Live data from Hacker News

FlightSimLabs Alleged Malware Analysis

medium.com

21–30 of 62 posts

Re: FlightSimLabs Alleged Malware Analysis

#21
post #10

I never understood the point of DRM. "10 extremely determined people want to steal my intellectual property! I'll go miles out of my way to design this in such a way that 1,000 people have a crappy experience to slow down the 10 people who want to be pirates!" Vendor makes a shitty product Pirates find a workaround, pirate shitty product anyway Vendor makes shitty product even shittier for all 1,000 people to agin tr…

Not only that: they end up enabling the pirates because the pirates are then able to provide the potential users of the product with a major reason for breaking the social contract (and the law): a much better user experience than the original.

Re: FlightSimLabs Alleged Malware Analysis

#22

Earlier quoted context omitted.

Wouldn’t that be downright illegal? Moreover, someone bricking my hardware would inspire me to forcefully return said “brick” to them, through their nearest window.

Wouldn’t that be downright illegal? Moreover, someone breaking my windows would inspire me to forcefully discuss said behaviour with them, with their nearest brick.

Totally illegal, but while I would feel like tossing something through their window, I would never do it. If only this company had as much of a moral compass!

Re: FlightSimLabs Alleged Malware Analysis

#23
post #14

"How do we know that FSLabs don’t use this, just because they say so?" How do you know the main executable doesn't do the same thing? How is trusting them not to run this .exe different from trusting them not to secretly implement this functionality in the actual program?

Well yeah. The appropriate reaction here is to assume that the company is shipping malware in the product regardless of what particular format.

Sure, but what of significance has changed? Every time you run a program, you're trusting the developer not to do nefarious things like reading your Chrome credentials, because the only assurance you have is the developer's word about what the program does. As far as I can tell, that hasn't changed at all. I'm not saying this is okay - there are reasons why this is a bad thing to do, I just don't see how no longer being able to trust the developer not to be malicious is one of them.

Re: FlightSimLabs Alleged Malware Analysis

#24
post #10

I never understood the point of DRM. "10 extremely determined people want to steal my intellectual property! I'll go miles out of my way to design this in such a way that 1,000 people have a crappy experience to slow down the 10 people who want to be pirates!" Vendor makes a shitty product Pirates find a workaround, pirate shitty product anyway Vendor makes shitty product even shittier for all 1,000 people to agin tr…

I think there are a few main kinds of reasoning behind DRM (non-exclusive, more then one could be involved in any specific case). One is psychological, one is pure greed and generally not explicitly acknowledged, but the last is potentially reasonable in specific situations.

The first essentially boils down to the well studied psychological phenomena of Loss Aversion, which is what you refer to and purely emotional, the feeling of "someone is TAKING my work!" It has been very well studied that humans in general have a strong natural tendency to prefer to avoid losses vs thinking about gains, and in fact the psychological power of losses can be vastly more (2x+) vs gains. This phenomena is used extensively in marketing and other areas involving behavioral economics. It is not usually logical, and particularly not in the case of IP infringement where the emotional response fails to consider both that there is no actual loss and that IP itself is not a natural construct and imposes societal costs. Nevertheless, it's definitely powerful and it fuels some of the emotional outrage many honestly feel at infringement, even if it's not merely illogical but outright economically self-destructive (they spend more on DRM and cause more pain to legitimate customers and in turn drive them away then they ever get back).

A second, purely greed one, comes down to controlling power. A lot of big publishers/organizations in particular saw (and still see) DRM as a way to extract far more money and rent seeking through extreme personalized spatial and temporal slicing of IP licenses. Basically, a much more extreme version of what the music and movie industries saw with the various format transitions (tape to CD to online, VHS/DVD/Blu-ray/online). Those were enormously lucrative since they could simply take existing IP and repackage it and sell it all over again, repeatedly. Their golden vision for DRM was payments not just for formats but everything. A different fee to play in each car, in each player, per units of time, every new bit of hardware, etc. Fundamentally DRM represents arbitrary control beyond the bounds of law, and that control can be used for a lot more then merely preventing infringement. Fortunately this vision was at least partially thwarted, but it'll be an eternal battle as lots of money will always be on the table here.

