27 ms·
Flight Sim Company Embeds Malware to Steal Pirates’ Passwords
- stryk 9y agoOK, so what were they going to do with the evil cracker's passwords.... steal from him? I'm no lawyer but how in the hell is this not a felony? They intentionally distributed malware that steals passwords. Jesus christ, some people, man... some people...
- Y_Y 9y agoNot only that, but such any "evidence" acquired by this route would surely be inadmissible. You aren't allowed to break the law just because you think someone else might have done it first.
- rbf 9y agoFYI there are only some countries where evidence is inadmissible solely because it is aquired illegaly (eg in the United States, but not most of Europe AFAIK). Not that I in any way condone what this company have done.
- skissane 9y agoEven in the US, the exclusionary rule only protects you against illegal evidence acquisition by the government. If a private party illegally gathers evidence against you (without any government prompting), that is admissible. See for instance Burdeau v. McDowell [1]. Another interesting case on this topic is Sackler v. Sackler [2], where the New York State Court of Appeals held that evidence illegally gathered by private investigators (working for one of the divorcing spouses) was admissible in divorce proceedings. [1] https://scholar.google.com/scholar_case?case=10755134066232305233&hl=en&as_sdt=6&as_vis=1&oi=scholarr https://scholar.google.com/scholar_case?case=107551340662323... [2] https://scholar.google.com/scholar_case?case=641943334909742610&hl=en&as_sdt=6&as_vis=1&oi=scholarr https://scholar.google.com/scholar_case?case=641943334909742...
- letsgetphysITal 9y agoThat's true. However, using credentials harvested in this way is almost certainly going to constitute unauthorised access of a computer system and a breach of the Computer Misuse Act.
- michaelt 9y agoOK, so what were they going to do with the evil cracker's passwords.... steal from him? Presumably get access to invitation-only torrent sites? To distribute more malware / gather IP addresses for prosecution?
- stryk 9y agoBy giving the same malware to all their customers??? And all those people are supposed to just take their word for it that they didn't use it on everyone else? This is about as non-frivolous as a lawsuit can get. if I'm the customers of this product I would sue them into the ground, there's no way they take this to court. And with that public statement they made flat-out admitting to it's use that's evidence at this studio's boss' criminal proceedings. What kind of goddamned morons OK the use of a tactic like this?
- squarefoot 9y agoGet their Paypal credentials and pay for the game using fake purchases?
- chrisper 9y agoAnd then get shutdown by PayPal for violating the ToS by transferring money into your own account unauthorized. How would that help?
- chillingeffect 9y agoThreaten them personally. By locking them out of accounts or worse. It sounds like they were going after an individual extrajudicially.
- softawre 9y agoReading the linked articles above it says they used it to get into an invite-only site to figure out exactly who the cracker was. They don't say exactly why they want to do that.
- aclelland 9y agoI work at a games company, I get that hackers take up an enormous amount of developer work but reading this article made my jaw hit the floor. This couldn't have been a single developer making the decision. There must have been multiple levels of management involved and no-one saw the legal or moral issues? To make matters worse, the additional statement at the bottom of the article they outright admit they used the tool and it wasn't a mistake: >We found through the IP addresses tracked that the particular cracker had used Chrome to contact our servers so we decided to capture his information directly
- Y_Y 9y agoThey must have backtraced it. IP addresses ending in a 5 are chromes.
- deleted 9y ago[deleted]
- dx034 9y agoI think it's a small shop, probably only a few developers working there. That said, it's likely everyone knew about this. Not sure if that can get employees into trouble in case of a criminal investigation (installing malware on computers without the user's knowledge is likely illegal even if you don't use it).
- slivym 9y ago>In a nutshell, FlightSimLabs installed a password dumper onto ALL users’ machines, whether they were pirates or not, but then only activated the password-stealing module when it determined that specific ‘pirate’ serial numbers had been used which matched those on FlightSimLabs’ servers. We installed spyware on your PC, but trust us, we didn't use it, we only used it on the people we didn't like... >“This method has already successfully provided information that we’re going to use in our ongoing legal battles against such criminals,” Kalamaras revealed. We're going to introduce documents into a legal process that were obtained through illegal means and hope we don't get counter-sued. It looks like once again, a gaming company has decided to stop working on making games, and start working on a convoluted game of cat and mouse with unemployed anonymous nerds. What could go wrong...
