Steam workshop virus what are the chances?

[Kiperclave]

Hello, I searched for some mods on steam workshop but i was a little paranoid if I could get a virus (for example malware/spyware etc) and i read the terms and conditions and there is written that its not guaranteed to not have a virus + no other mention. Could I get a virus from steam workshop mods? (I play games like Stormworks/Cities: Skylines/HoI 4 etc)
if yes what are the chances?

Thank you for answers

[Manectricz]

The chances are basically zero, dont worry about it

[Kiperclave]

Originally posted by Manectricz:

The chances are basically zero, dont worry about it :winter2019happydog:

Okay thank you

[nullable]

It would be extremely difficult.

1. It would have to get past Valve's standard malware checking.
   
2. And also only downloaded by clueless people who would never detect it.
   
3. In general Steam Workshop mods don't contain executable code, so in addition to above, there would have to be specific vulnerabilities in the game itself that would enable a mod to do something malicious. And that would have to be undetected and unpatched.

So it's not strictly absolutely impossible. But it's pretty implausible. So many things would have to happen and it would be difficult for that situation to persist long term undetected. I personally wouldn't worry about it unless you're the sort to worry about getting struck by meteorites or caught in sinkholes.

[davidb11]

You'd probably win the lottery three times in a row first than get a virus from the Steam Workshop.

[Arg0n]

Chances you will get eaten alive by giraffe is very low, but never zero:

https://www.pcgamesn.com/cities-skylines/mod-malware

The best malware detection and QA processes can't protect you from everything.

[davidb11]

Your own link says Malware was not found at all.
So, you shouldn't be linking to that.

[Arg0n]

The bigger risk was with Update from GitHub, which, er… let users update mods directly via GitHub. Naturally, bypassing the Steam Workshop system could allow that mod to install malware. However, it was “removed shortly after appearing on the Workshop”, and “only affected ~50 users”.

It seems there was a mod "Update from Github", which could directly pull stuff from GitHub and circumvented the Workshop verification.

// EDIT
@davidb11 I guess you are right that there was no malware found, but the mod had the capability to do so. But as the article mentioned only ~50 players were affected and the mod was removed very quickly from the workshop. I can't find any information whether it really downloaded any harmful stuff.

Here's the official statement from the devs: https://store.steampowered.com/news/app/255710/view/6047774523920146831

[Zee_]

There was a workshop mod years ago that did have malware in it, it was quickly detected and removed. If I'm remembering correctly I believe less than a dozen people had installed it before it was removed, and it should be noted that this was in the very early days of the steam workshop. They have added better security features since then.

The recent issue with a Cities Skylines workshop mod mentioned by the above poster had the ability to install 3rd party programs and the mod author had put in code that would cause certain players games to crash (when the game was run it would check the player's Steam ID and if it was on his hate list it would crash the game). Both of which are against the EULA, so the mod was removed and he was banned from uploading to the workshop.

If you want to be as sure as possible that there is no virus or malware you can simply scan your workshop folder after downloading any mods.The workshop mods folder can be found at <drive where you have Steam installed here>:\Steam\SteamApps\workshop

[Kiperclave]

Originally posted by Snakub Plissken:

It would be extremely difficult.

1. It would have to get past Valve's standard malware checking.
   
2. And also only downloaded by clueless people who would never detect it.
   
3. In general Steam Workshop mods don't contain executable code, so in addition to above, there would have to be specific vulnerabilities in the game itself that would enable a mod to do something malicious. And that would have to be undetected and unpatched.

So it's not strictly absolutely impossible. But it's pretty implausible. So many things would have to happen and it would be difficult for that situation to persist long term undetected. I personally wouldn't worry about it unless you're the sort to worry about getting struck by meteorites or caught in sinkholes.

Okay thank you

[Kiperclave]

Originally posted by Zee_:

There was a workshop mod years ago that did have malware in it, it was quickly detected and removed. If I'm remembering correctly I believe less than a dozen people had installed it before it was removed, and it should be noted that this was in the very early days of the steam workshop. They have added better security features since then.

The recent issue with a Cities Skylines workshop mod mentioned by the above poster had the ability to install 3rd party programs and the mod author had put in code that would cause certain players games to crash (when the game was run it would check the player's Steam ID and if it was on his hate list it would crash the game). Both of which are against the EULA, so the mod was removed and he was banned from uploading to the workshop.

If you want to be as sure as possible that there is no virus or malware you can simply scan your workshop folder after downloading any mods.The workshop mods folder can be found at <drive where you have Steam installed here>:\Steam\SteamApps\workshop

Okay thank you very much

[Kiperclave]

Originally posted by davidb11:

You'd probably win the lottery three times in a row first than get a virus from the Steam Workshop.

Okay thank you very much

[DK l heisenberg]

спч

[Kiperclave]

Originally posted by Snakub Plissken:

It would be extremely difficult.

1. It would have to get past Valve's standard malware checking.
   
2. And also only downloaded by clueless people who would never detect it.
   
3. In general Steam Workshop mods don't contain executable code, so in addition to above, there would have to be specific vulnerabilities in the game itself that would enable a mod to do something malicious. And that would have to be undetected and unpatched.

So it's not strictly absolutely impossible. But it's pretty implausible. So many things would have to happen and it would be difficult for that situation to persist long term undetected. I personally wouldn't worry about it unless you're the sort to worry about getting struck by meteorites or caught in sinkholes.

So just basicly look after comments, rating, how many people had downloaded it and if it's long enough on Steam?

[Kiperclave]

Originally posted by Zee_:

There was a workshop mod years ago that did have malware in it, it was quickly detected and removed. If I'm remembering correctly I believe less than a dozen people had installed it before it was removed, and it should be noted that this was in the very early days of the steam workshop. They have added better security features since then.

The recent issue with a Cities Skylines workshop mod mentioned by the above poster had the ability to install 3rd party programs and the mod author had put in code that would cause certain players games to crash (when the game was run it would check the player's Steam ID and if it was on his hate list it would crash the game). Both of which are against the EULA, so the mod was removed and he was banned from uploading to the workshop.

If you want to be as sure as possible that there is no virus or malware you can simply scan your workshop folder after downloading any mods.The workshop mods folder can be found at <drive where you have Steam installed here>:\Steam\SteamApps\workshop

So just basicly look after comments, rating, how many people had downloaded it and if it's long enough on Steam And after that check it with antivirus?

[davidb11]

Steam already checks everything with Antiviruses.
About 30 of them. :P
Then their hosting system checks for viruses with even more anti-viruses.

You'll never get a malicious file from the workshop.