EA's Troubles Keep Getting Worse: Big Security Flaw Discovered In Origin Platform
from the another-day,-another... dept
Perhaps the timing is a coincidence, but following the absolutely disastrous SimCity launch, in which EA’s focus on DRM seemed to get in the way of actually making a product that works, it’s been announced that CEO John Riccitiello is stepping down at the end of the month. This is clearly not a planned succession situation, because the company’s former CEO, Larry Probst, who ran EA from 1991 until 2007 when he handed it over to Riccitiello is taking over as interim CEO as they search for a real replacement. Perhaps they should look for someone who recognizes that providing a good product that people want to support is a better goal than “stopping piracy.” Just a suggestion.
Of course, they may also have bigger issues to deal with. Rich Kulawiec was the first of a few of you to submit the news that researchers have <a href=”http://lists.grok.org.uk/pipermail/full-disclosure/2013-March/089897.html” target=”_blank”>demonstrated a pretty big security vulnerability in EA’s Origin platform (the company’s Steam competitor), which can be used to exploit local vulnerabilities on the computers of about 40 million Origin users. If you’d like to see the hack in action, there’s a nice video.
Comments on “EA's Troubles Keep Getting Worse: Big Security Flaw Discovered In Origin Platform”
Well then, now the people exposing this flaw can get 3.5 years in jail and pay $73,000 USD.
Gotta love how our system works. You show a company that it has a security hole in their software, and instead of thanking you for exposing it so it can be fixed, they crucify you.
Re: Re:
You wouldn’t really want them to, you know, actually fix it would you?
Re: Re:
Actually, that sounds a lot like playing a title made by EA.
Re: Re:
That is why you have to be Anon if you are going to do something like that, unless it is Google.
“…it’s been announced that CEO John Riccitiello is stepping down at the end of the month”
All I heard was:
ka-ching
fwoosh
“So long suckers!”
(that’s the sound of a bonus being cashed in, a golden parachute being deployed and a CEO agonizing about the fact that he’s been fired).
This is a broadly similar flaw to one apparently present in Steam and other URI handling applications, and isn’t Origin specific.
http://arstechnica.com/security/2013/03/bug-on-eas-origin-game-platform-allows-attackers-to-hijack-player-pcs/
Re: Re:
Broadly similar to this:
http://arstechnica.com/security/2012/10/steam-vulnerability-can-lead-to-remote-insertion-of-malicious-code/
Re: Re:
From the artech steam article. Basically it’s a “feature” not a bug and it isn’t going anywhere. Just don’t tell your browser to auto accept steam/origin urls and don’t click stupid links.
“Not all Web users are equally at risk to these kinds of attacks. Browsers such as Chrome and Internet Explorer present users with an explicit warning when they click a Steam link, telling them they’re about to open or use an external program, and Firefox asks users for confirmation (without explicitly warning of potential vulnerability). Browsers including Apple’s Safari and Webkit, though, allow Steam URLs to launch the program without any warnings, letting a potential attack go completely unnoticed. Many browsers that provide prompts or warnings by default can be configured to suppress them, so it’s possible attacks might work more widely, Ferrante said.”
Re: Re: Re:
Browsers such as Chrome and Internet Explorer present users with an explicit warning when they click a Steam link, telling them they’re about to open or use an external program, and Firefox asks users for confirmation (without explicitly warning of potential vulnerability).
Oh good. We know that putting up a confirmation dialog before executing malicious code is almost completely effective. People don’t get owned on a regular basis after clicking OK on a dialog they don’t understand.
I saw this presented live at Black Hat
I saw this exploit being presented to the world at Black Hat Europe last week (where sploits are typically presented on-stage before advisories are sent – happy to see that Revuln has published the details).
There was much applause.
Also, it should be mentioned that Revuln did a similar stunt against Steam, pointing out that a three-and-a-half-year-old exploit _still_ isn’t patched for most games on Steam.
In any case, the sploits depend on making the victim click a link on the attacker’s web page that open Steam and Origin, respectively, so there is some manual action required for pwnage. Still, I understand there are plenty of such links around with the effect of “join my clan” etc.
Short version of how the exploit works is that it forces a game update from another server than the official one. Some games even allow this update server to be supplied on the command line (!) and thus, once you have an URL with the command line to start, the rest is a matter of working around a few input sanitizers. In short, it’s broken by design and a few checks won’t help much.
Cheers,
Rick
Re: I saw this presented live at Black Hat
(Oh by the way, the reason I was at Black Hat was that I gave the opening keynote.)
Re: Re: I saw this presented live at Black Hat
Congrats! and I hope you wear your hat with pride now 😉
Re: I saw this presented live at Black Hat
Oh hi Rick. Just wanted to say I really liked your “Who protects free speech” article on Torrentfreak. True, there is nothing in US style copyright law that actually encourages protecting someone’s speech: if you do the heinous act of merely carrying the message, you end up with your own head on the chopping block.
