GameSpy Sends DMCA-Based C&D To Security Researcher

chowbok writes "Luigi Auriemma has found several security holes GameSpy software over the past few months. He has reported them all to GameSpy but never got a response... until today, when he got a threatening letter from their lawyers. It says he's violating the DMCA, he needs to cease-and-desist, yadda yadda yadda." Update: 11/12 21:09 GMT by S : GameSpy has now posted an official response from the company's founder, Mark Surfas.

Damn those lawyers!

[HebrewToYou (644998)]

Always hating on the guy trying to enforce rigid security standards. Can't we all recognize that the only real harm caused would be by *not* reporting on these security holes. C&D letters only cause anti-corporate sentiment due to their rather accusatory tone. For shame. Good thing I don't use gamespy...

Hear that?

[Pxtl (151020)]

That's the sound of nobody being surprised.

Note for future reference: hackers, if you want someone to improve their security, don't go to the admin with your 'sploit, but anonymously release it into the wild. After all, the constant cease-and-decist letters _obviously_ say that that's what today's software companies want.

Re:Hear that?

[GoofyBoy (44399)]

> anonymously release it into the wild

Unfortunately thats what is going to happen.

A "nice" person would contact the company and inform them before it becomes a note-worthy problem. But what do these "nice" people get? A threat from lawyers.

So the alternative is to release something that would create a note-worthy problem, and due to media/customer base screaming, fix the problem.

Its a shame that it is coming to this. This use of the DMCA is turing "nice" people into "not-so nice" people.

Re:Hear that?

[IA-Outdoors (715597)]

Also, it's probably worth noting that incidents like this kill a companies credibility in the various security circles. So, on the upside, I now know to avoid GameSpy software which should have their marketing people trying to figure out how to do damage control on this. Don't underestimate the power of being /.'d

Re:Hear that?

[cduffy (652)]

The subject of this article first fell into the former category, and only after they were ignored moved themselves into the latter.

Personally, I don't think that's so inappropriate -- as one of the deployment/security engineers for my company's product, I'd be damned (not to mention in muddy legal waters, given the sensitivity of the data our app handles) if I let a security-relevant bug report go unresolved for multiple releases.

Folks who screw themselves over that badly (by ignoring security-relevant bug reports) deserve what they get.

Full disclosure wins

[Pac (9516)]

I think it also settles the question about full and limited disclosure. Limited disclosure is clearly a tool that allows lazy admins and developers to sit on their lazy asses while their company lawyers shoot the messengers.

What is needed now is an "official" infrastructure (mailing list/site/IRC channel/whatever) harboured somewhere with sensible laws and clearly geared toward transparent evaluation, discussion and discovery of security bugs in public software. Developers, admins and security experts welcomed, no matter their colour of their hats.

Re:Full disclosure wins

[EZmagz (538905)]

Just curious, but didn't you just describe Bugtraq? Granted, Securityfocus got bought out by Symantic IIRC, so there's the whole "do we REALLY trust them?" bit, but still...I've always seen Bugtraq as a reasonably-moderated open forum for new bugs, exploits, and discussion. Although it would be pretty neat to see something hosted offshore from the US with the primary goal being to bring the ruckus via full disclosure. Honestly, I'm surprised nobody has done this yet, with the main banner saying "What The DMCA Doesn't Want You To Know!".

Re:Full disclosure wins

[ryanr (30917)]

Most people didn't notice, but Bugtraq was moved to Canada, and turned over to a Canadian moderator a couple of years ago.

Re:Full disclosure wins

[Vainglorious Coward (267452)]

In recent months, I have found Bugtraq to be much less useful than the Full Disclosure [netsys.com] mailing list.

Not a US citizen

[by Anonymous Coward]

It is important to note that Luigi Auriema is in fact, an Italian citizen, and not a USian

Re:Not a US citizen

[Brahmastra (685988)]

and the Italian government will GUBO (Grease Up and Bend Over) and hand him over to the US unfortunately

Re:Not a US citizen

[TamMan2000 (578899)]

Heck, even murderers often don't get handed over

What scares me is that the US probably care less about the murders than the DMCA violators, and they will try to get him handed over...

