Now also with flight simulators: Installing malware on customer computers

[ZachariasX]

Certainly an interesting way to combat piracy, this time by FSLabs Flight Simulation Labs. Install their product and get a Chrome password stealer along with it to monitor the paying customer.

 

Read about the misery here:

https://www.fidusinfosec.com/fslabs-flight-simulation-labs-dropping-malware-to-combat-piracy/

 

Some geeks truly have no sense for the law. But on the other hand they ask the law to defend them.

[sinned]

Sounds about right justice served to pirate users. No issues.

[CanadaOne]

Give it a few years and every time you connect to the web, you will have to submit to a warrantless search of all your data to make sure you don't have a copyright infringing version of Police Academy 5 somewhere on your HD.

 

Freedom and private property? That's sooooo yesterday.

[=LD=Hethwill]

Freedom of acquiring privately owned property by legal means

 

- but -

 

The method shown in the OP is wrong, there's much better options for any software house. They cannot be the judges and simply "extract data" like that - now they MUST come before the community and announce WHY and HOW they will use the extracted data that is in no way associated with the product. 

[ZachariasX]

Give it a few years and every time you connect to the web, you will have to submit to a warrantless search of all your data to make sure you don't have a copyright infringing version of Police Academy 5 somewhere on your HD.

 

Freedom and private property? That's sooooo yesterday.

/confession mode

 

I acutally have that movie on DVD. Whether the publisher really was not infringing any copyright, that I don‘t know. So still waiting for my door bell to be rung at 4 am.

 

/confession mode off

[Pupo]

This is a very severe offense, and I really hope those guys get a nice lawsuit. 

 

That being said, this topic as nothing to do with BoX (fortunately), so we should consider continuing this discussion somewhere else.

[Mitthrawnuruodo]

Sounds about right justice served to pirate users. No issues.

 

 

What exactly do they hope to accomplish with stolen info from the pirate users? It's usually not a good idea to approach authorities unless your methods are clean. The potential for legal complications is too high. 

 

It's unbelievable that they're willing to scare away paying customers to facilitate their fight against largely imaginary losses to pirates. 

[Livai]

Nothing new in DCS World with his "p51_protect.dll, bf109_protect.dll...................whatever..........................."

[ZachariasX]

This is a very severe offense, and I really hope those guys get a nice lawsuit. 

 

That being said, this topic as nothing to do with BoX (fortunately), so we should consider continuing this discussion somewhere else.

You’re right, I should maybe have put this thread in the „Free Subject“ section. Maybe a moderator can take care of that

[ZachariasX]

Sounds about right justice served to pirate users. No issues.

Sho thang, bro. That is why we also better deactivate our virus scanner for installing „trusted software“. For your convenience:

https://forums.flightsimlabs.com/index.php?/announcement/10-a320-x-drm-clarification/

 

If your imagination about unducumented loggers enclosed in software (that is even run with system priviledges) do not bring you beyond the convenience of „a takedown on pirates“, fine. But don‘t assume that this is the case with most others. Especially people making and using such software.

[CanadaOne]

Freedom of acquiring privately owned property by legal means

 

- but -

 

The method shown in the OP is wrong, there's much better options for any software house. They cannot be the judges and simply "extract data" like that - now they MUST come before the community and announce WHY and HOW they will use the extracted data that is in no way associated with the product. 

 

The point being that even if the property is acquired by legal means, the property owner is now to be considered a "criminal in waiting" in that he may/must be supervised after - and perhaps in perpetuity - he has legally acquired the property.

 

Added to this is that not only will the owner of the private property be supervised after the fact, regarding how he uses what he bought and owns, but the method by which he will be supervised is on his own computer, hidden from him and beyond his control. And if someone were to tell him where those things are hidden on his computer, it would be illegal.

 

It's going to get worse before it gets better.

[=LD=Hethwill]

 

 

It's going to get worse before it gets better.

 

Of course.

[CanadaOne]

Of course.

 

Apologies for stating the obvious.

[SqueakyS]

What exactly do they hope to accomplish with stolen info from the pirate users? It's usually not a good idea to approach authorities unless your methods are clean. The potential for legal complications is too high. 

