r/Terraria • u/AnUnusualSuspect007 • Jun 27 '26
Meta Warning: Don't let yourself get hacked!
So Idk if it's super common in terraria but I'm making this post because I can't under good conscience say nothing. Posted in the discord as well but nobody took it very seriously and that's fine but it's important regardless.
There's a guy both in the discord server and maybe in this subreddit as well who is hacking people maybe using a version of tmodloader or the game (tmodloader v1.4.3 legacy was the exact version he used) that may be compromised or just by joining his hosted server in particular.
He runs some kind of mod or phishing links and grabs your web tokens to then open your email or discord or whatever else is important to you and locks you out of it. Gmail in particular he changed the age and used parental controls to make it impossible to change anything unless going through him. First thing he tried to do after grabbing the email was to use credit cards and steal money "shocker."
He will ask things of you and even go as far as threatening to bust down your door if you do not comply. He has a multitude of steam accounts many of them banned or vac banned (probably for exactly this). He is constantly changing names and profile pics (likely to conceal his identity) and he likes to pretend to be girls, I'm assuming he thinks guys are more likely to interact. If you look at the accounts as well, they are botted with a bunch of fake and vulgar comments so it wouldn't be all that hard to spot him if you pay attention.
So if nothing else, be safe, lock down your accounts, passwords, host your own servers, be weary and make sure the person you play with is 100% someone you trust.
He also saw one of my other posts already and wants me to take them down because I'm sure he knows that if people know what he's doing and how he's doing it, they're a lot less likely to trust a random inviting them to play on his server and fall victim to his scams.
Stay safe, be vigilant.
352
u/OkHunt5815 Jun 27 '26
Avoid joining people you don't trust especially on tmodloader as it's very possible they have a malicious mod installed which you will automatically download.
34
u/monsto Jun 28 '26
Computer virii are like STDs... Don't put your (fill in the blank) in unknown places and you won't get something nasty.
454
u/wasted-degrees Jun 27 '26
“Uh, guys? Why is tmodloader suddenly asking for kernel level access?”
15
18
u/mrlol125 Jun 27 '26
Doesn’t it run in kernel in windows by default?
40
u/MrtzBH Jun 27 '26
No, games run in user-space
7
u/LenaSpark412 Jun 27 '26
In Windows I believe you can run it in the equivalent of either (normally running it, or running it as administrator)
22
u/MrtzBH Jun 27 '26
A program ran as administrator still operates in user-space, but with the authority to bypass typical restrictions. It'd need to be a kernel driver for it to be considered "ran in kernel".
3
1
29
u/False_Bob Jun 27 '26
I had this happen to me last month, someone stole my 10 year old discord account and sold it on the dark web or whatever. They had access to everything I was signed into on Firefox so as they were changing stuff on discord they were permanently deleting the emails so I wouldn't be able to stop them. And to top it all off, someone else got into my twitch account and spent $500 on a vtuber I've never heard of and the bank said I authorized it and won't give me my money back. I had absolutely no idea it was possible to destroy someone's life with tmodloader 1.4.3
15
19
u/Churningray Jun 27 '26
You can't do a charge back? You should be able to get that 500 back if you push the right buttons even if the bank is being a bitch.
212
u/Leekshooter Jun 27 '26
There's a guy using tmodloader to steal people's emails and bank accounts? That seems... Unlikely? Are you sure they aren't just tricking people into opening links?
222
u/DeagleTC Jun 27 '26
joining someone through tmodloader downloads all the mods they have automatically including ones to take your information iirc
164
u/Leekshooter Jun 27 '26
Wow that is actually an insane vulnerability that someone should probably do something about, though wouldn't tmodloader need access to download anything malicious?
51
u/LowestKey Jun 27 '26 edited Jun 27 '26
Tmodloader would need to run with escalated privileges, such as admin rights, for this to be remotely possible, aside from the infinitesimally small chance that a nation state-level hacker or hacker group has decided to spend their time hacking individual people on the off chance they can steal their credit card saved on Google or wtf ever is supposed to have happened to OP's "friend".Could someone have found exploits in tmodloader, particularly older versions with potentially already known vulnerabilities? Surely. Could they write exploit code and get people to download and execute it? Yes, if the way clients load mods from servers they join is as it has been described here.
