Facts & Experiments with 1.1 (demo) protection

keithb · February 25, 2005

I've read all 20(?) pages on 1.1 protection and seen lots of opinions and emotions and anecdotes, but no actual observed experimental results.

Maybe I missed it hidden in the confusion, so perhaps we can have a thread for just observed facts?

I've only just been able to install the demo, so I had a chance to install a software firewall first. (eg Outlook from http://www.agnitum.com/download/) to supplement my hardware firewall.

Unlike the XP firewall this prevents outgoing connections that you have not authorised - eg out of the box it stopped Steam and Mozilla, asking for approval, and listing all connections.

So when I ran the 1.1 demo for the first time what happened? :?:

Nothing. :shock:

No outgoing connections, no unexpected traffic, no problem running the demo.

Maybe Starforce is only in the demo because it was too hard to take out or they forgot, or maybe its going to leap into life later........

Also Task manager did not show any unexpected tasks.

Tonight I will run the demo with Performance monitor in the background, to see what processes really are running.

But I dont think we should worry about the demo, just get a software firewall that prevents/reports outgoing connections to see whats really going on on your PC!

Cheers,

Keith

Darkness · February 25, 2005

I agree with you. All the tests I have done makes me think there is nothing wrong with failures or spyware or viruses or things like that. No internet traffic when I run the demo for the first time or when I run it again and again. I can only imagine that Starforce was not deleted from the binary for a mistake or something like that. I cannot imagine ED thinking of destroying the entire world with the 1.1 demo or Flaming Cliffs :lol:

JG27_Arklight · February 25, 2005

No issues here either.

I wonder if people would have really even known that SF was in the demo if somebody hadn't said something.

I think this hysteria tends to have a placebo effect on some people.

o4ki · February 25, 2005

i totally agree with you above posters - i cant fined any backdoor activity playing 1.1 too

Every thing works fine

I think that StarForce competitors begin this paranoia and speculation. And its crazy. Admins and Moders must do some damage control on these forums. I'm confident that 99% of the the complaints some of these crazies have are totally untrue.

Caretaker · February 25, 2005

My various tests also did not indicate anything suspicious going on. There seem to be some valid points with StarForce and its inclusion with the demo that need investigation, but a lot of statements or fears seem pretty overblown to me.

benzene31 · February 25, 2005

Dobryï dién ,

Me i dont know cause i dont use winxp to go on internet . I have no firewall and nothing else similar . I use winxp only for few game and in particular the lockon sim . To go on internet i use Mandrake 10.1 + mozilla1.7.5 .

Mandrake powaaaaa ...and lockon powaaaa too

spacibo tavarichtch :partyman:

:weedman:

Dunmer · February 25, 2005

Hi all.

That's true, nothing happens with SF.

I have to say something else: This kind of protection is considered as a part of the soft. This soft is delivered "as it is", and we all agreed with this before installing it. Even those who did not read the LICENCE TO USE THE MULTIMEDIA PRODUCT before clicking "I agree".

SF's official FAQ specify that SF do not send nor receive any data from/to the PC running it. If that's false, so they violate the law. Do they???

BeetleJuice · February 25, 2005

In the past I had various games with StarForce (although they did ask to install the driver) and NEVER had any issues like increased traffic, nasty processes or hackers stealing my bank accounts ;)

Dunmer · February 25, 2005

What a pity! Writing such things, whe might kill a pretty good sitcom :lol:

W-Natas · February 25, 2005

I have nohing against copyprotection, but nobody knows exact facts about how it works.

I can change 3 times my hardware... and then?

Windows gots a similar Hardware detection but i noticed it fails sometimes and i have to reactivate my Windows. After a couple of Reinstallations i have to activate my Windows via phone.

If starforce fails the hardware detection like in Windows, will i lose my FC?

Can i reactivate it? Did it costs something? How much?

