You can prevent this by setting up a virtual machine, it will still allow the benefit of being able to download whatever, without the risk of this ever happening.
This is the reason why games not on Steam or GoG are not playable for me. I won't download anything from itch or get a patch for a game that IS on steam. ROM Hacks are not for me as well. I might be to paranoid but I can't risk my PC getting infected.
my go-to recommendation for securing any discord / guilded server: use a second, cold-storage, account as the owner. do not use that account on your main machine. do not log into it unless you *really* need to change something on your server. there is rarely a reason you need full owner or even admin permissions once your server is set up.
If it makes you feel any better, you're the second game dev TH-camr I've seen fall for this. I don't recall who the first was. These attacks used to be worse though. Google Chrome's password manager used to store saved credentials in plain text so the same attack could let someone log into any websites you saved. Now I think they just save an auth token for Google that's used to download a decryption key. The suspicious activity notice you got might have been someone trying to log in using that token from an unusual location. I'm probably getting the details wrong but it's something like that. In any case, this was relatively minor so it's not worth stressing about too much
A 4000 member discord could be years of marketing work for an indie dev. That's likely his only way to directly reach his audience for marketing purposes outside of TH-cam, which is not a reliable way to make sure everyone interested in your projects sees your message. Losing your discord and potentially spreading the scam to all 4k members within it is a pretty serious problem.
I think I’ve seen this scam sometime mid last year? I wasn’t into game dev at the time I saw notifications from friends about it They’re definitely getting more creative with scams
Some good security practices: 1. Always verify via another method (text, email, other app) that messages asking you to download something REALLY are from people you trust. 2. VMs or Sandboxes can technically be escaped so don't think of it as a silver bullet, but it is a good step. 3. If you are to use a VM or a separate machine, make sure it is a machine/VM that you don't use for logging into any accounts 4. Wouldn't be a bad idea to run the game through Virus Total
@2dquix Nah. Check the CVEs for those and you'll see it can happen. Although, as long as you are running the most up-to-date software, the likelihood is pretty darn low.
The idea that Discord would allow a server to be deleted without numerous layers of extra verification is absolutely bonkers to me. At the same time making it 100% irreversible without so much as a 30 day grace period is also asinine.
@@Challacade You should have a backup server. You can easily do this my going to server settings > server template. It saves all your roles and data so you won't have to rebuild the server again.
Hey man, Just a simple suggestion; Have a fully locked down alt that you don't access from anything you do other stuff on and then make that alt the owner of any servers you own. This prevents stuff like this, while still allowing you to log in and make any changes you may need to make.
This is actually a good idea but will only work if your current account have moderator access at max, while damage can still be done by the hacker, they still can't either delete the server of demote the administrator (the alt account) or other mods... allowing you to recover the server takeover... the only downside is that if the server needs any major changes you have to login the alt account to manage things up. Also never login on your alt account on a compromised system.
For anyone running Windows 11 Pro, you might be able to install and run "Windows Sandbox" as a feature. This essentially works like a virtual machine, but it's based off your Windows system files (so it doesn't require any extra disk space or installation). So if I don't trust an executable, I open the sandbox (which gives you a clean Windows that runs most programs) and you can just run the game inside. Once the sandbox is closed, everything is gone. And at no point does the program inside have access to anything outside said box.
@@daniishere1009 Open Add/Remove Programs, pick the option to add/remove Windows Features, and look for "Windows Sandbox" (it's top level and named like that, but your CPU has to support virtualization and it has to be enabled in UEFI). Once that's installed, you should have a new program called "Windows Sandbox", that's it!
@@daniishere1009 first off, to enable it you need to have virtualization enabled (could be called Virtualization or VT or something similar on Intel and SVM on AMD, also depends on your motherboard's manufacturer) in the BIOS (I've used the "shutdown /r /fw" command to get into it,but there are many other ways as well). Then you can search for the setting "Turn Windows features on or off" in Windows search, there you will want to find and enable "Windows Sandbox" and then click "OK". Once it's done enabling/installing it, you can just search for and run "Windows Sandbox" to start it up. If it says something along the lines of "No hypervisor was found." when trying to open it, you don't have virtualization enabled.
I appreciate you updating not just your fanbase, but anyone else who comes across this video to download with caution! Very important online rule that many forget about or ignore
It’s definitely scary. I’ve been in a similar situation before and it wrecked me for a while. My anxiety was super high for days to. It’s something at least for me that’s hard to forget about but in some ways it’s not all bad because it was a learning situation. While your server is gone you’ve gained knowledge to better help you in the future.
I wasn't on the server yet but i know the pain of making one that works perfectly. Hope you and your mods can start up again and make a new server that is even better then the last. And this time I will join it!
windows should have sandboxing by default. When your friend sends you a unity game they made, it's usually self contained, it's never going to need access to your file system or other applications, they could still support game saves and preferences so long as the file system is local. So people intuitively know if it requests native access that the program is sketchy. like image a windows popup like "this program wants native file access, games or graphical applications should not request this. YES, [NO]"
Sorry to hear that happened to you. Thanks for making a great video explaining what happened and how it happened to you. I’ll be teaching a unit on this in my AP computer science class in a couple weeks and I’ve decided to include your video in my lesson.
