Slashdot Mirror
Street Fighter V Update Installed Hidden Rootkits on PCs (theregister.co.uk)
Capcom's latest update for Street Fighter V was installing a secret rootkit on PCs. An anonymous Slashdot reader quotes The Register:
This means malicious software on the system can poke a dodgy driver installed by Street Fighter V to completely take over the Windows machine. Capcom claims it uses the driver to stop players from hacking...to cheat. Unfortunately, the code is so badly designed, it opens up a full-blown local backdoor... it switches off a crucial security defense in the operating system, then runs whatever instructions are given to it by the application, and then switches the protection back on
Friday Capcom tweeted "We are in the process of rolling back the security measures added to the PC version of Street Fighter V." This prompted one user to reply, "literal rootkits are the opposite of security measures."
Friday Capcom tweeted "We are in the process of rolling back the security measures added to the PC version of Street Fighter V." This prompted one user to reply, "literal rootkits are the opposite of security measures."
Only a fool would install a game made by them after this.
Why are people STILL running WINDOWS and WINDOWS SOFTWARE?
This shit happens EVERY FUCKING DAY NOW!!! What the FUCK??
Sorry for the unwanted penetration. Please accept our apologies as we proceed to unfuck you.
I know ya'll in the tech industry love to poach employees from other companies... But REALLY Capcom!? Did you have to hire that guy from Sony !?!?
As opposed to figurative rootkits?
#DeleteChrome
I'm adding Capcom to my little boycott list.
Sure, that's not going to make much of a difference to their finances, but for what it's worth, my money won't be supporting their total misunderstanding of "security" and their abuse of other people's property and trust.
Telling others about misguided companies like Capcom and Sony may have a larger effect, especially as Xmas approaches.
The Sony DRM Installs a Rootkit.
https://it.slashdot.org/story/05/10/31/2016223/Sony-DRM-Installs-a-Rootkit
These acts should have been met with crippling penalties, but nothing changes....
You lose!
Cuntish behavior from a cunt company.
the code is so badly designed, it opens up a full-blown local backdoor
Sounds like antiviruses: they're supposed to fix problems and filter out malware, but such complex software requires excellent optimized algorithms and code, which unfortunately is still due.
Slashdot, fix the reply notifications... You won't get away with it...
I think people are too quick to whine about this stuff.
Every online game has anti-cheating stuff in it. Especially Korean MMO games. However things like Hackshield tend to make the computer running it behave poorly.
There's no "even handed" anti-cheating off-the-shelf software. Everyone either rolls their own, and you get stuff like this, or everyone uses crap like Hackshield and under-performing systems become completely unusable while it's running. Like, on a game that was designed in 2003, it shouldn't behave like it's running on a PC from 2003.
In the case of Street Fighter, honestly has a "PC" version of a console game ever not sucked? Even FFXIV, which was designed around PC/PS3 specs at the time, had to be redesgined to not totally suck the performance out of the machine. The result is that all the models lost some some complexity (all the female models lost butt curves so that they could all wear the same human armor.) The end result is that FFXIV for the PC has no anti-hacking protection what-so-ever.
So we have various examples of where anti-hacking tools do little or nothing (eg Hackshield in Archeage, Mabinogi, and so forth), overkill (Warden for WoW) , or the lack of anti-hacking tools (FFXIV) and honestly I prefer the non-shitty FFXIV experience to the Archeage and Mabinogi experience where the system would just straight up die randomly due to the anti-hacking tools.
The point is you can NEVER rely on the client side, so quit assuming players won't be assholes, and instead apply anti-hacking from the server end. Randomly check that packets are valid and investigate sources of invalid data.
SFV was already a mediocre, overpriced, overhyped and unfinished piece of junk. But this really is the dingleberry on top of the shit sundae.
Sic transit gloria Capcom. They really did make some awesome games in their time, but it seems today they rely on brand name alone to pump out turd after turd.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
This is similar to a bank forcing everyone to take a drug injection before entering. This increases the security of the bank by making everyone docile. The fact that customers can easily get mugged when they exit the bank is secondary.
So people are saying Capcom
But there's always 1 idiot who gave green light for this "feature" and knew EXACTLY what it meant
While I think the ultimate cause is the user's trust model (you don't stuff things you just found on the street into your mouth, do you?) [1], Capcom should be prosecuted for this.
[1] But still you give admin powers to some shady game installer, execute random Javascript your browser just found in the Intertubes and so on. Well, you *fucking deserve* to be pwned. Ah, but, but... it's sooo convenient. Your choice.
Like hogwash.
Literally.
Why make it hard on yourself? Just re-use your Ashley Madison login.
Il n'y a pas de Planet B.
Cracked software is the only software that has been given an independent in-depth review of its security measures. Buying uncracked software opens your computer to every malice the original author has stooped to in order to seize control of your computer.
And more often than not, the EULA makes it rather hard to get legal recourse for damage intentionally done to your computer. In contrast, a cracker inserting malicious code may go to jail for it.
