Unity устранила в играх для Android уязвимость, опасную для пользователей криптовалют

cryptonews.ruPublicado em 2025-03-06Última atualização em 2025-10-07

Компания Unity Technology устранила уязвимость, которая позволяла запускать сторонний код в мобильных играх на базе Android. На прошлой неделе некоторые эксперты предупреждали, что это может представлять опасность для пользователей криптовалют.

В пятницу Unity заявила, что выпустила исправления безопасности для устранения уязвимости в игровом движке, обнаруженной в июне.

Директор сообщества Unity Technologies Ларри «Майор Нельсон» Гриб опубликовал предупреждение об обновлении безопасности. В нем он объяснил, что уязвимость может позволить локальное выполнение кода и «доступ к конфиденциальной информации на устройствах конечных пользователей, на которых запущены приложения, созданные на основе Unity».

Он добавил, что нет никаких доказательств использования уязвимости, «и не было никакого воздействия на пользователей или клиентов».

Ошибка затронула проекты, созданные еще в 2017 году. Речь идет о приложениях для мобильной платформы Android, а также играх, работающих на Windows, macOS и Linux.

Unity просит разработчиков загрузить исправленный редактор

Unity рекомендовала разработчикам загрузить исправленное обновление Unity Editor перед следующей сборкой. Также компания предложила пересобрать все выпущенные игры с исправленным редактором и повторно опубликовать их, чтобы пользователи могли обновиться.

«Unity предоставляет разработчикам приложений патч для исправления этой проблемы, и разработчикам следует немедленно обновить свои приложения», — сообщил представитель Google.

Мобильным геймерам он рекомендовал обновить свои устройства, включить автоматические обновления и использовать актуальное антивирусное программное обеспечение.

Исследователь GMO Flatt Security RyotaK, описавший эту уязвимость, заявил, что она позволяет вредоносным приложениям, установленным на том же устройстве, перехватывать разрешения, предоставленные приложениям Unity. Это можно использовать удаленно для выполнения произвольного кода.

Microsoft выпустила исправления для игр, созданных с помощью Unity

В пятницу компания Microsoft также выпустила предупреждение о безопасности. В нем говорится, что команды разработчиков игр для Windows работают над обновлением всех игр и приложений, потенциально подверженных этой уязвимости. При этом консольные игры не затронуты.

Защитник Windows также был обновлен для обеспечения защиты, а системы защиты от вредоносных программ в Android были улучшены.

По словам Неовина, разработчики игр, такие как Obsidian Entertainment, временно удалили несколько игр из всех цифровых магазинов, пока идет работа над исправлением. Тем временем, по данным GameRant, работа над устранением уязвимости продолжается.

Unity — ведущая в отрасли платформа инструментов для разработчиков, позволяющая создавать и развивать игры и приложения в реальном времени на различных платформах. Она поддерживает более 70% из тысячи самых популярных мобильных игр.

Leituras Relacionadas

Ethereum down 45% YTD – So why do SharpLink and whales keep buying?

Despite Ethereum (ETH) being down 20-45% year-to-date amid broader crypto weakness, institutional and whale buying activity suggests growing long-term conviction. SharpLink, after an eight-month pause, purchased 5,000 ETH and later added $45.54 million in LSETH, increasing its total holdings significantly despite substantial unrealized losses. Similarly, a new whale wallet accumulated over 18,000 ETH worth $28.9 million in nine days, indicating strategic positioning for future price movements rather than short-term trading. However, this accumulation contrasts with spot Ethereum ETFs, which saw net outflows of $12.85 million recently, highlighting a divergence between direct treasury/whale buyers and ETF investors. While the persistent buying from these large holders may gradually ease selling pressure, a sustained recovery for Ethereum still depends on a reversal in ETF flows and a broader improvement in network demand and market sentiment.

ambcryptoHá 3h

Ethereum down 45% YTD – So why do SharpLink and whales keep buying?

ambcryptoHá 3h

Just now, DeepSeek V4 updates with DSpark, improving inference speed by 80%

DeepSeek has updated its DeepSeek V4 model with the DSpark speculative decoding framework, achieving a significant 60-85% speedup in generation for Flash models and 57-78% for Pro models while maintaining the same overall throughput. This engineering-focused update, rather than a core architectural change, introduces DSpark to address latency and throughput bottlenecks in high-concurrency production environments. DSpark combines high-throughput parallel generation with adaptive load-aware verification. Its key innovations include a semi-autoregressive generation architecture to model dependencies within token blocks and a hardware-aware confidence-scheduled verification system. This system uses a confidence head to predict token acceptance probabilities, allowing it to dynamically optimize verification length per request and allocate compute only to tokens with the highest expected payoff. The asynchronous scheduler is designed for real-world deployment, ensuring zero-overhead scheduling and continuous CUDA graph replay while preserving the target model's output distribution. In tests across mathematical reasoning, code generation, and daily dialogue, DSpark outperformed state-of-the-art models like Eagle3 and DFlash, increasing average acceptance length by 26.7%-30.9% and 16.3%-18.4% respectively on Qwen3 target models. DeepSeek also open-sourced DeepSpec, a full-stack codebase for training and evaluating speculative decoding draft models, providing a standardized toolkit that includes data preparation tools, model implementations, training code, and evaluation scripts.