I am so sorry to hear this happen to you. Discord sadly will never do anything about this as you discussed and it's just a case to be aware of it and spread the knowledge ( so good job on the video). You will Rebuild!
So sorry to hear that, I'll definitely keep that in mind as I do tend to get careless and just ignore the warning all together at times, good chance I would fall for this too. I wish you good luck in the future, and I'll pray for your fortune just in case to top it off.
Happened to me too last week. I was lucky I saw people discussing it on the server. I was able to reset all my passwords and log out existing sessions before any damage was done. I assume my 2FA slowed them down, or maybe I got less a dedicated crew of criminals than you did. Thanks for taking the time to let people know about this scam.
Man, you deserve better than this. I really enjoy your content and I'm sure you'll be able to rebuild but having to go through something like this just sucks. Thanks for getting the word out too.
Little thing to keep note of as well: if you are using a Clickteam run game (games that used clickteam to create) (it’s also mainly for Undertale fan games) windows HATES it. It will try EVERYTHING to keep you from playing. THEY ARE FALSE POSITIVE.
I've always feared this outcome for the indie scene. The Issue of run anyway being common practice for those who dont want to pay for the certification.
I’m in a server with a developer that’s been working on a project for over 10 years. I’ve been a mod for a little over half a year and I’m so paranoid of DMs now. Thankfully my friends and fellow mods understand and even encourage my careful behavior. I wish you the best of luck rebuilding your community
I love your channel and content man, you are my big inspiration for my game and now hearing this is just touching. Sorry for what happened. I will never understand how you can do that to another person..
I actually just got this exact scam. I got a DM from someone I barely talk to and he convinced me to download and run the file as administrator. Unbeknownst to the hacker, I was running it on a windows sandbox and even had the tabs for the file and website checkers still up when he asked if I could share my screen. He was very angry when he realized I was running a VM and me and my friends got a good laugh after words. I'm glad I used a VM because it would've been embarrassing as a Computer Science student to get my computer comprised.
I feel for this scam like 2 years ago and had a 4 month long battle to recover my discord account because it didn't have 2FA on (which I do now). I now have a windows VM SPECIFICALLY to test indie games some of my friends send me specifically because of this scam. Haven't been hacked once since and would recommend this to anyone.
I was one of the many who got pinged, i couldnt try it at the time but when i didnt find the server i was pretty confused, sucks to see that it happened to you and your work
We got hit by the same thing; luckily our discord is quite small and most of the members were aware of the hack happening on the Valheim server (relevant since our lead dev is also the Valheim dev who initially got hacked). Really brought to light how limited security options are on discord. Even with full admin access I of course couldn't shut out Robin's owner account, and the hackers kicked me shortly afterward. They managed to get access to his Twitter and Itch accounts as well. I've seen some suggestions about transferring server ownership to essentially a dummy account for these situations but it would be nice for discord to have better failsafes as well. Don't beat yourself up too much, either; these hackers are really good at mimicking the accounts they're posting from, right down to switching languages if need be. Pretty spooky!
I love the video, its really exciting and very important to get the message out - I feel sad that you got hacked though. The background track sounds great - What songs do you use?
this happened to me! the name of the game was grapple tank, or hover tank, if i recall correctly, though, it was over discord, and that's all that got stolen.
is it possible to get to the chest directly above the bridge in the village or is it just there as an easter egg, ive looked all over and have beaten 3 bosses but only have 21% completion. also the overworld map doesnt really work is it a bug on my end or is it something your working on? just a few questions, otherwise its a very fun game and I look forward to the final release when its completed.
Challa, i now you don't have to do this, but if you could help me, i'm making a game, and loved how you character can move and attack with diferent comands and still hadles "looking at the right direction" after the attacks perfectly. Can you say witch method are you using? ( Pardon my english )
And putting this in a second commit for visibility: If you can't use Windows Sandbox, holding down Shift while right clicking an executable should give you the option to run it under a different user. You can do so, even using your very same account, which still should isolate it at least somewhat from other processes (unless that changed, haven't used it in ages, though). This obviously won't stop malware from changing files or adding registry keys and the like.
A tool I use a lot if on windows is Sandboxe Plus - it lets you run a program via right click menu in an isolated sandbox that can't access any user data, and can be erased quickly. You can even have sandboxes that disable network. But since it's not a VM, games still run full speed. In fact, when doing malware analysis, I'll still use it even inside of a VM as it being in such a small filesystem makes it easier to inspect.
Something that I always do when someone sends me a link on a platform like messenger or discord is I always call them or text them from their real number just to make sure. I am sorry to hear what has happened, but I know things will get better. Can't wait to see what comes in the future!
