EA's Troubles Keep Getting Worse: Big Security Flaw Discovered In Origin Platform

from the another-day,-another... dept

Perhaps the timing is a coincidence, but following the absolutely disastrous SimCity launch, in which EA’s focus on DRM seemed to get in the way of actually making a product that works, it’s been announced that CEO John Riccitiello is stepping down at the end of the month. This is clearly not a planned succession situation, because the company’s former CEO, Larry Probst, who ran EA from 1991 until 2007 when he handed it over to Riccitiello is taking over as interim CEO as they search for a real replacement. Perhaps they should look for someone who recognizes that providing a good product that people want to support is a better goal than “stopping piracy.” Just a suggestion.

Of course, they may also have bigger issues to deal with. Rich Kulawiec was the first of a few of you to submit the news that researchers have <a href=”http://lists.grok.org.uk/pipermail/full-disclosure/2013-March/089897.html” target=”_blank”>demonstrated a pretty big security vulnerability in EA’s Origin platform (the company’s Steam competitor), which can be used to exploit local vulnerabilities on the computers of about 40 million Origin users. If you’d like to see the hack in action, there’s a nice video.

You can read the details directly, if you’d like, which comes complete with some graphics explaining how the security vulnerability, found in the URI handling of Origin, can be exploited:
You get the feeling that March 2013 is a month that EA would prefer to forget ever existed.

Filed Under: ,
Companies: ea

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “EA's Troubles Keep Getting Worse: Big Security Flaw Discovered In Origin Platform”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Re:

From the artech steam article. Basically it’s a “feature” not a bug and it isn’t going anywhere. Just don’t tell your browser to auto accept steam/origin urls and don’t click stupid links.

“Not all Web users are equally at risk to these kinds of attacks. Browsers such as Chrome and Internet Explorer present users with an explicit warning when they click a Steam link, telling them they’re about to open or use an external program, and Firefox asks users for confirmation (without explicitly warning of potential vulnerability). Browsers including Apple’s Safari and Webkit, though, allow Steam URLs to launch the program without any warnings, letting a potential attack go completely unnoticed. Many browsers that provide prompts or warnings by default can be configured to suppress them, so it’s possible attacks might work more widely, Ferrante said.”

nasch (profile) says:

Re: Re: Re:

Browsers such as Chrome and Internet Explorer present users with an explicit warning when they click a Steam link, telling them they’re about to open or use an external program, and Firefox asks users for confirmation (without explicitly warning of potential vulnerability).

Oh good. We know that putting up a confirmation dialog before executing malicious code is almost completely effective. People don’t get owned on a regular basis after clicking OK on a dialog they don’t understand.

Rick Falkvinge (user link) says:

I saw this presented live at Black Hat

I saw this exploit being presented to the world at Black Hat Europe last week (where sploits are typically presented on-stage before advisories are sent – happy to see that Revuln has published the details).

There was much applause.

Also, it should be mentioned that Revuln did a similar stunt against Steam, pointing out that a three-and-a-half-year-old exploit _still_ isn’t patched for most games on Steam.

In any case, the sploits depend on making the victim click a link on the attacker’s web page that open Steam and Origin, respectively, so there is some manual action required for pwnage. Still, I understand there are plenty of such links around with the effect of “join my clan” etc.

Short version of how the exploit works is that it forces a game update from another server than the official one. Some games even allow this update server to be supplied on the command line (!) and thus, once you have an URL with the command line to start, the rest is a matter of working around a few input sanitizers. In short, it’s broken by design and a few checks won’t help much.


Rikuo (profile) says:

Re: I saw this presented live at Black Hat

Oh hi Rick. Just wanted to say I really liked your “Who protects free speech” article on Torrentfreak. True, there is nothing in US style copyright law that actually encourages protecting someone’s speech: if you do the heinous act of merely carrying the message, you end up with your own head on the chopping block.

Huh…I wish that my gaming computer was still up and running. I’d totally mod the opening sequence in Skyrim to be about that.

