Slashdot Mirror
GameSpy Sends DMCA-Based C&D To Security Researcher
chowbok writes "Luigi Auriemma has found several security holes GameSpy software over the past few months. He has reported them all to GameSpy but never got a response... until today, when he got a threatening letter from their lawyers. It says he's violating the DMCA, he needs to cease-and-desist, yadda yadda yadda." Update: 11/12 21:09 GMT by S : GameSpy has now posted an official response from the company's founder, Mark Surfas.
Always hating on the guy trying to enforce rigid security standards. Can't we all recognize that the only real harm caused would be by *not* reporting on these security holes. C&D letters only cause anti-corporate sentiment due to their rather accusatory tone. For shame. Good thing I don't use gamespy...
I'm not popular enough to be different.
Homer Simpson, The Simpsons
That's the sound of nobody being surprised.
Note for future reference: hackers, if you want someone to improve their security, don't go to the admin with your 'sploit, but anonymously release it into the wild. After all, the constant cease-and-decist letters _obviously_ say that that's what today's software companies want.
It is important to note that Luigi Auriema is in fact, an Italian citizen, and not a USian
Mirror here: www.outputservices.com/marty/mirrors/secfocus.html
To the Gamespy Feedback Page
I didn't think it was possible, but my opinion of Gamespy just went even lower. If it wasn't for them hosting old Nodwick strips, they'd have no redeeming values at all.
I mean, let's face it, anyone who wants to exploit Gamespy's servers probably already knows how to do so, this guy's bug reports notwithstanding...
Kierthos
Mr. Hu is not a ninja.
quote: I'm 22 years old and I live in Milan district in Italy. The DMCA doesn't apply to him. Cease and decist this!
so, incredulously, he asks whether bug research is a criminal act and bug researchers criminals.
Unfortunately, the answer today in America is a simple "yes". that is, unless you feel like researching and then hoarding your findings.
mmm... yeah... You see, we're putting the cover sheets on all TPS reports now before they go out...
One might think that notifying GameSpy about its security problems might be A Good Thing (R) because they could be fixed before being exploited. Just another reminder that, in the United States of America, no good deed goes unpunished.
There are two types of people: those prepared for the zombie apocalypse and those who will be eaten.
This makes a lot of sense, really! Let's let someone do all the work for us in finding security holes, have him come directly to us and tell us about the holes, have him keep them to himself instead of releasing them for everyone to use, and then tell him he's doing a BAD thing and he needs to stop!
I fail to see ANY logical reasoning behind this.
Use ventrilo. free and has a few different ports. My clan uses it when we play eve-online
This is a highly stupid move on GameSpy's part.
This guy wasnt posting his findings on the internet, or seeking publicity for himself; he was just using his skills to help out and try to improve GameSpy's product (and it needs all the help it can get, IMO).
If you ignore security, it will go away...
Manipulate the moderator system! Mod someone as "overrated" today.
Does the DMCA apply outside the US? How can this guy be breaking US and Federal law while carrying out his research in Milan, Italy? Chris
From the article:
"Bug research is a crime and bug researchers are criminals, didn't you know that?"
I know he's being sarcastic, but how long until he's correct ?
One more reason to despise the DMCA, I'm not even sure how it could apply - certainly the lawyer's reasons don't make any technical sense.
Simon
Physicists get Hadrons!
Laws are really needed to help protect people conducting security research and find problems and reporting them without doing anything malicious.
Having hackers poking and proding makes everything more secure ("So the first woodpecker to come along doesn't destroy civilization").
The only one winning here seem to be the lawyers.
1) Nice to another another justification for moving security research out of the US. So Alan Cox isn't a paranoid raving nut, after all... unfortunately.
2) It doesn't look like he's taken down the stuff, yet. Mirror time?
Someday, you're going to die. Get over it.
It would be nice to have a list of all of them all in one place so I can make sure to never ever pay money to any organization that has used the DMCA against someone.