Me and my friends have code words to confirm that we are in fact chatting with each other if we get links. If the person can’t answer anything then we know.
That's unfortunate, did you have the server option 'require 2fa for mod actions' enabled? I'm not familiar with how he got access but that would've made discord prompt for 2fa for any mod actions including transfer ownership.
Sounds awful, sorry to hear you had to go through that. Sounds like the hacker understood the community they were dealing with, much more effective than the usual scams that get sent to your email at random. Also sounds like Discord is an absolute mess in regards to security and customer support
This is why i never let chrome or any browser remember my info and i always have multiple emails for certain categories like shopping for example with their own passwords
Sad This Happend to you. Btw I have a quick question and that is: is there a way to change the controllls or select something without left click? because i accidentally made left click close the game in the custom control sceme. 😓
Thanks for letting me know about this possibility - for now you can delete the control schemes file, which is in Users/user/Appdata/Roaming/LOVE/moonshire
That sucks, sorry this happened to you. It'd been good if you had doubled check with your friend like if he's your irl friend to text his number or just feel something's off as I bet the hacker was texting differently than your friend. Personally this is why I use Linux, windows so vulnerable and windows defender is like airport security. One thing I do is if I really wanna open a file up but suspicious it might be infected is to just open the file in a VM (Virtual machine) it's very easy to set one up and if the file is infected the VM is separated from your host machine so it would just be infecting a blank computer with nothing on it assuming you aren't logged into discord. Well I hope you recover from this sorry this happened!
This is why, if possible, always confirm on a second, separate communication system that a message/file is legit before installing and running any file, even from trusted friends
there were 3 different distinct hinges in this situation where you could had stopped or prevented it yourself, and though unfortunate either way, you still must accept responsibility fully for such things. and to be fair, falling for this would catch a person serious hell and ridicule in the enthusiast pc space, so be careful too.
I was in the same position 2 years ago. I'm not Owning a Discord Server but my all firends messages from. They even got my Steam account where I luckily disconnected my PayPal just a few day prior because I had safety concerns. And most of my accounts had 2FA so I was pretty lucky but I could if been way worse. So I can relate to it
I saw this happen to another smaller game dev and it sucks seems to be a common occurrence since they also hacked one of the devs and did a ton of stuff then deleted it this sucks and people like this suck. sorry this happened to you and I wish you the best
2fa isn't enough to protect your account. They can steal your token and use it to log into your account, change the email, and use the new email to disable 2fa and then enable their own 2fa and change the password
We need to normalize testing games in sandbox/virtual PC environments. The more habitual and standardized it is, the harder it will be for this kind of scam to affect people.
I already knew about this fishing scam cause some of my friends got hacked and then the hacker came on the server to ask us, except my friends had 2nd accounts on the server so they told us that they got hacked and we shouldn't launch the "game" plus they had a habit of making us take control of a secondary computer they have when they want us to test their games instead of downloading the game so those who already tested one of their game knew something was off when we first saw the message. and then because we are really mature we went trolling the hacker in dm, someone even tried to hack back the hacker with another fake game to get the account back (no success)
I'm really glad you made a video about this, and you're fortunate that the problem wasn't significantly worse. If the hacker was able to steal your bank account information and drain your account, it is not reimbursable by your bank. Teaching your audience about how this happened and raising your standards for security is the best action you can take 👏🏻 It's 2024 and game development has literally never been easier. No one should be opening .exe files they're downloading from the internet to play a demo of a game. If a developer can't host a demo of their game online, it doesnt deserve feedback. The alternative is exactly as you said, we're conditioning the audience to ignore basic security and internet safety. I doubt you need it, but let me know if you need any help setting up a website or server for your audience to play a private demo of your game
My question is though what are good alternatives if you want to share your indie projects with friends as clearly this is a big issue. Like yes having the playing in browser feature is good but I’m unsure if everyone can or will want to use that feature
@@TheDirtManYT asking random people to spin up a VM to test a game isn't going to get much testing done (random people aren't likely to know how to do this)... and unless you to GPU pass through into the VM, your limited to really crappy rendering tech.. it is a great idea in theory, but not a great one in practice. Better would be if the OS supported a "run in sandbox" mode for apps, so that they can only access their own files, the ability to render, and read input.
Awww this scam… I’d seen it going around before I even got into game development. This is why if any of us send nitro gifts or anything scammers do we either wait 3 days or have a code word between us to confirm that we haven’t been hacked
It should be trivial for windows to implement a "Run in a Sandbox" mode that runs it in a jail with a fake file system. But msft isn't incentivized to not share all your data with anyone who asks.
When opening an unsigned program, always do it in a VM sand box. This way it wont be able to infect your PC. Alternatively if you cannot figure out how to set up a VM or can't, a cheap dell optiplex/old computer that isnt connected to anything for testing a friends game is also a good go to. Use an old GPU you have on hand along with whatever other on hand parts you have and call it a day. Even if the program has the most infectious vurus known to man, it cant spread if there is nothing to spread to. CD-ROMs work great for this as well as they are not capable of being automatically burned with data from commericial sale versions of windows. You can also let your friend know the specs of the computer and how it well/not it ran on the hardware as well which can help them figure out roughly the recommended specs required.
