Claims some has been found on MakerWorld….
1 Like
One such download flagged on MakerWorld contained a ZIP file, a BLEND (editable 3D model) file, a Windows EXE file hiding a script for AutoHotkey, and a text file explaining how to “use” the download. Interestingly, no STL or 3MF file was provided with the download.
I think this says it all. Newbies need to be informed but if you’ve printed for any amount of time the lack of .stl or .3mf should be a flag. A .exe should be a big freaking flag for anyone. This shouldn’t be hard to spot and report.
13 Likes
Such an upload shouldn’t have passed verification.
Here are some suggestions, if they haven’t been implemented already.
- Basic file format verification when uploading to MW to exclude extra files
- A vigorous malware screening when:
- upload model and/or print profile
- links added to comments on MW model pages
- links used in private messages on MW
- links used on this forum and the Community tab on MW
10 Likes
Thank you for bringing this to our attention. Our MakerWorld team immediately began investigating the issue.
During our investigation, we identified several high-risk .exe files hidden within certain .zip archives uploaded to the platform. As a precaution, we strongly advise users not to open or run any untrusted .exe files, in order to protect your devices from potential malicious attacks.
We have already identified the root cause and implemented additional safeguards to prevent the upload of potentially dangerous content.
Please rest assured that the MW team is continuing to monitor the situation closely to ensure the platform remains safe for all users.
If you have any concerns or need assistance, please feel free to submit a support ticket and our team will be happy to help.
We truly appreciate your patience and understanding.
19 Likes
Bambu Lab printers and MW are for the masses. Majority of the public don’t know what an .exe file is, nor do they care to know.
But MW taking prompt action is good 
. I would suggest building up a safeguard system that is ahead of potential security risks instead of playing catch-up.
5 Likes
The one example they found on MakerWorld had an EXE. But the article explains that BLEND files can be compromised, too. So not running an EXE doesn’t necessarily protect you. Not opening BLEND files also needs to be understood.
Few if any users will even think they need to take precautions with BLEND files.
1 Like
Oh if only IT was that simple, most security is reactionary as people find ways to exploit your systems in ways you had not predicted, nothing will ever be completely safe, especially when it allows for user uploads
1 Like
Any file opened by any application can be compromised and exploited, its why teaching basic internet literacy should be part of all basic schooling, but alas it is not
1 Like
An .exe file hidden inside a zip file can be predicted.
1 Like
I`d be more concerned about the run cmd than the file itself .
The BLEND file can have an embedded script that downloads the malware invisibly. It’s not just a EXE risk.
“I’m not dumb enough to run that EXE, but… oh! Look! They also posted their Blender CAD file!” and you open it and bam! you’re toast. 
2 Likes
A long while ago, it was popular to write malware in vbscript and pack it into excel files. Now its python in blender. Whats old is new 
//over time, microsoft added lots of warnings before excel is allowed to execute vbscript
1 Like
I would suggest that “any” .exe file not be opened or run, aside from Bambu Lab issued updates to Studio. For anyone looking at content, especially new users, or those less computer/security savvy, I’d recommend sticking purely to .stl and .3mf files.
2 Likes
If you do not allow ZIP files ^^, delete them on upload.
If you do allow them, open and strip any EXE, COM, ZIP (child of parent) or other executable files.
^^ ZIP files should still be part of the Parametric Model Maker to provide local support files. This is a subject outside the scope of this topic, though.
1 Like