I know what in trademark cases, companies have to enforce their trademark or risk losing it (i.e. xerox, kleenex, rollerblade) - but is there any similar clause in the DMCA which dictates that corporations must send cease-and-desists instead of taking these suggestions seriously? That seems to be the standard method companies employ in these circumstances, and I was wondering if it was a legitimate legal issue, or lawyers just being, well, lawyers.
"Good samaritan" acts like this tend not to go over well with companies when their products are on the line. They think we're just a bunch of reckless hackers trying to H4CK TEH PLAN3T! The thing they fail to realize is that by shutting up honest people like this via the DMCA and unleashing lawyers on white hats, then the only people left WILL be the bad guys. And frankly, I'd like to see some black hats get nasty on companies like this. This DMCA bullshit is getting tiring.
"Hell hath no fury like a woman scorned for SEGA. ..."
Publish all the exploits underground, as anonymously as possible. This way the exploits are in the wild and the sloppy code has to _fixed_ instead of covered up with a mountain of legal manure.
This is not what GS wants, nor what they mean. It is, however, what they are apt to get. Had they thought (ha!) things through this mistaken mistreatment of someone sending friendly warnings would not have occured.
Hey, GS. Why not try shooting at the real target? You just hit your foot.
I'll never get it:
Those guys researching security flaws in your software are working for free for your company. You just saved some money for security audits...
Be grateful, perhaps offer them a contract for more research, but don't threaten them with lawsuits. Some people may not like it and won't contact you before spreading an exploit.
Tread softly because you tread on my dreams. -- Yeats
What better way to get your bugs known by every technically literate person on the planet than to send a C & D letter like this, leading to a reference that gets posted on Slashdot as a home page story?
I congratulate Gamespy on their great word-of-mouth campaign to get all of their exploitable bugs known by the widest possible audience...
The party of stupid and the party of evil get together and do something both stupid and evil, then call it bipartisan.
I think the issue here is much less one of the right to publish and to speak, though of course in the end that will always be most important. This story is really one for universal concern because it exposes the way in which companies like Gamespy are spelling their own death by sending out these letters. It is publicly revealed information that inspires companies to take security seriously and act quickly toward hole-patching. There should be no doubt in anyone's mind that this information will be disseminated irregardless of its wide publication, and so challenges to security will still happen. Is it not in everyone's best interest that change-motivating embarrassing public releases of information like this be allowed? And plus, doesn't the even wider attention which a company stands to garner by sending out C&D's to avid exposers of flaws like this make them completely worthless?
Don't forget to report the letter to CHilling Effects
--You will rephrase your request for me to go to hell. Goto statements are not acceptable programming constructs
But it looks like the economic incentive to cover up rather than fix makes the concept of welcome full disclosure a myth akin in proportion to the commonly-misheld belief that chopsticks of course originated in Asia. Interesting story: the recently uncovered truth of the matter is that they were actually designed as a gimmick by immigrants cooking in American mining communities in the 1800s and later carried back to Asia as a less resource-intensive means of preparing and serving food. Ironically, the U.S. is the largest exporter of chopsticks, with something like 3% of U.S. lumber production going towards the effort to supply Asia, where chopstick use grew to outstrip other utensils within the last century.
The point is that when you look at the bigger picture, you realize that there is an economic disincentive to do the right thing; or rather, an incentive to do whatever it takes to improve the bottom line. I think it's unfortunate that they're choosing to punish an individual that was trying to help, and that it's this sort of attitude that drives good hackers underground. When code is owned by outlaws, only outlaws own the code.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
i haven't used Game spy in years... in my view its nothing but Addware every where... My best advice for every one is Stop using it and goto Kali
www.kali.net
I have been using it for years.. and its the best Gaming comunity every...
All his proof-of-concept exploits are on his website ... BUT, he did notify the company AND gave them lead time to fix each problem before publishing. Sounds like a perfectly responsible approach, similar to that used by university researchers here in the US.
I too must regretfully must send you a C&D letter base on the fact that your software violates DMCA laws by allowing unlawful access to copyrighted information stored on my computer and my network of computers. Until you can correct the programming errors in your software which allow this DMCA violation, I ask that you shut down all end user services provided by GameSpy.
