Rebecca Martin: It's in the Game: Spreading Malware Through Sims 4 Mods

It's in the Game: Spreading Malware Through Sims 4 Mods Rebecca Martin Last year, the Sims 4 community was shocked by the relavation that malcious actors were using mods to spread malware, mainly infostealers, spread by compromised modders' accounts. No-one expects to get pwned by a mod for their silly life simulator, especially from modders that they trusted, but here we are. So how did this happen? It all comes down to ts4script files - a collection of complied Python scripts that let modders add custom functionality to the game. If you can run Python code, you can basicially do anything - especially if there's no restrictions on what that code is doing, like being able to connect to the Internet. See where this is going? First, let's talk about how Sims modding actually works and why ts4script files are so powerful (and dangerous). The Sims community has been modding for decades, and they've built ecosystem of shared content - but it's all based on trust. What happens when that trust is broken? Then, I'll break down the actual malware campaign. How did attackers hide malicious code in seemingly innocent mods? How long did it take for people to catch on? I'll also cover the community's response to this malware campaign, which included creating a mod antivirus to detect malware hidden in mods, by digging into its internals and showing how it works. Finally, we'll see if we can create our own malicious mod that flies under the radar of the aformentioned antivirus. Can we make a "Sims virus" that looks innocent but does sketchy stuff in the background? When's the last time you worried about your game mods being malicious? Talk room 1 (400 people) Sun 5:25 pm - 5:55 pm