The third most arguably legitimate use is an extremely time-limited-then-eliminated application for the kinds of major entertainment IPs that experience extreme reverse J-curve demand patterns. Ie., a majority of total lifetime demand may come in the first few days/weeks/months before exponential falloff and a move into low long tail territory. This can simultaneously represent the time when costs are highest too, due to factors like simultaneous online resource demands and (in the case of video games) ongoing development work/support engagement. For movies and video games your numbers (10 vs 1000) are backwards or worse, an enormous number of people will pirate if it's convenient enough. But these are very low effort, casual pirates, not dedicated ones, and they also are time pressured. They aren't fundamentally unwilling to pay for whatever it is either if they have to because they want it right then to be part of the cultural zeitgeist and experience the social networking at its peak period.

In this last situation, limited time DRM can be a practical choice in some cases. If it's cheap enough it only needs to last a month or two, or even just a few weeks, to generate significant economic return. Then it can be completely removed for the long tail as the entertainment IP gets into sale territory, which may bring in some more people who care and eliminate ongoing support costs as well as ensuring that all existing owners will not experience problems as the publisher attention winds down.

Of course, getting rid of it there promptly is key and something that publishers too often ignore (or they're actually looking towards #2, and hoping to monetize it in other ways with the aid of ongoing control). In principle though this is relatively innocuous, since the biggest practical problem with DRM is in the longer term. If for example it was mandated by law that all DRM had to be removed within 6-12 months of an IP launch it wouldn't be ideal and there'd still be moral concerns and arguments but it might be a practical compromise too given the realities of human psychology.

Re: FlightSimLabs Alleged Malware Analysis

#25
post #16

Earlier quoted context omitted.

My thoughts exactly. This is so unbelievably bone-headed. I want to believe that this was slipped in by a small rogue group within FSL, and that its not something everyone approved of...

LinkedIn only has 3 people who are listed at working at this company [0], so I'd assume it's a small indie shop without a legal department. [0] https://www.linkedin.com/search/results/index/?keywords=Flig... .

It still baffles me. You can't stay even moderately up to date on technology news, without knowing that initiating a security breach, even on someone who has stolen your product, will still be criminal.

Re: FlightSimLabs Alleged Malware Analysis

#27

The passwords aren't protected somehow from copying?

On Windows they are protected with DPAPI, so you won't be able to decrypt them without having access to the user account that "owns" the passwords.

Of course, this helps you very little when the malware is running under your user account and uses DPAPI calls to decrypt the passwords.

https://msdn.microsoft.com/en-us/library/ms995355.aspx

Re: FlightSimLabs Alleged Malware Analysis

#28
post #10

I never understood the point of DRM. "10 extremely determined people want to steal my intellectual property! I'll go miles out of my way to design this in such a way that 1,000 people have a crappy experience to slow down the 10 people who want to be pirates!" Vendor makes a shitty product Pirates find a workaround, pirate shitty product anyway Vendor makes shitty product even shittier for all 1,000 people to agin tr…

There is a different philosophy of DRM, maybe less well-known because it doesn't tend to produce newsworthy examples, that says that the goal is to provide just enough of a nudge toward paying for the product that you're not operating completely on the honor system.

Under this approach, you really only want to make pirating the software just a little bit less convenient than paying for the software for most users. Because most potential pirates aren't determined attackers, they're just regular folks who are every bit as lazy and strapped for time as everyone else, and therefore won't bother to spend a few minutes keying in credit card information if they don't have to.

It's sort of analogous to turnstiles at train stations. Virtually anyone can go around or under them if they want to, but that's not the point. The point is that hopping a turnstile is just a bit more of a hassle than fishing your transit card out of your purse. Just enough more that most people would rather do that.

Re: FlightSimLabs Alleged Malware Analysis

#30
post #26

The passwords aren't protected somehow from copying?

Not on Windows, but on Linux it's encrypted with your account password (it uses the Gnome Keyring/KDE Wallet APIs). But none of that is going to help against an attacker with the same permissions.

If that's the case that's a choice Google made. Windows via the CryptProtectData API[0] allows you to protect data via the user's session just like the Gnome Keyring/KDE Wallet.

But as you pointed out, another process with the same privileges can decrypt it making it pretty pointless in both cases. Only way to securely do it is to prompt the user for a decryption key each time they open the browser which has usability issues but Firefox offers it via the Master Password functionality.

[0] https://msdn.microsoft.com/en-us/library/windows/desktop/aa3...

Post reply on HN