The corporations that influence the government so heavily don't really care when one of the people of the US gets killed, but when their profits are in danger... watch out!

Re:Not a US citizen

[flynt (248848)]

Don't forget he also has attained citizenship in the Mushroom Kingdom.

Send some love

[Del Vach (449393)]

To the Gamespy Feedback Page [gamespy.com]

Re:Send some love

[HunterWare (128177)]

In response to an email my email I got the prompt response:

(SNIP)
Hi Hunter -

Unfortunately, he's not telling the truth. What is happening is simply attempted extortion. He didn't contact us, never has, and has been harassing us for over a year.

Mark
(/SNIP)

Re:Send some love

[mbbac (568880)]

How is he harassing them if he hasn't contacted them?

Re:Send some love

[apankrat (314147)]

Yeah, right.

Harassing them with fully disclosed vulnerabilities [google.com],
which would take under a day to patch even in case of the unimaginably
horrible code ?

Re:Send some love

[mcpkaaos (449561)]

There's one problem with your logic. To my knowledge, Gamespy still doesn't actually own the source to Gamespy3D, to which I believe these security holes refer. That codebase is owned by the original coders of Quakespy, the program that got the company started. The deal was: Surfas owned the brand, the coders owned the code. Never at any time could he talk them into selling it. That is the primary reason for the original development of Arcade - to bring ownership of some form of Gamespy software in- house.

How do I know? I was one of the original coders at the company back when Arcade was just an idea tossed around the Tuesday morning staff meetings. And no, I didn't have much of a hand in Arcade, thankfully, so please don't put a pox on me.

Of course, if this guy was pointing out holes in Arcade (to be honest, I couldn't tell from his website, it didn't seem 100% clear which product he was testing) - well, it's going to take *alot* more than a single day to fix.

Not that you really want to know this, but Arcade was very tightly coupled to a stock MFC, App-Wizard generated Doc/View project, and didn't stray too far throughout its lifetime. In fact, by the time I left, most of the code was essentially layered on top of rather poorly implemented MFC classes. (Props, Walla!) It gets even uglier (like data and UI being completely interleaved), but I'll save you the anguish.

Suffice it to say, you would be ill-advised to hold your breath while waiting for these issues to be fixed. Better to use the All Seeing Eye [udpsoft.com] instead. That's what I do. And this coming from a Gamespy stock holder! hehe.

Re:Send some love

[mcpkaaos (449561)]

Sorry to reply to myself, but a thought just occured to me. It's a rare thing, so I had to act on it. Okay, bear with me, this is liable to get a little bumpy.

If GSI doesn't actually own the code to Gamespy3D, merely owning the brand, and it is, in fact, the product in question, do they actually have the right to cite the DMCA in this case? I'm probably nuts for this, but hear me out...

If I have a brand and you have the technology, and I pay you a fee to sell your product under my branding without purchasing the technology itself, I still only own the brand, right? In other words, I'd only effectively be licensing the usage of your technology, but the ownership, and all rights thereof, remain in your hands? Presuming that's correct, if something or someone comes along and "threatens" that technology, but not the brand itself, as in this case, how can I assert the right to take any legal action in regards to said technology? I don't think the DMCA covers branding, so I would imagine this case has to be in explicit regards to the technology. Unless I was acting on official behalf of the owners of that technology, would I even have a leg to stand on? Isn't that like taking some guy to Judge Judy to sue him for kicking your vacationing neighbor's dog while you were babysitting it? The mind boggles.

Are there any lawyers that care to comment? It would be very interesting to see if the DMCA would still apply.

If I'm not making any sense (which, undoubtedly, I am not), please reply and let me know. I'll try to make some kind of sense out of it.

Re:Send some love

[dboyles (65512)]

About 90% of the posts prior to mine say something to the effect of, "If he hasn't contacted them, how could he have harassed them?" I think the objective thing to do is at least consider the fact that Gamespy could be telling the truth. Most posts related to this response are really dealing with semantics. This response from "Mark" was obviously almost casual in nature, so it's not a stretch to think that he may have accidentally contradicted himself with his words.

