Workshop Hacker Vulnerability Is Fixed!

Hey guys,

So I've been in contact with someone who is far more knowledgeable on computer security, and they have managed to identify exactly what was happening with the recent Workshop hacking attacks.

Essentially, it seems as though reading from a simple text file *can *execute malicious code with the method I was using when I made this game, being the BinaryFormatter. So they would replace map level text with these malicious scripts and when you would download them and try to simply read the text data from them to load a map, it would execute that code. Sometimes this was also packaged with .bat files, which explains why some users reported the .bat files being downloaded, but the root cause seems to be the map text file.

Since then, I have made several changes to prevent this from ever happening again:

1. I am now using Json to store my level data, which as far as I've been told, has a very rigid layout format meaning anything that isn't structured as a Json (like a malicious script) will be rejected

2. Only the host will now download the Workshop file, and then send that decoded text data to the players in the lobby through Mirror which is safe, meaning that worst case only the host gets hacked instead of the whole lobby

3. I have made it so that anything other than the required data inside a workshop folder will be deleted immediately upon download

This does mean that all the maps on the Workshop will no longer be valid, as they are all using the old system, but I have added backwards compatibility for the map makers to load their levels from the old system (which should be safe if it's your own level) and then they can reupload them to the workshop in the new Json format.

I want to thank the good Samaritan who has helped me to identify these issues, they themselves were robbed by these hackers in another game and now they seek vengeance on them by helping out developers any time they exploit their games in this way. I simply refer to him as Code Batman, so thank you so much Code Batman.

To those of you that have been hacked and/or lost anything from these hacks, there are no words to explain the guilt I feel, and how my game was used as a mechanism for these attacks, it sickens me and has made me much more wary to the vulnerabilities the Steam Workshop has, but at least now I am fully aware going into my future games on what to do when it comes to Steam Workshop verification.