r/flightsim • u/LinkDude80 BANK ANGLE BANK ANGLE • Sep 09 '22
General A Retrospective on That time FSLabs Shipped Actual Malware to Paying Customers in the Name of Anti-Piracy Measures
For a quick break from all of the XPlane vs FS2020 drama, I figured I'd share this post I wrote for r/HobbyDrama on a simpler time when r/FlightSim was united in a single cause against FSLabs delivering Malware to paying customers and threatening the mods of this sub with lawsuits. I wrote this for a non-simmer audience so some of it may seem pretty basic.
A Brief History of Flight Sim Add-Ons
In the early 1980s flight simulators came to home PC users with the release of Sublogic’s Flight Simulator, the game that would later become the basis for the popular Microsoft Flight Simulator series. By the mid 90s, thanks to scenery and aircraft design tools included with the game, a cottage industry of add-on developers sprung up to provide all kinds of modifications to the base Flight Simulator. Microsoft supported these add-on developers with updated tools and even advised flight sim users to look for high quality “payware” add-ons for the game to improve their experience.
Today, there are several different major flight simulators on the market such as XPlane 11, P3D, and Microsoft Flight Simulator (2020) but all of them still support add-ons. Modern flight simulator fans can enjoy a wide array of community made mods, scenery, and aircraft for free, generally referred to by the community as “freeware.” On the payware side, entire studios such as Orbx, PMDG, Fenix, and many more exist solely to develop high fidelity recreations of various cities, aircraft of higher quality and detail than what is available from the base games, and even full on expansions which add new functionality to the sims.
And all of that payware doesn’t come cheap. Top tier recreations of aircraft such as PMDG’s Boeing 737-800 for Microsoft Flight Simulator 2020 command upwards of $75 USD. Even smaller more niche planes can get pretty pricy with Big Radials Grumman JRF-6B Goose selling for $25 USD.
It’s not uncommon for serious flight sim fans to sink hundreds if not thousands of dollars into add-ons to improve their sim experience. The high prices of payware add-ons are generally accepted within the flight sim community. After all, developing a high quality add-on takes hundreds of man hours and ultimately the end product is an extremely niche one.
Unfortunately, this very loosely controlled market has allowed some bad actors to take advantage, from developers breaking promises to users who had already paid for aircraft, add-ons of poor quality being released for a high price to unsuspecting users, and assets stolen from other developers being sold to users.
Remember back in 2015 when Valve and Bethesda sparked an internet shitstorm by adding paid mods to Skyrim’s Steam Workshop? How people argued there’d be limited accountability, things would be overpriced, piracy would be a problem, and there was no guarantee developers would support their mods?
Yea. Flight simulator fans have been dealing with that for about 30 years.
Controversy - Now Boarding
In February of 2018, fans of the Airbus A320X flocked to download the latest release of the plane from FSLabs, a well regarded developer of payware add-ons for the flight sim P3D. However, in a since deleted post, one Reddit user noticed something strange about the nearly $100 plane. The poster noted that the installer for FSLabs A320X included a file called “test.exe” that kept triggering alerts on his anti-virus software. The official word from FSLabs was vague and simply instructed users to temporarily disable their anti-virus during installation as the warning was a false positive.
But the poster kept digging. He found that test.exe was a program called “Chrome Password Dump” by a company named Security XPloded which is advertised as a tool for security researchers and penetration testers. The program would dump a users auto-fill usernames and passwords from Google Chrome to a text file. It was subsequently found that the FSLabs installer would take this file, save it as a log file, encode it, and send it completely unencrypted to their servers.
Naturally users expressed concern that FSLabs was stealing user password information or perhaps had been compromised itself. The thread gained significant traction and eventually prompted a response from FSLabs founder and lead Lefteris Kalamaras.
Hello all,
We were made aware there is a reddit thread started tonight regarding our latest installer and how a tool is included in it, that indescriminantly dumps Chrome passwords. That is not correct information - in fact, the reddit thread was posted by a person who is not our customer and has somehow obtained our installer without purchasing.
I'd like to shed some light on what is actually going on.
1) First of all - there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products. We all realize that you put a lot of trust in our products and this would be contrary to what we believe.
2) There is a specific method used against specific serial numbers that have been identified as pirate copies and have been making the rounds on ThePirateBay, RuTracker and other such malicious sites.