This kinda stuff sucks since its very easy to believe you wouldn't fall for it. I've never been hacked before (besides in a single online game when i was like 7) and i always consider myself smarter then these but i admit that i could fall for something like this
Windows really makes me angry. There should be functionality like running anything in a proper easy to use sandbox, and while there are sandbox apps, they really suck. Running games in a VM aren't really an option if it requires a GPU (and getting GPU passthrough is very difficult on windows.)
Maybe if a few software developers got together to build a platform like steam, epic, etc but for indie developers that can be used for play testers or just a platform for indie devs to release there games for free. Of course it won't be as big/feature rich as steam or all these other platforms but it could help with security
this happened to one of my friends. they sent me a message asking to test a game, luckily i was at work at the time. by the time I got home another friend told me what was up
just a heads up: this thing, is not just a malware, but a spyware: so basicly changing your passwords wont do much, because he'll still have access to your new passwords no matter what...unless you delet that virus at the source and re-install your windows....unfortunately.
01:30 Thats also what i noticed when i reported a groomer with a server full of lil kids doing all sorts of weird stuff for him on cam discord support is the worst because they do nothing or dont answer like wtf! this needs to get more attention. also "its not bad but i could be worse" yeah bricking 800 computers to a point where people who dont know anything about tech loose all their data, saying "its not bad" is a huge understatement
A way I prevented my server from getting deleted was 100% dumb luck. My server I don't technically own. My server ownership is under a account i have access to, but that's never logged in. I fell for the same trick under pretty similar circumstances. I never open or run files unless i know the person and in my circumstance i knew the guy was big into creating new projects and games in the past. Just kinda bad luck. Also the google thing happened to me too. Pretty sure it's just because google is seeing a log in from a fresh computer that's never logged in before.
When he showes his face it’s serious
i want ask is that game he created in unity? (i talk on moonshire)
@@Sergio_dev no, he used a framework called love
This is actually terrifying to me, I love the idea of playing games from creators in the community, but this makes that so much harder :(
i am subed to both of you
These kind of scams are usually extremely obvious though, so unless you don't pay any attention at all you should be fine
You can prevent this by setting up a virtual machine, it will still allow the benefit of being able to download whatever, without the risk of this ever happening.
This is the reason why games not on Steam or GoG are not playable for me. I won't download anything from itch or get a patch for a game that IS on steam.
ROM Hacks are not for me as well. I might be to paranoid but I can't risk my PC getting infected.
That is one of the best use cases for virtual machines tho :)
my go-to recommendation for securing any discord / guilded server:
use a second, cold-storage, account as the owner. do not use that account on your main machine. do not log into it unless you *really* need to change something on your server.
there is rarely a reason you need full owner or even admin permissions once your server is set up.
Ooh this is really smart, a silent overlord to keep the server safe.
Everyone talks about beefing up your own security habits but nobody ever talks about hunting malicious actors for sport
There are a few youtubers mak8mg videos on wasting scammers' time.
@@tymondabrowski12 they're doing the lord's work
@@tymondabrowski12 Kitboga and Scammer Payback notably
Treat it like the wild hunt.
The best way to stay safe is to be the only developer in your friends group.
I don't think that would be safe, this means that if you got hacked, YOUR ACCOUNT will be the vulnerability here
@@mrgaberson1465 I see no issues with that.
something about this just seems a little backwards. Developers need developer friends.
If it makes you feel any better, you're the second game dev TH-camr I've seen fall for this. I don't recall who the first was. These attacks used to be worse though. Google Chrome's password manager used to store saved credentials in plain text so the same attack could let someone log into any websites you saved. Now I think they just save an auth token for Google that's used to download a decryption key. The suspicious activity notice you got might have been someone trying to log in using that token from an unusual location. I'm probably getting the details wrong but it's something like that. In any case, this was relatively minor so it's not worth stressing about too much
A 4000 member discord could be years of marketing work for an indie dev. That's likely his only way to directly reach his audience for marketing purposes outside of TH-cam, which is not a reliable way to make sure everyone interested in your projects sees your message. Losing your discord and potentially spreading the scam to all 4k members within it is a pretty serious problem.
I think I’ve seen this scam sometime mid last year? I wasn’t into game dev at the time I saw notifications from friends about it
They’re definitely getting more creative with scams
Some good security practices:
1. Always verify via another method (text, email, other app) that messages asking you to download something REALLY are from people you trust.
2. VMs or Sandboxes can technically be escaped so don't think of it as a silver bullet, but it is a good step.
3. If you are to use a VM or a separate machine, make sure it is a machine/VM that you don't use for logging into any accounts
4. Wouldn't be a bad idea to run the game through Virus Total
want to test my game ?
