bit-tech.net

EA's Origin hit by remote code execution flaw

EA's Origin hit by remote code execution flaw

EA's Origin digital distribution platform has been found to be vulnerable to the same flaw as suffered by Valve's Steam in October last year.

A security vulnerability in EA's Origin digital distribution platform could allow attackers to use the software to load malware and other unwanted packages onto a target system, according to reserach carried out by ReVuln last last month.

EA's Origin, the company's equivalent to Valve's popular Steam service, sets itself up as a helper application for special "origin://" links when installed on a client PC. These links are used by EA's Origin website to trigger the application to do a variety of tasks - install a newly-purchased game, for example - and are also used by the Origin client itself to launch installed games and communicate with the in-built digital rights management (DRM) system.

So far, so standard: that's exactly how Steam operates, except for the links being "steam://" rather than "origin://" in Valve's case. Sadly, security researchers Luigi Auriemma and Donato Ferrante of ReVuln claim to have located a loophole in EA's system that can allow ne'er-do-wells to use Origin as a means of loading executable content onto a client system, taking full control of the computer in the process.

'In order to demonstrate the insecurity of the Origin platform, we picked the most recent and well known game available on this platform: Crysis 3, which was released on 19 February 2013,' the pair explain in a white paper (PDF) warning on the matter, written on the 28th of February but only made public this past weekend. 'We found several ways to trigger remote code execution against remote victim systems by abusing the Origin platform itself.'

The proof-of-concept attack carried out by the pair demonstrated on video, resulted in the attacker being able to load a dynamic link library (DLL) executable file from a remote system on the client system - with the result that the client machine started to run untrusted code from a remote source. Had the attack been real, this code could have been anything from a back-door package to allow full remote access to a malicious package to delete critical files.

It's a serious flaw, but one with plenty of precedence: Valve's Steam platform was discovered to have the exact same issue (PDF warning) back in October last year, by the same security researchers. That another company has fallen victim to the same design flaw, however, does not make the problem any less serious for EA - and, coming as it does on the back of a botched high-profile game launch and the resignation of its chief executive, it's news EA could do without.

Asked for comment, EA refused to confirm that the flaw exploited by the researchers was legitimate - despite video evidence of that fact - stating only that 'our [security] team is constantly investigating hypotheticals like this one as we continually update our security infrastructure.'

11 Comments

Discuss in the forums Reply
Fizzban 19th March 2013, 12:34 Quote
Naturally they will patch this issue out, which will almost certainly break my Origin install. That is what usually happens when Origin updates, and what led me to cracking ME3 just so I could play it without issue... Although every time I start a new game I have to replace the legit .exe and give Origin permission to access the internet again so it can authenticate my DLC. Pah..I hate that bloody thing.
damien c 19th March 2013, 13:50 Quote
Quote:
Originally Posted by Fizzban
Naturally they will patch this issue out, which will almost certainly break my Origin install. That is what usually happens when Origin updates, and what led me to cracking ME3 just so I could play it without issue... Although every time I start a new game I have to replace the legit .exe and give Origin permission to access the internet again so it can authenticate my DLC. Pah..I hate that bloody thing.

Strange I never had any issues with my Origin install apart from when I ran a beta version.

Have nothing but issues though with Steam constantly loading with no connection until I restart it.

Anyway EA will probably fix this pretty soon.
rollo 19th March 2013, 14:09 Quote
As much as i hate origin its been fine never had any issues, same with steam.

People make a big hubu over nothing 90% of the time
Fizzban 19th March 2013, 14:23 Quote
I've had the occasional hiccup with Steam too, but I've found it to be far more reliable. Origin on the other hand seems to break every other update, necessitating me having to re-download and re-install it. Most frustrating when all you want to do is a play a game.

Thankfully all the other games I have on there don't require me to use Origin at all.
schmidtbag 19th March 2013, 14:40 Quote
Quote:
Originally Posted by damien c
Strange I never had any issues with my Origin install apart from when I ran a beta version.

Have nothing but issues though with Steam constantly loading with no connection until I restart it.

Anyway EA will probably fix this pretty soon.

Steam generally takes a long time to load, but it gets exponentially slower if you're downloading something else. While anything can load slower when you're multitasking your internet bandwidth, I've found Steam will often just stop trying to connect if I'm downloading something else. If you want to run Steam, I've found its usually best to just sit and wait until it logs you in.
damien c 19th March 2013, 15:46 Quote
Quote:
Originally Posted by schmidtbag
Steam generally takes a long time to load, but it gets exponentially slower if you're downloading something else. While anything can load slower when you're multitasking your internet bandwidth, I've found Steam will often just stop trying to connect if I'm downloading something else. If you want to run Steam, I've found its usually best to just sit and wait until it logs you in.


That's the problem it doesn't log in unless I manually restart it.

Steam and Origin both load on boot, and my net connection is active as soon as Windows loads so there should be no issues and there wasn't till the last 2 updates for Steam hit and now it just sits there with, no connection.