Thankyou and good riddance,
HFC.
I think it also settles the question about full and limited disclosure. Limited disclosure is clearly a tool that allows lazy admins and developers to sit on their lazy asses while their company lawyers shoot the messengers.
What is needed now is an "official" infrastructure (mailing list/site/IRC channel/whatever) harboured somewhere with sensible laws and clearly geared toward transparent evaluation, discussion and discovery of security bugs in public software. Developers, admins and security experts welcomed, no matter their colour of their hats.
If users computers are broken in to as a result of not fixing known vulnerabilities I wonder what kind of liability GameSpy would have under US Tort law for being negligent.
Darthtuttle
Thought Architect
Time to update my Smoked Company Instant Poll:
Who smoked the most crack in 2003?
(_) SCO
(_) Belkin
(_) Verisign
(_) *A (MPAA, RIAA, ARIA)
(_) GameSpy
(_) All of the above
Ceci n'est pas une signature
For some odd reason the formating didn't paste into Slashdot...odd
I have always been a frequent visitor of Gamespy websites, be it the Gamespy site itself or the Planet sites, I've also been a long time FilePlanet subscribed. Yet this will cease to be the case forever now that I have been made aware of your recent C&D letter to a security researcher who was trying to help you fix the flaws in your software.
I'm outraged at your response for numerous reasons.
First of all I would have thought that a company such as GameSpy is well aware of the issues of today and would find a document such as the DMCA to disagree with their views and those of its customers. I like many if not most of your customers feel that the DMCA is a troubled and over reaching document that limits user rights, threaten research and lowers the need for true progress in the field of security.
Second, I am disgusted by your handling of security issues. If there are problems in your software then the way to fix them is with patches - not C&D letters. I would have expected GameSpy, a news site, to know that not once in the history of the DMCA has a C&D letter or even a full lawsuit ever fixed a security hole. Why attack the messenger?
And finally I am baffled by the fact that the person you have sent a C&D letter to has in fact notified you of the holes and means to fix them before posting them online. I do not see how suing somebody who has just done some valuable QA for you is justified. It's just absurd!
Imagine this, you are driving down the street in your car when all of a sudden the car behind you starts flashing your lights to get your attention, then pulls up to you and tells you that you're leaking gas. You instead of thanking the driver for making you aware of the risk you are under threaten him with a lawsuit because now that your gas leak has been noticed, somebody may light it.
This is what's happening now. You are attacking somebody who helped you. You are trying to keep your software secure by hiding its flaws. It's the same as the car with the gas leak; no matter how you hide it, it's still there and a spark can make it all blow up in your face.
Having said that, I will no longer be a customer of GameSpy, I will no longer visit any GameSpy affiliated site and I will contact every developer who promotes GameSpy services with their games to suggest using other services until some sort of public apology is offered to Luigi Auriemma.
Sincerley yours,
Google Toolbar is SPYWARE!
Then, for a joke, I tried the URL..
someone's already been there and done that.
I don't blame Gamespy at all. This jackass has basically enabled untold numbers of 12 year old pricks to tie up public game servers for their shallow amusement.
The general method of DoS he employs is not a "security flaw" but a byproduct of how multiplayer games are typically designed. You could theoretically do the same thing by going into an office and starting up a bunch of instances of the game on a bunch of PCs and logging into a server and leaving them there -- the "proofs of concept" that this guy Luigi wrote just automates this, simulating clients and hanging them.
The "problem" is that lots of games (hell, most network services of any kind) inherently require one TCP connection or UDP stream that stays alive throughout the entire multiplayer game and that begin with some authentication process, and most games only maintain a small number of slots (listening sockets).
Generous timeouts are also often needed to support spotty connections/freezes without disconnecting, so simply checking for timeouts might not help servers get past this issue. (However, maybe they could add some simple limit on how long a client can stay in the preliminary authentication/non-'playing' stages before booting them, requiring a prohibitively large amount of additional reverse engineering/sophistication to simulate a playing client.)
