Hacker News Reader

Comment by oliwarner | Hacker News Reader

Their announcement yesterday[0] is barely half an apology.

The only mistake they're admitting to is that their malware ran on all installations, when they meant for it to only run on pirates computers. Or that they got caught doing it.

There's no recognition that collecting this data from [innocent until proven guilty] "pirates" was wrong. There's no confession of what they did with the data they collected, but I can only imagine it amounts to a serious infringement of global Computer Misuse Acts.

Just because you think somebody didn't pay for your software doesn't give you carte blanche to anything on their computer. Again, that is almost certainly a criminal offence.

[0] https://forums.flightsimlabs.com/index.php?/announcement/11-...

View on HN

Also, just because the pirate broke the law doesn’t mean that stealing their passwords or otherwise doing something nefarious isn’t equally or more illegal.

The last time I checked, it's not okay to commit a felony in the pursuit of a felon. I can't imagine this underwent anything close to a legal review before it was implemented. Did they honestly think they'd get the pirates credentials, then authenticate with the pirates accounts in an attempt to uncover their real identity and not understand that crosses some major ethical and legal boundaries? I don't think it would be an exaggeration to say that their 'solution' was in itself criminal.

Only police are allowed to commit what would normally be crimes in the act of pursuing criminals, and even then these cases are limited. The only exception I can think of for normal people is self defense, which is not always legal.

There's also the concept of a citizen's arrest. Although I doubt this can be broadened to include vigilantism by malware.

It's a straight violation of the CFAA [1]. There is going to be a few lawsuits for this one.

[1] https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

Or a criminal indictment, I would hope.

Why didn't they just build a bogey binary and seed that to the torrent sites?

I've wondered why copyright holders don't do this more in general. I've seen a few cases where a downloaded movie for example just gets borked towards the end ... presumed it was deliberate and surely some form of a deterrent!

If you read the article, they were attempting to target a specific person they believed was cracking their software, not the pirates themselves.

That's doubly stupid. Every capable hacker is going to run the software in a VM or on a separate computer.

In fairness, there are an incredible amount of incompetent “hackers”.

I would like to see the incompetent hackers who can reverse engineer and break non-trivial copy protection. I'm sure they exist, but I would imagine there's not an "incredible" amount meeting said criteria.

Also to be fair those are more often than not just someone using exploits someone much more capable found.

Also to be fair, even if the cracker wasn’t paranoid I expect doing it in a VM is much more convenient since you can trivially reset your environment.

They would only have to make one mistake and would be exposed. You would be surprised how often that happens.

Reminds me of a great episode of Reply All:

https://www.gimletmedia.com/reply-all/21-hack-the-police

But it looks like it worked.

They got the logins for some other websites they did not had access to before. Logged in and found out how they could generate the keys.

At least that was my understanding.

When my shareware was pirated and posted on torrent sites, but had a fairly low number of seeds, I forked transmission and changed the source to give out bad checksums, so that downloaders would never see their downloads complete. I figured I would run this on a bunch of computers and become the top seeds and peers and ensure that few downloads ever finished.

It did not take long for me to realize how crazy I was being over this. My time was better spent improving the software and focusing on customers who would pay.

We manifest what we see in ourselves.

You might even have caused lost sales, depending on your software's business model.

Oh and thank you for hiding a loaded gun into your clients PCs. Now all a black hat needs #todo is to find a a way to activate said gun with not much effort since it already has its hooks in.

Disclaimer: I don't know the exact implementation, but this stinks from every angle you approach this.

And when somebody complained that anti-virus detected their malware they said it's false positive and they recommend to disable the AV: https://i.imgur.com/GTSPLDE.png

Archive link in case the content in the original link gets retracted:

http://archive.is/cRB57

Reply on news.ycombinator.com