Questions over Questions.... and we get no answers.

sida · February 25, 2005

keithb

I think you are confused with one thing:

As of now Sf will not do anything to your PC, no tcp traffic or nasty suprises so you experiment is bound to prove nothing (still not a bad idea to test though). There is no malicious virus,backdoor or exploit writen (yet) for SF (as far as I know), you can browse anti-virus and even spyware site databases and you will not find anything under SF entrie.

In all those 20+ pages of posts there was not a one saying "the whole world is now connected to my PC", "My BIOS got wiped clean" etc.

What is kicking up all the fuss for a lot of people is realising negative (as in bad, nasty) POTENCIAL of this extremly badly writen peace of software.

SF out of the box was allowing user accounts to run admin priviledges on computer. That was fixed in 1.0 version (as posted on their website) but there was so many vulnerabilities left, even in the late 3.XX versions.

SF vulnerabilities are listed on several legimit security sites (without examples abviously) and there are proof of concepts (ready to use) comming out already on the web on some more dubious sites, such as http://www.starforcemeat.tk/

This means someone will sooner or later write something that will take advantage of SF being installed on your computer and even if you are logged on as guest (very protected account) you will still be able to wipe out your HDD, BIOS or whatever the bastard writter intended.

For me, the most idiotic thing in all these 20 pages was explanation from someone working in StarForce explaining decision on why the driver stays installed even if you uninstall the game:

wait for it...

Abbie Sommer: The fact that they remain was something that no one predicted would be such a contentious issue.

Why ED decidided to use such mediocra company is beyond me. Maybe becaouse this is still one of the most higly regarded copy protections out there, but they just didn't put any effort in searching about problems and issues it may bring due to a bad implementation.

That's one guranteed sale lost on my behalf if they don't change it.

Starlight · February 25, 2005

It's good that there are these test results but the point is another.

The Starforce protection IS NOT a spyware itself, so it won't send packets or data, maybe for some people it was not so clear in all that confusion.

BUT, it has been proved that Starforce has bugs that ALLOW malicious software to do things on some PCs that shouldn't be able to do. In a few words,, it seems Starforce protection causes a security leak.

Just to make an example. Sometimes there are new bugs discovered in operating systems (like Windows). The problem is not that the OS sends malicious packets or enstabilishes malicious connections. The problem is that the bug ALLOWS other software to do that. This is the reason why bugs and leaks must be patched.

Then, the reasons why I'm a bit upset with it are three:

- No one told us of the presence of 3rd party software in a freely downloadable demo. if it was the case of the game it could have been less dramatic, because you can expect a copy protection made by 3rd party. But in this case I feel it being a bad behaviour towards a community who has given TONS of support to ED and has also TONS of patience. (both for LockOn and for 1.1 FC)

- I don't want a copy protection to cause any security leak. a copy protection should be a feature capable to protect the software house without affecting the product performance and/or other issues (such as OS security). I don't care how much it does affect the security of my PC. Today Starforce is NOT secure. Will it be tomorrow? maybe, or maybe not, or maybe another leak will be found. I want to buy a game with a secure copy protection. CD checks are the only safe way? ok, go burn those CDs for the western market too and send them by mail! no problem!

- It's still unclear the knowledge about the game-key issues after 3 re-installs or 3 major pc hardware changes. It's not a minor issue, even if it was totally smooth (that is, after the key is not valid you request another one and you get it). The reason is very simple. Once I have my key not working anymore, will I be able to get another one? Microsoft uses activation, but Microsoft will hardly be out of the scene within the next 10 years (even if some will hope so!). Instead I don't know if ED ot Starforce will still exist in the next 2-3 years (maybe even one, I really don't know). And even if they were still alive, after my key doesn't work anymore, what will I do? I am from Italy, will I have to call a numer to US or to another country and spend 20 more euros of international call to get another key? I'll more likely dump my FC copy in the trash can and bring back LockOn or any other sim. Today I still play with older games when I have some spare time, such as Falcon 4 and Gunship. I wanna be able to do the same with FC.

These are the questions ED must answer before I buy FC

I have waited so long to get the demo, I can wait something more after FC is out. Before I must know what I'm really getting from ED for 35 $.

