Slashdot Mirror
'Irresponsible' Google Refused Fortnite's Request To Delay Vulnerability Disclosure To Score Cheap PR Points, Says Epic's Chief (bbc.com)
The leader of the firm behind the hit game Fortnite has accused Google of being "irresponsible" in the way it revealed a flaw affecting the Android version of the title. BBC, with additional input from Slashdot staff: On Friday, Google made public that hackers could hijack the game's installation software to load malware. The installer is needed because Epic Games has bypassed Google's app store to avoid giving it a cut of sales. Epic's chief executive said Google should have delayed sharing the news. "Android is an open platform. We released software for it. When Google identified a security flaw, we worked around the clock (literally) to fix it and release an update. The only irresponsible thing here is Google's rapid public release of technical details," he said. "We asked Google to hold the disclosure until the update was more widely installed," tweeted Tim Sweeney. "They refused, creating an unnecessary risk for Android users in order to score cheap PR points."
cuz epic is make billions off this game and they don't get any.
Google isn't playing nice. Don't get a cut of the profit? Well screw your security alerts.
~ People that think they are better than anyone else for any reason are the cause of all the strife in the world.
Why turn it around on the distributor? Politics or no, Epic failed.
I'd at least like to hear Google's side of this first.
Would hate to unpack the pitchfork for nothing and all that.
If an application is allowing malware to be sideloaded, the users have damn well a right to know about it.
Not because of disclosure, but because of Trump! Trump and Teh Trump Mob are their own best enemy. God Save America Again!
#GSAA
I guess what Google is really saying here is if you find any zero-days in Android, publish them right away. Never mind this silly 'responsible disclosure' that companies like Google make noises about supporting.
It's not clear what level of ownership Google should be expected to take on this. It seems to me that they technically did more than I'd feel obligated to in their shoes. Epic appears to have been responsible for the bug, Google appears to have found it for them. Honestly I think they already went the extra mile right there.
Of course if Epic used the app store, then I'd expect a more appropriate arrangement of identification, fix and announcement.
Dumbtard Epic... the method is known (man in the disk type of attack) and it should have been a major concern of everyone at least since this years DefCon when it was shown on several applications... two weeks past and Epic is crying that Google didn't give them more time? Sod Epic, bunch of incompetent fools.
you did
why did you release software with that flaw in the first place Epic?
Google has nothing to lose by delaying disclosure of an exploit that isnt even in its ecosystem...
however...google has everything to lose if the idea of operating outside its walled garden catches on.
Good people go to bed earlier.
Google followed its own guidelines. Their guidelines are that they will release the details when the first of 2 things happens, either 90 days has expired OR a general availability patch has been released. The second happened, but Epic wanted google to violate its own guidelines for them.
The problems is in bypassing the play store they did open themselves up some and now they want google to change, not them.
When you cant win, ad hominem.
creating an unnecessary risk for Android users
This shitty installer is the actual risk. Hilarious how the companies that produce shitty code always blame the ones who discover their flaws.
sudo rm -r -f --no-preserve-root /
So they bypass the App Store to avoid paying Google, then they fail to spend the money they saved to provide one of the most important benefits of going through App Store. Oh.
"We asked Google to hold the disclosure until the update was more widely installed," tweeted Tim Sweeney. "They refused, creating an unnecessary risk for Android users in order to score cheap PR points."
Allowing the unpatched game to continue running also unnecessarily risks Android users. Doesn't google have the ability to delete an app in Android? If so perhaps they should have deleted the unpatched game versions?
Looking forward maybe google should have the ability to lock out a vulnerable version of an app. Don't delete it, just prevent it from running, only allow it to be updated to a newer version.
"Google is irresponsible and at fault that we have a vulnerability in our installer. Clearly this vulnerability is someone else's fault and not ours. Google announced it too early, therefore we're not responsible for our own vulnerability."
Except when it is in our best interest.
Which is usually.
The moment a patch is released attackers have the opportunity to reverse engineer the patch to find the vulnerability regardless of whether there is a subsequent disclosure or not. By this vulnerability being widely circulated in the press its more likely users will upgrade or uninstall than hoping users launch fortnite in the next 90-days. I imagine the real issue Epic has here is that they do not want the bad press leading to users who downloaded Fortnite to try uninstalling.
Gp stated correctly that this serious vulnerability would not have existed had Epic not insisted that users disable security protections. That's a fact. Not a wish, not a "best possible future", but a simple fact.