I admit that the way most of these things work out, it's likely that the company is in the wrong (not responding to bug disclosure and overreacting when the exploits get posted). But don't take everything you read on Slashdot as gospel.

Before you flame put yourself in the other guy's shoes, and before you mod me down consider if you're doing it because you disagree with me.

Re:Send some love

[fahrvergnugen (228539)]

Thanks for the link! Here's what I sent them:

I read with great interest a news article about Gamespy siccing its lawyer brigade on an Italian security researcher who, after making good-faith efforts to make Gamespy aware of its security shortcomings and receiving no response, went public with the exploits he found.

It's a pity you're so short-sighted. Now, instead of working with a co-operative third party researcher willing to perform QA on your product for free, you instead face the prospect of having much more of this kind of attention being focused on your organization by some very, very clever individuals. Further, from now on, nobody's going to be stupid enough to tell you when they find an exploit. Instead, all of their findings will be released into the cracker underground, as anonymously as possible. In the future, when exploits are found for Gamespy's servers, Gamespy won't know until they've already been pwned.

gg.

Hear that? It's the sound of me uninstalling your software, calling all my friends and advising them to do the same, telling our ad-blocker software not to display your ads anymore, and then all of us getting out our credit cards so we can reward the fine people who created the All-Seeing Eye.

Hope you enjoyed it, you had a pretty good run while it lasted.

Re:Send some love

[orthogonal (588627)]

There are other things going on that demand one's attention and you just can't fight every battle that comes into your life.

True enough. But if you've got the time to complain about GameSpy, take the time to complain to GameSpy.

Or if you had the time to respond to my post....

Wow

[Kierthos (225954)]

I didn't think it was possible, but my opinion of Gamespy just went even lower. If it wasn't for them hosting old Nodwick strips, they'd have no redeeming values at all.

I mean, let's face it, anyone who wants to exploit Gamespy's servers probably already knows how to do so, this guy's bug reports notwithstanding...

Kierthos

He lives Italy, so who chares??

[HuggybearVT (576997)]

quote: I'm 22 years old and I live in Milan district in Italy. The DMCA doesn't apply to him. Cease and decist this!

it's not that he just reported them, though...

[Corporate Drone (316880)]

From Gamespy's email: "In contrast to simply advising GameSpy of these vulnerabilities, by publishing this software to the world at large you are clearly facilitating the intentional crashing of GameSpy's server by others".

so, incredulously, he asks whether bug research is a criminal act and bug researchers criminals.

Unfortunately, the answer today in America is a simple "yes". that is, unless you feel like researching and then hoarding your findings.

Thanks for nothing...

[the_ed_dawg (596318)]

One might think that notifying GameSpy about its security problems might be A Good Thing (R) because they could be fixed before being exploited. Just another reminder that, in the United States of America, no good deed goes unpunished.

What the?

[DrEldarion (114072)]

This makes a lot of sense, really! Let's let someone do all the work for us in finding security holes, have him come directly to us and tell us about the holes, have him keep them to himself instead of releasing them for everyone to use, and then tell him he's doing a BAD thing and he needs to stop!

I fail to see ANY logical reasoning behind this.

If you ignore it...

[t0ny (590331)]

This is a highly stupid move on GameSpy's part.
This guy wasnt posting his findings on the internet, or seeking publicity for himself; he was just using his skills to help out and try to improve GameSpy's product (and it needs all the help it can get, IMO).

If you ignore security, it will go away...

Actually, he did publish/release it

[GFW (673143)]

All his proof-of-concept exploits are on his website ... BUT, he did notify the company AND gave them lead time to fix each problem before publishing. Sounds like a perfectly responsible approach, similar to that used by university researchers here in the US.

Confused

[LizardKing (5245)]

Does the DMCA apply outside the US? How can this guy be breaking US and Federal law while carrying out his research in Milan, Italy? Chris

Re:Confused

[IthnkImParanoid (410494)]

A certain college undergraduate (well, probably graduated or moved on now) in Norway would probably like to know the same thing.