Huh…I wish that my gaming computer was still up and running. I’d totally mod the opening sequence in Skyrim to be about that.
Re: I saw this presented live at Black Hat
If Valve and EA aren’t keen to fix these issues is there something an end-user can do to protect themselves?
Re: Re: I saw this presented live at Black Hat
Yes. The exploit is that you click a link on a website, and your browser asks what program should be used to open that link. Most users will have long set their browser to auto open all Steam links with Steam and ditto for Origin (fortunately, I’m not amongst that crowd). One thing you can do is have your browser ask you every time you do click on such a link. That way, the only time it should ask you is when you’re on the Steam or Origin websites. If it happens anywhere else, don’t allow the link to be run, because it can’t be trusted.
Re: Re: Re: I saw this presented live at Black Hat
Yeah but what about the people that don’t wait to take the extra 1/8th of a second to press enter or the extra 1/3 to click confirm.
Re: Re: I saw this presented live at Black Hat
Don’t click steam/origin links in your browser.
Re: Re: I saw this presented live at Black Hat
Other than running a good AV product and running under USER credentials… not much. Even what I suggested isn’t 100% fool-proof and probably would only catch known exploits such as the script-kiddy type stuff.
Re: I saw this presented live at Black Hat
Thanks for the Comment !
This is the sort of copyright legacy that out_of_the_lube is cheering on? Well, now we know all along what colour the sky is in his godforsaken world.
Re: Re:
Go back a couple of articles, to the one about the Library of Congress. He explicitly says that its all right for jazz recordings from the 30’s to be degraded beyond hope of recovery thanks to insane copyright laws…simply because he himself doesn’t like jazz.
Re: Re: Re:
What he doesn’t like jazz
Wow, you’d never guess it from the way he keeps on blowing his own horn all the time ad infi-fuckin-nitum
Re: Re: Re: Re:
He doesn’t like “jazz”. It’s one letter away from “jizz”.
This article actually mentions Steam but doesn’t mention that the same exploit happens in Steam so it makes it sound as if it only happens in EA and thus diminishes the article’s objectivity. I know it’s popular to kick EA this month but #candobetter.
Re: Re:
This article actually mentions Steam but doesn’t mention that the same exploit happens in Steam so it makes it sound as if it only happens in EA and thus diminishes the article’s objectivity.
“As we have demonstrated for Steam in our previous paper, Steam Browser Protocol Insecurity, almost the same design problem applies for Origin.”
That isn’t explicit enough?
Re: Re: Re:
Yes, the original paper is clear. The TechDirt article is as I described.
I always knew Origin was shitty software, but I didn’t know it was a goddamn backdoor. EA’s suck provides hilarity once more.
Re: Re:
Ubisoft’s Uplay was a backdoor too. That one involved installing a plugin into your web browser (without telling you of course) that would have allowed malicious websites to remote access your machine.
Re: Re:
As much as I am loving this EA house of cards and the barn door, even Blizzard has issues with Battle.net compromised accounts that don’t have authenticators.
Let’s not pretend that the utopia of being online and 100% safe even exists.
Adios…
We shall Forget you even existed….
Recursive link
The hyperlink bound to the text “demonstrated a pretty big security vulnerability in EA’s Origin platform” links back to this article.
Re: Recursive link
Shh. We don’t want hasn’t_got_a_clue to know what a REAL loopy tour/link is now do we?
Re: Re: Recursive link
Lol that was my first thought too 😀
EA’s troubles can not get any worse. The company’s been at the bottom of the barrel for years now.
Saying it’s worse is like saying a flat tire is worse because someone stuck a nail in it.
The only way to fix the problem is to change it.
I don’t see that happening, even as the CEO bails while pulling on his golden parachute rip cord.
Re: Re:
Actually, Riccitello had all the interesting ideas, and my understanding is that internal politics, rather than actual failures, are what have pushed him out.
EA will now die within the next five years. Bank on it.
Re: Re: Re:
This is the guy who stated that the Amazon hate-on for Spore DRM in 2008 was some sort of “cabal” of malcontents and/or/probably pirates, instead of a rather large expression of disapproval by fans of the game (which had been hyped for years before it was released).
Same guy who defended the use of Securom back in 2007 despite the proven problems it caused for paying customers.
Yadda, yadda. A disconnected CEO, color me unsurprised at anything except his resignation.
Re: Re: Re: Re:
Yes. As further condemnation, he’s also the chairman of the USOC.
Re: Re:
About golden parachutes…when and how did they become the norm? Which Board of Directors was the first to say to a CEO applicant that even if he fucks everything up, he can still leave with a few million?
