Subject: [saag] Need vendor support to address a malware vector

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 26 Sep 2016 10:52:22 -0400

​I have been doing some poking around this morning and I think I have
uncovered a major vector for distribution of malware - Minecraft mods.

This is a totally logical way to distribute malware. The kids don't know
what to expect and will click on anything to get their skin, mod whatever.

Most of the sites require the user to install a 'download assistant' of
some sort. These are invariably larded with malware. In many cases so are
the sites.

We need to fix this. It is a problem.

One short term fix is to blacklist the various modding sites but that is
not going to do any good.

Microsoft paid $2.5 billion for Minecraft. I think that means they can
afford to give free hosting to the entire modding community to get rid of
the problem in the Minecraft world. Oh and I am going to be at a policy
forum lunch with a Microsoft SVP in a couple of weeks so consider this a
heads up for the pressure I am about to create.

But this is a problem that is bound to affect pretty much every similar
community. So while we can make this particular problem the property of one
vendor, Google, Facebook, Apple and the rest can't ignore the issue.

We have to have a community effort on this.

---

From: Joe Touch <[email-masked]>
Date: Mon, 26 Sep 2016 08:22:13 -0700

On 9/26/2016 7:52 AM, Phillip Hallam-Baker wrote:
> ​ I have been doing some poking around this morning and I think I have
...
> Microsoft paid $2.5 billion for Minecraft.
...
> But this is a problem that is bound to affect pretty much every
> similar community. So while we can make this particular problem the
> property of one vendor, Google, Facebook, Apple and the rest can't
> ignore the issue.
>
I disagree that the community needs to provide free resources to
Microsoft to ensure the health and profitability of their product.
Microsoft needs to ante-up.

That's true for every vendor with a product that needs such a solution.

I appreciate your goal of finding either a technology or community
approach that helps vendors do this - and that we as users will benefit,
but IMO any solution needs to start with "pay-for-support".

Joe

---

From: Yoav Nir <[email-masked]>
Date: Mon, 26 Sep 2016 21:59:11 +0300

On 26 Sep 2016, at 6:22 PM, Joe Touch <[email-masked]> wrote:

>> ​ I have been doing some poking around this morning and I think I have uncovered a major vector for distribution of malware - Minecraft mods.
> ...
>> But this is a problem that is bound to affect pretty much every similar community. So while we can make this particular problem the property of one vendor, Google, Facebook, Apple and the rest can't ignore the issue.
>> 
> I disagree that the community needs to provide free resources to Microsoft to ensure the health and profitability of their product. Microsoft needs to ante-up.
> 
> I appreciate your goal of finding either a technology or community approach that helps vendors do this - and that we as users will benefit, but IMO any solution needs to start with "pay-for-support”.

IDK. There’s mods for games, and toolbars for browsers, and YouTube downloaders for browsers, and a Siri-lookalike for Android, and I remember some Windows add-on that made a sheep or a cat walk around your Desktop. It was a hit in the 90s.

Regardless of how they’re described, they’re all software that the user is duped into downloading and installing. The makers of Minecraft or the browsers or the phone OS don’t really make these. Sure, they could make their product non-extendable, non-moddable. They don’t. Because we like mods for games, extensions/plug-ins for browsers and apps for phones.  So people install stuff they shouldn’t. 

I’d be glad if we could do something about it. But malware is hard to identify (except for very specific kinds) or even to define. So I don’t know what we (for whatever interpretation of we) can do.

To get back to Phil’s message, even if Microsoft hosted all the mods, they might still include bad stuff. Just like every app store or extension library.

Yoav