Companies attempting to enforce the DMCA outside US jurisdiction isn't new. The first high profile DMCA case I remember (the one I alluded to above) was just such a case. The question is then "Does gamespy have enough clout to pull this off like the MPAA did?".

Norwegian Law

[bstadil (7110)]

FYI, He is being tried under Norwegian law, nothing to do with the US DMCA. Look at This [itworld.com]link. I know it is being appealed but this is the status now.

Italy has adopted an equivalent law

[morcheeba (260908)]

On march 28th, italy implemented the EU copyright directive [ipjustice.org], which is modeled after the DMCA, but with fewer exemptions. All 15 EU members were supposed to adopt this by last december, but only a handful of countries have done it yet. The UK just became the sixth to adopt. [ipjustice.org]

How did I get so interested in the DMCA? I recently interfaced the Ritz disposable digital camera [maushammer.com] to my computer, and didn't like how the DMCA has been used to stifle competition. [maushammer.com]

Text of the EUCD (eu copyright directive) [eu.int]

Use and abuse

[Space cowboy (13680)]

From the article:

"Bug research is a crime and bug researchers are criminals, didn't you know that?"

I know he's being sarcastic, but how long until he's correct ?

One more reason to despise the DMCA, I'm not even sure how it could apply - certainly the lawyer's reasons don't make any technical sense.

Simon

Laws needed to indemnify research

[acomj (20611)]

Laws are really needed to help protect people conducting security research and find problems and reporting them without doing anything malicious.

Having hackers poking and proding makes everything more secure ("So the first woodpecker to come along doesn't destroy civilization").

The only one winning here seem to be the lawyers.

Two things

[Platinum Dragon (34829)]

1) Nice to another another justification for moving security research out of the US. So Alan Cox isn't a paranoid raving nut, after all... unfortunately.

2) It doesn't look like he's taken down the stuff, yet. Mirror time?

DMCA Wall O' Shame

[pclminion (145572)]

Is there a site out there like a "Wall of Shame" where we can go to see a list of fuckheads who have C&D'd people using the DMCA as a threat?

It would be nice to have a list of all of them all in one place so I can make sure to never ever pay money to any organization that has used the DMCA against someone.

Re:DMCA Wall O' Shame

[chowbok (467829)]

This isn't exactly what you want, but I think you'll find it of interest:
Chilling Effects [chillingeffects.org]

Yes, I know... it's a legal question....

[mdemeny (35326)]

I know what in trademark cases, companies have to enforce their trademark or risk losing it (i.e. xerox, kleenex, rollerblade) - but is there any similar clause in the DMCA which dictates that corporations must send cease-and-desists instead of taking these suggestions seriously? That seems to be the standard method companies employ in these circumstances, and I was wondering if it was a legitimate legal issue, or lawyers just being, well, lawyers.

Not surprising

[EZmagz (538905)]

Let's face it guys, this is the kind of corporate attitude everyone should expect from companies like Gamespy. In their mind it's far easier to send a C&D letter, citing the DMCA, to shut up someone who found found gaping holes in their products than it is to sit down and pay coders to actually FIX the problem. Keep in mind, I said "In their mind".

"Good samaritan" acts like this tend not to go over well with companies when their products are on the line. They think we're just a bunch of reckless hackers trying to H4CK TEH PLAN3T! The thing they fail to realize is that by shutting up honest people like this via the DMCA and unleashing lawyers on white hats, then the only people left WILL be the bad guys. And frankly, I'd like to see some black hats get nasty on companies like this. This DMCA bullshit is getting tiring.

Message rec'd. Loud and clear.

[by Anonymous Coward]

Publish all the exploits underground, as anonymously as possible. This way the exploits are in the wild and the sloppy code has to _fixed_ instead of covered up with a mountain of legal manure.

This is not what GS wants, nor what they mean. It is, however, what they are apt to get. Had they thought (ha!) things through this mistaken mistreatment of someone sending friendly warnings would not have occured.

Hey, GS. Why not try shooting at the real target? You just hit your foot.

Gamespy does a good job publicizing their bugs...