Dunmer · February 25, 2005

Who can the Hell PROVE ME that we will be limited to 3 updates? Who can the Hell tell me exactly what we're talking about but suspicions born from nowhere? Who can tell me that ED officially decided to limit this product by this way?

Where is the INFORMATION? Wait and see!

keithb · February 25, 2005

Folks,

we are in danger of losing the point of this thread.

I'm not confused - just trying to stay level-headed and open-minded.

Many people have removed the demo in the fear that it is actively exposing their system to hackers and spyware, and that Starforce is sending information about them out into the internet.

That doesnt appear to be the case, and I want to focus here on actual observed facts. We have more chance of ED responding that way also.

I've kept my opinions to the 'good news, bad news" threads etc, they are not happy opinions - my credit card is back in my wallet, but I'm not dissing anybody, whether they believe ED are the saviours of flight-simming or Starforce are the minions of beelzebub or anything between.

Cheers,

Keith

Dunmer · February 25, 2005

just trying to stay level-headed and open-minded

All that's important is contained in those words.

I'd just like us to talk about what we really know, even if I'm the first to be vigilant about what ED will decide and communicate.

I just think it's useless wasting our energy about what we don't know or even just suppose. But thanks for having exposed the very few things we are absolutely aware about. :wink:

Starlight · February 25, 2005

Who can the Hell PROVE ME that we will be limited to 3 updates? Who can the Hell tell me exactly what we're talking about but suspicions born from nowhere? Who can tell me that ED officially decided to limit this product by this way?

Where is the INFORMATION? Wait and see!

Somebody said that there is this issue. Since it's something I don't know about, I wanna be sure before buying the game. I think at this point it's in ED's best interest to publish info on the 3rd party software they put into their product.

The info on Starforce leaks can be found on the Internet (do a google search or browse security sites). As of November 2004 there was no patch for that leak.

leafer · February 25, 2005

Who can the Hell PROVE ME that we will be limited to 3 updates? Who can the Hell tell me exactly what we're talking about but suspicions born from nowhere? Who can tell me that ED officially decided to limit this product by this way?

Where is the INFORMATION? Wait and see!

No one apparently. But I guess it's fun for some people to post such doomy and gloomy stuff like that. But as I understand it, an official from ED did say that they are looking for an alternative to Starforce.

Dunmer · February 25, 2005

Here is the problem: "Somebody" :shock:

I'll wait "Somebody" to be replaced by "ED" and then I will know if there is a trouble or not :wink:

sida · February 25, 2005

I tried to stick to only security side of the things, although my fingers were twiching to spell the beans exactly about all the points Starlight mentioned.

I did put in the brackets "still not a bad idea to test though" exactly having in mind people alerting about info being sent to SF without our knowledge and I'm glad you can confirm that is not the case.

Why I was suspicious that was the case: someone from SF denied it and I just coudn't trust them.

SF are the company making the living from protecting manufacturer and producer rights and should know all about legal aggrements and rights . On the other hand when it came to the user rights they have chosen to ignore those completely from the begining under the banner "nah, they won't kick up the fuss about removal issue, let's just leave it there".

Users did kick up the fuss so they so they produced cleaner tool and sudenly recomend to publishers (like ED) to include this in their distributions, but it should be realy part of the SF . A bit late for demo version.

Thanks for those tests keithb, I didn't mean to sound ungreatfull.

o4ki · February 25, 2005

BUT, it has been proved that Starforce has bugs that ALLOW malicious software to do things on some PCs that shouldn't be able to do.

where is the provement?

It's still unclear the knowledge about the game-key issues after 3 re-installs or 3 major pc hardware changes.

as somebody wrote here it works as WinXP. Why do not you protest against XP?

It depends on publisher how many time you changed your hardware and how many time you install it on your PC, but im sure that such protection options for demo is MORE THEN ENOUGH!

Who say to u that release game will be protected as demo was? Im sure they will make normal protection with bindinf to CD.

Its called a panic -> http://forum.lockon.ru/viewtopic.php?t=3393, there is 99% untrue there.