Getting around it will force game devs to play a stupid game of cat and mouse and to implement complicated challenge/response and other antispoofing mechanisms (IP banning, timeouts, etc.) -- time that could be, and ought to be spent on making fun games.
Too bad that Gamespy invoked the DMCA but that's probably the only legal leg they can stand on. Furthermore, Gamespy has nothing to do with the implementation of various game developers' servers.
Perhaps a better avenue would be for game devs to sue the guy for posting key gen algorithm internals and other shit like that.
I think though that breaking both his legs and giving him a donkey punch (#3) or dirty sanchez (3rd from bottom) would be more fitting, and funnier.
-fren
"Where are we going, and why am I in this handbasket?"
Where lawyers are pitted against each other in some sort of arena in the style of Thunderdome. "2 lawyers enter - one lawyer leaves". The victor wins the case and we get the added benefit of reducing the number of lawyers in the world.
The sort of street cred you get for having javascript errors on your site? I hear that's how these young punks rebel against their elders these days. It's the programmer's equivalent to wearing pants around your knees.
It's nothing but crumpled porno and Ayn Rand.
FYI, He is being tried under Norwegian law, nothing to do with the US DMCA. Look at This link. I know it is being appealed but this is the status now.
Help fight continental drift.
From the bottom of the page: Simple enough, eh ? The link in the story is currently not the recommended link...
"Whoever would overthrow the liberty of a nation must begin by subduing the freeness of speech."--Benjamin Franklin
On march 28th, italy implemented the EU copyright directive, which is modeled after the DMCA, but with fewer exemptions. All 15 EU members were supposed to adopt this by last december, but only a handful of countries have done it yet. The UK just became the sixth to adopt.
How did I get so interested in the DMCA? I recently interfaced the Ritz disposable digital camera to my computer, and didn't like how the DMCA has been used to stifle competition.
Text of the EUCD (eu copyright directive)
HIV Crosses Species Barrier... into Muppets
Yesterday,
Algorithms programmed in any way
Now it looks as though there's liabilit-ay
And, it's 'cause of the D-M-C-A
Suddenly,
I'm not allowed to speak in C
There's a shadow hanging over me
Oh how D-M-C-A makes silence be
How some bits do flow, you can't know,
We couldn't say
I said something wrong
now I'm among, law D-M-C-A-ay-ay-ay
Yesterday,
"code" was such an easy game to play
Now I need a place to hide away
And, it's 'cause of the D-M-C-A
Young man, you've been writing some code, I said,
Young man, think it ought to be showed, I said,
Young man, but what you shoulda knowed, is some
Things... must... be... left... un-said
Young man, there's a law that's been passed, I said,
Young man, we hoped it wouldn't last, but now,
Young man, if you break it, your ass will be
Hauled... a-way... to... Club Fed
We cannot stay with the DMCA
Get hauled away with the DMCA
You cannot circumvent
Any music or book
Can't even let your kid take a look
That's why we're flamin' the DMCA
Our guy was framed on the DMCA
The Man gives us rules
That we've got to obey
But encryption just gets in the waaaaaay...
Young man, there's no need to feel down, I said,
Young man, hide yourself underground, I said,
Young man, 'cause the Feds are in town, you know,
There's no place you can hide,
Young man, there's no place you can go, I said,
Young man, when they don't like your code, if you
Stay here, I am sure you will find
That you haven't got no more time.
(chorus)
You sir, I hope you understand, we're im-
Pa-tient, hope the Feds free our man, but no-
Bo-dy... can resist our demand, we'll shout
Til... they... free... D-mi-try
Dima's... fate lies in our own hands, so please
Help us... make them meet our demands, so call
D.C., make them send this young man, back to
His... own... home... and... fam'ly
(chorus)
Well what would be a better one? This: "Say you're walking down the street and somebody tells you that your shoe laces are untied and your stupid ass is likely to fall on your face and with your luck right into something a dog did and your stupid ass tries to sue them for it instead of tying your damn shoe laces!" That better?
