EA's Troubles Keep Getting Worse: Big Security Flaw Discovered In Origin Platform

from the another-day,-another... dept

Perhaps the timing is a coincidence, but following the absolutely disastrous SimCity launch, in which EA's focus on DRM seemed to get in the way of actually making a product that works, it's been announced that CEO John Riccitiello is stepping down at the end of the month. This is clearly not a planned succession situation, because the company's former CEO, Larry Probst, who ran EA from 1991 until 2007 when he handed it over to Riccitiello is taking over as interim CEO as they search for a real replacement. Perhaps they should look for someone who recognizes that providing a good product that people want to support is a better goal than "stopping piracy." Just a suggestion.

Of course, they may also have bigger issues to deal with. Rich Kulawiec was the first of a few of you to submit the news that researchers have demonstrated a pretty big security vulnerability in EA's Origin platform (the company's Steam competitor), which can be used to exploit local vulnerabilities on the computers of about 40 million Origin users. If you'd like to see the hack in action, there's a nice video.
You can read the details directly, if you'd like, which comes complete with some graphics explaining how the security vulnerability, found in the URI handling of Origin, can be exploited:
You get the feeling that March 2013 is a month that EA would prefer to forget ever existed.


Reader Comments (rss)

(Flattened / Threaded)

  •  
    icon
    Gothenem (profile), Mar 19th, 2013 @ 4:51am

    Well then, now the people exposing this flaw can get 3.5 years in jail and pay $73,000 USD.

    Gotta love how our system works. You show a company that it has a security hole in their software, and instead of thanking you for exposing it so it can be fixed, they crucify you.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Mar 19th, 2013 @ 5:38am

    "...it's been announced that CEO John Riccitiello is stepping down at the end of the month"

    All I heard was:

    ka-ching
    fwoosh
    "So long suckers!"

    (that's the sound of a bonus being cashed in, a golden parachute being deployed and a CEO agonizing about the fact that he's been fired).

     

    reply to this | link to this | view in chronology ]

  •  
    icon
    Lonyo (profile), Mar 19th, 2013 @ 5:42am

    This is a broadly similar flaw to one apparently present in Steam and other URI handling applications, and isn't Origin specific.

    http://arstechnica.com/security/2013/03/bug-on-eas-origin-game-platform-allows-attacker s-to-hijack-player-pcs/

     

    reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Mar 19th, 2013 @ 6:44am

      Re:

      From the artech steam article. Basically it's a "feature" not a bug and it isn't going anywhere. Just don't tell your browser to auto accept steam/origin urls and don't click stupid links.

      "Not all Web users are equally at risk to these kinds of attacks. Browsers such as Chrome and Internet Explorer present users with an explicit warning when they click a Steam link, telling them they're about to open or use an external program, and Firefox asks users for confirmation (without explicitly warning of potential vulnerability). Browsers including Apple's Safari and Webkit, though, allow Steam URLs to launch the program without any warnings, letting a potential attack go completely unnoticed. Many browsers that provide prompts or warnings by default can be configured to suppress them, so it's possible attacks might work more widely, Ferrante said."

       

      reply to this | link to this | view in chronology ]

      •  
        icon
        nasch (profile), Mar 19th, 2013 @ 1:23pm

        Re: Re:

        Browsers such as Chrome and Internet Explorer present users with an explicit warning when they click a Steam link, telling them they're about to open or use an external program, and Firefox asks users for confirmation (without explicitly warning of potential vulnerability).

        Oh good. We know that putting up a confirmation dialog before executing malicious code is almost completely effective. People don't get owned on a regular basis after clicking OK on a dialog they don't understand.

         

        reply to this | link to this | view in chronology ]

  •  
    identicon
    Rick Falkvinge, Mar 19th, 2013 @ 5:44am

    I saw this presented live at Black Hat

    I saw this exploit being presented to the world at Black Hat Europe last week (where sploits are typically presented on-stage before advisories are sent - happy to see that Revuln has published the details).

    There was much applause.

    Also, it should be mentioned that Revuln did a similar stunt against Steam, pointing out that a three-and-a-half-year-old exploit _still_ isn't patched for most games on Steam.

    In any case, the sploits depend on making the victim click a link on the attacker's web page that open Steam and Origin, respectively, so there is some manual action required for pwnage. Still, I understand there are plenty of such links around with the effect of "join my clan" etc.

    Short version of how the exploit works is that it forces a game update from another server than the official one. Some games even allow this update server to be supplied on the command line (!) and thus, once you have an URL with the command line to start, the rest is a matter of working around a few input sanitizers. In short, it's broken by design and a few checks won't help much.