I thought vm's like virtual box and VMware cant be escaped
@2dquix Nah. Check the CVEs for those and you'll see it can happen. Although, as long as you are running the most up-to-date software, the likelihood is pretty darn low.
@damonfedorick In the context of this conversation, I'd say respectively, NO
Compile from source always
Looking at the post, 42MB for a Unity game seems tiny. That feels like an immediate red flag
The screenshot in the video is a fake page made by me, just for the clip. I uploaded a random zip, I should have checked the size haha
i mean, could've been a game demo
The idea that Discord would allow a server to be deleted without numerous layers of extra verification is absolutely bonkers to me. At the same time making it 100% irreversible without so much as a 30 day grace period is also asinine.
no 2fa either or anything
I completely agree
@@Challacade You should have a backup server. You can easily do this my going to server settings > server template. It saves all your roles and data so you won't have to rebuild the server again.
Hey man,
Just a simple suggestion;
Have a fully locked down alt that you don't access from anything you do other stuff on and then make that alt the owner of any servers you own.
This prevents stuff like this, while still allowing you to log in and make any changes you may need to make.
This is actually a good idea but will only work if your current account have moderator access at max, while damage can still be done by the hacker, they still can't either delete the server of demote the administrator (the alt account) or other mods... allowing you to recover the server takeover... the only downside is that if the server needs any major changes you have to login the alt account to manage things up.
Also never login on your alt account on a compromised system.
I. ABSOLUTELY. DESPISE HACKERS!!!
Same!
who doesn't
@@n0tjak 9 year olds
calling them hackers is to generous. they're digital terrorists.
THEY ARE NOT HACKERS. it was a script kiddie.
For anyone running Windows 11 Pro, you might be able to install and run "Windows Sandbox" as a feature. This essentially works like a virtual machine, but it's based off your Windows system files (so it doesn't require any extra disk space or installation). So if I don't trust an executable, I open the sandbox (which gives you a clean Windows that runs most programs) and you can just run the game inside. Once the sandbox is closed, everything is gone. And at no point does the program inside have access to anything outside said box.
Can you tell me how to use this sandbox feature? Since I am using Windows 11, but I don't know how to use this feature?
@@daniishere1009 Open Add/Remove Programs, pick the option to add/remove Windows Features, and look for "Windows Sandbox" (it's top level and named like that, but your CPU has to support virtualization and it has to be enabled in UEFI). Once that's installed, you should have a new program called "Windows Sandbox", that's it!
I tried to use it a bit ago but it doesn't lock the mouse cursor properly, so playing 3D games isn't possible using it
@@Hietakissa Can you tell me how to use this sandbox feature? Since I am using Windows 11, but I don't know how to use this feature?
@@daniishere1009 first off, to enable it you need to have virtualization enabled (could be called Virtualization or VT or something similar on Intel and SVM on AMD, also depends on your motherboard's manufacturer) in the BIOS (I've used the "shutdown /r /fw" command to get into it,but there are many other ways as well).
Then you can search for the setting "Turn Windows features on or off" in Windows search, there you will want to find and enable "Windows Sandbox" and then click "OK".
Once it's done enabling/installing it, you can just search for and run "Windows Sandbox" to start it up. If it says something along the lines of "No hypervisor was found." when trying to open it, you don't have virtualization enabled.
As soon as you said “Sent me a game” i was like uh oh
I appreciate you updating not just your fanbase, but anyone else who comes across this video to download with caution! Very important online rule that many forget about or ignore
true dat
It’s definitely scary. I’ve been in a similar situation before and it wrecked me for a while. My anxiety was super high for days to. It’s something at least for me that’s hard to forget about but in some ways it’s not all bad because it was a learning situation. While your server is gone you’ve gained knowledge to better help you in the future.
I wasn't on the server yet but i know the pain of making one that works perfectly. Hope you and your mods can start up again and make a new server that is even better then the last. And this time I will join it!
windows should have sandboxing by default. When your friend sends you a unity game they made, it's usually self contained, it's never going to need access to your file system or other applications, they could still support game saves and preferences so long as the file system is local. So people intuitively know if it requests native access that the program is sketchy.
like image a windows popup like "this program wants native file access, games or graphical applications should not request this. YES, [NO]"
Appreciate the transparency and honesty of your post.
Good advice on running projects in a sandbox or virtual environment.
Sorry to hear that happened to you. Thanks for making a great video explaining what happened and how it happened to you. I’ll be teaching a unit on this in my AP computer science class in a couple weeks and I’ve decided to include your video in my lesson.
I am so sorry to hear this happen to you. Discord sadly will never do anything about this as you discussed and it's just a case to be aware of it and spread the knowledge
( so good job on the video).
You will Rebuild!
how is this in my recommended 3 minutes after its uploaded. das crazy.
edit: watched the video. that really sucks man. stay strong. ✌
So sorry to hear that, I'll definitely keep that in mind as I do tend to get careless and just ignore the warning all together at times, good chance I would fall for this too. I wish you good luck in the future, and I'll pray for your fortune just in case to top it off.