- moviuro 9y ago> We installed spyware on your PC, but trust us, we didn't use it, we only used it on the people we didn't like... And, yes, your AV is showing a false positive ;) [0] Also, piracy doesn't seem to have a huge impact (if any) on sales[1] [0] https://www.fidusinfosec.com/wp-content/uploads/2018/02/Oct-2017.png https://www.fidusinfosec.com/wp-content/uploads/2018/02/Oct-... , from https://www.fidusinfosec.com/fslabs-flight-simulation-labs-dropping-malware-to-combat-piracy/ https://www.fidusinfosec.com/fslabs-flight-simulation-labs-d... [1] https://juliareda.eu/2017/09/secret-copyright-infringement-study/ https://juliareda.eu/2017/09/secret-copyright-infringement-s... https://juliareda.eu/wp-content/uploads/2017/09/displacement_study.pdf https://juliareda.eu/wp-content/uploads/2017/09/displacement... see page 79 for games
- ravingraven 9y agoI'm pretty sure that piracy does have a huge impact on sales for niche addons and games like that. The client base is very very small and anything that is not absolutely perfect quality does not get sold these days (seriously, look at the quality and effort that has gone into some PMDG planes or the ixeg 737, it's astounding). Small client base plus very good quality equals, everyone must pay their share for the product to be viable. That being said, what FSLabs did is of course inexcusable.
- JorgeGT 9y ago> We found through the IP addresses tracked that the particular cracker had used Chrome to contact our servers so we decided to capture his information directly The issue is that IP/computer != single person. If they dump and steal the Chrome credentials of the computers using pirated serials, they are most probably stealing the credentials of law-abiding partners, parents, siblings, children, etc. who also use that computer. Which is, of course, illegal. In fact, probably more serious offence than copyright infringement, if these credentials are related to protected information such as financials, healthcare, etc.
- shaki-dora 9y agoNo, the problem is that even copyright-infringing people enjoy the protection of the law, and that it's illegal to distribute malware. Also note that receiving a pirated copy is not a crime in most jurisdictions I know, just a civil law injury. Stealing their passwords, however, is a crime.
- jopsen 9y agoAlso as far as I can see he was just cracking it to build a serial generator... I'm not sure that's even illegal to distribute, since there is no copyright violation. There are some places that forbid breaking DRM, but telling other people how to break DRM is even weaker.
- 24gttghh 9y ago>The issue is that IP/computer != single person. This brings up a thought I've had lately: The endgame of IPv6 -let's say, 100% adoption, and the retirement of IPv4- will be IPv6=single device, no? I would think that ends (in however many years it takes to get there) what little anonymity IPv4 currently provides.
- teraflop 9y agoIn principle the situation isn't that different from IPv4. A device on an IPv6 network can cycle through a series of random "temporary addresses" which it generates itself, without contacting a DHCP server. Someone who gets your IPv6 address can track it down to a specific network, but there's no record of which device on that network initiated it, similar to IPv4+NAT. (A couple of caveats. One is that attackers can still correlate different connections within a short period of time, between temporary address rotations. Another is that temporary address support is broken on some Windows versions, so you may be leaking your MAC address all over the ace without knowing it.)
- moviuro 9y agoSo... stop trusting the game industry, I guess? We probably should run our games in containers. Anyone got an idea about how to do this? Isolate Steam/Origin/Games into their own little sandbox
- carlmr 9y agoI have a dual boot system, my windows is my container for games :D.
- John_KZ 9y agoI hope you at least encrypt the other system. To be actually secure you have to have 2 completely disconnected drives.
- carlmr 9y agoIt's a single drive, not so secure. I wasn't really serious on my previous post.
- chrisper 9y agoI think it is safe enough for the common Windows malware such as this one.
- chopin 9y agoI am not sure if it is that bad. If your Linux partition is some file system unknown to Windows (like ext3), it'd be very hard to come by from a running Windows image (at least for Win7, where I had problems doing this).
