FSL320窃取用户Chrome网页密码事件报告

昨日北京时间日间，在FSL的官方论坛上爆出信息，FSL320启动时会启动一个名为"test.exe"的可执行文件，这个文件经确认会窃取用户的Chrome浏览器中保存的网页账号密码信息。此文件被证实存在于其出品1.0.1.232版本以及其之前的所有版本。

附原论坛地址：https://forums.flightsimlabs.com ... lware-in-installer/


随着本事件的曝光，FSL官方在之后两个小时发布了一个解释公告，全文如下：

Hello all,

we were made aware there is a reddit thread started tonight regarding our latest installer and how a tool is included in it, that indescriminantly dumps Chrome passwords. That is not correct information - in fact, the reddit thread was posted by a person who is not our customer and has somehow obtained our installer without purchasing.

I'd like to shed some light on what is actually going on.

1) First of all - there are no tools used to reveal any sensitive information of any customer who has legitimately purchased our products. We all realize that you put a lot of trust in our products and this would be contrary to what we believe.

2) There is a specific method used against specific serial numbers that have been identified as pirate copies and have been making the rounds on ThePirateBay, RuTracker and other such malicious sites.

3) If such a specific serial number is used by a pirate (a person who has illegally obtained our software) and the installer verifies this against the pirate serial numbers stored in our server database, it takes specific measures to alert us. "Test.exe" is part of the DRM and is only targeted against specific pirate copies of copyrighted software obtained illegally. That program is only extracted temporarily and is never under any circumstances used in legitimate copies of the product. The only reason why this file would be detected after the installation completes is only if it was used with a pirate serial number.

This method has already successfully provided information that we're using in our ongoing legal battles against such criminals.

We will be happy to provide further information to ensure that no customer feels threatened by our security measures - we assure you that there is nothing in our products that would ever damage the trust you have placed in our company by being our customer.

Kind regards,

Lefteris

在公告中，FSL承认此程序为官方加入，在使用加入黑名单的序列号激活的FSL320机模中才会启动（存疑），且此程序已经收到信息。

受此影响，论坛内影响的版本FSL320插件即时起停止下载服务。也强烈建议现安装所有盗版FSL320机模的飞友们立即停飞并卸载FSL320机模。已确认自己使用谷歌Chrome浏览器的飞友请检查自己保存在浏览器的那些密码与账户，尽快进行更改密码操作。

在之后，FSL官方疑似收到较大舆论压力，在之后放出一个去掉上述Test.exe的FSL320升级包，论坛强烈建议现为正版FSL用户的飞友们至FSL官网立即下载并安装此升级包升级自己的FSL320系列机模。原文如下：

Hello all,

I would like to further address some of the controversy that has taken place this evening.

I want to reiterate and reaffirm that we as a company and as flight simmers would never do anything to knowingly violate the trust that you have placed in us by not only buying our products but supporting them and FlightSimLabs.

While the majority of our customers understand that the fight against piracy is a difficult and ongoing battle that sometimes requires drastic measures, we realize that a few of you were uncomfortable with this particular method which might be considered to be a bit heavy handed on our part.  It is for this reason we have uploaded an updated installer that does not include the DRM check file in question.

I want to thank you all for voicing your concerns in a considerate manner on our forums and elsewhere.  We do listen to our customers because without you, there would be no FlightSimLabs.

Here's the link to the updated A320-X v232 installer.

常在河边走，哪能不湿鞋

只叹息现做空客的厂商们不大给力啊

这样的情况，在我看来，也是在一定程度上是让盗版逼得

不要不要的

PMDG还是一个神的存在

问题在于

不做空客机模啊

FSL官方又对此事作出了详细的解释原文：https://forums.flightsimlabs.com ... -drm-what-happened/


公告大意：

1.FSL320用户可以选择全额退款。
2.当你输入错误的序列号时，服务器只会返回提醒信息而不会在启动“test.exe”。
3.test.exe在使用进入黑名单的序列号进行激活时继续启动。
FSL官方声称，在最初的FSL320 32位版本，发现了一些使用离线激活破解成功的情况。并且破解者通过这个方法甚至找到了FSL的服务器地址，尝试使用Chrome访问。因此便会尝试通过提取账号密码的方式锁定IP。
3.当所有信息均和黑名单中的符合时“test.exe”才会启动。
4.FSL保证他们的服务器不会因为安全问题而泄露任何已经搜集到的信息。
5.FSL道歉并保证今后不会再发生类似事件。


事情结束。
同时，是不是应该反思些什么呢？