Happened to me too last week. I was lucky I saw people discussing it on the server. I was able to reset all my passwords and log out existing sessions before any damage was done. I assume my 2FA slowed them down, or maybe I got less a dedicated crew of criminals than you did.
Thanks for taking the time to let people know about this scam.
It's a good thing you had your game on steam already
i want ask is that game he created in unity or unreal? (i talk on moonshire)
Man, you deserve better than this. I really enjoy your content and I'm sure you'll be able to rebuild but having to go through something like this just sucks. Thanks for getting the word out too.
This is such a horrible way to take advantage of the way a community runs, shares and engages with each other.
Little thing to keep note of as well: if you are using a Clickteam run game (games that used clickteam to create) (it’s also mainly for Undertale fan games) windows HATES it. It will try EVERYTHING to keep you from playing. THEY ARE FALSE POSITIVE.
I've always feared this outcome for the indie scene. The Issue of run anyway being common practice for those who dont want to pay for the certification.
I’m in a server with a developer that’s been working on a project for over 10 years.
I’ve been a mod for a little over half a year and I’m so paranoid of DMs now.
Thankfully my friends and fellow mods understand and even encourage my careful behavior.
I wish you the best of luck rebuilding your community
I love your channel and content man, you are my big inspiration for my game and now hearing this is just touching. Sorry for what happened. I will never understand how you can do that to another person..
I actually just got this exact scam. I got a DM from someone I barely talk to and he convinced me to download and run the file as administrator. Unbeknownst to the hacker, I was running it on a windows sandbox and even had the tabs for the file and website checkers still up when he asked if I could share my screen. He was very angry when he realized I was running a VM and me and my friends got a good laugh after words. I'm glad I used a VM because it would've been embarrassing as a Computer Science student to get my computer comprised.
This is nightmare fuel as a 6k+ member server owner myself. Thank you for the PSA and helping spread the word.
I feel for this scam like 2 years ago and had a 4 month long battle to recover my discord account because it didn't have 2FA on (which I do now).
I now have a windows VM SPECIFICALLY to test indie games some of my friends send me specifically because of this scam. Haven't been hacked once since and would recommend this to anyone.
I am sorry this happened to you. Your videos are inspiring and your game looks amazing. Keep on keeping on.
:( poor server
i want ask is that game he created in unity? (i talk on moonshire)
@@Sergio_dev Yeah, a server about the game
I was one of the many who got pinged, i couldnt try it at the time but when i didnt find the server i was pretty confused, sucks to see that it happened to you and your work
Dang, that's really sad to hear. Hope everyone stays safe!
You can also double check with your friend through a different form of communication before running their game
Thank you for this I definitely ignore warnings from games wayyy too much!
We got hit by the same thing; luckily our discord is quite small and most of the members were aware of the hack happening on the Valheim server (relevant since our lead dev is also the Valheim dev who initially got hacked). Really brought to light how limited security options are on discord. Even with full admin access I of course couldn't shut out Robin's owner account, and the hackers kicked me shortly afterward. They managed to get access to his Twitter and Itch accounts as well. I've seen some suggestions about transferring server ownership to essentially a dummy account for these situations but it would be nice for discord to have better failsafes as well. Don't beat yourself up too much, either; these hackers are really good at mimicking the accounts they're posting from, right down to switching languages if need be. Pretty spooky!
I love the video, its really exciting and very important to get the message out - I feel sad that you got hacked though. The background track sounds great - What songs do you use?
this happened to me! the name of the game was grapple tank, or hover tank, if i recall correctly, though, it was over discord, and that's all that got stolen.
is it possible to get to the chest directly above the bridge in the village or is it just there as an easter egg, ive looked all over and have beaten 3 bosses but only have 21% completion. also the overworld map doesnt really work is it a bug on my end or is it something your working on? just a few questions, otherwise its a very fun game and I look forward to the final release when its completed.
This is very insightful! I never heard of this until now. Thank you for sharing this!!
Challa, i now you don't have to do this, but if you could help me, i'm making a game, and loved how you character can move and attack with diferent comands and still hadles "looking at the right direction" after the attacks perfectly. Can you say witch method are you using? ( Pardon my english )
I have heard Thor, from Pirate Software, discuss this attack. I’m sorry this happened to you. New server or not, still looking forward to the game! 🙂
And putting this in a second commit for visibility: If you can't use Windows Sandbox, holding down Shift while right clicking an executable should give you the option to run it under a different user. You can do so, even using your very same account, which still should isolate it at least somewhat from other processes (unless that changed, haven't used it in ages, though). This obviously won't stop malware from changing files or adding registry keys and the like.
A tool I use a lot if on windows is Sandboxe Plus - it lets you run a program via right click menu in an isolated sandbox that can't access any user data, and can be erased quickly. You can even have sandboxes that disable network. But since it's not a VM, games still run full speed.
In fact, when doing malware analysis, I'll still use it even inside of a VM as it being in such a small filesystem makes it easier to inspect.