I'd have liked to finish off this posting with "/s" but there really is no suitable placement for the starting sarcasm tag.
Such a driver certainly needs a EV code signing certificate, I assume Microsoft has revoked this by now? Preferably by blacklisting whichever company is in the certificate for all eternity.
Supposedly the code signing was required exactly to prevent such things, or is it maybe in reality all about keeping users out while letting the criminals do whatever they want still?
On the plus side, if Microsoft doesn't revoke the certificate that driver will be very useful to circumvent all kinds of Microsoft (and other program's) DRM.
Why make it hard on yourself? Just re-use your Ashley Madison login.
I thought the point of Ashley Madison was to make it hard.
Considering the whole mess that PC game was is a half-baked, barely ported console clone, one has to wonder whether that rootkit exists in the console version as well, and whether it can be used to gain control over the system...
Why should rootkits only work against the interests of the person owning... ok, that's saying too much, "being in the possession of" is a better term ... the machine?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Because people want to play video games...
Was does Windows have anything to do with couple of thousands games on Steam(*) that all run on any OS (Windows ; Mac OS X ; Linux) ?
Oh, yeah... "Triple-A games".
The kind of overrated content that rarely gets correct ports (Hi, Ryan Gordon, thank you for being the refreshing exception to this sad rule !), and is the most likely to b0rk your machine due to DRM (You know! Because "AAA" development costs a lot of money, and the "AAA" studios have to protect their revenue. By completely fucking the experience of their paying customer base).
If anything, today's DRM example is a big argument of why people should prefer the PirateBay version, and why I've personally downloaded cracks for any DRMed game that I've bought.
----
(*) : I know that Steam also uses some forms of DRM, but we have yet to have a FA on /. titled "Steam's own DRM causes a massive backdoor on all computers"
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Is this signed by Microsoft? Am I protected? Oh, I don't even play this game!
But Street Fighter V is available on Linux
Twinstiq, game news
And not to mention consoles. I have a Linux PC but not a very powerful GPU so I play games on consoles. Works fine.
Twinstiq, game news
Where is the intrepid prosecutor that throws them all in jail?
Oh, wait, the US police state does not do that to representatives of companies, because they might be able to fight back. Better to only do it to individuals that cannot defend themselves...
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
http://steamcommunity.com/grou...
Didn't know since I just game on console. With all the problems PC ports have anyway I find it too frustrating to play on that platform.
Twinstiq, game news
The only thing I wanna see is if this will result in a class action lawsuit like what happened in Sony's case back... in the 90s was it?
It'll say something about the current state of forgiveness for huge screw ups in this day and age of broken games and gamers being used as beta or alpha testers of new releases.
I'd rather just pay an extra 50 cents to continue than spend two days reinstalling windows and all my software.
God spoke to me
Isn't it great that the compassionate conservatism is still practiced?
Look at me, I only see what I want to see, thanks to my zeal for being ignorant!
You have the assessment skills of an idiot.
No, that's viagra spammers.
This sounds like another instance of proprietary malware to add to the list. And nobody should trust a proprietor to "roll back" their malware (just as some of the Twitter.com followups suggest), regardless of whether they say this was a mistake. There's no reason to trust unvettable, uncorrectable, unsharable code and there's no reason why people should have to live with months-old backdoors while the only programmers allowed to inspect or fix the code apparently don't fix that code.
Digital Citizen
UEFI eliminated all root kits without disabling the ability to install Linux. Oh snap!
This is a computer crime, bar none. No shades of grey here. So why aren't companies that pull this shit getting raided by the authorities and people being frog marched out of the offices in handcuffs? No too long ago, from what I heard, a student was facing serious prison time for tampering with a school's master calendar, yet these companies are damaging computer systems by the millions and at worst they face a lame lawsuit that they just write off as the cost of doing business. I am sick of it. And these same companies want to lock down, SECUREBOOT,and drm and fucking mummify everything so there is zero freedom to do anything without their blessing. Fuck this shit. If they law does not apply to them, it should not apply to me either. Maybe i should go and fuck their shit up, and get everyone else to do the same. Hak, crak and PIRATE! BANZAI!!!!!!!!
See, this is the kind of nonsense that an App Store protects us from; or at least tries to. If Street Fighter blah was a UWP program, it literally could not do this sort of thing. Microsoft are trying to divide the world into "belongs to the OS" and "available for Apps" -- increasingly, the role of the Operating System is to defend the User against the actions of Applications (compared to the traditional model that the Application was an agent for the User.) That's the big advantage of "Apps", they're in their sandbox and they cannot get out of it. Protects the user and the OS.
This does, sadly, mean sometimes we can't get good things - some useful features become denied to all applications because some applications behaved poorly and ruined it for everything.
No, that's viagra spammers.
True - I stand corrected, or is that erected?
I made a report to Steam about this rootkit when the news did so, and encouraged several others to do so. Despite this, Capcom was not told "GTFO and stay out" by Valve. I guess being a jerk to your customers is a bigger crime than compromising the security of a system.
Never buying a Capcom game again.
you hack us we hack you