- John_KZ 9y agoThe first thing that needs to be done is criminally charge the company. If their CEO goes to jail, corporate people will be more reserved about distributing malware. As far as isolating software, there are a few possibilities, but sandboxing doen't always work. VMs are the way to go for now, but they're not foolproof either, and they come with a myriad of downsides.
- alkonaut 9y agoAside from this being a terrible decision on their part alltogether, why did they bundle malware? It means that legitimate customers get a program installed that at least potentially shows up as malware. That in itself is bad enough. This is a desktop program, if they wanted to perform something bad on a condition, why not just code it in their own program? The chrome browser history and password db could just be decrypted and uploaded, for example. It's exactly the same thing and just as bad, but at least they didn't install third party malware that shows up in AV, at their paying customers. It's also MUCH easier to deny since at the legitimate users there is neither any suspicious signature, nor any suspicious network activity.
- draw_down 9y agoWhat’s the difference?
- dod9er 9y agoIt always comes down to "You have nothing to fear if you have nothing to hide", "Just trust us and our ability to keep off free-riders" Once again I really would like to stop giving admin-privileges to any windows-app that I would like to use... but otherwise, I couldn´t do anything with this piece of hardware :)
- mnw21cam 9y agoThe kicker is that it doesn't actually need admin privileges to read your chrome password store.
- detaro 9y agopreviously: https://news.ycombinator.com/item?id=16412541 https://news.ycombinator.com/item?id=16412541 and https://news.ycombinator.com/item?id=16416401 https://news.ycombinator.com/item?id=16416401
- yAnonymous 9y agoWhat happens when your key is simply stolen and posted online? They think that grants them the right to spy on all your passwords. Where is the company, Flight Sim Labs Ltd., registered? It's difficult to find an address. They also removed info from their About page. From their posts it looks like they might be in the Netherlands. Anyway, I'll contact the FBI and local authorities about this if I can find out what jurisdiction they're in and I hope others do the same. This crap is absolutely unacceptable.
- pbhjpbhj 9y agoIf the company cause the malware to be installed in your country, eg by bundling it with customer software for customers in your country, then the corresponding jurisdiction is almost certainly your own country. There's a history of extradition to USA from UK for relatively minor unauthorised access; this seems pretty major in comparison.
- Mashimo 9y agoThe password stealer was not triggered by a wrong CD key.
- JumpCrisscross 9y agoLittle trick for finding a company’s legal jurisdiction: see who they are in their privacy policy or terms of services. The lack of these policies is a red flag. The forum where the CEO makes his statement raises this red flag [1]. The CEO’s LinkedIn Page says he is Greek. “Flight Sim Labs” produces no hits in the Athenian corporate registry [2]. I did find a Flight Sim Limited in the U.K., but registered to a different person [3]. This British Flight Sim Ltd was formed about a month ago. TL; DR Consider whether you, or customers like you, have legal recourse before executing someone’s blob. [1] https://forums.flightsimlabs.com/index.php?/announcement/11-a320-x-drm-what-happened/ https://forums.flightsimlabs.com/index.php?/announcement/11-... [2] http://www.acci.gr/acci/shared/index.jsp http://www.acci.gr/acci/shared/index.jsp [3] https://beta.companieshouse.gov.uk/company/11142081/officers https://beta.companieshouse.gov.uk/company/11142081/officers
- ckastner 9y agoThe privacy policy [4] does not appear to be linked from the homepage, but you can reach it through search. It's devoid of any meaningful content, though. The company appears to be a shell registered in Cyprus [5]. The address on an older SSL certificate [6] matches the one in the registry. [4] http://www.flightsimlabs.com/index.php/privacy-policy/ http://www.flightsimlabs.com/index.php/privacy-policy/ [5] https://efiling.drcor.mcit.gov.cy/DrcorPublic/SearchForm.aspx?sc=0 https://efiling.drcor.mcit.gov.cy/DrcorPublic/SearchForm.asp... (search for "flight", 2nd page. Can't link to it directly, apparently) [6] http://www.herdprotect.com/signer-flight-sim-labs-ltd-020d1789c5d944369ac8a5d647cf84c5.aspx http://www.herdprotect.com/signer-flight-sim-labs-ltd-020d17... (link fixed, sorry)
- dx034 9y agoAs they accepted payments through paypal, it'll be easy for law enforcement to track down the owner. PayPal is very cooperative in these cases (as any bank). A shell company won't help them if someone knows where they have their office. The criminal offence isn't against the company anyway, it'll be against natural persons working for the company. But the worst that can happen for them short term is that PayPal (and credit card vendors if they use them) block their account if they get too many charge backs as a result of that.