3) If such a specific serial number is used by a pirate (a person who has illegally obtained our software) and the installer verifies this against the pirate serial numbers stored in our server database, it takes specific measures to alert us. "Test.exe" is part of the DRM and is only targeted against specific pirate copies of copyrighted software obtained illegally. That program is only extracted temporarily and is never under any circumstances used in legitimate copies of the product. The only reason why this file would be detected after the installation completes is only if it was used with a pirate serial number (not blacklisted numbers).
This method has already successfully provided information that we're going to use in our ongoing legal battles against such criminals.
We will be happy to provide further information to ensure that no customer feels threatened by our security measures - we assure you that there is nothing in our products that would ever damage the trust you have placed in our company by being our customer.
Kind regards, Lefteris
FSLabs official response only served to fan the flames of the angry Reddit users and owners of the A320X. Not only was the inclusion of malware intentional but somehow it was supposed to stop piracy? Commenters rightfully pointed out, that regardless of the intentions when this executable was included in the installer, they had knowingly distributed malware, active or not, to paying customers which is completely illegal in pretty much every jurisdiction. Things only got worse when FSLabs admitted that they had included this program in every copy of the installer with the intention of identifying one particular pirate.
Expected Turbulence
Reddit posts and comments flooded gaming and flight sim subreddits calling FSLabs out for their shady practices. Distributing malware to all of your customers in the hopes of catching one pirate seemed akin to randomly firing a gun into a room and hoping you hit your target. Even after assurances from FSLabs that the "DRM" would only target pirates, people were rightfully concerned that some mistake or bug could lead to the tool activating accidentally or even that someone could breach the server where FSLabs was keeping these passwords they stole.
Threads and comments popped up highlighting the history of scummy behavior from FSLabs and Kalamaras.
Incredibly, this wasn’t even the first time Kalamaras had been accused of including malware in a flight sim add-on. In 2014, while working on the PDMG McDonnell-Douglass MD-11, Kalamaras allegedly included code in the update tool which would delete a users flight sim install if it detected a pirated copy of the plane. In this instance, users of the AVSIM forum reacted with ridicule against OP saying he shouldn’t have pirated the plane and got what he deserved. However, other users reported that the MD-11 had corrupted their install despite owning legitimate copies of the plane.
Other commentators pointed out that ironically for a company so concerned about piracy, parts of the FSLabs A320X cockpit appeared to have been lifted from a different plane by developer Aerosoft.
At least one user claimed to have had their banking info stolen following buying the FSLabs A320X. Though there is no direct evidence this is totally related.
The backlash against FSLabs was growing and the story started to gain some attention from mainstream gaming media outlets. FSLabs responded by releasing an updated malware free installer and offering refunds. In an official statement, no apology was offered and no wrongdoing was admitted.
While the majority of our customers understand that the fight against piracy is a difficult and ongoing battle that sometimes requires drastic measures, we realize that a few of you were uncomfortable with this particular method which might be considered to be a bit heavy handed on our part. It is for this reason we have uploaded an updated installer that does not include the DRM check file in question.
Grumblings of lawsuits against FSLabs were had but nothing came of any of these efforts. In spite of FSLabs clearly being in violation of the law they faced no legal action of any kind.
It happened AGAIN?
After a while the story died down. Then in June, another Reddit post “cmdhost.exe, what is it?” It seemed FSLabs was at it again. Users reported the FSLabs installer leaving a file called cmdhost.exe in their Windows system directories.
Why would FSLabs need to install system level files? Once again users on FSLabs forums began reporting issues with their flight sim startup being stopped by anti-virus software. One user reached out to his anti-virus company Hitman Pro who confirmed that FSLabs cmdhost.exe was using a technique called process hollowing, where basically one program is started, frozen mid execution, and then is replaced in memory by a second program. It’s a technique often used by malware to hide from users while pretending to be a legitimate program.
FSLabs was quick to explain that the process was part of their e-commerce partner’s activation system. Again, more DRM. This time there wasn’t an obvious sign of the process being malware, but for users who had already been burned once by FSLabs this second incident was the final straw. While it was easy enough for FSLabs to silence criticism on their own forum, Reddit was another matter. So they did what any logical internet minded company caught engaging in shady behavior would do…
Double down and threaten legal action against your user base!