marsbitHá 4h

Just now, DeepSeek V4 updates with DSpark, improving inference speed by 80%

marsbitHá 4h

Can Aavenomics 3.0 sustain AAVE’s recovery rally amid Kraken buyout talks?

Aave Labs CEO Stani Kulechov has dismissed reports of a potential stake sale to Kraken, clarifying that Aave would not sell at a significant discount. He highlighted Aave's substantial annualized revenue and its focus on a broad financial market. Kulechov also announced plans for Aavenomics 3.0, featuring a new automated buyback mechanism. Following these updates, the AAVE token price surged 12%, extending its June recovery rally to over 50% from its recent lows. The rally is partly attributed to reduced selling pressure and positive sentiment from the announced tokenomics plan, despite the token remaining significantly below its all-time high.

ambcryptoHá 5h

Can Aavenomics 3.0 sustain AAVE’s recovery rally amid Kraken buyout talks?

ambcryptoHá 5h

BIT Research: The 2028 Halving Is Not the End, the Real Shake-Up of the Bitcoin Mining Industry Is Just Beginning

The Bitcoin mining industry is undergoing its most complex structural adjustment since inception. Despite Bitcoin's price holding near $61,000 and the network hash rate approaching a record 1 ZH/s, miner profitability is deteriorating. The industry is operating close to its breakeven point, with the 2028 halving expected to accelerate consolidation. The challenges extend beyond the halving's subsidy reduction; the industry's revenue model has yet to successfully transition towards a fee-driven structure. Increasingly, mining companies are evolving from simple Bitcoin producers into infrastructure and energy operators, including providers of AI/HPC computing power. Competition is shifting from pure hash rate expansion to business model upgrades. Economic pressure is evident. The theoretical daily mining revenue at current prices is around $78 million, yet the actual figure is only about $33 million—a 136% gap. Transaction fees remain low at roughly $220k daily, far below historical implied levels. With a current estimated industry-wide breakeven price near $65,000, mining alone is struggling to generate ideal profits. The 2028 halving is projected to push the fundamental production cost floor to approximately $93,289. This will likely accelerate a shift towards consolidation among larger, well-capitalized miners with diversified revenue streams. Competitive advantage will belong to institutionalized players with access to low-cost energy, AI/HPC hosting operations, and stronger balance sheets. In essence, Bitcoin mining is transitioning from a "mining business" to an "infrastructure business." Future profitability and resilience will depend less on block rewards and more on diversified income sources like energy management and computational infrastructure services. For investors, the key question is not the halving itself, but which miners can successfully navigate this business model transformation.

marsbitHá 6h

BIT Research: The 2028 Halving Is Not the End, the Real Shake-Up of the Bitcoin Mining Industry Is Just Beginning

marsbitHá 6h

This is How God Karpathy Uses Claude?

Andrej Karpathy, a prominent figure in AI, has reportedly joined Anthropic, leading to a noticeable decrease in his open-source contributions and social media activity. A document claiming to be his personal "CLAUDE.md" file—a set of instructions for the Claude AI to follow within a specific codebase—has been circulating online. While its authenticity is unverified, the content aligns closely with Karpathy's publicly shared principles on effective AI-assisted programming. The document outlines key rules for AI coding assistants, emphasizing the importance of reading existing code thoroughly before writing new code to maintain consistency. It advises against over-engineering, advocating for simple, surgical modifications that match the project's existing style. Other guidelines include clarifying assumptions upfront, writing meaningful tests, thoughtful debugging, and carefully considering dependencies. The core message is that these principles help prevent common AI coding failures, such as introducing unnecessary abstractions, style drift, or making invisible architectural decisions. The community has noted that even experts like Karpathy require detailed instructions to guide AI effectively, akin to managing a junior developer. A related GitHub repository, "andrej-karpathy-skills," which encapsulates these ideas, is reported to significantly reduce Claude's code error rate. Ultimately, the advice stresses that the best CLAUDE.md is tailored to one's own tech stack and coding practices.

marsbitHá 6h

This is How God Karpathy Uses Claude?

marsbitHá 6h

Trading

Spot
活动图片

Categorias popularesright-arrow

Etiquetas Popularesright-arrow