 

It's unbelievable that they're willing to scare away paying customers to facilitate their fight against largely imaginary losses to pirates. 

There was a post on Reddit/r/flightsim where a guy had some money stolen from his bank account which turned out to be FSLabs. Scummy business and highly illegal basically anywhere. Especially under EU law.

[JaffaCake]

There was a post on Reddit/r/flightsim where a guy had some money stolen from his bank account which turned out to be FSLabs. Scummy business and highly illegal basically anywhere. Especially under EU law.

 

 

Could you link please? I don't think FSlabs will be around for much longer if that is proven to be true.

[216th_Lucas_From_Hell]

Cybersecurity firm Fidus Information Security (FIS) said the "test.exe" file also triggered a "malicious" warning on 30 out of 67 antivirus tools, according to test service VirusTotal. Researchers also uncovered a comment made by a member of the FSLabs team in October 2017 regarding the "test.exe" file triggering antivirus software warnings.

 

"This is why we recommend you disable your AV when installing," the FSLabs team member wrote. "Many AV engines see our installers as a virus, which they are not (also known as a false positive)."

 

Bloody hell, the lengths they've gone...

[SqueakyS]

Could you link please? I don't think FSlabs will be around for much longer if that is proven to be true.

 

https://www.reddit.com/r/flightsim/comments/78h2ak/fslabs_a320_just_got_off_the_phone_with_my_bank/

[Wedgewood]

Sounds about right justice served to pirate users. No issues.

They have no right to steal peoples information.  They are the criminals for doing so.  While we're on the subject, pirates as you call them still have rights even after they have broken a law.[

[CanadaOne]

They have no right to steal peoples information.  They are the criminals for doing so.  While we're on the subject, pirates as you call them still have rights even after they have broken a law.[

 

They should, but those rights are being killed off in a psychotic frenzy of copyright protection mania. In some cases, just being accused by a copyright troll firm can get you kicked off the net. No proof required, just accusations. And there is the death of due process.

 

Also, the whole deal about no cruel and unusual punishment is dead and gone when it comes to piracy. Sneak into a movie theater to watch "Black Panther" and they'll kick you out. Steal the DVD, maybe you get busted for petty theft and spend an hour in the can. But if you download the movie, they want tens of thousands of dollars sometimes. It's a complete perversion of justice.

 

Look at the pic below. Why are federal authorities involved at all? If you sneak into the theater or steal the DVD, it's a local issue, but if you download the movie, the feds talk about five-years in prison and quarter million dollar fine. It's 100% insane. Might as well give $5000 tickets for not making a full stop at a STOP sign.

 

[CanadaOne]

...and furthermore!

 

Two people acquire a product that is sold with (skanky) DRM. One buys it and one steals it.

 

The guy who bought it and legally owns it is now treated as an ongoing threat by the company who sold him the software. The customer is the enemy. He has limitations, sometimes really skanky ones, placed on him that limit his ability to enjoy the product he bought and "owns". Sometimes he is almost being spied on and often there is hidden software installed on his PC.

 

The guy who stole it? He uses it free and clear of encumbrances.

 

Bravo!

[BeastyBaiter]

Nothing new, doesn't typically end well for the offender:

 

https://www.cbsnews.com/news/texas-sues-sony-over-cd-software/

[Nightrise]

That break at least one law in just about every country its gonna be sold in. 

[CanadaOne]

Truth be told, the guy at Flightsim Labs did write a pretty decent apology on the site. A for effort.

[JaffaCake]

Truth be told, the guy at Flightsim Labs did write a pretty decent apology on the site. A for effort.

 

 

You mean the one where he completely avoided admitting that what they did is criminal, and used a petty excuse of the "We are terribly sorry that some of you felt bad about things we did" ? I wouldn't give any rating for that effort.

[CanadaOne]

You mean the one where he completely avoided admitting that what they did is criminal, and used a petty excuse of the "We are terribly sorry that some of you felt bad about things we did" ? I wouldn't give any rating for that effort.

 

You're absolutely right.

 

I didn't meant to insinuate innocence on his part, only that there was obviously an effort made at damage control - disingenuous as it may have been. I've seen some lovely screw ups like this where the guilty party issues little more than a "**** you if you don't like it!" Now that guy may get an A for honesty, but as far as damage control goes, not so much.

