Slashdot Mirror
BioShock Installs a Rootkit
An anonymous reader writes "Sony (the owner of SecureROM copy protection) is still up to its old tricks. One would think that they would have learned their lesson after the music CD DRM fiasco, which cost them millions. However, they have now started infesting PC gaming with their invasive DRM. Facts have surfaced that show that the recently released PC game BioShock installs a rootkit, which embeds itself into Explorer, as part of its SecureROM copy-protection scheme. Not only that, but just installing the demo infects your system with the rootkit. This begs the question: Since when did demos need copy protection?"
I won't be buying. I was looking forward to this one, too.
The author even admits that he's just trying to get search engine traffic in the comments. It uses SecureROM, which regardless of your feelings on it, is mis-detected by Microsoft's Rootkit detection program. He even says in the main article it's not malware.
Okay, I was getting myself good and riled up over this piece of news. I was even ready to return the game first thing tomorrow despite it being a lot of fun. Then I did the unthinkable - I RTFA.
Seems this is a big load of nothing. SecureROM installs a service to let those running without admin privileges run the SecureROM stuff. This is kinda bitterweet - yes, SecureROM is bad etc but running as a restricted user is good. This is assuming you trust SecureROM's website which says (from TFA):
SecuROM(TM) will install a Windows(TM) service module called "User Access Service" (UAService) on your system. This is a standard interface commonly used by several other applications as well. It is no spyware or rootkit at all. This module has been developed to enable users without Windows(TM) administrator rights the ability to access all SecuROM(TM) features. Please be assured that this service is installed only for security and convenience purposes. Since it is a standard Windows(TM) service, you can stop and delete this service, like any other Windows(TM) service. If deleted, the access for non-administrator users to SecuROM(TM) protected applications will be affected. As opposed to TFA which makes it sound something sinister. However, I don't trust GamingBOB due to his own admission: Using "rootkit" brings the traffic. It's all about the SEO, and is why this article is on top in Google. I would add my own emphasis, but I don't think it needs it. Someone finds out a service is installed along with a game and demo and calls it a rootkit to gain traffic / links / ad revenue. Slashdot should not link to crap like this. It would be newsworthy if it were true: I think many people here - myself included - would return the game if it had a true rootkit installed along with it. But this...?I don't see the issue here.
If all you have is a grenade, pretty soon every problem looks like a foxhole -- MightyYar
This is pure FUD. The twat who wrote it even admits it in the comments:
Whether it is a rootkit or not, I'll let others more knowledgeable than me decide that but the comments in the article basically has the author admit that he ties the word rootkit and the game together to get better SEO. Not only is the article light on actual technical detail it declares fire where there may be a hint of smoke for the purpose of driving traffic. I know I must be new here..
I just can't be bothered.
This is why, after being a PC gamer for 20 years, I recently bought a console.
I got sick and tired of copy protection fucking up my machine, or refusing to run a valid copy because it didn't like my disk. (Medieval Total War and Diablo II being two games in particular that simply would not run on my hardware without a CD crack.)
Having to upgrade hardware every couple years was annoying, but it's all this crap heaped on me, who is trying to pay real money for games that pushed it over the edge. I'm sure I'm not alone. And yes, I know that Console games are protected too...but for console games, it's transparent to the user.
Note that I also paid for "Galactic Civilizations II", which was not protected, and the expansion will be the only PC game I purchase this year.
The cake is a pie
One word: TETRIS!
Good for certain uses anyway. I've participated in Iowa State University's Cyber Defense competitions as a red team hacker, and I've found they really help to take out the defending teams. Every team is required to run a regular Windows desktop that any user can access (the teams often play the part of universities or other facilities trying to secure a public lab), and it's fun to just walk up like a normal user, put in a "normal" music CD or game (courtesy of Sony), and then BOOM, rootkited. From there on, of course, things get easier... it's hard to remove malicious files when the OS won't let you know they are there :D.
Beware of bugs in the above code; I have only proved it correct, not tried it.
I'm not sure of the specifics of how these rootkits work, but if every piece of software we buy starts installing a rootkit, What is the probably they will conflict with each other and make the system less stable, and/or break the system completely? What kind of support or compensation is available once this starts happening. I find it very disturbing that they will install rootkits, or use non-standard CDs that don't work in a lot of CD drives (which used to happen a lot), making a terrible experience for the end users, while the pirates just modify the machine code, so it doesn't do any checks, and use the software without paying.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Devs like to hide things there because they know average users wont be able to easily change or find the information, which is why it's used to store CD keys and in the case of Bioshock, this "rootkit" nonsense. It's all a very windows-centric way of doing things too; having a central repository for virtually EVERY little configuration and customization. After spending some time in the Linux/BSD side the method of using individual config files still seems like the more logical, and technically superior way of handling configurations and settings. When I work with the registry I can't help but feel that things are intentionally obfuscated and muddled to discourage me from messing with anything. There are a few good examples of games that do it right, all the UT games use plaintext config files for the game settings. It still uses the registry for your CD key, but they are much better at keeping everything in the install directory than most other games.
