Almost as soon as PlateUp! became available to play, lots of creative people have been enhancing the game by building and sharing their own unofficial content in the form of mods. Given the risks of modding continuing completely outside our control, we decided to support mods officially and enabled the Steam Workshop so that we could step in if we saw any mods that put the safety of players’ games at risk. Over the last four years, we've been monitoring the Workshop, with assistance from the modding community, to ensure the mods there are safe for players to use.
Incident Summary
Unfortunately, on the evening of October 15th, for the first time since launch, a malicious user uploaded mod content to the workshop containing malware. Once we became aware of this, we disabled all the affected mods and banned the user from uploading further mods. From our initial investigation into the mods, they only became actively malicious the next day. The window where they were dangerous to players was approximately four hours long. Accordingly, we believe that only 4 users were affected by the malware and are working with Steam to reach out to these users directly.
We also patched the game immediately to prevent the malicious mods from loading if they are still installed. We have also temporarily prevented the game from loading any new mods. The game will not load any newly uploaded mods until we are confident they are safe.
Affected Workshop Mods
The following mods were malicious and have been removed. They were all uploaded on October 15th, became actively malicious at 7PM UK time the next day and were then removed by us about 4 hours later (at ~11PM UK time).
The mods were:
Tonkotsu Ramen (Workshop ID: 3820068225)
Omurice (Workshop ID: 3820068225)
Loaded Nachos (Workshop ID: 3820068550)
Judging by the information we have available, the vast majority of users who subscribed to the mods downloaded them while they were not active, and did not run them during the window where there was a risk. The game will not load these mods and, while it is technically safe to run the game with these mods installed now, we would strongly advise anyone who downloaded them to verify the mods have been uninstalled properly and run a full virus scan of your PC. The malware also caused affected users to upload copies of these mods; no users subscribed to the copied mods before they were taken down, and these mods have also been removed from the workshop and are blocked by the game.
Next Steps
Modding support in PlateUp! has always been popular, and so many excellent mods have been created, because of the flexibility of the modding techniques that modders use. Modders write their own code, and at launch the game loads in their code. While this gives mods lots of power to make the mods they want to, it also opens up an attack surface for malicious actors. While we have to reiterate that users should be vigilant and only use mods they trust, we're also aware that this is difficult for players to actually do in practice; it is also our responsibility as curators of the Workshop to do as much as we can to make every player safe.
By preventing the game from loading new mods, the game is currently protected from further malicious mods. Obviously, this is not an ideal solution long-term, and we would like to find a way to allow new mods again. We won’t be able to do this until we, together with the players and modding community, can decide how to keep the game safe going forward.
Unfortunately, there is no clear answer to this problem. The recent rise of AI coding has greatly increased the ability of malicious actors to create malware mods at scale, targeting many games quickly by cloning existing mods, adding malicious code and using AI generated imagery and descriptions to appear genuine.
Over the next few days, we will be deciding how to proceed in a way that is safe, hopefully without compromising the quality of mods that can be uploaded. We feel that changing the way modding support works to be more restrictive is not a satisfactory solution for anyone; partly because it will drastically reduce what mods can do, but mostly because it will encourage people to download mods through unofficial channels and prevent us from being able to directly protect players going forward.
We have a number of initial options that we can consider, including:
Switching to a manual mod review process. While this would be a huge workload for us, it’s currently looking like the most likely option. New or updated mods would have to be queued for review before they can be loaded, and it may take some time for us to process the queue. We already do something similar to this for key library mods used by lots of players, so we may be able to broaden that out into a platform-wide solution.
Splitting mods into “code mods” and “content mods”. This is an option used by lots of games with similar modding support. It means players can download “content” mods (such as outfits or dishes) knowing that they are less risky than “code” mods. Unfortunately, unless we outright ban “code” mods we’d still need to do something to fix those “code” mods.
Completely disabling mods, or significantly restricting what mods can do. We don’t think this is a good option for anyone because this would just encourage people to distribute and download mods using an unofficial mod loader, and then we’d be in the same position but we wouldn’t be able to directly assist if there’s another incident in the future.
Continuing as we were, making sure that players are aware of the risks of downloading mods, and continuing to monitor the Workshop closely and proactively for any threats. While we’re happy we were able to respond to this situation before many users were affected, we don’t really want to be in this situation again.
We’d greatly appreciate feedback from community members about these proposed options so please leave us your thoughts and suggestions wherever you usually comment. We want to remind everyone to use caution when it comes to downloading user-generated content on Steam or otherwise. If you ever notice anything suspicious while using Workshop mods or while browsing the Workshop, please report it through Steam and, for PlateUp! mods, we ask that you reach out to us on Discord so we can investigate promptly.
