Flightsimlabs installer has malware

[BSim500]

what are you defending? Your right to steal?

You've gone from asking sensible questions and a former half reasonable debate to simply shouting the same baseless lies about EULA's over and over before finally constructing the dumbest "false dilemma" based strawman ever in the style of "unless you agree with me that lynching drivers who do 31mph in 30mph zones is acceptable, then you must support letting drink-drivers who kill off the hook". Enjoy trolling yourself from now on...

 

[JSt0rm]

thats a fair point. What are you defending?

 

[Ranulf]

thats a fair point. What are you defending?

People's privacy rights and preventing id theft. When you start hiding processes in the windows system directory, I'm going to take a dim view of your attempts at retribution towards software pirates.

https://www.hardocp.com/news/2018/06/29/100_dlc_comes_password_stealing_malware_for_drm

"As shady as that is, it is not the end. FlightSimLabs removed the "test.exe" from the addon's installer after backlash from the community, however a new shady file has been found called "cmdhost.exe." This file inserts itself into the windows system, and syswow directories. Deleting or not installing the "cmdhost.exe" will cause your game to not run. A user submitted this file to HitmanPro, an anti-malware program, where it was found to be a "hollow process." Ronny from HitmanPro support states."

Now imagine if some hacker gets ahold of that program or one of their employees goes rogue.

Ars article on the Reddit threats: https://arstechnica.com/gaming/2018/06/flightsimlabs-threatens-reddit-mods-over-libelous-drm-posts/

 

[JSt0rm]

People's privacy rights and preventing id theft. When you start hiding processes in the windows system directory, I'm going to take a dim view of your attempts at retribution towards software pirates.

https://www.hardocp.com/news/2018/06/29/100_dlc_comes_password_stealing_malware_for_drm

"As shady as that is, it is not the end. FlightSimLabs removed the "test.exe" from the addon's installer after backlash from the community, however a new shady file has been found called "cmdhost.exe." This file inserts itself into the windows system, and syswow directories. Deleting or not installing the "cmdhost.exe" will cause your game to not run. A user submitted this file to HitmanPro, an anti-malware program, where it was found to be a "hollow process." Ronny from HitmanPro support states."

Now imagine if some hacker gets ahold of that program or one of their employees goes rogue.

Ars article on the Reddit threats: https://arstechnica.com/gaming/2018/06/flightsimlabs-threatens-reddit-mods-over-libelous-drm-posts/

imagine if those people didnt steal the software. No problems.

 

[aigomorla]

imagine if those people didnt steal the software. No problems.

2 wrongs dont bring a right.

You start messing with other people's info, or create back doors, your asking for a legal world of hate.
Also what if its a child in your home that did it, and it back door'd your PC which lead to a whole lot of PW's being stolen.

That wont hold in court when you say, a member in the house pirated a XX$ software which lead to the Id theft costing thousands or tens of thousands.

The software company just signed a death note in court with class action law suits being lined up against them.

Even steam went though a whole bunch of legal problems when they took anonymous stats on hardware people had running steam. Hence now they ask for participation, and the option to Opt out of such stats.

 

[JSt0rm]

2 wrongs dont bring a right.

You start messing with other people's info, or create back doors, your asking for a legal world of hate.
Also what if its a child in your home that did it, and it back door'd your PC which lead to a whole lot of PW's being stolen.

That wont hold in court when you say, a member in the house pirated a XX$ software which lead to the Id theft costing thousands or tens of thousands.

The software company just signed a death note in court with class action law suits being lined up against them.

Even steam went though a whole bunch of legal problems when they took anonymous stats on hardware people had running steam. Hence now they ask for participation, and the option to Opt out of such stats.

how is the ability to opt out any different to a eula? And if they are wrong then sue them. I would counter sue as you pirated my software but sure go ahead and sue. Or dont steal.

 

[aigomorla]

how is the ability to opt out any different to a eula? And if they are wrong then sue them. I would counter sue as you pirated my software but sure go ahead and sue. Or dont steal.

Ok you can sue me for 500 dollars for software theft..
i'll sue you the 1 million dollars your software brought ID theft to in class action.
And also all the others whom suffered from your software as well.

Who do you think is going to hurt more?

