6 ms·

Their announcement yesterday[0] is barely half an apology. The only mistake they're admitting to is that their malware ran on all installations, when they mean

Their announcement yesterday[0] is barely half an apology. The only mistake they're admitting to is that their malware ran on all installations, when they meant for it to only run on pirates computers. Or that they got caught doing it. There's no recognition that collecting this data from [innocent until proven guilty] "pirates" was wrong. There's no confession of what they did with the data they collected, but I can only imagine it amounts to a serious infringement of global Computer Misuse Acts. Just because you think somebody didn't pay for your software doesn't give you carte blanche to anything on their computer. Again, that is almost certainly a criminal offence. [0] https://forums.flightsimlabs.com/index.php?/announcement/11-a320-x-drm-what-happened/ https://forums.flightsimlabs.com/index.php?/announcement/11-...

spyder 9y ago
And when somebody complained that anti-virus detected their malware they said it's false positive and they recommend to disable the AV: https://i.imgur.com/GTSPLDE.png https://i.imgur.com/GTSPLDE.png
deleted 9y ago
[deleted]
sah2ed 9y ago
Archive link in case the content in the original link gets retracted: http://archive.is/cRB57 http://archive.is/cRB57
rusk 9y ago
Why didn't they just build a bogey binary and seed that to the torrent sites? I've wondered why copyright holders don't do this more in general. I've seen a few cases where a downloaded movie for example just gets borked towards the end ... presumed it was deliberate and surely some form of a deterrent!
- rando444 9y ago
  If you read the article, they were attempting to target a specific person they believed was cracking their software, not the pirates themselves.
  - guy98238710 9y ago
    That's doubly stupid. Every capable hacker is going to run the software in a VM or on a separate computer.
    - iancarroll 9y ago
      In fairness, there are an incredible amount of incompetent “hackers”.
      - malnourish 9y ago
        I would like to see the incompetent hackers who can reverse engineer and break non-trivial copy protection. I'm sure they exist, but I would imagine there's not an "incredible" amount meeting said criteria.
      - brazzledazzle 9y ago
        Also to be fair those are more often than not just someone using exploits someone much more capable found. Also to be fair, even if the cracker wasn’t paranoid I expect doing it in a VM is much more convenient since you can trivially reset your environment.
    - stingraycharles 9y ago
      They would only have to make one mistake and would be exposed. You would be surprised how often that happens.
      - p49k 9y ago
        Reminds me of a great episode of Reply All: https://www.gimletmedia.com/reply-all/21-hack-the-police https://www.gimletmedia.com/reply-all/21-hack-the-police
- robterrell 9y ago
  When my shareware was pirated and posted on torrent sites, but had a fairly low number of seeds, I forked transmission and changed the source to give out bad checksums, so that downloaders would never see their downloads complete. I figured I would run this on a bunch of computers and become the top seeds and peers and ensure that few downloads ever finished. It did not take long for me to realize how crazy I was being over this. My time was better spent improving the software and focusing on customers who would pay.
  - throwawaysecops 9y ago
    We manifest what we see in ourselves.
  - endless1234 9y ago
    You might even have caused lost sales, depending on your software's business model.
HenryBemis 9y ago
Oh and thank you for hiding a loaded gun into your clients PCs. Now all a black hat needs #todo is to find a a way to activate said gun with not much effort since it already has its hooks in. Disclaimer: I don't know the exact implementation, but this stinks from every angle you approach this.
dkersten 9y ago
Also, just because the pirate broke the law doesn’t mean that stealing their passwords or otherwise doing something nefarious isn’t equally or more illegal.
- patcheudor 9y ago
  The last time I checked, it's not okay to commit a felony in the pursuit of a felon. I can't imagine this underwent anything close to a legal review before it was implemented. Did they honestly think they'd get the pirates credentials, then authenticate with the pirates accounts in an attempt to uncover their real identity and not understand that crosses some major ethical and legal boundaries? I don't think it would be an exaggeration to say that their 'solution' was in itself criminal.
  - Wohlf 9y ago
    Only police are allowed to commit what would normally be crimes in the act of pursuing criminals, and even then these cases are limited. The only exception I can think of for normal people is self defense, which is not always legal.
    - gnode 9y ago
      There's also the concept of a citizen's arrest. Although I doubt this can be broadened to include vigilantism by malware.
- ProAm 9y ago
  It's a straight violation of the CFAA [1]. There is going to be a few lawsuits for this one. [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
  - gnode 9y ago
    Or a criminal indictment, I would hope.