- skate22 9y agoI remember in 7th grade i de compiled the client of a private server version of a popular video game for a learning experience. When sifting through the files i found a method called 'fillHDD' which would recursively create files to fill your HD. I imagine this method was called when people were caught cheating.
- zbentley 9y agoThat's possible, but it's also possible that it was there for testing: run a test function that fills up the HD and try to save a game in order to make sure that game-saving errors show up properly.
- skate22 9y agoThis was for an mmorpg, all the state data for a player was stored server side, but this was a client side function
- HenryBemis 9y ago>we have his name available upon request of any authorities" When someone is stealing from me, or causing harm to my business and my clients using my products, damaging my reputation, then I go to the Police, I don't wait for them to read an article on torrentfreak.com or the comments section in HN (which I think any security angency worth its salt must have an eye in here too). I'm going to help them out!!!!! Hey FSLabs people!!! FBI website is https://www.fbi.gov/contact-us/ https://www.fbi.gov/contact-us/ (these guys know their e-crime stuffs, they can help you out!) Lefteris Kalamaras is definitely Greek, so.. http://police.gr/ http://police.gr/ (I hear they got a decent e-crime fighting unit over there) (don't say I never did anything for you FSLabs, and NO I don't want a free copy of your game on my PC)
- Shengbo 9y agoThis reads like an article you'd encounter on The Onion. >“[T]here are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products. We all realize that you put a lot of trust in our products and this would be contrary to what we believe. Ok, so I guess there's no malware in the official downloads then. >“Test.exe is part of the DRM and is only targeted against specific pirate copies of copyrighted software obtained illegally. That program is only extracted temporarily and is never under any circumstances used in legitimate copies of the product,” Well, nevermind then. >“This method has already successfully provided information that we’re going to use in our ongoing legal battles against such criminals,” That's easily the stupidest thing I've read this week. Are they so oblivious to how legal systems work that it didn't even occur to them to consult a lawyer before attempting to distribute malware and steal people's information?
- titzer 9y agoNot OK. Private enterprises should not be engaging in this kind of espionage against criminals. In meatspace, this is why there are police. Why don't we have cyberpolice?
- JumpCrisscross 9y ago> Why don't we have cyberpolice? Most law enforcement agencies have e-crimes, digital crimes, Internet crimes, et cetera divisions.
- titzer 9y agoI've never dealt with the police regarding e-crimes. Do they have capable detectives in this area? I bet it varies widely.
- deckar01 9y agoWhen is the last time you had theft resolved by local police? I never have. My local police don't even have the resources to collect security system footage from adjacent properties. Even if they did, they told me their job is to gather evidence for criminal charges not help me get my stuff back. Hire a private detective. Hire a private security firm. Do it yourself, because no else is going to do it for you unless you pay them to.
- hnal943 9y agoJurisdiction is an issue in cyberspace. It's hard for someone to steal your physical stuff from the other side of the world.
- TomK32 9y agoNext time when making a pirate game that gets pirated, add a routine to use the pirate's webcam for a mugshot and use that mugshot throughout the pirate game for the baddies. Just a thought.
- oliwarner 9y agoTheir announcement yesterday[0] is barely half an apology. The only mistake they're admitting to is that their malware ran on all installations, when they meant for it to only run on pirates computers. Or that they got caught doing it. There's no recognition that collecting this data from [innocent until proven guilty] "pirates" was wrong. There's no confession of what they did with the data they collected, but I can only imagine it amounts to a serious infringement of global Computer Misuse Acts. Just because you think somebody didn't pay for your software doesn't give you carte blanche to anything on their computer. Again, that is almost certainly a criminal offence. [0] https://forums.flightsimlabs.com/index.php?/announcement/11-a320-x-drm-what-happened/ https://forums.flightsimlabs.com/index.php?/announcement/11-...
