1.1 Copy protection

[Lipfert]

I found a pretty good read about Star-Force, it may not answer all my questions but it does raise some good points.

 

http://www.firingsquad.com/print_article.asp?current_section=Features&fs_article_id=1530

[Gel214th]

Found this link after searching awhile:

 

http://www.star-force.com/index.phtml?category=200&type=5

 

This is part of the problem.

 

Updating StarForce drivers can improve protected applications performance and drivers compatibility. The following procedure will update the StarForce drivers on your system.

 

 

Why the hell do I have to download drivers to update third party copy protection on my system to prevent compatibility problems with my other stuff!???

[Guest Dlink]

I'll point out that the vulnerability introduced by Star-Force allows priviledge elevation to administrator LOCALLY. THat means that some program on your computer could gain administrator level access once run on your computer. IT CANNOT DO SO OVER THE NETWORK! SF DOES NOT OPEN A DOOR IN YOUR COMPUTER FOR STUFF TO JUST JUMP IN FROM THE NET!

 

Lastly, this vulnerability affects you ONLY if you are attempting to run things as a normal user in order to keep things safe. If you are runnign as ADMINISTRATOR then this vulnerability means NOTHING to you since any program that you execute /already/ has administrator priviledges!

 

Period, end of story.

 

Paranoia off. :P

 

Why are you posting this. Are you suggesting that we shouldn't worry about this because YOU SAY SO.

 

Another great apologist.

[Stormin]

I'll point out that the vulnerability introduced by Star-Force allows priviledge elevation to administrator LOCALLY. THat means that some program on your computer could gain administrator level access once run on your computer. IT CANNOT DO SO OVER THE NETWORK! SF DOES NOT OPEN A DOOR IN YOUR COMPUTER FOR STUFF TO JUST JUMP IN FROM THE NET!

 

Lastly, this vulnerability affects you ONLY if you are attempting to run things as a normal user in order to keep things safe. If you are runnign as ADMINISTRATOR then this vulnerability means NOTHING to you since any program that you execute /already/ has administrator priviledges!

 

Period, end of story.

 

Paranoia off. :P

 

 

Why are you posting this. Are you suggesting that we shouldn't worry about this because YOU SAY SO.

 

Another great apologist.

 

How is he being an "apologist" for stating facts?

[Bug11]

come on guys.

 

the fact that MOST (in our opinion) users are MAYBE running as administrator (in our opinion) on their computer does not make a security flaw irrelevant.

 

this is a STUPID STUPID STUPID argument.

 

if microsoft shared this attitude they'd never patch for escalation privilige security flaws.

 

look - there is a flaw - it exists (or did) - no amount of extenuating circumstances make that flaw fixed - only the flaw being fixed does that. I find it absurd what lengths some people are going to to make it ok for the flaws to be there. If it was ok would starforce have patched it? Have a bit of common sense!

 

Come on, hold hands, kumbaya, kumbaya. Just accept some people take flaws seriously and some people don't and agree that you'll never agree on how important they are.

[Witchking]

can we get PERSONALISED SERIALS AND IMPLEMENT PUNKBUSTER ETC....I SURE WANT A VERY HARD TO CRACK GAME..becos I want ED to get the money they worked for. Starforce is EXCELLENT with me as far as we don't have to buy the game AGAIN after 3 hardware installs.

[Bogun]

Guys, there still is (and had been for some time) basic misunderstanding of what StarForce “backdoor” is and how it may jeopardize your system security even if you do almost all things right trying to protect your PC(s). Many people like Gel214th, others where trying hard, but still some people keep missing the explanation. I will try one more time.

 

Here is a very simple version of explanation:

 

First – StarForce driver is NOT a “virus”,”tojan” or alike.

It does what it suppose to do – prevent illegally obtained copy of the software/game from running on one’s PC.

It is a peace of software written to run as a low level driver.

The first category “Drivers” are usually only needed to make your PC to recognize and be able to interact with your PC’s hardware, they are running in the most privileged Ring0 of the x86 processors where OS is running. No security apply onto anything running on this level. StarForce driver runs like that and that’s why it is actually capable of executing unstoppable “CreateSystemProcess” routine coded into it.

There is also second category of software running as a “Processes” – almost like TSR in the old Windows 3.x world. They are running all the time and user may try to stop them to not to consume system resources if they (processes) are not needed for normal PC operation.

The “Processes” may start to run with either “Users” or “System” privileges and run in either “User Mode” or “Kernel Mode”.

The third category - “Applications” are runing in “User Mode”, they don’t have direct access to any functions, and must request services from the Operating System, Processes or Drivers.

 

Now - You are malicious software writer and your target is the PC with “StarForce driver” installed.

You write the ActiveX application for the Web page or “normal executable” to be distributed via e-mail, counting on the user to allow it to run even if user is not an “Administrator” on his PC and normally would not be able to install malicious software to run as a “Process”. You (virus writer) use the capability of the “StarForce driver’s backdoor” (use “function call”) to “CreateSystemProcess” to install your malware somewhere on target PC and give it a name like svchost.exe or csrss.exe to make it look undistinguishable in Task Manager from legitimate system processes running on PC and make it to start it with the “System” privileges. This malicious process (your application) can do anything you want it to do on target PC – be that remote control, FTP server, e-mail worm or anything else – this process will start every time your PC starts, run with “System privileges” and will be extremely hard to detect for normal computer user. You may even create second system process (with similar legitimately sounding name) to prevent user from shutting down your first process.

 

Now – there are no known working malware to take advantage of the “StarForce driver backdoor” yet.

There is one worm, which try to use the “backdoor” but it is poorly written and it doesn’t work, but that’s just the beginning.

I’m sure some other “better malware writers” will soon try to take advantage of the “StarForce driver backdoor”.

When this happened Microsoft or anti-virus companies like Symantec and McAfee will try to close the “backdoor” and all the software/games protected by StarForce will stop working. Should we all wait for that?

[CanadaDave]

come on guys.

 

the fact that MOST (in our opinion) users are MAYBE running as administrator (in our opinion) on their computer does not make a security flaw irrelevant.

 

this is a STUPID STUPID STUPID argument.

 

Yes, but it's equally nonsensical for users who routinely run as administrator to rant about how their security has been comprimised, which also happened.

 

It was a certainly a flaw, it just got blown out of proportion here.

[raf_kichu]

As a legitimate software user I want to use the software with the same ease as if it had not any software protection at all. Which means that it should be completely transparent for me and shouldn't affect ANY other fuctionality of my computer.

 

Other concepts are just broken by design I think. First they treat the legitimate users as a potential pirate, they force him to do things that the pirate doesn't have to do (despite he pays for the software) and sometimes this gets the legitimate user with troubles the pirate doesn't have.

 

I want to be okay, I pay... and they get me troubles instead of trouble-free software.

 

I this case I won't get the illegal copy, but I dont think I buy the original either.

[wsoul2k]

Guys, there still is (and had been for some time) basic misunderstanding of what StarForce “backdoor” is and how it may jeopardize your system security even if you do almost all things right trying to protect your PC(s). Many people like Gel214th, others where trying hard, but still some people keep missing the explanation. I will try one more time.

 

Here is a very simple version of explanation:

 

 

First – StarForce driver is NOT a “virus”,”tojan” or alike.

It does what it suppose to do – prevent illegally obtained copy ........

 

........I’m sure some other “better malware writers” will soon try to take advantage of the “StarForce driver backdoor”.

When this happened Microsoft or anti-virus companies like Symantec and McAfee will try to close the “backdoor” and all the software/games protected by StarForce will stop working. Should we all wait for that?

 

 

Fantastic explanation tks a lot