    Cheers,
    Rick

     

    reply to this | link to this | view in chronology ]

    •  
      identicon
      Rick Falkvinge, Mar 19th, 2013 @ 5:45am

      Re: I saw this presented live at Black Hat

      (Oh by the way, the reason I was at Black Hat was that I gave the opening keynote.)

       

      reply to this | link to this | view in chronology ]

    •  
      icon
      Rikuo (profile), Mar 19th, 2013 @ 5:55am

      Re: I saw this presented live at Black Hat

      Oh hi Rick. Just wanted to say I really liked your "Who protects free speech" article on Torrentfreak. True, there is nothing in US style copyright law that actually encourages protecting someone's speech: if you do the heinous act of merely carrying the message, you end up with your own head on the chopping block.

      Huh...I wish that my gaming computer was still up and running. I'd totally mod the opening sequence in Skyrim to be about that.

       

      reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Mar 19th, 2013 @ 5:58am

      Re: I saw this presented live at Black Hat

      If Valve and EA aren't keen to fix these issues is there something an end-user can do to protect themselves?

       

      reply to this | link to this | view in chronology ]

      •  
        icon
        Rikuo (profile), Mar 19th, 2013 @ 6:10am

        Re: Re: I saw this presented live at Black Hat

        Yes. The exploit is that you click a link on a website, and your browser asks what program should be used to open that link. Most users will have long set their browser to auto open all Steam links with Steam and ditto for Origin (fortunately, I'm not amongst that crowd). One thing you can do is have your browser ask you every time you do click on such a link. That way, the only time it should ask you is when you're on the Steam or Origin websites. If it happens anywhere else, don't allow the link to be run, because it can't be trusted.

         

        reply to this | link to this | view in chronology ]

        •  
          identicon
          Anonymous Coward, Mar 19th, 2013 @ 8:50am

          Re: Re: Re: I saw this presented live at Black Hat

          Yeah but what about the people that don't wait to take the extra 1/8th of a second to press enter or the extra 1/3 to click confirm.

           

          reply to this | link to this | view in chronology ]

      •  
        identicon
        Anonymous Coward, Mar 19th, 2013 @ 7:09am

        Re: Re: I saw this presented live at Black Hat

        Don't click steam/origin links in your browser.

         

        reply to this | link to this | view in chronology ]

      •  
        identicon
        sniperdoc, Mar 19th, 2013 @ 7:53am

        Re: Re: I saw this presented live at Black Hat

        Other than running a good AV product and running under USER credentials... not much. Even what I suggested isn't 100% fool-proof and probably would only catch known exploits such as the script-kiddy type stuff.

         

        reply to this | link to this | view in chronology ]

    •  
      icon
      gorehound (profile), Mar 19th, 2013 @ 7:44am

      Re: I saw this presented live at Black Hat

      Thanks for the Comment !

       

      reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Mar 19th, 2013 @ 5:45am

    This is the sort of copyright legacy that out_of_the_lube is cheering on? Well, now we know all along what colour the sky is in his godforsaken world.

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      Rikuo (profile), Mar 19th, 2013 @ 6:27am

      Re:

      Go back a couple of articles, to the one about the Library of Congress. He explicitly says that its all right for jazz recordings from the 30's to be degraded beyond hope of recovery thanks to insane copyright laws...simply because he himself doesn't like jazz.

       

      reply to this | link to this | view in chronology ]

  •  
    icon
    BentFranklin (profile), Mar 19th, 2013 @ 6:05am

    This article actually mentions Steam but doesn't mention that the same exploit happens in Steam so it makes it sound as if it only happens in EA and thus diminishes the article's objectivity. I know it's popular to kick EA this month but #candobetter.

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      nasch (profile), Mar 19th, 2013 @ 1:27pm

      Re:

      This article actually mentions Steam but doesn't mention that the same exploit happens in Steam so it makes it sound as if it only happens in EA and thus diminishes the article's objectivity.

      "As we have demonstrated for Steam in our previous paper, Steam Browser Protocol Insecurity, almost the same design problem applies for Origin."

      That isn't explicit enough?

       

      reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Mar 19th, 2013 @ 6:18am

    I always knew Origin was shitty software, but I didn't know it was a goddamn backdoor. EA's suck provides hilarity once more.

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      Rikuo (profile), Mar 19th, 2013 @ 6:26am

      Re:

      Ubisoft's Uplay was a backdoor too. That one involved installing a plugin into your web browser (without telling you of course) that would have allowed malicious websites to remote access your machine.