Agreed that without ED info ppls start to reinstall thier windows :lol: not only remove demo.

And remember - its only DEMO!

sida · February 25, 2005

BUT' date=' it has been proved that Starforce has bugs that ALLOW malicious software to do things on some PCs that shouldn't be able to do.[/quote']
where is the provement?

o4ki, read my first post again.

Question for you.
Quote:
Im sure they will make normal protection with bindinf to CD.

Why are you so sure. Are you developer?
Ever heard of software coming up with different type of protection for Demo and Full version. LOL
Mind you, with all this screaming they would be fools not to look into something else now.

W-Natas · February 25, 2005

One simple question....

is this forum moderated? Read the Developers our threads?

... i hope it...

Bogun · February 25, 2005

O4ki

Go here and read:

http://xforce.iss.net/xforce/xfdb/18047

http://www.securityfocus.com/bid/11628

In short - Starforce drivers, installed in your system, will allow ring-0 type privileges to any mailitious code from ring-3 (user level). The worst case - any virus or trojan (written to take adwantage of the “backdoor” build into StarForce) can get OS privileges and totally control your system.

You can try it for yourself:

1. Install LOCON v1.1 DEMO.

2. Download and unzip this “prove of concept” test:

http://www.wasm.ru/forum/files/_194194340__starforcemeat.zip

3. Run starforcemeat.exe.

4. Enjoy!

This starforcemeat.exe harmless, it is just to show you how StarForce “backdoor” can be exploited.

Read what people like Sida and Starlight are saying, don’t just declare – I have no problem yet, then all is OK… It is not OK, you may start having problem after opening next malicious e-mail or accidentally visiting wrong web site, who’s authors may try to take advantage of this security hole.

Understand – average users have so many security holes in their OS, there probably many more chances that any other exploit going to get them first, the problem with the Starforce – even if user is doing all right steps to protect his PC, and not login into it with Administrative account every time to play games – this exploit will still allow malware to take control of his machine.

StarForce is just badly designed/written software.

But it does not metter.

:!: At the moment we consider an opportunity of application of other protection for English version 1.1. I shall not answer questions while we shall not define precisely.

Hopefully, as Chizh stated, they are looking and will find better copyprotection solution for LOCON v1.1.

Shaman · February 25, 2005

Re: Facts & Experiments with 1.1 (demo) protection

So when I ran the 1.1 demo for the first time what happened? :?:
Nothing. :shock:
No outgoing connections, no unexpected traffic, no problem running the demo.

I've noticed the same before. That why I was not panicing. :wink:

I'm using Sygate Personal Firewall as my firewall software. And I give auto-access only to trusted apps. Everything else needs my manual intervention... even explorer.exe (kernel, lsa shell, generic host - svchost, and NDIS User mode I/O driver - ndisuio.sys are blocked from the first day - that's why no DOS attacks..never..ever.)

So firewall heard nothing from StarForce so far.

sida · February 25, 2005

Re: Facts & Experiments with 1.1 (demo) protection

So when I ran the 1.1 demo for the first time what happened? :?:
Nothing. :shock:
No outgoing connections, no unexpected traffic, no problem running the demo.

I've noticed the same before. That why I was not panicing. :wink:
I'm using Sygate Personal Firewall as my firewall software. And I give auto-access only to trusted apps. Everything else needs my manual intervention... even explorer.exe (kernel, lsa shell, generic host - svchost, and NDIS User mode I/O driver - ndisuio.sys are blocked from the first day - that's why no DOS attacks..never..ever.)

So firewall heard nothing from StarForce so far.

That's correct, it shouldn't have and it's good it didn't (yet).

Sign In

Facts & Experiments with 1.1 (demo) protection

Recommended Posts

keithb

Darkness

JG27_Arklight

o4ki

Caretaker

benzene31

Dunmer

BeetleJuice

Dunmer

W-Natas

sida

Starlight

Dunmer

keithb

Dunmer

Starlight

leafer

Dunmer

sida

o4ki

sida

W-Natas

Bogun

Shaman

sida

Recently Browsing 0 members