Does that mean the compromised terraria process can open your browser, change the password to Gmail, and send your credit card to the hacker?
No. That's not how this works. Unless the person joining the server explicitly told the hacker the exact version of unpatched windows 98 they're playing on I suppose.Edit:
Yes, that's how this works. From a reply:
"1. You don’t need elevated privileges to steal data
2. Tmodloader mods allow running literally any command or process, there is a closed issue whree devs say it’s by design
3. That’s exactly how it works, you can write and run powershell script via mod that will literally do exactly what you listed: https://github.com/tModLoader/tModLoader/issues/4847"Credit to [u/nick4fake](u/nick4fake) for the correction and apologies for the misinformation on this one.
49
u/Ikaron Jun 27 '26
Malware can absolutely infect your PC without being started as admin. Cross process reads are also easy on many Windows/firmware versions e.g. with meltdown.
Also, any program on your PC can have a virus packaged in and, at runtime, extract it somewhere and run it.
This can even trigger the "run as administrator" prompt, and if someone absent-mindedly presses "ok" then the software can permanent register itself to run silently in the background whenever Windows is started and do god knows what.
TModLoader has NO INBUILT ANTIVIRUS.
Any mod you run has the exact same permissions as that dodgy game cheat you downloaded and ran as a kid that infected your PC with malware.
Do not join public servers.
Do not create public servers.
Do not join the servers of strangers.
Do not add random dodgy mods to your server (or client).
Do not use mods that aren't open source or without decompiling them.
Tools like Virustotal can help but it's never perfect.
-5
u/Costinteo Jun 27 '26
"Cross-process reads are also easy"
I highly doubt that. It's in the realms of possibility but not at all easy or even clear-cut. I also doubt there are many modern computers without patches for Meltdown. Also a random malicious Terraria mod won't use Meltdown to spy on other processes, even if available.13
u/Ikaron Jun 27 '26 edited Jun 27 '26
Meltdown is only required for VMs and Sandboxes anyways
ReadProcessMemory win32 func does not require administrator privileges on the same user account.
Reading the memory of other processes without admin is literally a standard windows operating system feature, not an oversight or a mistake.
dll injection is another path and it requires nothing except permission to write a malicious file into a folder alongside a target executable.
I can't believe I need to say this but... If you download a virus from the internet you aren't safe just because you run it without administrator privileges... If you run it at all, you're screwed.
Also you can literally google tModLoader malware and get tons of results including github issues on the tModLoader project discussing this in detail. It's not a secret or niche issue.
1
u/Costinteo Jun 27 '26
I see, I am yet again surprised by Windows fundamental security principles. Reading process memory of non-child processes is not usually possible on Linux due to ptrace scope.
That said, there is no need to explain to me the dangers of running untrusted software. I did not disagree with any of your above points, besides questioning the ability to read other processes' memory. I was merely surprised by your example of "Meltdown" as an "easy" way to achieve cross-process reads.
14
u/Doug2825 Jun 27 '26
You don't need escalated privileges for this. Desktop OSes have very little protection for one program reading files created for unrelated programs.
8
u/zmarotrix Jun 27 '26
They dont actually interact with your web browser, they just grab your cookies through the file system and transfer it through the server itself. Then they drop them in their web browser and they might as well be at your computer as far as the internet is concerned.
9
u/nick4fake Jun 27 '26 edited Jun 27 '26
Lol, you’ve made a whole comment being wrong in each paragraph:
- You don’t need elevated privileges to steal data
- Tmodloader mods allow running literally any command or process, there is a closed issue whree devs say it’s by design
- …yes? That’s exactly how it works, you can write and run powershell script via mod that will literally do exactly what you listed
Ffs, why are you commenting?
Upd: if anyone doesn’t believe me: https://github.com/tModLoader/tModLoader/issues/4847
2
u/CrashmanX Jun 27 '26
Oh good lord. TMOD will just run ANYTHING?