I had a really similar situation happen to me recently, it really sucks to see it happening to others as well.
Something that I always do when someone sends me a link on a platform like messenger or discord is I always call them or text them from their real number just to make sure.
I am sorry to hear what has happened, but I know things will get better. Can't wait to see what comes in the future!
Me and my friends have code words to confirm that we are in fact chatting with each other if we get links. If the person can’t answer anything then we know.
Looking forward to when the server will be back; thank you for warning us all!
Did you reinstall windows with the recovery tool? or completely reformat the storage device? With the former, you still could have a rootkit
That's unfortunate, did you have the server option 'require 2fa for mod actions' enabled? I'm not familiar with how he got access but that would've made discord prompt for 2fa for any mod actions including transfer ownership.
Thanks for the video! I will follow the advice, stay strong!
Your reaction is really good, nice mentality !
Sorry to hear about this and I am wanting to create my own Discord community. Are you able to share the steps you took to secure your server?
Sounds awful, sorry to hear you had to go through that. Sounds like the hacker understood the community they were dealing with, much more effective than the usual scams that get sent to your email at random. Also sounds like Discord is an absolute mess in regards to security and customer support
This is why i never let chrome or any browser remember my info and i always have multiple emails for certain categories like shopping for example with their own passwords
This is exactly why I never check my dms and emails until I got my friends to verify that they actually sent me
i want ask is that game he created in unity? (i talk on moonshire)
I'm sorry to hear that. Thanks for sharing and reminding. 💪
Sad This Happend to you.
Btw I have a quick question and that is: is there a way to change the controllls or select something without left click? because i accidentally made left click close the game in the custom control sceme.
😓
Thanks for letting me know about this possibility - for now you can delete the control schemes file, which is in Users/user/Appdata/Roaming/LOVE/moonshire
Thanks for the advice , it Worked!
I can now play again! Yeeee@@Challacade
Thanks for the advice! It worked! Yay!
I can finally play again. Thank you very much@@Challacade
That sucks, sorry this happened to you. It'd been good if you had doubled check with your friend like if he's your irl friend to text his number or just feel something's off as I bet the hacker was texting differently than your friend. Personally this is why I use Linux, windows so vulnerable and windows defender is like airport security. One thing I do is if I really wanna open a file up but suspicious it might be infected is to just open the file in a VM (Virtual machine) it's very easy to set one up and if the file is infected the VM is separated from your host machine so it would just be infecting a blank computer with nothing on it assuming you aren't logged into discord. Well I hope you recover from this sorry this happened!
This is why, if possible, always confirm on a second, separate communication system that a message/file is legit before installing and running any file, even from trusted friends
Oh no, hope you are able to pick things up again
I didn't see the community message and wondered where the arcade server was
there were 3 different distinct hinges in this situation where you could had stopped or prevented it yourself, and though unfortunate either way, you still must accept responsibility fully for such things. and to be fair, falling for this would catch a person serious hell and ridicule in the enthusiast pc space, so be careful too.
I was in the same position 2 years ago. I'm not Owning a Discord Server but my all firends messages from. They even got my Steam account where I luckily disconnected my PayPal just a few day prior because I had safety concerns. And most of my accounts had 2FA so I was pretty lucky but I could if been way worse. So I can relate to it
I saw this happen to another smaller game dev and it sucks seems to be a common occurrence since they also hacked one of the devs and did a ton of stuff then deleted it this sucks and people like this suck. sorry this happened to you and I wish you the best
2fa isn't enough to protect your account. They can steal your token and use it to log into your account, change the email, and use the new email to disable 2fa and then enable their own 2fa and change the password
We need to normalize testing games in sandbox/virtual PC environments.
The more habitual and standardized it is, the harder it will be for this kind of scam to affect people.
I already knew about this fishing scam cause some of my friends got hacked and then the hacker came on the server to ask us, except my friends had 2nd accounts on the server so they told us that they got hacked and we shouldn't launch the "game"
plus they had a habit of making us take control of a secondary computer they have when they want us to test their games instead of downloading the game so those who already tested one of their game knew something was off when we first saw the message.
and then because we are really mature we went trolling the hacker in dm, someone even tried to hack back the hacker with another fake game to get the account back (no success)
Can i help you make a new server? I have even a way of making people report issues with the discord server apart from the normal chats
I'm really glad you made a video about this, and you're fortunate that the problem wasn't significantly worse. If the hacker was able to steal your bank account information and drain your account, it is not reimbursable by your bank. Teaching your audience about how this happened and raising your standards for security is the best action you can take 👏🏻
It's 2024 and game development has literally never been easier. No one should be opening .exe files they're downloading from the internet to play a demo of a game. If a developer can't host a demo of their game online, it doesnt deserve feedback. The alternative is exactly as you said, we're conditioning the audience to ignore basic security and internet safety.