Rikuo (profile) says:

Re: Re: I saw this presented live at Black Hat

Yes. The exploit is that you click a link on a website, and your browser asks what program should be used to open that link. Most users will have long set their browser to auto open all Steam links with Steam and ditto for Origin (fortunately, I’m not amongst that crowd). One thing you can do is have your browser ask you every time you do click on such a link. That way, the only time it should ask you is when you’re on the Steam or Origin websites. If it happens anywhere else, don’t allow the link to be run, because it can’t be trusted.

nasch (profile) says:

Re: Re:

This article actually mentions Steam but doesn’t mention that the same exploit happens in Steam so it makes it sound as if it only happens in EA and thus diminishes the article’s objectivity.

“As we have demonstrated for Steam in our previous paper, Steam Browser Protocol Insecurity, almost the same design problem applies for Origin.”

That isn’t explicit enough?

Akari Mizunashi (profile) says:

EA’s troubles can not get any worse. The company’s been at the bottom of the barrel for years now.

Saying it’s worse is like saying a flat tire is worse because someone stuck a nail in it.

The only way to fix the problem is to change it.

I don’t see that happening, even as the CEO bails while pulling on his golden parachute rip cord.

Anonymous Coward says:

Re: Re: Re:

This is the guy who stated that the Amazon hate-on for Spore DRM in 2008 was some sort of “cabal” of malcontents and/or/probably pirates, instead of a rather large expression of disapproval by fans of the game (which had been hyped for years before it was released).

Same guy who defended the use of Securom back in 2007 despite the proven problems it caused for paying customers.

Yadda, yadda. A disconnected CEO, color me unsurprised at anything except his resignation.

Rikuo (profile) says:

Re: Re:

About golden parachutes…when and how did they become the norm? Which Board of Directors was the first to say to a CEO applicant that even if he fucks everything up, he can still leave with a few million?
I can guess I can answer my own question with “No Board of Directors really cares about long term viability, only their own paychecks”.

Rikuo (profile) says:

Re: Re:

Uh dude…a quick glance at XCP’s wikipedia page tells me enough that its NOT the same code. A similar kind of malware? Yes, but not the same code. XCP allowed malware to run if it began with $sys$ and installed a device driver…hang on, I’m just gonna copy and paste

XCP.Sony.Rootkit installs a DRM executable as a Windows service, but misleadingly names this service “Plug and Play Device Manager”, employing a technique commonly used by malware authors to fool everyday users into believing this is a part of Windows. Approximately every 1.5 seconds this service queries the primary executables associated with all processes running on the machine, resulting in nearly continuous read attempts on the hard drive. This has been shown to shorten the drive’s lifespan.

Furthermore, XCP.Sony.Rootkit installs a device driver, specifically a CD-ROM filter driver, which intercepts calls to the CD-ROM drive. If any process other than the included Music Player (player.exe) attempts to read the audio section of the CD, the filter driver inserts seemingly random noise into the returned data making the music unlistenable.

XCP.Sony.Rootkit loads a system filter driver which intercepts all calls for process, directory or registry listings, even those unrelated to the Sony BMG application. This rootkit driver modifies what information is visible to the operating system in order to cloak the Sony BMG software. This is commonly referred to as rootkit technology. Furthermore, the rootkit does not only affect XCP.Sony.Rootkit’s files. This rootkit hides every file, process, or registry key beginning with $sys$. This represents a vulnerability, which has already been exploited to hide World of Warcraft RING0 hacks as of the time of this writing, and could potentially hide an attacker’s files and processes once access to an infected system had been gained.”

While of a somewhat similar nature, XCP and Origin do not use the same code. So please, be more precise in the future.

Anonymous Coward says:

should have gotten rid of him and the stupid ‘always on’ connection plus DRM a long time ago. EA have screwed up royally. it should, i hope, take a long time to get customer confidence back but only then if they drop all the crap they insist on including and having implemented in their games. whoever takes over needs to have a much more sensible approach and start treating customers as people, not criminals and stop worrying about piracy. if their games are pirated, it’s because they run better, are too expensive, dont have single player option and have to be connected to the internet indefinitely. ridiculous!! Sony started this crap and were backed by the USA courts. it hasn’t done them any good so far and wont in the future.

Ninja (profile) says:

Ah, Karma is a bitch eh? When they are arseholes towards the people and their customers they get divine punishment. Happened to Sony. Is happening with EA. The main difference is that Sony had plenty of other products to support the debacle. EA hasn’t.

Also, it’s much, much, much more probable that people will try to screw you up if you act like an arsehole.

I feel this eerie pleasure from seeing EA getting owned.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...