Your software is a malware which is designed to cause harm to people who have it.
Even if it was aquired illegally, its still designed to cause harm which will hold you liable at court.

 

[JSt0rm]

Ok you can sue me for 500 dollars for software theft..
i'll sue you the 100,000 dollars your software brought ID theft to.

Who do you think is going to hurt more?

I can sue you for whatever i want. Its up to the judge to decide if the amounts are correct.

 

[JSt0rm]

also you would need to prove I was the cause of your id theft.

 

[aigomorla]

I can sue you for whatever i want. Its up to the judge to decide if the amounts are correct.

no its not.. its up to the lawyers... do you have any clue on how the legal system in class action really works?

The lawyers bring bills upon bills until the company decides to settle.
Rarely does it ever goto the judge, it just eventually settles outside court.

also you would need to prove I was the cause of your id theft.

Your software created a back door, that is all the proof one needs.
Its up to you to prove that your software did something outside what it was not intentionally designed as.
Which again, first line, was proved to have done.

....

Seriously it seems your completely lost in how class action works, and how American Lawyers abuse the hell out that system.

 

[JSt0rm]

the judge can change settlement amounts. This is absolutely within the judges prevue.

At any rate we has 2 issues here. Unenforceable laws about piracy and companies saying Im gonna fix it myself with these deterrents.

 

[JSt0rm]

also how many pirates are going to join your class action? lmao. "Yes, I stole this software" I mean really.

 

[XavierMace]

maybe if more software companies used things like this to protect their software we would have less pirates?

Maybe you should stay in P&N where your ridiculous arguments are accepted.

 

[XavierMace]

also how many pirates are going to join your class action? lmao. "Yes, I stole this software" I mean really.

Maybe you're missing the part where the malware is included regardless if you pirated their application. It's just only used (supposedly) if you pirated it. This opens them to being sued by any/all of their legit customers. It's also not clear if it's uploading data from all Chrome profiles on the system. If so, this opens them up to being sued by people who just happen to share a computer with the pirate. Oh, and don't forget this information is being uploaded in clear text to a server with RDP open to the world. So, no chance of some other 3rd party acquiring this database of info given they've already been hacked. Let's play this out, best case scenario for them.

They successfully have every person who pirated their software prosecuted with the maximum sentence of 5 years in prison and $250k fine. That's never going to happen, but lets pretend it will. I don't know how many people that is, but I can't see it being a lot in the grand scheme of things given this is a specific mod for specific applications. They obviously aren't gaining any new customers from this but FSL is now basking in the glory of their moral victory. It's doubtful if any of the pirates people have $250k, so they'll probably file for bankruptcy making FSL's victory seem all the sweeter to them.

Now, each one of those pirates (either individually or class action, take your pick), have FSL prosecuted for unlawful use and access, access for fraudulent purposes, data theft, and identity theft. It's an open and shut case given the company openly said they did it. Wire fraud isn't a stretch either. Perhaps child endangerment if there's PII for minors involved in this. If this server they're storing all the info on gets hacked, by the time these pirates get of jail they're never going to have to work again as they're going to be laughing all the way to the bank. And that's just against normal people and their personal computers. If this happens on a business system, the businesses can get involved on this too. Even better, hacking a computer belonging to a government official cranks the punishment up to 11.

Hell, I wouldn't be surprised at this point if some people go download the pirated copy just to try to cash in on this if it completely blows up.

And that's just in the US. They're going to get destroyed in the EU as well as this is a gross violation of GDPR and the company flat out said they were doing it so there's not much to prove. This was a colossally bad idea and there's no way it's going to end well for them.

 

[mikeymikec]

https://en.wikipedia.org/wiki/Tit_for_tat

And if FSL's algorithm for spotting pirate users is incorrect in some way, then that's acceptable collateral damage, or what?

 

[BSim500]

And if FSL's algorithm for spotting pirate users is incorrect in some way, then that's acceptable collateral damage, or what?

FSL's support forums already include paying customers having issues no different to a legally purchased Steam key occasionally being invalid by mistake. But some people are so emotionally unbalanced with their obsession over extra-judicial "punishments", that dropping a 35,000lb Daisy Cutter on a pirates house wiping out the next door hospital & orphanage would be deemed "acceptable collateral damage" 'because i'm sure that's in the EULA'...