[_Sharp'r_ (649297)]

What better way to get your bugs known by every technically literate person on the planet than to send a C & D letter like this, leading to a reference that gets posted on Slashdot as a home page story?

I congratulate Gamespy on their great word-of-mouth campaign to get all of their exploitable bugs known by the widest possible audience...

Uh-oh, out of date already

[heironymouscoward (683461)]

Time to update my Smoked Company Instant Poll:

Who smoked the most crack in 2003?

(_) SCO
(_) Belkin
(_) Verisign
(_) *A (MPAA, RIAA, ARIA)
(_) GameSpy
(_) All of the above

What a dipshit

[frenetic3 (166950)]

I don't blame Gamespy at all. This jackass has basically enabled untold numbers of 12 year old pricks to tie up public game servers for their shallow amusement.

The general method of DoS he employs is not a "security flaw" but a byproduct of how multiplayer games are typically designed. You could theoretically do the same thing by going into an office and starting up a bunch of instances of the game on a bunch of PCs and logging into a server and leaving them there -- the "proofs of concept" that this guy Luigi wrote just automates this, simulating clients and hanging them.

The "problem" is that lots of games (hell, most network services of any kind) inherently require one TCP connection or UDP stream that stays alive throughout the entire multiplayer game and that begin with some authentication process, and most games only maintain a small number of slots (listening sockets).

Generous timeouts are also often needed to support spotty connections/freezes without disconnecting, so simply checking for timeouts might not help servers get past this issue. (However, maybe they could add some simple limit on how long a client can stay in the preliminary authentication/non-'playing' stages before booting them, requiring a prohibitively large amount of additional reverse engineering/sophistication to simulate a playing client.)

Getting around it will force game devs to play a stupid game of cat and mouse and to implement complicated challenge/response and other antispoofing mechanisms (IP banning, timeouts, etc.) -- time that could be, and ought to be spent on making fun games.

Too bad that Gamespy invoked the DMCA but that's probably the only legal leg they can stand on. Furthermore, Gamespy has nothing to do with the implementation of various game developers' servers.

Perhaps a better avenue would be for game devs to sue the guy for posting key gen algorithm internals [altervista.org] and other shit like that.

I think though that breaking both his legs and giving him a donkey punch (#3) or dirty sanchez (3rd from bottom) [drunkenwhores.com] would be more fitting, and funnier.

-fren

Re:What a dipshit

[Tom7 (102298)]

Hey man, there are technological fixes for these bugs. He is pointing out the weaknesses. On-line games aren't exactly critical infrastructure, but it is still important to know what the problems are so that they can be fixed or avoided in the future.
In any case, the DMCA is ridiculous here; he's not circumventing any technological measures, and there are no copyrighted works being accessed. The DMCA does not outlaw hacking.

Narf?

[Chibi Merrow (226057)]

The exploits I read were for the most part buffer overflows... Which are the result of improper bounds checking and just general sloppy coding. This has NOTHING TO DO with Gamespy's servers, and everything to do with their client software. The guy claims he informed them, they claim he didn't. If he did inform them, then tough luck. They deserve any negative publicity out of this. If he didn't inform them, then he needs to be dealt with.

Proof of concept code often is the only way to force a company to do something about its security problems... It's specifically because 12 year old script kiddies are exploiting the vulnerability that the company fixes it. Suing a security researcher for bringing this about is silly. Spend the money on fixing the problem, not on a Lawyer's retainer.

Comeon... sing with me...

[dark-br (473115)]

Yesterday,
Algorithms programmed in any way
Now it looks as though there's liabilit-ay
And, it's 'cause of the D-M-C-A

Suddenly,
I'm not allowed to speak in C
There's a shadow hanging over me
Oh how D-M-C-A makes silence be

How some bits do flow, you can't know,
We couldn't say
I said something wrong
now I'm among, law D-M-C-A-ay-ay-ay

Yesterday,
"code" was such an easy game to play
Now I need a place to hide away
And, it's 'cause of the D-M-C-A

Almost forgot this one...