Kinda like the fact that all your money you've been paying into Social Security is gone. It's been spent. It's not sitting there waiting for you to get it when you're older. Wishing things were different doesn't change the facts.
Google jumped at the chance to punish out of spite, because Epic chose to operate its own store. This is how it looks.
When all you have is a hammer, every problem starts to look like a thumb.
Comment removed based on user account deletion
Everybody has their own rules and guidelines around responsible disclosure. We need an organization like like the IEEE or ACM or CERT to make standard practices for this. This is important because there is always a question of liability. I'd like to know that if I followed the IEEE rules for responsible disclosure that I can be reasonably sure that someone can't sue me.
It's very simple, and it's not what this headline says.
Epic decided to forgo the Play Store for releasing Fortnite.
Google said "Okay, but this sort of thing can make our platform less secure. Be careful out there."
Epic releasesd an installer for Fortnite that could install Fortnite without the Play Store.
Google looks at it, and sees that it can be used to install more than just Fortnite, because it contains some stupidCode that can be used to install all sorts of malicious things because someone at Epic was very careless.
Google tells Epic about this lame bit of coding, and tells them they've got seven days to fix it because it would be really, really bad if this were exploited by someone who wanted a whole lotta phones on their DDoS botnet (for example).
Epic says "We believe we have 90 days to fix it" and releases a new installer without the stupidCode in it.
Seven days goes by, Google releases details of the stupidCode so that other people can learn from and not make this same foolish mistake.
Epic throws a tantrum.
The TL;DR is that this wouldn't have been a problem if someone at Epic hadn't decided to just throw an installer out there without looking at it carefully first, and Google probably should have given them 30 days instead of 7, but probably gave them only seven days because it lets them reinforce their point that poorly-written third-party installers are bad. Epic gave them reason to do that when they started talking to the press and basically whining about the Play Store cut as if Google did nothing to deserve any money (because it's so obviously both easy and free to build and maintain a giant marketplace with some semblance of standards), and Google appears to have noticed that if they ignore the tall tales "web reporters" spin, they eventually wind up having to explain complex concepts to state Senators and that tends to be very expensive.
Google can do that for Play apps. This whole pissing match started because Epic decided NOT to publish Fortnite on the Play Store.
If they can remove a Play app then they can remove a non-Play app. They may not do so currently but that is a choice not a technical issue.
"Boy, that's a nice independent game distribution model you have going there. It would be a shame if something happened to it . . . "
That's really childish of google, especially as Google is only using the 7 day deadline when it's due to a security risk if it's already being actively misused, but it isn't. Normally they have 90 days (or sooner if they notice it being actively being misused).
So why did they release it with the 7 day deadline? well we all know why...
> we worked around the clock (literally) to fix it
So they put a clock in the middle of the room and arranged their desks around it?
My phone is already insecure: the OS has received 0 patches. Microsoft does not leave it to Dell or ASUS to patch Windows and nor do FREE Linux distributions. Apple does not demand that Foxconn distribute iOS patches. As the only OS vendor to require hardware vendors to patch their OS, Google is unreasonable, irresponsible and arrogant. Google monetizes my data and targets me with ads, while refusing to patch the software they use to do it.
Lots of people install the Amazon App Store and pay for games through that source.
It does appear that Google wanted to make an example of Epic specifically, in the hopes that more app developers will be cautious to follow.
You obviously know how much it costs to run the play store, so break it down.
Whoops Tim. Only a few weeks ago you told Forbes:
Avoiding the 30% “store tax” is a part of Epic’s motivation. It’s a high cost in a world where game developers’ 70% must cover all the cost of developing, operating, and supporting their games. And it’s disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We’re intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.
You forgot about some other services performed by the Play Store. Automated analysis of your code for security issues. Automated roll-out of your updates to users. And in some cases - for very serious bugs - even forcing your updates onto users.
And now you're crying foul because you got greedy, forced your users to bypass Android's security mechanisms and now you don't have a way to get a fix to them within seven days. LOL.
"We decided to use our own launcher instead of the Play Store, and accidentally made all of our users' devices vulnerable. Google discovered this, informed us, gave us time to develop a fix, and then informed users of their devices of the vulnerability we made and the patch available for it. What villains! Ignore that we created this problem, the person that made you aware of it after giving us time to fix it is the one that screwed up, not us!" - Epic