Google Toolbar is SPYWARE!
Want to take over another user's identity, or just screw them in a ladder? Follow these simple steps:
1) make a new user with the same username as your target
As a loyal Gamespy user I was shocked/angered at your C&D letter to a bug finder. What you have managed to do is piss off a lot of people - some of which will probably now target these very vulnerabilities you've ignored for so long just because of your attitude.
The general sentiment on Slashdot is that the next time a hole in your software is found, it should just be anonymously published as a worm instead. God knows, no one wants to be sued, right? Using the DMCA and chasing after people like this is a waste of time and money (watch the futile attempts of the movie industry to control DeCSS as an example). Bottom line: FIX YOUR PRODUCT and STOP WHINING ABOUT IT.
I'm writing to other game manufacturers like EA who use your services to let them know just how dissatisfied/disgusted I am with you folks. I will never buy a product with your logo on it until I am certain you've corrected this issue appropriately.
BTW, what are we to think of a company who ignores bug reports from the wild - especially those that may concern the security of my system?
Not smart guys. Really.
"...Well, there's egg and bacon; egg sausage and bacon; egg and spam; egg bacon and spam; egg bacon sausage and spam..."
Your Cease and Desist letter to is utterly inappropriate. So, as a security analyst I'm going to take the next 5 minutes of your time to educate you as to what you did wrong, because we all know you'll do better in the future right?
1. Don't threaten us, we're trying to help you, contacting you quietly is a helluva lot better than say releasing the vulnerability into the wild first, but if you'd like to skip the contact step by sending things like cease-desist notices JUST SAY SO, as opposed to threatening us (see beginning of rule 1), we can move directly to putting the vulnerability into the wild.
2. Lawyers don't fix shoddy code, people do.
3. please get your legal department a map (so that they can determine that the DMCA ISNT the law of the land in Italy (it's this whole other place, right? and our laws don't apply there).
4. please explain in very short and simple words the difference between the gamespy CLIENT, and the gamespy SERVER to your legal and executive department, clearly such simple concepts elude them.
5. geektools.com contains links to traceroute, and whois programs to determine where on the internet various information is.
I would assume by this point you aren't particularly happy with me. So I'm going to let you in on a secret as to how to avoid such complaints from me again. It's very simple, treat us with respect when we protect your customers from you. Fix your bugs when we report them, they are YOUR REPSONSIBILITY. NEXT, send an APOLOGY letter to Luigi, just to show that you're good people and this was all a big mistake, because it was right? Do these things and you will find the computer security analysts will be good friends of yours, they'll look out for you and make sure your software runs right for you. Do it not, and the entire community will tear your software apart, and post anything and everything anonymously to bugtraq. Your behavior which borderlines on a legal fishing expidition to see what you can catch is grossly inappropriate, please stop.
Ooh and 1 meg pdf's sent via e-mail might in some circles be considered e-mail abuse, that doesn't engender much love for your company, and would potentially be grounds for a blacklisting.
Andrew D Kirch
Security Administrator
2mbit.com
Administrator
Abusive Hosts Blocking list
ahbl.org
trelane@2mbit.com
The exploits I read were for the most part buffer overflows... Which are the result of improper bounds checking and just general sloppy coding. This has NOTHING TO DO with Gamespy's servers, and everything to do with their client software. The guy claims he informed them, they claim he didn't. If he did inform them, then tough luck. They deserve any negative publicity out of this. If he didn't inform them, then he needs to be dealt with.
Proof of concept code often is the only way to force a company to do something about its security problems... It's specifically because 12 year old script kiddies are exploiting the vulnerability that the company fixes it. Suing a security researcher for bringing this about is silly. Spend the money on fixing the problem, not on a Lawyer's retainer.
Maxim: People cannot follow directions.
Increases in truth directly with the length of time spent explaining them
I have been in and out Bugtraq along the years, and it is pretty fine. But I was thinking of something more than a mailing list, probably a whole set of tools (site/irc/list/foruns) geared toward the discovery, publicizing and reproduction of security problems.