spyder 9y ago

And when somebody complained that anti-virus detected their malware they said it's false positive and they recommend to disable the AV: https://i.imgur.com/GTSPLDE.png https://i.imgur.com/GTSPLDE.png

deleted 9y ago

[deleted]

sah2ed 9y ago

Archive link in case the content in the original link gets retracted: http://archive.is/cRB57 http://archive.is/cRB57

rusk 9y ago

Why didn't they just build a bogey binary and seed that to the torrent sites? I've wondered why copyright holders don't do this more in general. I've seen a few cases where a downloaded movie for example just gets borked towards the end ... presumed it was deliberate and surely some form of a deterrent!

rando444 9y ago
If you read the article, they were attempting to target a specific person they believed was cracking their software, not the pirates themselves.
- guy98238710 9y ago
  That's doubly stupid. Every capable hacker is going to run the software in a VM or on a separate computer.
  - iancarroll 9y ago
    In fairness, there are an incredible amount of incompetent “hackers”.
    - malnourish 9y ago
      I would like to see the incompetent hackers who can reverse engineer and break non-trivial copy protection. I'm sure they exist, but I would imagine there's not an "incredible" amount meeting said criteria.
    - brazzledazzle 9y ago
      Also to be fair those are more often than not just someone using exploits someone much more capable found. Also to be fair, even if the cracker wasn’t paranoid I expect doing it in a VM is much more convenient since you can trivially reset your environment.
  - stingraycharles 9y ago
    They would only have to make one mistake and would be exposed. You would be surprised how often that happens.
    - p49k 9y ago
      Reminds me of a great episode of Reply All: https://www.gimletmedia.com/reply-all/21-hack-the-police https://www.gimletmedia.com/reply-all/21-hack-the-police
robterrell 9y ago
When my shareware was pirated and posted on torrent sites, but had a fairly low number of seeds, I forked transmission and changed the source to give out bad checksums, so that downloaders would never see their downloads complete. I figured I would run this on a bunch of computers and become the top seeds and peers and ensure that few downloads ever finished. It did not take long for me to realize how crazy I was being over this. My time was better spent improving the software and focusing on customers who would pay.
- throwawaysecops 9y ago
  We manifest what we see in ourselves.
- endless1234 9y ago
  You might even have caused lost sales, depending on your software's business model.

HenryBemis 9y ago

Oh and thank you for hiding a loaded gun into your clients PCs. Now all a black hat needs #todo is to find a a way to activate said gun with not much effort since it already has its hooks in. Disclaimer: I don't know the exact implementation, but this stinks from every angle you approach this.

dkersten 9y ago

Also, just because the pirate broke the law doesn’t mean that stealing their passwords or otherwise doing something nefarious isn’t equally or more illegal.

patcheudor 9y ago
The last time I checked, it's not okay to commit a felony in the pursuit of a felon. I can't imagine this underwent anything close to a legal review before it was implemented. Did they honestly think they'd get the pirates credentials, then authenticate with the pirates accounts in an attempt to uncover their real identity and not understand that crosses some major ethical and legal boundaries? I don't think it would be an exaggeration to say that their 'solution' was in itself criminal.
- Wohlf 9y ago
  Only police are allowed to commit what would normally be crimes in the act of pursuing criminals, and even then these cases are limited. The only exception I can think of for normal people is self defense, which is not always legal.
  - gnode 9y ago
    There's also the concept of a citizen's arrest. Although I doubt this can be broadened to include vigilantism by malware.
ProAm 9y ago
It's a straight violation of the CFAA [1]. There is going to be a few lawsuits for this one. [1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act
- gnode 9y ago
  Or a criminal indictment, I would hope.