Security researchers at Check Point Research have published a report about GodLoader, a malware loader using Godot as its runtime to execute malicious

Statement on GodLoader malware loader

submited by

Style Pass

2024-11-28 14:00:17

Security researchers at Check Point Research have published a report about GodLoader, a malware loader using Godot as its runtime to execute malicious code and infect unaware users with known malware. Based on the report, affected users thought they were downloading and executing cracks for paid software, but instead executed the malware loader.

As the report states, the vulnerability is not specific to Godot. The Godot Engine is a programming system with a scripting language. It is akin to, for instance, the Python and Ruby runtimes. It is possible to write malicious programs in any programming language. We do not believe that Godot is particularly more or less suited to do so than other such programs.

Users who merely have a Godot game or editor installed on their system are not specifically at risk. We encourage people to only execute software from trusted sources – whether it’s written using Godot or any other programming system.

Godot does not register a file handler for .pck files. This means that a malicious actor always has to ship the Godot runtime (.exe file) together with a .pck file. The user will always have to unpack the runtime together with the .pck to the same location and then execute the runtime. There is no way for a malicious actor to create a “one click exploit”, barring other OS-level vulnerabilities. If such an OS-level vulnerability were used then Godot would not be a particularly attractive option due to the size of the runtime.