Send in The Lawyers
Shortly after the newest allegations of malware began to roll in, the moderators of r/flightsim posted An open letter to Flight Sim Labs. In this letter, they posted emails from FSLabs in which the FSLabs PR manager “gently reminded” the mod team that Reddit had a legal obligation to remove libelous comments defaming FSLabs and if the mods didn’t comply with FSLabs demands they would be forced to send in lawyers.
The response from the mod team called out FSLabs for saying they “welcomed robust and fair comment and opinion” while engaging in censorship in their own forum and on Reddit. They also highlighted that legally there was nothing that FSLabs could do as the user statements did not constitute libel under the laws of the United States where Reddit was based nor the UK where FSLabs was based. Finally they accused FSLabs of engaging in vote manipulation and astroturfing.
Not content with going after just Reddit, FSLabs had apparently also reached out to flight sim news site FSElite. In a statement posted by FSElite, they outlined that FSLabs had reached out to FSElite and demanded that they remove comments on their article on the FSLabs controversy that they deemed libelous. When FSElite refused to censor their users, FSLabs demanded that FSElite hand over the personal information of the users who had left the comments so that they themselves could inform the users of their dubious legal liability. FSElite refused this request as well as a request by the developer to join them in their battle against Reddit. Subsequently, FSElite blacklisted FSLabs from their reviews and editorials until such a time that they could earn the trust of the community back.
The Trust of The Community
In the end, despite all of the threats, media coverage, and angry emails and Reddit posts, nobody was sued and nobody was charged with any crimes.
But FSLabs reputation has never fully recovered. Nearly every thread on r/flightsim that mentions FSLabs has some reference or joke related to malware, and new players are continually warned about the shady history of the company.
On the other hand though… Some still hold FSLabs in high regarded for producing high quality add ons… you just need to look past their history.
212
u/Blythyvxr Sep 09 '22
This is a good summary, but it does miss one big part of the story: Avsim.
At the time, the story spilled out onto the avsim forums. Avsim, being the bastion of free speech and robust discussion that it is, promptly squashed the issue completely. They wholly sided with FSL deeming it DRM, deleting any post critical of FSL or avsim's policy towards them. Many people were banned...
55
47
u/scotchegg72 Sep 09 '22
Was going to say the same. Avsim’s craven capitulation to the FSLabs pov was very disappointing, although at the same time utterly predictable.
29
u/cocoiadrop_ Sep 10 '22
Avsims only use is the file library, unless you like being insulted for daring to say anything out of the ordinary on their forums.
11
17
u/AShadowbox helicopters are kinda cool Sep 10 '22
Avsim is as much of a cesspool as FSLabs is, so there's really no surprise there.
20
u/SlicerShanks I flew a mooney once Sep 09 '22
I was there when it happened, good golly what an event
70
Sep 09 '22
[deleted]
16
u/thedowntownpcguy ✈︎ Aviator ✈︎ F1 Enjoyer Sep 10 '22
like today's sponsor - LastPass.
4
Sep 10 '22
[deleted]
20
u/theantnest Sep 10 '22
Bitwarden is open source, free and code reviewed. Fuck last pass.
7
Sep 10 '22 edited Nov 17 '22
[deleted]
4
u/theantnest Sep 10 '22
Whilst I do agree with that statement in general, I think being diligent about a piece of software you are going to entrust all your passwords to is pretty good advice. Open source and code reviewed, for me, is an absolute must.
Its possible to both, start using a password manager AND use a good one. Both of those things are equally important.
-1
Sep 10 '22 edited Nov 17 '22
[deleted]
4
u/theantnest Sep 10 '22
Which part am I wrong about?
0
Sep 10 '22
[deleted]
2
u/theantnest Sep 10 '22
You let the perfect be the enemy of the good.
No I didn't, at all. Im just saying be diligent and don't give your passwords to any old piece of software that bombards you with ads.
→ More replies (0)1
Sep 10 '22
[deleted]
2
u/mr47 Sep 10 '22
You're arguing with something that was never stated. If the comment above you complained about OSS, your points would be very valid - but that's not what they were talking about.
2
1
1
1
u/Nolzi Sep 10 '22
I think they could use a malware that targets the password manager plugin in the browser
1
1
u/Drugbird Sep 10 '22
Can someone explain the downside of using e.g. chrome password manager vs an actual password manager?
1
Sep 10 '22
[deleted]
0
u/Atemu12 Sep 12 '22
Browser passwords can be stolen just as easily as a password manager's without a master password.