I can guess I can answer my own question with “No Board of Directors really cares about long term viability, only their own paychecks”.
Re: Re: Re:
It’s a function of lawyers, actually. CEOs can hire teams of lawyers to write contracts for them that guarantee golden parachutes and the company just has to accept it or find another CEO.
Re: Re: Re: Re:
“find another CEO” How hard can this be?? Business schools like Kellogg and Harvard publish the resumes of their grads. It’s not as if candidates are hiding in a cave.
Re: Re: Re: Re:
Man, now I want to be a CEO. Do no work, possibly leave the company worse than when you found it, cash out in millions after having spent years playing golf with my other CEO buddies.
Sign me up!
Re: Re: Re:
When headhunter companies started to get into the business. As soon as you have to force someone away from another job, the incentives have to be universally better than their current situation…
Re: Re:
It can get worse.
Charles Carreon has shown us that no matter how bad things get, you can always dig the hole you are in deeper.
Re: Re:
Two years in a row as worst company in america would seem like the next step. They seem to gun for perfection in user-alienation!
Note to self, uninstall all EA products from computer when I get home.
Note to self, make sure my computer deletes all of it’s contents if I ever try to install another EA game, as it’ll be less frustrating then trying to play the EA game.
Re: Re:
It actually would be less frustrating because at that point, all you’re doing is formatting your hard drive and then reinstalling the OS, which is entirely up to you. EA? You have no idea when their servers are going to be up or down.
Re: Re:
Make sure to delete Steam as well while you’re at it.
And all your browsers too.
And Windows actually.
It’s as I mentioned before…they use the same code as XCP Audio DRM. It leaves you open to attack.
Re: Re:
DRM is malware, nothing exemplifies that more than XCP.
Re: Re:
Uh dude…a quick glance at XCP’s wikipedia page tells me enough that its NOT the same code. A similar kind of malware? Yes, but not the same code. XCP allowed malware to run if it began with $sys$ and installed a device driver…hang on, I’m just gonna copy and paste
“
XCP.Sony.Rootkit installs a DRM executable as a Windows service, but misleadingly names this service “Plug and Play Device Manager”, employing a technique commonly used by malware authors to fool everyday users into believing this is a part of Windows. Approximately every 1.5 seconds this service queries the primary executables associated with all processes running on the machine, resulting in nearly continuous read attempts on the hard drive. This has been shown to shorten the drive’s lifespan.
Furthermore, XCP.Sony.Rootkit installs a device driver, specifically a CD-ROM filter driver, which intercepts calls to the CD-ROM drive. If any process other than the included Music Player (player.exe) attempts to read the audio section of the CD, the filter driver inserts seemingly random noise into the returned data making the music unlistenable.
XCP.Sony.Rootkit loads a system filter driver which intercepts all calls for process, directory or registry listings, even those unrelated to the Sony BMG application. This rootkit driver modifies what information is visible to the operating system in order to cloak the Sony BMG software. This is commonly referred to as rootkit technology. Furthermore, the rootkit does not only affect XCP.Sony.Rootkit’s files. This rootkit hides every file, process, or registry key beginning with $sys$. This represents a vulnerability, which has already been exploited to hide World of Warcraft RING0 hacks as of the time of this writing, and could potentially hide an attacker’s files and processes once access to an infected system had been gained.”
While of a somewhat similar nature, XCP and Origin do not use the same code. So please, be more precise in the future.
Re: Re: Re:
Just to clarify, what you wrote could also be written as “Game 1 and Game 2 used the same code because they had the same effect”…even if Game 1 was written in Java and Game 2 was written in Python
You get the feeling that March 2013 is the month that EA stopped existing.
should have gotten rid of him and the stupid ‘always on’ connection plus DRM a long time ago. EA have screwed up royally. it should, i hope, take a long time to get customer confidence back but only then if they drop all the crap they insist on including and having implemented in their games. whoever takes over needs to have a much more sensible approach and start treating customers as people, not criminals and stop worrying about piracy. if their games are pirated, it’s because they run better, are too expensive, dont have single player option and have to be connected to the internet indefinitely. ridiculous!! Sony started this crap and were backed by the USA courts. it hasn’t done them any good so far and wont in the future.
Ah, Karma is a bitch eh? When they are arseholes towards the people and their customers they get divine punishment. Happened to Sony. Is happening with EA. The main difference is that Sony had plenty of other products to support the debacle. EA hasn’t.
Also, it’s much, much, much more probable that people will try to screw you up if you act like an arsehole.
I feel this eerie pleasure from seeing EA getting owned.
As long as we allow monopolistic rights to be held by companies EA will not go out of business. I have no idea why professional sports are exempt from these laws, but it’s probably not going to change until we get lawmakers in who are young enough to know what the major console brands are.