Although imperfect, there's generally a good reason we have a legal justice system and due process in the first place, despite some being a little slower on the uptake than others to figure out why...

 

[JSt0rm]

Maybe you should stay in P&N where your ridiculous arguments are accepted.

Is software piracy a politics and news topic? Or do you just not like my viewpoint and want me to "go away"

 

[Ranulf]

imagine if those people didnt steal the software. No problems.

And when ID theft happens due to their hacked data and I'm a paying customer with receipt to prove it? And people wonder why I'm willing to pay more for DRM free products at times. They're hiding stuff in windows system files now for pete's sake. I'm supposed to trust them? While I might be sympathetic to the devs/publisher's cause for their supposedly great $100 plane model, you act as if the business world has a great track record of security of their own systems and how often those companies just shrug their shoulders when the bad things happen.

 

[JSt0rm]

And if FSL's algorithm for spotting pirate users is incorrect in some way, then that's acceptable collateral damage, or what?

Its based on known pirated keys I believe.

 

[Fallen Kell]

Its based on known pirated keys I believe.

So the moment someone generates an auto-key generator which then spits out a key of a existing user and it is posted online, then the user who validly purchased the game and gets his/her (and all other users of the computer it is installed on) usernames/passwords stolen is "ok"?

JSt0rm, I'm sorry, you will never win this argument on this. The US and European law strictly doesn't allow this behavior on computer systems. In fact, each username/password it collects can each be treated as a separate offense (actually each installation of the software which can collect such data can be treated an a separate offence, as the act doesn't require that anything be stolen, just that an attempt was made). It can in fact be found to be a violation of the Computer Fraud and Abuse Act (Title 18, Part I, Chapter 47, 1030) sections : (a)(2)(C), (a)(5)(B), (a)(5)(C), (a)(7)(B), (and possibly (a)(2)(A) if they (or facilitated someone else) to login to a banking/financial system using the information), resulting in upwards of 20 years imprisonment. And that would be for each and every installation of the software, not just the cases where it activated (as the CFAA considers any attempt to do any of the above the same as actually doing it).

It gets much worse once people have to spend time to repair their computer and reset logins/passwords, as the time spent doing so is calculated into damages. Once damages exceed a certain level (and it will with this many offenses), additional penalties start.

This is why people like Aaron Swartz committed suicide when charged with abuses against this statute. His was only for total 11 violations, which included $1 million in fines, I can't calculate how much in fines would result from the potential hundreds, possibly thousands of separate violations FSL committed.

And has been held previously by multiple courts, agreeing to something in a contract, does not make an illegal act legal. And on top of that EULAs have been ruled time and time again that they are not necessarily legally binding contracts depending on the terms in them, as it has been found that you can not place terms which exceed rights granted under federal, state, and local laws within a EULA.

 

[mikeymikec]

So the moment someone generates an auto-key generator which then spits out a key of a existing user and it is posted online, then the user who validly purchased the game and gets his/her (and all other users of the computer it is installed on) usernames/passwords stolen is "ok"?

Or someone mistypes their key and ends up inputting a 'pirated' key, or what always happens when someone takes the law into their own hands - they get overzealous.

 

[JSt0rm]

both highly unlikely events.

 

[mikeymikec]

both highly unlikely events.

Highly likely you mean. Unless you wish to tell me that you've never mistyped a product key in your life, and that various DRM-related fiascos somehow passed you by without you noticing.

I've typed a hell of a lot of product keys in my time, and I'd say I have a 25% failure rate due to stupid things like B's and 8's looking similar, or l, I or 1 looking similar with no frame of reference, or just pressing the wrong key because derp.

 

[JSt0rm]

Highly likely you mean. Unless you wish to tell me that you've never mistyped a product key in your life, and that various DRM-related fiascos somehow passed you by without you noticing.

I've typed a hell of a lot of product keys in my time, and I'd say I have a 25% failure rate due to stupid things like B's and 8's looking similar, or l, I or 1 looking similar with no frame of reference, or just pressing the wrong key because derp.

i dont think you know how product keys work.

 

[mikeymikec]

i dont think you know how product keys work.

I don't think you do either if you think every software maker's algorithm is the same. But by all means dodge my DRM argument and others if that makes you feel better.