       

      reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Mar 19th, 2013 @ 10:00am

      Re:

      As much as I am loving this EA house of cards and the barn door, even Blizzard has issues with Battle.net compromised accounts that don't have authenticators.

      Let's not pretend that the utopia of being online and 100% safe even exists.

       

      reply to this | link to this | view in chronology ]

  •  
    icon
    Mega1987 (profile), Mar 19th, 2013 @ 6:29am

    Adios...

    We shall Forget you even existed....

     

    reply to this | link to this | view in chronology ]

  •  
    icon
    dennis deems (profile), Mar 19th, 2013 @ 6:29am

    Recursive link

    The hyperlink bound to the text "demonstrated a pretty big security vulnerability in EA's Origin platform" links back to this article.

     

    reply to this | link to this | view in chronology ]

  •  
    icon
    Akari Mizunashi (profile), Mar 19th, 2013 @ 6:38am

    EA's troubles can not get any worse. The company's been at the bottom of the barrel for years now.

    Saying it's worse is like saying a flat tire is worse because someone stuck a nail in it.

    The only way to fix the problem is to change it.

    I don't see that happening, even as the CEO bails while pulling on his golden parachute rip cord.

     

    reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Mar 19th, 2013 @ 6:44am

      Re:

      Actually, Riccitello had all the interesting ideas, and my understanding is that internal politics, rather than actual failures, are what have pushed him out.

      EA will now die within the next five years. Bank on it.

       

      reply to this | link to this | view in chronology ]

      •  
        identicon
        Anonymous Coward, Mar 19th, 2013 @ 9:08am

        Re: Re:

        This is the guy who stated that the Amazon hate-on for Spore DRM in 2008 was some sort of "cabal" of malcontents and/or/probably pirates, instead of a rather large expression of disapproval by fans of the game (which had been hyped for years before it was released).

        Same guy who defended the use of Securom back in 2007 despite the proven problems it caused for paying customers.

        Yadda, yadda. A disconnected CEO, color me unsurprised at anything except his resignation.

         

        reply to this | link to this | view in chronology ]

    •  
      icon
      Rikuo (profile), Mar 19th, 2013 @ 6:46am

      Re:

      About golden parachutes...when and how did they become the norm? Which Board of Directors was the first to say to a CEO applicant that even if he fucks everything up, he can still leave with a few million?
      I can guess I can answer my own question with "No Board of Directors really cares about long term viability, only their own paychecks".

       

      reply to this | link to this | view in chronology ]

      •  
        identicon
        Anonymous Coward, Mar 19th, 2013 @ 8:08am

        Re: Re:

        It's a function of lawyers, actually. CEOs can hire teams of lawyers to write contracts for them that guarantee golden parachutes and the company just has to accept it or find another CEO.

         

        reply to this | link to this | view in chronology ]

        •  
          icon
          dennis deems (profile), Mar 19th, 2013 @ 8:41am

          Re: Re: Re:

          "find another CEO" How hard can this be?? Business schools like Kellogg and Harvard publish the resumes of their grads. It's not as if candidates are hiding in a cave.

           

          reply to this | link to this | view in chronology ]

        •  
          icon
          akp (profile), Mar 19th, 2013 @ 9:10am

          Re: Re: Re:

          Man, now I want to be a CEO. Do no work, possibly leave the company worse than when you found it, cash out in millions after having spent years playing golf with my other CEO buddies.

          Sign me up!

           

          reply to this | link to this | view in chronology ]

      •  
        identicon
        Anonymous Coward, Mar 19th, 2013 @ 8:28am

        Re: Re:

        When headhunter companies started to get into the business. As soon as you have to force someone away from another job, the incentives have to be universally better than their current situation...

         

        reply to this | link to this | view in chronology ]

    •  
      identicon
      Michael, Mar 19th, 2013 @ 6:50am

      Re:

      It can get worse.

      Charles Carreon has shown us that no matter how bad things get, you can always dig the hole you are in deeper.

       

      reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Mar 19th, 2013 @ 8:26am

      Re:

      Two years in a row as worst company in america would seem like the next step. They seem to gun for perfection in user-alienation!

       

      reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Mar 19th, 2013 @ 7:11am

    Note to self, uninstall all EA products from computer when I get home.

    Note to self, make sure my computer deletes all of it's contents if I ever try to install another EA game, as it'll be less frustrating then trying to play the EA game.

     

    reply to this | link to this | view in chronology ]

    •  
      icon
      Rikuo (profile), Mar 19th, 2013 @ 7:19am

      Re:

      It actually would be less frustrating because at that point, all you're doing is formatting your hard drive and then reinstalling the OS, which is entirely up to you. EA? You have no idea when their servers are going to be up or down.