[JaffaCake]

You're absolutely right.

 

I didn't meant to insinuate innocence on his part, only that there was obviously an effort made at damage control - disingenuous as it may have been. I've seen some lovely screw ups like this where the guilty party issues little more than a "**** you if you don't like it!" Now that guy may get an A for honesty, but as far as damage control goes, not so much.

 

 

Still effectively means nothing. It is not an apology when a person comes around and tells you "I am sorry you feel offended that I intentionally robbed your house".

 

That is not the kind of damage control, where you try to save your image. That is the selfish damage control a company takes where it knows it doesn't have much longer to exist and thus the damage control is focused on the finance and reduction of possible litigation afterwards.

 

There are smart businessmen and dumb businessmen. If offering refunds will get you out of criminal chargers - a smart businessman will offer those refunds. Not because he is feeling sorry, but because he knows that the other option is way worse.

Edited February 21, 2018 by JaffaCake

[Feathered_IV]

 Not at all good for the flight sim industry as a whole.  I've just seen the news, but I'm guessing the apology is similar to those fake-sincere repentances seen by shamed youtubers:  "I'm sorry if I offended anybody but..."

[CanadaOne]

Still effectively means nothing. It is not an apology when a person comes around and tells you "I am sorry you feel offended that I intentionally robbed your house".

 

That is not the kind of damage control, where you try to save your image. That is the selfish damage control a company takes where it knows it doesn't have much longer to exist and thus the damage control is focused on the finance and reduction of possible litigation afterwards.

 

There are smart businessmen and dumb businessmen. If offering refunds will get you out of criminal chargers - a smart businessman will offer those refunds. Not because he is feeling sorry, but because he knows that the other option is way worse.

 

 

Hmmm, my 1000th post.   

 

I think were are in complete agreement. I'm only saying the guy made a good effort at damage control. That the effort was motivated by something other than genuine regard for the client is another matter.

 

if you wish to cite his apology as BS, that's fine. But it was pretty good BS.

[unreasonable]

Not sure why the surprise and outrage. The whole high tech system is controlled by a combination of abusive monopolists who have their FANGs into the mug punters who have become addicted to their junk, and traditional governments who use secret evidence presented to  secret courts to justify secret monitoring using secret sources and methods in order to identify and punish anyone who threatens to embarrass them by revealing their corruption and incompetence.  This little flight-sim company is just following the example of the big boys. 

[1PL-Husar-1Esk]

Not sure why the surprise and outrage. The whole high tech system is controlled by a combination of abusive monopolists who have their FANGs into the mug punters who have become addicted to their junk, and traditional governments who use secret evidence presented to secret courts to justify secret monitoring using secret sources and methods in order to identify and punish anyone who threatens to embarrass them by revealing their corruption and incompetence. This little flight-sim company is just following the example of the big boys.

Yes.

Only free software and hardware can be trusted to respect user.

[unreasonable]

Yes.

Only free software and hardware can be trusted to respect user.

 

Actually I mistrust anything free even more. No such thing as a free lunch.... (generally).  

 

I am fine with paying for services and products that do what they say they do. We just need to be aware that by opening our homes and communications to the net, we are essentially living in Bentham's Panopticon, and any service provider who tells you that your privacy is protected is lying through their teeth. 

[ZachariasX]

Actually I mistrust anything free even more. No such thing as a free lunch.... (generally).  

 

I am fine with paying for services and products that do what they say they do. We just need to be aware that by opening our homes and communications to the net, we are essentially living in Bentham's Panopticon, and any service provider who tells you that your privacy is protected is lying through their teeth.

 

I‘m sure with „free“ Tomcat meant open source. There you could check what the software does. At least theoretically. Depending on the documentation of the code.

[BeastyBaiter]

Reputable companies don't include malware. Of course, absolutely everything you do on the internet is recorded forever. But that's the world we live in. Even if your software does not track and neither does the site you visit, both your ISP and the NSA/FSB/... do.

[JaffaCake]

I‘m sure with „free“ Tomcat meant open source. There you could check what the software does. At least theoretically. Depending on the documentation of the code.

