GTA V mods 'noclip' and 'angry planes' installing malware onto users’ PCs

The game has been praised for letting people create whatever they like — but some of them allow people to track what you’re doing on your computer

Andrew Griffin
Friday 15 May 2015 10:48 BST
Comments

Your support helps us to tell the story

From reproductive rights to climate change to Big Tech, The Independent is on the ground when the story is developing. Whether it's investigating the financials of Elon Musk's pro-Trump PAC or producing our latest documentary, 'The A Word', which shines a light on the American women fighting for reproductive rights, we know how important it is to parse out the facts from the messaging.

At such a critical moment in US history, we need reporters on the ground. Your donation allows us to keep sending journalists to speak to both sides of the story.

The Independent is trusted by Americans across the entire political spectrum. And unlike many other quality news outlets, we choose not to lock Americans out of our reporting and analysis with paywalls. We believe quality journalism should be available to everyone, paid for by those who can afford it.

Your support makes all the difference.

GTA V mods can be used to make the game have flying car, falling whales and an eerie flooded landscape. But they can also let people take over your computer and run malicious code.

The modifications change the code of the game so that new features, objects and landscapes can be added to it. But malicious code could be packaged in those downloads, which gets installed at the same time.

On a forum for players of the game, one user said that they have spotted malware in two mods. Those spotted were “noclip”, which lets people walk through walls and objects, and “angry planes” which spawns planes that attack players.

The mods came packaged with code that installed a file called fade.exe, which connects to the internet. It seems to use that connection to read what users are doing and then send it off across the internet — potentially to be used to break into accounts and commit identity theft.

The malicious code watches user by hijacking a genuine part of Windows. It doesn’t seem to come into effect until players open the game, and so just downloading it is thought not to cause the problems.

The mods identified have since been removed from the websites that were hosting them. But since the problem exists more are likely to come, and users have been warned to change passwords and be wary of future downloads.

Join our commenting forum

Join thought-provoking conversations, follow other Independent readers and see their replies

Comments

Thank you for registering

Please refresh the page or navigate to another page on the site to be automatically logged inPlease refresh your browser to be logged in