If you build it, nerds will come. Soylentnews.org
The article title on the blog has just changed replacing the word Rootkit to SecuROM. I believe Slashdot has done the internet a great justice today. We just made a blogger correct himself and prevent future FUD.
(Remember, we are not your personal army.)
Just me
I used to buy a fair few more music CDs until the funny games they started playing to stop me playing my entirely-legitimately-purchased CDs on my PC. It was a gradual thing- I just started getting sick of half of my purchased music CDs not working when I got them home to listen to whilst I worked. Over time I just stopped buying them so often.
I used to buy a fair few more PC games. After some of the nastier games the bigger vendors started playing, I stopped buying larger commercial games and moved on to games made by smaller indies (okay, there were some other reasons to, but that's a discussion for another day). They are far less likely to install crap on your system or make you jump through hoops post-purchase.
Until recently. I purchased a game from a larger indie and then found out I had to "activate" it (after they got my money, of course). They "promise" it'll all be okay, they've got money aside in case they go out of business (which they'll never touch, of course, promise promise). But it's okay because "Windows does it too". I'd name-and-shame them but they did make an effort to make it right when I kicked up. And honestly, I don't want this fight. So let's just say it was a good indie game.
So I'll be buying less and less games over time, I guess.
So where are we now? Here I am, along with other paying customers, doing the right thing- and I get shafted as a result. I can get a better copy with less restrictions by going to the local warez-are-us. That copy won't stop working ten years later when the developer shuts down. It won't phone home and refuse to run. It won't refuse to run without a net connection sending God-knows-what to their activation server.
As a software developer I can completely understand the reason to protect your software from being casually distributed, but dammit- CD driver replacements, rootkits, web trojans, privilege elevation servers, surprise "activation". Why are you subjecting your legitimate customers to this nonsense, when the people ripping you off are just going to get it from someone who has already stripped this stuff out? Don't you realise the logical conclusion of making your product considerably worse that the warez version? Of making every software install a risk of hosing the system?
(Remember, we are not your personal army.)
/. wields quite a bit of power in terms of internet outcry. That's why we see so many troll articles; interested parties know that submitting their spin to /. will give their viewpoint a wide audience. That's why its important that we, as a community, take the time to investigate claims and discuss them based on fact (yeah yeah, I know). If we behaved more responsibly as a community, rather than jumping on every rabid bandwagon that comes our way, I think we would see a marked decrease in the amount of crap press releases being posted as "news for nerds". If people with an ax to grind needed to be sure that posting to /. wouldn't expose their lies, instead of just taking for granted the blog will be a group masturbation fest over FUD that affirms our deepest fears, they would think twice (maybe) before posting the more paranoid delusions that we see here.
I think you make an important point that is seldom stressed:
It really is our internet; we have no one to blame for what it is other than ourselves.
...sometimes, in order to hurt someone very badly, you have to tell that person terrible lies. - PA
I agree that programmers should be paid for making software, just like musicians should be paid for making music.
But only for making the software/music, not for the copies. So if an artist/programmer spends 100 hours making a song or programming an application, he/she should get paid for the 100 hours they spent, according to their hourly rate. Why do people think it's fair to get paid for work they actually haven't done ?
If you have a plumber install a toilet in your house, you don't have to pay a license fee for every person who wants to take a shit on it, you just pay him for the amount of time he's spent installing it. I don't see how music or software is any different.
First of all, your link to the forums goes to a thread about achievement points on the Xbox version of the game. This thread is much more relevant; it's about the rootkit.
Second of all, I, like many other people, was looking forward to Bioshock's release. I, like I hope many other people will do, refuse to buy it now.
Whether people thing of this as FUD or not, the simple matter of the fact is that:
2K Games has A FAQ about SecuROM that is, at best, contradictory in several places. They say:
However, Sysinternals' RootkitRevealer software begs to differ. Who am I going to trust, a game company that is practicing Defective by Design tactics, or Mark Russinovich, a software engineer who's proven time and again that he is the guru of this stuff, the guy who discovered the infamous Sony rootkit, the guy who knew Windows better than even the Windows people knew Windows, so well that Microsoft bought his company and hired him? I'll gladly cast my lot with Mark any day, even if he does work for Microsoft now.
