Hacker News Reader

Comment by Twirrim | Hacker News Reader

I wonder if they realise just how illegal their actions are, and that they've fully confessed to breaking the law?

They should have at least sought legal advice before trying to do what they did, but failing that at least sought it before posting this message.

View on HN

They should go the FB/Goog route and claim it was a bug.

Which is probably what a legal counsel would've advised them to do. Get rid of the "feature" without admitting to what it actually did. Would've been much harder to prove how they used it without them admitting to it.

Would that hold water? A file was added to the installer which has clearly nefarious purposes. As well the output produced by running that file was caught by another executable and sent home. Pretty hard to say that this wasn't intentional. Even if you would claim it was bundled erroneously, why would that be part of your code base anyway? It has no legitimate use there.

To be honest, it doesn't really sound illegal to me. Detecting fraud and collecting additional data when it is detected doesn't sound unreasonable or unusual - as long as it is specified in the privacy policy anyway.

That being said, I'd be very interested to learn more about why it would be illegal. Could you elaborate/source?

Apart from stealing passwords which is definitely misuse of computing resources?

The link doesn't mention extraction of passwords

The story is that the bundle contains a piece of software that uses elevated privileges gained through the installer to extract passwords from Google Chrome, and then ships that data back to mothership. I am not sure how that’s not stealing passwords but I am open to interesting arguments supporting the negative.

The publisher pinky-swears that they only steal passwords from bad people. That is not an interesting argument to me.

The post kind of dances around exactly what 'information' was exfiltrated from the targeted user, but it's pretty clear from a close reading that it has to have included his Chrome passwords.

  unfortunately we could not be able to enter the registration-only web sites he was using to provide this information to other pirates.

  We found ... that the particular cracker had used Chrome to contact our servers so we decided to capture his information directly

  .. to dump that cracker's information needed for us to gain access to those illicit web sites

  this method worked, in fact, and we were able to receive this information

This all followed by screenshots from the "registration-only web sites" they could not previously reach.

Also, at least one of the initial reddit reports which set off this whole thing was due to A/V software detecting an executable file included in the installer (which was dropped but not executed on all user installs) as "Chrome Password Dump" malware.

Edit: The earliest responses about this from FSLabs seem to confirm that they were running the password dumps on anyone who was using known pirated serials; it looks safe to say that the linked post is overstating how targeted their actions actually were.

  This method has already successfully provided information that we're going to use in our ongoing legal battles against such criminals.

If they truly believe that they have any hope of using any information thus gathered to aid them in their 'legal battles' against crackers and pirates, this is one deeply confused company.

More context in case you didn't follow the issue, there is an exe that will dump all your Chrome passwords and send them back to the dev issuing a POST request, unsecurely (no https, just plain http. Yes, really, all your passwords sent over http): https://www.fidusinfosec.com/fslabs-flight-simulation-labs-d...

First, context: the original reddit thread [1] that kicked this off indicated that this malware included was intended to extract passwords from Chrome ("Chrome Password Dump") and that it was active and likely had the needed permissions as the installer would generally be run with administrative level access rights. So the issues are that malware was placed onto users' systems at all, its capabilities, whether and to what extent data was exfiltrated, and how any exfiltrated data was stored or used.

In terms of jurisdiction, the company seems to be incorporated out of Delaware (though I may have mis-searched there), but employs EU nationals residing in the EU. At least one of them seems to be in England, and thus subject to at least both the Computer Misuse Act of 1990 and the Data Protection Act of 1998, which in turn ties in more generally to the 1995 EU Data Protection Directive (which has further been implemented in other countries). Multiple levels of their actions would definitely fall under the CMA and if they actually gathered anything the DPA would kick in also. All of the actions they are known to have performed and may have performed are illegal in most first world jurisdictions. You cannot install malware even if it's not used. It's extra offense to use it, worse to take any data off, to store that data, and further to use it in anyway. Vigilantism is not generally considered at all acceptable by developed governments worldwide.

In the USA, precedent for this sort of thing appears to exist already in the form of major examples like the 2005 Sony BMG rootkit situation. Sony's malware prompted actions at the state and federal levels as well as multiple class action lawsuits. The FTC brought charges under Section 5a of the Federal Trade Commission Act and Sony was forced to settle. The FTC chair at the time stated that "Installations of secret software that create security risks are intrusive and unlawful." [2]

Really, this sort of thing is just crazy dumb to even attempt in this day in age, it's genuinely surprising that developers could still think that it wouldn't open them up to massive potential trouble particularly in the EU. That's not to say anyone will necessarily go after them, as always that's a matter of discretion at the governmental level and at the civil level whether anyone cares to devote the resources to it, but there is plenty of cause to at least make a go of it and it's not clear that they recognize that. Legitimate developers just don't install malware on peoples' computers, period. That they may be bad people isn't any defense at all. Furthermore, bugs of course can happen. Even if it's not intended to be activated, it may do so, or may open the way to later malicious use by a 3rd party. The original developer who was responsible for it being there can be expected to be liable.

Surreptitious actions in general should be a real red flag: if you have to hide it from your users and it affects anything but your own software, think twice. Then think three or four more times after that too. EULAs (or any contract in general) cannot overrule higher level non-exempted law requirements and will not provide protection against civil or criminal enforcement.

-----

1: https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a3...

2: https://web.archive.org/web/20070929111043/https://www.consu...

Reply on news.ycombinator.com