letting the other people test them first. The added benefit of that approach is that mature mods are less likely to break your save or have dirty edits and such.

To answer the new question, mods can modify quite a bit, including most visuals and many game mechanics. There are some things that mods cannot do, such as add skill trees (Though they may emulate them in a way). I failed to locate any details on exactly what files the Steam Workshop will accept (A detail one would image should be on their wiki), but at the very least they will be .esp files and .bsa archives, textures, models, sounds, Papyrus scripts and text files.

Improve this answer
1
  • Also, you can consider modifications in the steam workshop which have been downloaded a fair amount of times as "safe". I can't imagine Valve not doing any malware check on uploading mods as well.
    – Jeroen Baert
    Commented Apr 3, 2012 at 13:32
0

Don't download any mods that require to use an alternative .exe and you are fine. Mods which come as .esp are highly unlikely to be harmful.

Improve this answer
-3

It's highly unlikely. To upload something to Steam workshop, you have to be a registered member of the Steam community. So if anybody did somehow manage to include some malicious behaviour in a mod (I don't know if that is even possible with what the Creation Kit allows/supports), they would be found out fairly quickly and no doubt banned.

While I understand your reluctance to trust any random website that claims to host only clean files, I reckon an integrated Steam-based solution is as safe as you're gonna find.

Improve this answer
8
  • 3
    eh... getting a new Steam account is hardly something expensive, between Humble Indie Bundles, promotional offers and just very cheap games.
    – badp
    Commented Feb 15, 2012 at 19:45
  • 2
    You still don't know how good they are, @Pyrodante. I highly doubt they are going to be monitoring the files coming in, apart from rejecting the obviously suspicious ones, and let the community alert them if there is an issue.
    – kotekzot
    Commented Feb 15, 2012 at 19:46
  • 2
    @badp: Right; and if it is possible to write a malicious mod, I'm sure it would not be hard at all to slip it by Valve as something legitimate. It happens all the time to Apple, and they are much more scrutinous with apps than Valve ever will be with mods. -1 to this answer.
    – BlueRaja - Danny Pflughoeft
    Commented Feb 15, 2012 at 19:51
  • 1
    @badp you still need to buy skyrim.
    – alexanderpas
    Commented Feb 15, 2012 at 21:15
  • 1
    Do you really need to get mods from Steam? Or can they be hosted on third-party websites? If the latter, then any protection the Steam Workshop's approval process offers is effectively moot if one can be persuaded to download their mods from somewhere else.
    – Iszi
    Commented Feb 16, 2012 at 1:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.