Network gaming company uses its “cheat-prevention” client to build a Bitcoin botnet

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

In one episode of the nerdtastic TV sitcom Big Bang Theory, the socially-challenged Caltech physicist antihero, Dr Sheldon Cooper, has his World of Warcraft account hacked.

A giant shopping-list of Sheldon's virtual property gets plundered: his wand of untainted power, all his gold, and even Glenn, his beloved battle ostrich.

As Sheldon laments, "Three thousand hours. Three thousand hours clicking on that mouse, collecting weapons and gold. It's almost as if it was a huge waste of time."

And that's the problem with games that you play across the internet: how do you trust the other people in the contest?

Even when there's no money involved, it spoils the fun if the other guys aren't on the level.

That's where on-line communities like ESEA, or E-Sports Entertainment, come into play.

ESEA describes itself on Facebook as "the leading game play based community. With a sweet pick up game mod, a custom anti-cheat client that works, and cool statistics to log all of your activity, ESEA is the place to play!"

To join ESEA's network, you need to install and use the company's custom client software.

The client is designed, amongst other things, to maintain a level playing field by detecting cheats, such as players who programmatically automate tasks - rapid, accurate shooting, for instance - that are supposed to be a battle of dexterity between human opponents.

Imagine the stirrings of discontent when players on ESEA's network started wondering about symptoms such as their GPUs (graphics processing units, the special graphics cards that speed up the display) running at high utilisation.

Overcooking your GPU can be a costly exercise, since it increases electricity consumption and may shorten the life of your hardware.

What was causing the hot and heavy running?

Surreptitious Bitcoin mining, it seems!

One customer took the simple precaution of looking in the ESEA client log file and found this:

Another user got in telephonic contact with a sysadmin at ESEA to discuss what was going on, and received some surprising admissions during the call.

Here's a partial transcript of the sysadmin's comments:

It shouldn't be any surprise, but the [anti-cheat] client is capable of doing a lot of things that people don't know about. [...] They think the client does screenshots and that's about it. Truth be told...it probably does more than about 50 different things, because there are more than 50 ways to cheat.

[...] Funnily enough, there was a debate, a conversation, regarding the subject of using the client to mine Bitcoins. That was a joke, but at the same time it was half serious.

The high-performance GPUs that many gamers own are handy for Bitcoining, because the Bitcoin system relies on computing massive numbers of SHA checksums, a task that just happens to be ideally suited to today's graphics hardware.

The ESEA staffer continues, rather unconvincingly:

It turned out I actually did write code to do it, but it wasn't supposed to be code that was everywhere. [...] I restarted the server and the [configuration] setting got reset and [the mining code] actually got turned on, which was only, like, it wasn't for very long.

We calculated how much we would actually make, if we really wanted to do it. We would make hundreds of thousands of dollars if we actually did it with everybody. But that would be pretty intense.

[Voice of caller] Not to mention kind of illegal.

And that's the problem with software that you run across the internet: how do you trust the other people in the protocol?

Even if there's no money involved, it spoils the fun if the other guys aren't on the level.

ESEA head honcho Torbull has now tried to make a clean breast of it, admitting that the company had toyed with the idea of using its customers as a giant Bitcoin botnet, but decided not to go ahead.

Nevertheless, someone inside the company didn't listen, and ran a Bitcoin farm on ESEA customers' computers for the next two weeks.

The outcome fell far short of the hundreds of thousands of dollars predicted above, but was nevertheless a handy sum to accumulate for free: just under $4000's worth of Bitcurrency.

It's a funny sort of infringement, because the Bitcoins weren't actually stolen, and the client software was voluntarily installed by each user, no doubt under terms and conditions that permit fairly arbitrary remote updates and reconfiguration.

Indeed, the Bitcoins didn't even exist until before the unauthorised mining started.

ESEA has decided to donate the proceeds to charity, to chip in the same amount again itself, and to create a prize pool for customers that will return $3,713.55 back into its customer community.

Peace with honour?

Probably - but it does raise the age old question: who will guard the guards?