- spyder 9y agoAnd when somebody complained that anti-virus detected their malware they said it's false positive and they recommend to disable the AV: https://i.imgur.com/GTSPLDE.png https://i.imgur.com/GTSPLDE.png
- deleted 9y ago[deleted]
- sah2ed 9y agoArchive link in case the content in the original link gets retracted: http://archive.is/cRB57 http://archive.is/cRB57
- rusk 9y agoWhy didn't they just build a bogey binary and seed that to the torrent sites? I've wondered why copyright holders don't do this more in general. I've seen a few cases where a downloaded movie for example just gets borked towards the end ... presumed it was deliberate and surely some form of a deterrent!
- rando444 9y agoIf you read the article, they were attempting to target a specific person they believed was cracking their software, not the pirates themselves.
- ashelmire 9y agoThe conclusion of this article seems to directly contradict that company’s statement, while using the joining clause “in other words”. Seriously, go back and read that with some skepticism. This is obviously a hit piece with no journalistic integrity. Some user downloaded an illegal copy that had malware and is trying to blame the company, when that malware doesn’t appear for legitimate copies. Don’t want malware? Don’t steal software hat could have been tampered with.
- mavdi 9y agoErm from what I'm reading it sure looks like they included what is practically a trojan in their software that only got activated when a pirated copy was detected. Obviously exposing their users to a whole set of new security attack surface.
- Nicksil 9y agoThe malware was included within every installation and supposedly deleted only after a legitimate software key was installed thereafter. So, regardless of whether you pirated the software, it was indeed installed on your system without your consent.
- DC-3 9y agoFor whatever reason, Flight Sim companies are some of the most customer-hostile software companies out there.
- qwerty456127 9y agoJust don't let an application to connect to the Internet unless you actually want it to (i.e. I would only allow the browser, the SSH client and the messenger). Good news this policy is rather easy to implement on Windows (Sphinx Windows 10 Firewall Control and many alternative application firewalls), Mac (Little Snitch) and Android (DroidWall, XPrivacy). Bad news it seems quite hard to implement on GNU/Linux desktops (I don't know about any practical solutions).
- throwawaymanbot 9y agoThis violates a few laws.... Someones at that company is going to be in jail for this.
- RandomCSGeek 9y agoI don't understand what the use of anti-piracy measures is. Most pirates are those who won't pay for the software anyway. If an AAA game doesn't get cracked, most people would simply get another cracked game and play it. So companies aren't getting anything from anti-piracy measures. Rather, they are wasting time and money on implementing these measures. If I were to make a software, I'd keep it DRM free. Maybe I'll give occassional discounts to attract people who won't pay otherwise, but that's it.
- nugi 9y agoYes, but that leaves a lot in the hands of the market. That terrifies anyone with their ass on the line. Also, deliberately not drm'ing your product could be seen in some legal situations as failing to protect your IP, making seeking damages more difficult when wronged. But business pressures aside, I do avoid DRM encumbered products and I direct my clients to as well in most cases. You ARE hurting your bottom line with DRM.
- Raphmedia 9y agoI am a flight sim enthusiast. I have joysticks, a track-IR setup, a VR headset and a dedicated space for such simulation games. Let me say loudly that I will never download any software from flightsimlabs.com anymore and that any copy of their software I might have had has been nuked to hell. The second you admit to adding a keylogger to your software is the second I lose all trust in you.
- bawana 9y agoBrave new world. The new model to enforce compliance - steal valuable customer info which will be used to make the customer's life hell if he/she does not comply. Pre-emptive hostage taking as a security model?
- rootlocus 9y agoAnyone else wondering why they had to use a cheap "test.exe" that is flagged by malware websites instead of embedding the code (possibly write it from scratch) into their binary?
- kseifried 9y agoI have requested a CVE for this, due to unsafe password storage (CWE-256).
- kseifried 9y agoAh it got a CVE yesterday: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7259 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7259