2K Games also says in its FAQ:
They then go on to say:
Um... If SecuROM doesn't fingerprint my hardware, what is the "machine ID" that a hash is taken of and sent to their servers? And how the hell is it possible that changing several pieces of hardware might result in a required reactivation? The simple answer is, of course, that SecuROM does fingerprint your hardware, and 2K Games lied to our faces in the hopes that computer users who aren't as savvy as us won't get bogged down with the technical details and just read the part where they say that it doesn't fingerprint the hardware.
This is totally inexcusable, and I won't have anything to do with this company. Will the game be cool? Maybe, but nothing is cool enough to install this crap on my computer for. As far as I'm concerned, 2K Games has destroyed its credibility, and they can go to hell for it.
How the HELL did this get modded informative!!?
The summary never says that Bioshock is a Sony game. In fact, Bioshock isn't even mentioned until well into the summary, and it's clear that they licensed the software from Sony. The summary makes it crystal clear that Sony is the owner of SecuROM copy protection, the copy protection that Bioshock installs.
Are you on drugs? I mean, seriously, are you on drugs!? That's the only way I can think of to explain how stupid that sentence is. If Sony came up with the technology, and then the other guys decided to license it and use it, does this mean Sony had much to do with it? Hell yes, because they wrote it!!! Plus, there's also the little fact that they've done this exact same thing before that you're totally ignoring. Once is a lapse in judgement. Twice is a pattern. I wasn't what you call and anti-Sony-fanboy before all of this rootkit fiasco, but I sure as hell am now. If not wanting rootkits installed on my computer makes me a anti-Sony-fanboy, then I suppose I'm proud to call myself one, and for the mere sake of computer security, I highly recommend to everyone I know that they immediately become anti-Sony-fanboys too.
If I steal your credit card numbers, and then other guys decided to buy them and use them, does this mean that I had much to do with it?
Damn, there's dense, and then there's dense. You, sir, are the latter kind. By all means, feel free to riddle your computer with rootkits for the sake of playing a stupid game, and be happy that at least you know that you're selling your soul to the devil, unlike most of the non-computer-savvy users who will probably buy and play this game that are none the wiser.
If a plumber installs a toilet, you get one toilet. If you buy a copy of Bioshock, you get one copy of Bioshock. Only one person can use the toilet at a time, much the same with the copy of Bioshock.
-]Phreak Out[-
Not exactly, you're buying a LICENSE to play their game. SecuROM is NOT required to play their game, therefore it is NOT a requirement of the license. As such, it has no place in the game.
Worse, SecuROM actually PREVENTS you from using your computer in other commonly used, non-infringing ways. So by buying the game, you're actually buying the crippling of your system along with it.
You need to read again what SecuROM does. Where you have it installed is irrelevant. It actually alters your operating system in a manner that allows non-privileged applications to run as an administrative user. That means that at the very least, it can affect your entire Windows installation. And before you go with your "I've used Linux..." rationale, you should realize that it can also affect your Linux installation.
Here's how it could work. I write a piece of software that uses the elevated privileges that SecuROM grants to normal users without your knowledge or consent that goes in and wipes all non-recognized partitions on your hard drive. Voila, your system has been compromised because playing a stupid game whose publishers willingly opened up a security hole on your system. That's what I mean when I keep saying that even if 2K Games didn't have evil intentions, what they're unleashing on people can most certainly be used for evil purposes.
The thought that you are paying them for the privilege of having a rootkit installed on your computer and that you're okay with it quite disconcerting to me, but by all means, if the service of having your system compromised is worth $50 to you, go ahead. (There are lots of people who would willingly compromise your system for free, incidentally.) Personally, I find it disgusting that anyone can't see the bigger picture and would support a company that engages in these practices, but it's your computer and your money.
The problem with your logic is it totally ignores risk, reward, and performance. If you make a piece of rubbish "game" (like daikatana) according to you the team should make about the same amount of money as a group who make the truly transcendent Bioshock. And this isn't about the programmers anyway, its about the companies who finance them. A company can spend 20 million dollars to buy a bunch of programmers from India to make them a game according to a piece of paper you wrote. And another group can spend 100-200 million dollars to hire a team of experienced managers and coders and content developers to work together and make something worth actually buying. The risk of course, is that you wont make your money back and so make a loss. This is not a simple "make a house according to a plan". Thats totally naive. Any code monkey can make boilerplate code. This is about investing money and time and resources to create a product that sells a number of units to make the money back. All games are not equal, and do not cost the same to make. And finally, lets not even get into the differences between software and physical devices. Both take the same amount of time to create, but one needs to be sold per unit, while the other can be reused without limit. If we reach a point where that difference becomes the defining feature, nobody will bother making software -> they'll just start selling hardware that incidentally happens to play a single game. Look up dongles on wikipedia if you want to know what that future looks like.