Follow @duckblog

View the original article here

Should jailbreaking gaming consoles, mobile phones and tablets be legalized?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Yesterday US copyright regulators opened up the floodgates for a public hearing (PDF) of proposals to change copyright law, including authorizing the cracking of tablets, DVDs, gaming consoles and mobile phones.

Every three years, the US Copyright Office mulls over requests to create temporary loopholes in the law that forbids circumventing encryption in the things we buy.

Changes to those loopholes have the potential to mean a lot to George Hotz.

Hotz is a hardware hacker known online as Geohot who owns a box full of Sony products. Per court order, they've been tucked away where he can't tinker with them.

As Wired's David Kravets writes, Sony last year dropped a PlayStation 3 jailbreaking lawsuit against Hotz in return for his promise to never again hack his game console or any other Sony product.

He told Wired that he hasn't touched the components since the settlement.

Before the settlement of the civil suit, he was busy figuring out how to play homemade games on the Sony console, in violation of a law that forbids cracking encryption in hardware or software, even for legal purposes.

This will be the fifth time the office has heard requests to modify the law—the Digital Millennium Copyright Act (PDF)—since it was passed in 1998.

The DMCA criminalizes both the technology and the act of circumvention, regardless of whether doing so actually infringes on a copyright.

Hotz is far from the only individual intent on the amendment hearings.

Proposed exemptions, previously granted but now expiring, include one for jailbreaking smartphones to run on a consumer's choice of carriers, one that would allow DVD cracking of motion pictures for the purpose of educational or documentary commentary, and another that would allow consumers to hack e-books digital rights management to enable read-aloud features for the visually impaired.

Public Knowledge, a public interest group involved in intellectual property law, is also seeking the legalization of technology that lets users crack encryptions on movies and TV shows they own on DVD.

That would allow consumers to watch legally purchased movies on whatever device they want and to make backups of sticky/scratched-up/chewed-on/quickly brutalized children's movies.

It just makes sense, given how comfortable we've gotten with copying copyrighted works we own from one medium to another, as is the case with CDs, writes Public Knowledge's Michael Weinberg.

This is sometimes called 'space shifting' or 'format shifting.' For example, this is what you do when you rip a CD in order to create .mp3 files to transfer to your iPod.

Another example of this is when you transfer a movie from a DVD onto a laptop or a tablet device, like an iPad. However, there is one important difference between a movie on DVD and a song on a CD: unlike the CD, DVDs are encrypted. That means that while copying a song from a CD is a one step process (copy the file), copying a movie from a DVD is a two-step process (decrypt the file, copy the file).

Users are authorized to decrypt the movie in order to watch it, but are not authorized to decrypt the movie in order to copy it. As a result, that extra DVD step (decrypting) is illegal under the DMCA. That makes it impossible to copy DVDs the same way you copy CDs.

The proponents and foes of proposed DMCA changes are lining up predictably: industry groups are against, consumer rights and knowledge freedom proponents are for.

Industry groups argue against the changes on the grounds that their business models will be ruined, that all hell will break lose vis-a-vis cyberattacks on cell phone networks, and that illegal game copies will flower like dandelions.

Here's how Sony attorney Jeffrey Cunard put it (PDF) in his comments to the Copyright Office:

If the exemption is granted, it is virtually certain that successful hackers, under the guise of the exemption, will create the tools that enable even novice users to make, distribute, download and play back illegal copies of games.

But as Wired's Kravets points out, the 2010 court decision to allow mobile phone users to jailbreak smartphones most certainly didn't squash Apple's profits, in spite of what the company predicted.

Rather, it fostered a "vibrant alternative to the tightly constrained and capriciously run Apple App Store," Kravets said.

He was referring to Cydia, a third-party app store for jailbroken iPhones, iPod Touches or iPads that recorded 4.5 million weekly users as of April 2011.

Cyberattacks didn't run wild. Apple didn't go broke.

If the new changes get accepted, will Call of Duty b**tard spawn careen across the PlayStations of a copyright wasteland?

Time will tell.

Stay tuned: Another hearing's taking place in Washington, DC, next month, with final amendments likely due to be adopted by year's end.

What do you think?

Follow @LisaVaas

Fishbowl image courtesy of shutterstock
Money tree image courtesy of shutterstock
Devices image courtesy of shutterstock

View the original article here