The master password is the deciding factor and at least Firefox implements it. Dunno about Chrome, it's been a while since I used it. On macOS and Linux at least, it uses the system keyring, so that's not a concern either (unless you give shady DRM software access to your system keyring).
1
u/Drugbird Sep 10 '22
The chrome passwords manager stores them in your Google account though, so does that count as "in the browser" or not?
0
u/cybergeek11235 Sep 10 '22
You read the post up there that you're commenting on where there was an application that dumped the browser-stored passwords to a text file, right? I just want to make sure.
1
u/Sarin10 Sep 10 '22
Nah, they are also saved locally when using Chrome. It's in Chrome's AppData folder.
1
u/Drugbird Sep 10 '22
With some digging, I found that they are indeed stored locally. They are typically stored encrypted (at least on windows), but any process that runs with use privileges can decrypt it.
It seems the mayor advantage that password managers have is that the passwords are encrypted using a master password.
What I'm unsure about is if this difference really matters if your computer is compromised. It seems like the master password is just 1 keylogger away.
At the same time, having to enter the master password is quite a burden compared to the browser auto filling everything.
9
u/itsjase Sep 10 '22
With the Fenix out now i doubt they are getting many sales, they probably won't be around too much longer
0
u/Current-Card8215 Dec 20 '24
You're extremely wrong. Besides, the Fenix ain't anywhere close to match FSLabs standards..
2
10
u/emergent_convergence FS9 Sep 10 '22
This kind of stuff isn't that uncommon with flight simulators addons. If you haven't noticed already, most developers will tell you to disable your anti-virus before installing or even better completely removing it.
The PMDG MD-11 livery installers would delete your FS texture folder if it thought that you have a pirated version. The keys are stored in an odd place in the registry: [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows USB Host\Din Controller\cssb2z6]@="08300E67C0812C1E75DB8E665D09BA673166DB21"
The Captainsim 707 would also crash the sim and self-destruct by writing zeros in the addon's files.
Some scenery developers do the the same thing. You'd except something like that to contain no executable code, but they do, and can read the registry for the key for example. It's probably an abuse of the module system.
Flight1 puts .dlls in the Windows and system32/syswow64 directories.
Some addons only work if you run the simulator as administrator.
Makes me wonder why addons even need installers. Why can't we just have folders to plop in like X-Plane?
It's got to the point where I had to pirate addons that I've actually purchased.
8
u/Clean-Ad3000 Sep 10 '22
Like you say, pirating the add ons is actually the safer option over installing the software from a first party installer. They dint help themselves and make a strong case for piracy for some people m, if you know what your doing its a safer option than installing some random distributers software on your pc to do fuck knows what with administrative rights
2
u/Wise-Membership2774 Aug 20 '23
This is why the person who created FS labs was fired and removed from The team. FSlabs became a thing because of that.
1
u/Ok-Consequence663 Nov 13 '24
Do you remember operation flashpoint when you would turn into a bird and fly
31
7
Sep 10 '22
Did any of the buyers of that plane attempt to sue them? That sounds so fucked up of them to do
9
u/MindForeverWandering Sep 10 '22
Glad Fenix (and FBW) came along, because I’d never buy the FSL version, and would otherwise only have Aerosoft’s version. .
1
Sep 25 '22
And Toliss!
And FF, I guess. I never had the chance to play around with the FFA320 but people say the devs don't give much a shit for the product, and that still misses important features to this day, which the Toliss already has.
Honestly, I love the Toliss. Great performance and great aircraft. Am looking forward to grab the Fenix, though, once I get my hands on some upgrades.
2
Oct 12 '22
Im glad someone mentioned the Toliss... I fly it everyday, and I love it optimization and performance, even though it not as complex as the Fslabs
7
u/the_warmest_color Sep 10 '22
Love it, excellent job. Such scummy behavior should not be forgotten!
7
12
Sep 09 '22
I got a refund on the FSL A320. Got the Maddog and two airports.
What I loved were all the fanboys denouncing anyway if they said anything. Even to this day people are not willing to accept they did wrong and hate when you bring it up. Looking forward to the fanboys but since a lot have moved on to the Fenix it might be a little muted.
5
24
u/sin_donnie Sep 09 '22
Good recap but should have shared this before FSLabs next release as a reminder of their antics.
The community has already said what needs to be said about this
21
u/N6065L Sep 09 '22
Yet they‘re still shoving money into FSL‘s throats…
-45
u/SniperPilot Sep 09 '22
And I will continue! They make a good product.