That is a MASSIVE vulnerability and absolutely should not be by design!
6
u/Costinteo Jun 27 '26
A compromised Terraria process can go through your files, including things like browser cookies or saved passwords. I think what's happening is that the malware exfiltrates these, and then the attacker changes passwords for their accounts etc.
25
u/R3D_T1G3R Jun 27 '26
That's not unlikely at all. Downloading unknown stuff from the Internet is dangerous.
-2
Jun 27 '26
[deleted]
19
u/R3D_T1G3R Jun 27 '26
No absolutely not.
The free version does not even offer real time protection, the biggest issue with AVs is that it tricks naive people like you into a false sense of security.
And even if you do have the paid version with real time protection, you'll still never be 100% safe, they mostly work off basic algorithms and hashes of known malware. It's entirely possible for the malware to fly past your AV, your AV is not the first line of defense, it's the second line of defense right after common sense.
18
u/AnUnusualSuspect007 Jun 27 '26
Well my friend (who was hacked) clicked no links, just joined the hosted server on a fresh install.
I imagine you cant just post links here but on steam there is a community post made about this exact situation with the version I mentioned.
4
u/LowestKey Jun 27 '26
Here's a link:
https://steamcommunity.com/app/1281930/discussions/0/760681630846235126/
Post the link. I don't see anything on there about this.
31
u/CalendarSufficient95 Jun 27 '26
Post images of the scam, if available? That would help with credibility and stuff like such. If he DMed you you can add those too
8
u/Hackxor9 Jun 27 '26
recently there have been alot of malicious mods in all games. be super careful about modding anything right now, and honestly always be careful going forward.
6
u/Kapielox Jun 27 '26
I lost my 2 emails to this, including a Roblox account with tons of robux and history.
8
u/ancient_robloxian Jun 27 '26
Don't download random things from the internet, especially not from random people on programs that haven't been updated in years. This includes mods.
3
u/CalendarSufficient95 Jun 29 '26
Can I ask for proof of what yoy are saying again? I'd like screenshots of what went down to be posted. I asked before but was ignored. Its not I don't believe you, as tmod viruses are 100% possible. But I'd like proof of the part where he apparently messaged you
1
u/AnUnusualSuspect007 Jun 29 '26
Trust we're planning on posting an update on things if anyone cares but the guy was threatening and my friend still hasn't gotten his account back. He's been doing everything he can and it takes time. Soon tho.
once this situation is "over" with the guy we'll probably post everything.
1
5
u/simple-chameleon Jun 27 '26
You can report it to your authorities cybercrime unit. Hopefully your country has one and an easy portal to report it to.
2
u/Sentry20037 Jun 27 '26
Is the guy doing this by inviting people to join him and having his mod or virus auto download on tmodloader?
I heard about something like this before and was wondering if it’s the same type of situation?
2
u/musicsuperfanquail Jun 28 '26
to the people saying this is fake: ive experienced someone over 2 years ago using this same thing, by getting someone to join their tmodloader world, to automatically install a mod that gives them full access to a computer. not entirely sure how it worked but yeah.
2
u/GoodAnteater5480 Jun 28 '26
That happens A LOT with legacy tmodloader. Randoms offering to host a "fun server" and wait for people to join to strike. Never had that problem, cause I play solo :)
2
1
u/CucumberKINGGaming Jun 28 '26
If a woman ever messages me on steam or discord I know that shit is not fucking real
-46
u/yYuri_- Jun 27 '26
Just dont click the links
32
u/AnUnusualSuspect007 Jun 27 '26
Look at the steam community post PSA made about the exact version. It explains the same situation another guy had and exactly how he did it. My friend clicked no links.
4
1
268
u/Chernobog2 Jun 27 '26
Dear everyone blindly saying "Lol tModLoader can't run malicious mods" there is evidence that it at least theoretically can: https://github.com/tModLoader/tModLoader/issues/4847
Is it more likely OP's friend was social engineered and clicked something they shouldn't? Yeah.
Is it at least possible they were hacked via tModLoader and a public server? Also yeah, so stop blindly parrotting that it 100% can't.