Given the enormous teen audience such a beast would attract I don't think it would be even possible to keep it up without the services of the very good moderators and the best security experts around. But them again one may dream.
And then you have the geographic problem. Such a place would have to be hosted somewhere with very liberal laws and a government capable of (and willing to) resisting the vast pressure the targeted companies would put on it.
First, it could be the code that GameSpy3D uses because that's entirely Joe, Tim and Jack. That's an entirely different product. That's Spy Software that holds the code itself, not GSI. It is hard to fix code you don't actually have!
Secondly, has he been giving them a chance to fix the code? Think about it, he's hacking a protocol that is nearly the same since Quake 2. That's how many engines you'd have to change to get a real fix in place. Hell, I have a friend who still plays Heretic 2 online! heh That's a lot of changes. So, I think they just want him to calm down while they fix the issues.
Finally, I will point out that Mark's nickname is Bastard, but he's not an entirely bad guy. He's been one of the few guys to survive the dotcombomb and not sell out completely. He has some business sense and is trying to protect his business. And a big chunk of his business is reliable internet servers and keeping people using his browser. Personally, I think the cause of reliable online gaming to be worth a 'stop a moment while we fix this stuff.'
Then again, I'm biased, I did run a server for four years for them.
Gonzo Granzeau
"Nothing the god of biomechanics wouldn't let you into heaven for.." -Roy Batty
I have no problem with the other things. If he figured out how to DDOS because of a gamespy bug, then that's just fine. That is definitely the kind of thing that people like him should be figuring out and sharing with everyone.
Project Steve
"Half-Life 1.1.1.0 client's "Unknown command" format string bug test 0.1 This is a tool to test a format string bug I have found in the Half-Life client. I have not released an advisory because at the moment I don't know if this bug lets remote code execution or not. Feel free to check it (in the zip file there is also the mail I have sent to vuln-dev that contains some details)"
In this case he's posting source for the exploitation of a bug before HE EVEN KNOWS WHAT THE BUG DOES. This makes me doubt how responsible he is in informing companies of bugs in their products. How about this changelog in the source of his UTDDos attack:
"CHANGELOG: - Now supports UT2003 servers!!! - better allocation method (now it's not limited, and the memory used is very very small!) - big code optimizations - a lot of bug fixes (libnet name resolution and other little problems)"
Why would these changes be necessary for a proof of concept? Sounds more like he wants anybody to be able to easily compile and use his programs to exploit not just UT servers, but UT2003 servers as well.
I think hackers should have as much restraint as possible in releasing "proof of concept" programs. Because really, what do these programs do? It does exactly what you are afraid people will do with the bug you found, exploit it. When you release that to the public, you are ENSURING that the bug will be exploited. Only in extreme cases should this be used to force a company to fix a bug, because at best the result is a brief period of time in which the bug is exploited widely, before the company fixes it. However, I think there is a serious risk of more harm being done in this period of time than would have ever been done if the proof of concept program had never been released, and the bug taken longer to be fixed or perhaps not fixed at all.
This guy is obviously not using proof of concept programs as a last resort. In fact, check out this comment:
"CD-Key hash changer for UnrealTournament 2003 v2225 for Win32 0.1 practically this proof-of-concept lets you to use a custom cd-key hash. The main idea was to find a cd-key theft bug but fortunally this bug doesn't exist so this tool can be considered only a test just for fun"
He wants people to use it "for fun"? What kind of white hat hacker releases a proof of concept program for "fun"? If I read this right, he was hoping to be able to steal CD keys with this, which he probably would have released as well. That would of been a huge mess, and is what I mean when I say there is serious risk of a concept program doing a lot more harm than good. So, it turns out it only lets you use other people's CD hashes, which you can get just from joining a game. This would allow you to steal someone's CD hash that you didn't like, and then go make a total ass of yourself on a server and get him banned. Sounds "fun" don't you think? Gamespy may not be my favorite company, but this guy give hackers a bad name.