 

 

With personal and other people's experience working in software I generally found that "security through obscurity" and temptations to do shady stuff is a whole lot higher in closed-source projects. 

 

Generally speaking:

Paid software - mostly OK, main issues are DRM-heavy products. With a few exceptional rogue firms, such as FSLabs.

Free software / Shareware - the bottom of the pit kind of stuff - they do not care for the customer as they get nothing. So they try to get something in some way - either the information, or bitcoin mining, or any other borderline illegal crapware.

Free Open source - mostly hobby projects or major companies looking to expand the sector or reduce the costs of bug fixing / development. Rarely any intentional crapware added, as it is extremely easy to find out who and where introduced it (all changes are tracked). Mostly have to deal with bugs and the developer simply not caring about your problems because he isn't doing it for you, but for himself.

Edited February 22, 2018 by JaffaCake

[ZachariasX]

Reputable companies don't include malware. Of course, absolutely everything you do on the internet is recorded forever. But that's the world we live in. Even if your software does not track and neither does the site you visit, both your ISP and the NSA/FSB/... do.

If you put the bar such that „taking info from a user he is not aware off“ would not qualify for „being reputable“, then neither Apple or MS are reputable companies. As long as the current agreement seems to be that regrading client abuse, „anything goes“ because you put it in the EULA (being a respactable company) and thus „it is legal“, no matter how many national laws you are breaking, only extreme examples are sanctioned and thus common abuse is the current modus operandi. It is funny that publishers ask for respect that they have a hard time giving to their clients.

 

As for myself, I absolutely think that good work needs and should be paid well. But there is no second chance for putting clients at risk over something that their private worry.

 

I also think that it is borderline criminal advertising games that cost $50+ but are in fact designed to be shoplifting the minority of players that are easily addiced. Yes, pay another $2000 or so in total in in game lotteries to get caracters like a certain ‚Luke Skywalker‘ (or play until your game is no longer supported by the operating system) in a Star Wars game, that is what the paying customer today is facing.

 

Including a keylogger with ALL customers just to gain access to the forum where the evil guy that warezd your software dumps his stuff seems to be straight forward then.

 

Ok, that guy wrote a nice appology. But would you EVER trust someone like him again if he got up in the morning and felt another itch?

[1PL-Husar-1Esk]

Actually I mistrust anything free even more. No such thing as a free lunch.... (generally).

 

I am fine with paying for services and products that do what they say they do. We just need to be aware that by opening our homes and communications to the net, we are essentially living in Bentham's Panopticon, and any service provider who tells you that your privacy is protected is lying through their teeth.

Only open source software can be free (not free as free beer) but not all open source software is free (one who respect you freedom). Only when you can yourself audit the code or hire someone for that job) you can be sure it's save software and respect your freedoms.

Reputable companies don't include malware. Of course, absolutely everything you do on the internet is recorded forever. But that's the world we live in. Even if your software does not track and neither does the site you visit, both your ISP and the NSA/FSB/... do.

Are Sony, Amazon reputable company's??

[1PL-Husar-1Esk]

1)With personal and other people's experience working in software I generally found that "security through obscurity"

 

2)Free Open source - mostly hobby projects or major companies looking to expand the sector or reduce the costs of bug fixing / development. Rarely any intentional crapware added, as it is extremely easy to find out who and where introduced it (all changes are tracked). Mostly have to deal with bugs and the developer simply not caring about your problems because he isn't doing it for you, but for himself.

1) only in close source - proprietary softwares in that kind you must trust is secure (can't audit the source code)

2) most of IT industry (LAMP, WordPress) and Big companies like Google relay on open source and free software as free - no charge and free as respectfully for user rights.

Edited February 22, 2018 by 307_Tomcat

[1PL-Husar-1Esk]

copyright laws are amazing now all kids are criminals

There is hope :-)

 

[BeastyBaiter]

If you put the bar such that „taking info from a user he is not aware off“ would not qualify for „being reputable“, then neither Apple or MS are reputable companies. As long as the current agreement seems to be that regrading client abuse, „anything goes“ because you put it in the EULA (being a respactable company) and thus „it is legal“, no matter how many national laws you are breaking, only extreme examples are sanctioned and thus common abuse is the current modus operandi. It is funny that publishers ask for respect that they have a hard time giving to their clients.