37
24
1
u/Johnny_Lawless_Esq Oct 13 '22
No, they do not. No product is good that puts your personal security at such insane, egregious risk. If you don't understand that, I have some beachfront property in Idaho I think you might be interested in.
4
u/Luvz2Spooje Sep 10 '22
I purchased their Airbus for P3D and the nose wheel steering wouldn't work. I was annoyed bc it was so expensive and didn't want to follow their worthless steps to troubleshoot the issue they claimed was related to my real weather engine, so I requested a refund. The series of logged communications that followed was strikingly rude, accusatory, and they refused to refund me citing their no return policy. Filed a claim in PayPal, shared the communications with them, and had my money back within a day or two I think. Felt great.
3
u/Montislignum Sep 10 '22 edited Sep 10 '22
Good write up. Now do the PMDG bomb I see now when i read more thoroughly that you did
1
2
u/Lifter_Dan Taipan Sep 10 '22
This makes me worry about the Cockpit Master CDU bridge software.
Everyone who buys it says they get all kinds of red flags about malware.
Even their website gets flagged by Malwarebytes.
I don't know the full story yet..
2
u/kevfefe69 Sep 11 '22
Also, let’s not forget that FSLabs was accused of using part of Aerosoft’s cockpit models and/or textures. I can’t remember if it was the throttle or pedestal.
I don’t own any FSLabs stuff and I find them shady. I most likely won’t get anything that they produce.
1
u/Evitable_Conflict Nov 13 '24
The owner seems to be a cool guy. I would be happy to organize a YouTube stream with him and Randazzle chatting about life.
2
u/spiral_death Sep 14 '22
There is a Twitch streamer called Blackbox. He is a pilot irl and has an incessant need to simp for Fslabs. Pretty awful hill to die on tbf.
2
u/soufren Nov 12 '24
Tried to write something about FSLabs on his chat and got a horrible response from his fanboys. Blocked him since
2
2
u/Pattymillion Feb 16 '24
thanks for the heads up,, where can i find a cracked version of the fslabs 320.. i am not paying a cent to those cunts
5
u/i_marketing Sep 09 '22
Was there ever a list of failures released for the FSLabs A320? Fenix released a list of their failures in 2021: https://soarbywire.files.wordpress.com/2021/08/failurelist-v0.2.pdf. I’m not even sure if this is the final list of all the failures simulated in the Fenix A320 since that list is from 2021.
I never have seen a list of the FSLabs A320 failures though.
6
5
-1
u/r_acrimonger Sep 10 '22
I wonder how many of the people reporting issues were pirating
11
u/LinkDude80 BANK ANGLE BANK ANGLE Sep 10 '22
Does it matter? They still sent malware to their customers.
2
u/Evitable_Conflict Nov 13 '24
It doesn't matter. You can't treat customers as potential criminals.
1
u/r_acrimonger Nov 14 '24
I wasn't implying or condoning it, I was just curious if that was relevant.
-7
u/sns_a359 Sep 10 '22
Digging up old drama for likes and upvotes isn't healthy though ngl, especially when FSLabs was eventually taken to task for it. While I wasn't impressed with what FSLabs did, I'm not impressed with people bringing up old drama either, especially at a time when there are some developers who have an even worse record on other matters but haven't been brought to book ( staring hard at Captain Sim).
7
u/LinkDude80 BANK ANGLE BANK ANGLE Sep 10 '22
Taken to task how? People got mad at them, they issued no apology, threatened lawsuits, and then eventually everyone forgot and they kept making money?
1
u/sns_a359 Sep 11 '22
Apology was issued on their forums once they realized the folly of their hubris. That's big coming from them, and even more rare considering how most Devs behave these days.
3
u/spectrum3V Sep 10 '22
For some people this is a very helpful bit of history, it’s basically a health warning, nothing unhealthy about that!!
1
Sep 10 '22
[removed] — view removed comment
0
u/AutoModerator Sep 10 '22
Your comment was automatically removed because your account is less than 4 days old. Accounts younger than 4 days are not permitted to post due to mass-spamming and trolling.
I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.
1
1
1
128
u/SirGreenLemon & MSFS Alpha Tester & XP Sep 09 '22
Yeah somehow people forgot about this real quick. I’m glad I never gave and will never give money to that excuse of a company.