Support NeoGAF

[R6Rider]

Infected Steam game downloads malware disguised as patch

A 2D platformer game called BlockBlasters has recently started showing signs of malicious activity after a patch release on August 30. While the user is playing the game, various bits of information are lifted from the PC the game is running on - including crypto wallet data. Hundreds of users...

www.gdatasoftware.com

First saw this on Reddit.
Reddit Post

The game is called BlockBlasters.

SteamDB has a warning on the game page:

https://steamdb.info/app/3872350/charts/

 

[nial]

People are just so shit, man.

 

[R3TRO]

Almost makes me want to stay away from small indie games.

 

[Gamer_By_Proxy]

But is the game any good? Can't find it on Steam anymore.

 

[The_hunter]

Only 8 users peak.

 

[calistan]

The post-console launch patch for Ready or Not was like some sort of malware. Uninstalled the shit out of that game immediately.

 

[peronmls]

Why keep the game up? Should the Steamdb Staff have them sort out this issue instead of making a warning?

 

[ScHlAuChi]

Valve makes billions in profit and cant even check the damn games for malware?
Good job Gaben!

 

[bender]

Valve makes billions in profit and cant even check the damn games for malware?
Good job Gaben!

Running Casinos for children is time consuming.

 

[DownLikeBCPowder]

Why keep the game up? Should the Steamdb Staff have them sort out this issue instead of making a warning?

This is what I would think.. odd!

 

[Nocty]

Not a good look for Valve at all.

 

[adamsapple]

Get your shit together, Gabe.

 

[Soodanim]

Average estimated owner count of 6.7k. Was this free? Peak concurrent of 8 means this wasn't exactly high on anyone's list, thankfully.

Valve scanning should be a standard thing, I'd say.

Edit: Valve do have some sort of screening, it seems:

These threat actors bypassed initial security screening from Valve which allowed the deployment of malicious patches and infected multiple users of the platform. Now we observed a similar case in another Steam-released game called BlockBlasters, further highlighting the ongoing risks to players.

 

[Bojji]

Get your shit together, Gabe.

 

[Soodanim]

Link in the article takes you to this:

 

[thicc_girls_are_teh_best]

Link in the article takes you to this:

Yeah, this was really sad to see having happened; it hurts seeing people get screwed over like this, especially those in situations like him. Hope the dude can get the money back somehow through new donations and more secure crypto wallet/bank. Whoever made the "game" should be located and legally charged, sentenced with some heavy prison time and have all their assets and (likely additional) stolen money seized. Complete shitheads.

But also yeah, Valve need to really crack down on this. It does suck for them that sleazy, fake puritanical payment processors are trying to force Steam into censorship (tho some of the "games" clearly about & simulating sex assault only for pleasure needed to get yeeted, IMHO), but Valve should hopefully be able to deal with those losers while also actively cracking down on devs disguising malware and crypto draining programs as games on the storefront.

 

[//DEVIL//]

"hundreds of users are affected "

 

[rkofan87]

Almost makes me want to stay away from small indie games.

same

 

[MrTroubleMaker]

It was removed from steam.

 

[Sophist]

Valve makes billions in profit and cant even check the damn games for malware?
Good job Gaben!

It's hard to check without the source code. Especially that most anti-cheats are no different than malwares.

 

[ScHlAuChi]

It's hard to check without the source code. Especially that most anti-cheats are no different than malwares.

What a weak excuse, Valve could simply hire a large team of testers to check for that stuff.
But they dont want that!

 

[The_hunter]

It's hard to check without the source code. Especially that most anti-cheats are no different than malwares.

IOS and mac sandbox everything.

Best advice is to only download software with a lot of downloads, or a reputable developer.

 

[coffinbirth]

It's not the first, and certainly won't be the last. Been a thing for years.

They snagged 907 crypto wallets with just this one game, allegedly.

 

[Gripsx]

another reason to never use auto-update for any type of software

 

[Reizo Ryuu]

Hope the dude can get the money back somehow through new donations and more secure crypto wallet/bank.

someone in the comments immediately sent him what he lost in crypto to replace it.

 

[Draugoth]

Point Clicker is also a scam, and people are still clicking cookies thinking they will earn hundreds for some reasn

 

[Generic]

Tim would never allow this.

 

[March Climber]

Almost makes me want to stay away from small indie games.

If you want to be safe, check and see if it's on mobile app stores first, then read the reviews.

--If not--

If you want to be safer, mainly buy indie games that were ported to console.

--If not--

If you want to be the safest, wait for more than 10 user reviews before buying anything.

 

[coffinbirth]

If you want to be safe, check and see if it's on mobile app stores first, then read the reviews.

--If not--

If you want to be safer, mainly buy indie games that were ported to console.

--If not--

If you want to be the safest, wait for more than 10 user reviews before buying anything.

These scam games, including this one, have tons of fake positive user reviews.

These types of scams are impossible to differentiate from legit games on the surface, and unless you have access to the source code AND you know what to look for, something that end users of these scams aren't typically privy to, you'd be none the wiser.

The "safest" way to avoid malware like this is by not downloading trash you've never heard of. Search the game on youtube. If no one has played it, I would consider that a giant red flag.

 

[March Climber]

The "safest" way to avoid malware like this is by not downloading trash you've never heard of. Search the game on youtube. If no one has played it, I would consider that a giant red flag.

This sounds like a good option #4.

Have malware games like this made it to consoles?