 

As for myself, I absolutely think that good work needs and should be paid well. But there is no second chance for putting clients at risk over something that their private worry.

 

I also think that it is borderline criminal advertising games that cost $50+ but are in fact designed to be shoplifting the minority of players that are easily addiced. Yes, pay another $2000 or so in total in in game lotteries to get caracters like a certain ‚Luke Skywalker‘ (or play until your game is no longer supported by the operating system) in a Star Wars game, that is what the paying customer today is facing.

 

Including a keylogger with ALL customers just to gain access to the forum where the evil guy that warezd your software dumps his stuff seems to be straight forward then.

 

Ok, that guy wrote a nice appology. But would you EVER trust someone like him again if he got up in the morning and felt another itch?

 

Malware is something you place on a users's device which does something malicious. Examples include keyloggers, viruses and so on. Microsoft does not do this. They do collect some data for advertising purposes, but that is easily switched off in the privacy settings. It's shady that it's in there at all but at least they make it clear they are doing it and give you an easy way to turn it off. Additionally, if you install windows yourself, turning it on or off is part of the install process. I have to give OEM's half the blame for this even being a thing tbh. It is not malware though. I do agree that the whole EULA thing needs to be revised. Software companies do need some level of immunity from suits over bugs and unintended effects (original purpose of the EULA), but it's been taken to places that it shouldn't have.

 

The core problem is technology has rendered privacy impossible from a technical aspect. Storage is cheap and so absolutely everything gets recorded and saved forever. There needs to be a serious push for privacy laws which put hard limits on how long data can be stored and penalties for using older data. But I suspect a genocide or something will need to occur in order for industrialized nations to look at it seriously. There is too much money in it to address it without a massive abuse to draw the general public's attention.

 

 

Only open source software can be free (not free as free beer) but not all open source software is free (one who respect you freedom). Only when you can yourself audit the code or hire someone for that job) you can be sure it's save software and respect your freedoms.

 

Are Sony, Amazon reputable company's??

 

Sony? No, definitely not. They've pulled enough BS that their corporation's papers should be pulled (death penalty for a legal entity). I'm not aware of that ever happening since the idea of a corporation was invented, but corporate death penalty really ought to be a thing. When it comes to amazon, the only bad things I've heard about them are their treatment of their warehouse workers. But Amazon will replace those people with robots in a few years anyways, so...   

[1PL-Husar-1Esk]

Malware is something you place on a users's device which does something malicious. Examples include keyloggers, viruses and so on. Microsoft does not do this. They do collect some data for advertising purposes, but that is easily switched off in the privacy settings. It's shady that it's in there at all but at least they make it clear they are doing it and give you an easy way to turn it off. Additionally, if you install windows yourself, turning it on or off is part of the install process. I have to give OEM's half the blame for this even being a thing tbh. It is not malware though. I do agree that the whole EULA thing needs to be revised. Software companies do need some level of immunity from suits over bugs and unintended effects (original purpose of the EULA), but it's been taken to places that it shouldn't have.

 

The core problem is technology has rendered privacy impossible from a technical aspect. Storage is cheap and so absolutely everything gets recorded and saved forever. There needs to be a serious push for privacy laws which put hard limits on how long data can be stored and penalties for using older data. But I suspect a genocide or something will need to occur in order for industrialized nations to look at it seriously. There is too much money in it to address it without a massive abuse to draw the general public's attention.

 

 

 

Sony? No, definitely not. They've pulled enough BS that their corporation's papers should be pulled (death penalty for a legal entity). I'm not aware of that ever happening since the idea of a corporation was invented, but corporate death penalty really ought to be a thing. When it comes to amazon, the only bad things I've heard about them are their treatment of their warehouse workers. But Amazon will replace those people with robots in a few years anyways, so...

Yes Amazon

 

https://gizmodo.com/5317180/big-brother-amazon-remotely-deletes-purchased-copies-of-1984-and-animal-farm-from-thousands-of-kindles