[dark-br (473115)]

Young man, you've been writing some code, I said,
Young man, think it ought to be showed, I said,
Young man, but what you shoulda knowed, is some
Things... must... be... left... un-said

Young man, there's a law that's been passed, I said,
Young man, we hoped it wouldn't last, but now,
Young man, if you break it, your ass will be
Hauled... a-way... to... Club Fed

We cannot stay with the DMCA
Get hauled away with the DMCA

You cannot circumvent
Any music or book
Can't even let your kid take a look

That's why we're flamin' the DMCA
Our guy was framed on the DMCA
The Man gives us rules
That we've got to obey
But encryption just gets in the waaaaaay...

Young man, there's no need to feel down, I said,
Young man, hide yourself underground, I said,
Young man, 'cause the Feds are in town, you know,
There's no place you can hide,
Young man, there's no place you can go, I said,
Young man, when they don't like your code, if you
Stay here, I am sure you will find
That you haven't got no more time.

(chorus)

You sir, I hope you understand, we're im-
Pa-tient, hope the Feds free our man, but no-
Bo-dy... can resist our demand, we'll shout
Til... they... free... D-mi-try

Dima's... fate lies in our own hands, so please
Help us... make them meet our demands, so call
D.C., make them send this young man, back to
His... own... home... and... fam'ly

(chorus)

Think for a second before you take his side...

[James Lewis (641198)]

It seems most of the posts here take the side of the "hacker" which isn't surprising given this is Slashdot. But if you go look at his site, he is posting working source for DDos attacks for various games and exploits. Here is one description:

"Half-Life 1.1.1.0 client's "Unknown command" format string bug test 0.1 This is a tool to test a format string bug I have found in the Half-Life client. I have not released an advisory because at the moment I don't know if this bug lets remote code execution or not. Feel free to check it (in the zip file there is also the mail I have sent to vuln-dev that contains some details)"

In this case he's posting source for the exploitation of a bug before HE EVEN KNOWS WHAT THE BUG DOES. This makes me doubt how responsible he is in informing companies of bugs in their products. How about this changelog in the source of his UTDDos attack:

"CHANGELOG: - Now supports UT2003 servers!!! - better allocation method (now it's not limited, and the memory used is very very small!) - big code optimizations - a lot of bug fixes (libnet name resolution and other little problems)"

Why would these changes be necessary for a proof of concept? Sounds more like he wants anybody to be able to easily compile and use his programs to exploit not just UT servers, but UT2003 servers as well.

I think hackers should have as much restraint as possible in releasing "proof of concept" programs. Because really, what do these programs do? It does exactly what you are afraid people will do with the bug you found, exploit it. When you release that to the public, you are ENSURING that the bug will be exploited. Only in extreme cases should this be used to force a company to fix a bug, because at best the result is a brief period of time in which the bug is exploited widely, before the company fixes it. However, I think there is a serious risk of more harm being done in this period of time than would have ever been done if the proof of concept program had never been released, and the bug taken longer to be fixed or perhaps not fixed at all.

This guy is obviously not using proof of concept programs as a last resort. In fact, check out this comment:

"CD-Key hash changer for UnrealTournament 2003 v2225 for Win32 0.1 practically this proof-of-concept lets you to use a custom cd-key hash. The main idea was to find a cd-key theft bug but fortunally this bug doesn't exist so this tool can be considered only a test just for fun"

He wants people to use it "for fun"? What kind of white hat hacker releases a proof of concept program for "fun"? If I read this right, he was hoping to be able to steal CD keys with this, which he probably would have released as well. That would of been a huge mess, and is what I mean when I say there is serious risk of a concept program doing a lot more harm than good. So, it turns out it only lets you use other people's CD hashes, which you can get just from joining a game. This would allow you to steal someone's CD hash that you didn't like, and then go make a total ass of yourself on a server and get him banned. Sounds "fun" don't you think? Gamespy may not be my favorite company, but this guy give hackers a bad name.

Re:Uhm...

[IthnkImParanoid (410494)]

The sort of street cred you get for having javascript errors on your site? I hear that's how these young punks rebel against their elders these days. It's the programmer's equivalent to wearing pants around your knees.