I doubt you need it, but let me know if you need any help setting up a website or server for your audience to play a private demo of your game
I suppose if you wanted to be very secure, you could create a backup and disconnect from the internet before running the program
what an absolute nightmare. Thanks for heads up!
I was a member of the server, I hope everything gets better soon and I'm sorry that this happen :
i have found a way "around" the windows popup, i justed used 7z insted of zip, and i have no idea why zip is like that
My question is though what are good alternatives if you want to share your indie projects with friends as clearly this is a big issue. Like yes having the playing in browser feature is good but I’m unsure if everyone can or will want to use that feature
tell them to use a vm
@@TheDirtManYT oh yeah that will probably work
@@TheDirtManYT asking random people to spin up a VM to test a game isn't going to get much testing done (random people aren't likely to know how to do this)... and unless you to GPU pass through into the VM, your limited to really crappy rendering tech..
it is a great idea in theory, but not a great one in practice.
Better would be if the OS supported a "run in sandbox" mode for apps, so that they can only access their own files, the ability to render, and read input.
Awww this scam… I’d seen it going around before I even got into game development.
This is why if any of us send nitro gifts or anything scammers do we either wait 3 days or have a code word between us to confirm that we haven’t been hacked
It should be trivial for windows to implement a "Run in a Sandbox" mode that runs it in a jail with a fake file system. But msft isn't incentivized to not share all your data with anyone who asks.
When opening an unsigned program, always do it in a VM sand box. This way it wont be able to infect your PC. Alternatively if you cannot figure out how to set up a VM or can't, a cheap dell optiplex/old computer that isnt connected to anything for testing a friends game is also a good go to. Use an old GPU you have on hand along with whatever other on hand parts you have and call it a day. Even if the program has the most infectious vurus known to man, it cant spread if there is nothing to spread to. CD-ROMs work great for this as well as they are not capable of being automatically burned with data from commericial sale versions of windows. You can also let your friend know the specs of the computer and how it well/not it ran on the hardware as well which can help them figure out roughly the recommended specs required.
Im so sorry this happened to you man. Its very big of you to make a video about it. feckin script kiddies man :(
This kinda stuff sucks since its very easy to believe you wouldn't fall for it. I've never been hacked before (besides in a single online game when i was like 7) and i always consider myself smarter then these but i admit that i could fall for something like this
when i open the game i played for a bit and killed some bosses but when i bought the map it doesnt work
This is why you should always check
Windows really makes me angry. There should be functionality like running anything in a proper easy to use sandbox, and while there are sandbox apps, they really suck. Running games in a VM aren't really an option if it requires a GPU (and getting GPU passthrough is very difficult on windows.)
aww man, this sucks. but i'm glad you turned this around and made a video to positively make conscious this issue. thanks, dude. take care.
Man… thank you so much for your courage of admitting that! Thanks for warning us! You will grow stronger 😉
Maybe if a few software developers got together to build a platform like steam, epic, etc but for indie developers that can be used for play testers or just a platform for indie devs to release there games for free. Of course it won't be as big/feature rich as steam or all these other platforms but it could help with security
theres itch io. but again hackers can also upload there.
Yeah I was thinking more of a controlled per platform launcher but free@@emperor8716
Another option is to run the game under a linux VM with proton. I think it should be very difficult for any virus to pass that.
this happened to one of my friends. they sent me a message asking to test a game, luckily i was at work at the time. by the time I got home another friend told me what was up
just a heads up: this thing, is not just a malware, but a spyware: so basicly changing your passwords wont do much, because he'll still have access to your new passwords no matter what...unless you delet that virus at the source and re-install your windows....unfortunately.
* which is why, if i ever need to download content from my friends or people i know, i always run it in a VM, not in my actual computer *
I often forget about this Windowsy stuff, since I've been using Linux for so long and only go to Windows to build windows ports of playable games.
Does having a different OS like a Mac or Linux stop windows malware?
that mail from google is NOT the one for unrecognized device, if they did not change it since my last reinstall
Seems like the same thing that happened to WhyKev (developer of Paper Klay) a few weeks ago.
hey dumb question, are you still using love2d as your game engine or something else? i know bad timing and all but i just wanna know.
he is yeah
@@WolfAeterni
thank you
Terrifying I'm happy that you're ok (:
01:30
Thats also what i noticed when i reported a groomer with a server full of lil kids doing all sorts of weird stuff for him on cam
discord support is the worst because they do nothing or dont answer like wtf! this needs to get more attention.
also "its not bad but i could be worse"
yeah bricking 800 computers to a point where people who dont know anything about tech loose all their data, saying "its not bad" is a huge understatement
A way I prevented my server from getting deleted was 100% dumb luck. My server I don't technically own. My server ownership is under a account i have access to, but that's never logged in. I fell for the same trick under pretty similar circumstances. I never open or run files unless i know the person and in my circumstance i knew the guy was big into creating new projects and games in the past. Just kinda bad luck. Also the google thing happened to me too. Pretty sure it's just because google is seeing a log in from a fresh computer that's never logged in before.