       

      reply to this | link to this | view in chronology ]

    •  
      icon
      Lonyo (profile), Mar 19th, 2013 @ 7:59am

      Re:

      Make sure to delete Steam as well while you're at it.
      And all your browsers too.
      And Windows actually.

       

      reply to this | link to this | view in chronology ]

  •  
    icon
    Wally (profile), Mar 19th, 2013 @ 7:30am

    It's as I mentioned before...they use the same code as XCP Audio DRM. It leaves you open to attack.

     

    reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Mar 19th, 2013 @ 7:38am

      Re:

      DRM is malware, nothing exemplifies that more than XCP.

       

      reply to this | link to this | view in chronology ]

    •  
      icon
      Rikuo (profile), Mar 19th, 2013 @ 7:44am

      Re:

      Uh dude...a quick glance at XCP's wikipedia page tells me enough that its NOT the same code. A similar kind of malware? Yes, but not the same code. XCP allowed malware to run if it began with $sys$ and installed a device driver...hang on, I'm just gonna copy and paste
      "

      XCP.Sony.Rootkit installs a DRM executable as a Windows service, but misleadingly names this service "Plug and Play Device Manager", employing a technique commonly used by malware authors to fool everyday users into believing this is a part of Windows. Approximately every 1.5 seconds this service queries the primary executables associated with all processes running on the machine, resulting in nearly continuous read attempts on the hard drive. This has been shown to shorten the drive's lifespan.

      Furthermore, XCP.Sony.Rootkit installs a device driver, specifically a CD-ROM filter driver, which intercepts calls to the CD-ROM drive. If any process other than the included Music Player (player.exe) attempts to read the audio section of the CD, the filter driver inserts seemingly random noise into the returned data making the music unlistenable.

      XCP.Sony.Rootkit loads a system filter driver which intercepts all calls for process, directory or registry listings, even those unrelated to the Sony BMG application. This rootkit driver modifies what information is visible to the operating system in order to cloak the Sony BMG software. This is commonly referred to as rootkit technology. Furthermore, the rootkit does not only affect XCP.Sony.Rootkit's files. This rootkit hides every file, process, or registry key beginning with $sys$. This represents a vulnerability, which has already been exploited to hide World of Warcraft RING0 hacks as of the time of this writing, and could potentially hide an attacker's files and processes once access to an infected system had been gained."


      While of a somewhat similar nature, XCP and Origin do not use the same code. So please, be more precise in the future.

       

      reply to this | link to this | view in chronology ]

      •  
        icon
        Rikuo (profile), Mar 19th, 2013 @ 7:46am

        Re: Re:

        Just to clarify, what you wrote could also be written as "Game 1 and Game 2 used the same code because they had the same effect"...even if Game 1 was written in Java and Game 2 was written in Python

         

        reply to this | link to this | view in chronology ]

  •  
    identicon
    jackn, Mar 19th, 2013 @ 7:50am

    You get the feeling that March 2013 is the month that EA stopped existing.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Mar 19th, 2013 @ 8:50am

    should have gotten rid of him and the stupid 'always on' connection plus DRM a long time ago. EA have screwed up royally. it should, i hope, take a long time to get customer confidence back but only then if they drop all the crap they insist on including and having implemented in their games. whoever takes over needs to have a much more sensible approach and start treating customers as people, not criminals and stop worrying about piracy. if their games are pirated, it's because they run better, are too expensive, dont have single player option and have to be connected to the internet indefinitely. ridiculous!! Sony started this crap and were backed by the USA courts. it hasn't done them any good so far and wont in the future.

     

    reply to this | link to this | view in chronology ]

  •  
    icon
    Ninja (profile), Mar 19th, 2013 @ 9:25am

    Ah, Karma is a bitch eh? When they are arseholes towards the people and their customers they get divine punishment. Happened to Sony. Is happening with EA. The main difference is that Sony had plenty of other products to support the debacle. EA hasn't.

    Also, it's much, much, much more probable that people will try to screw you up if you act like an arsehole.

    I feel this eerie pleasure from seeing EA getting owned.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Mar 19th, 2013 @ 9:47am

    As long as we allow monopolistic rights to be held by companies EA will not go out of business. I have no idea why professional sports are exempt from these laws, but it's probably not going to change until we get lawmakers in who are young enough to know what the major console brands are.

     

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
Follow Techdirt
A word from our sponsors...
Essential Reading
Techdirt Reading List
Techdirt Insider Chat
A word from our sponsors...
Recent Stories
A word from our sponsors...

Close

Email This