I also get random disconnects from Steam meaning I loose connection to the Call Of Duty servers for the likes of MW2/3, Black Op's and Black Op's 2 and then it reconnects after a few seconds even though my internet is still up and has nothing wrong with it.

I have none of that trouble with Origin not to mention I get my full download speed from Origin unyet Steam only let's me download at 30Mb instead of 100Mb.

I always hear people saying Origin is crap etc but, I have never once really had any issues with it other than when trying a beta version of it unyet Steam I constantly have issues with.

This happens on a fresh install of Windows 7 as well, but I cannot try it with Windows 8 because allot of the games I play just won't load on Windows 8 and my motherboard which is supposed to be Windows 8 supported, won't install any of the drivers and the graphics drivers won't install but that's just Windows 8 for you.

As soon as I can stop using Steam I will but until then I have no choice but to use it, because of some of the games I choose to play and if those games were available on Origin I would buy them on there instead of Steam.
LightningPete 19th March 2013, 17:07 Quote
Quote:
Originally Posted by rollo
As much as i hate origin its been fine never had any issues, same with steam.

People make a big hubu over nothing 90% of the time

Apart from the fact is slow to load-up, slow to update, its yet another program for games without actually owning it and that all their newer titles like simcity can potentially be switched off so your paying to rent the game only in a certain timeframe, its server connections are never 100% and the fact that you cant just buy it for any other platform like Steam either. I dont know, maybe not 90% is nothing ;)
tuk 19th March 2013, 18:11 Quote
Quote:
Originally Posted by rollo

People make a big hubu over nothing 90% of the time
While that may be generally true ..it has little bearing on this thread.
Quote:
A security vulnerability in EA's Origin digital distribution platform could allow attackers to use the software to load malware and other unwanted packages onto a target system

^^not exactly nothing
leexgx 20th March 2013, 01:27 Quote
Quote:
Originally Posted by damien c
Quote:
Originally Posted by schmidtbag
Steam generally takes a long time to load, but it gets exponentially slower if you're downloading something else. While anything can load slower when you're multitasking your internet bandwidth, I've found Steam will often just stop trying to connect if I'm downloading something else. If you want to run Steam, I've found its usually best to just sit and wait until it logs you in.


That's the problem it doesn't log in unless I manually restart it.

Steam and Origin both load on boot, and my net connection is active as soon as Windows loads so there should be no issues and there wasn't till the last 2 updates for Steam hit and now it just sits there with, no connection.

I also get random disconnects from Steam meaning I loose connection to the Call Of Duty servers for the likes of MW2/3, Black Op's and Black Op's 2 and then it reconnects after a few seconds even though my internet is still up and has nothing wrong with it.

I have none of that trouble with Origin not to mention I get my full download speed from Origin unyet Steam only let's me download at 30Mb instead of 100Mb.

I always hear people saying Origin is crap etc but, I have never once really had any issues with it other than when trying a beta version of it unyet Steam I constantly have issues with.

This happens on a fresh install of Windows 7 as well, but I cannot try it with Windows 8 because allot of the games I play just won't load on Windows 8 and my motherboard which is supposed to be Windows 8 supported, won't install any of the drivers and the graphics drivers won't install but that's just Windows 8 for you.

As soon as I can stop using Steam I will but until then I have no choice but to use it, because of some of the games I choose to play and if those games were available on Origin I would buy them on there instead of Steam.

I guess your on virgin then
damien c 20th March 2013, 08:51 Quote
Quote:
Originally Posted by leexgx
Quote:
Originally Posted by damien c
Quote:
Originally Posted by schmidtbag
Steam generally takes a long time to load, but it gets exponentially slower if you're downloading something else. While anything can load slower when you're multitasking your internet bandwidth, I've found Steam will often just stop trying to connect if I'm downloading something else. If you want to run Steam, I've found its usually best to just sit and wait until it logs you in.


That's the problem it doesn't log in unless I manually restart it.

Steam and Origin both load on boot, and my net connection is active as soon as Windows loads so there should be no issues and there wasn't till the last 2 updates for Steam hit and now it just sits there with, no connection.

I also get random disconnects from Steam meaning I loose connection to the Call Of Duty servers for the likes of MW2/3, Black Op's and Black Op's 2 and then it reconnects after a few seconds even though my internet is still up and has nothing wrong with it.

I have none of that trouble with Origin not to mention I get my full download speed from Origin unyet Steam only let's me download at 30Mb instead of 100Mb.

I always hear people saying Origin is crap etc but, I have never once really had any issues with it other than when trying a beta version of it unyet Steam I constantly have issues with.

This happens on a fresh install of Windows 7 as well, but I cannot try it with Windows 8 because allot of the games I play just won't load on Windows 8 and my motherboard which is supposed to be Windows 8 supported, won't install any of the drivers and the graphics drivers won't install but that's just Windows 8 for you.

As soon as I can stop using Steam I will but until then I have no choice but to use it, because of some of the games I choose to play and if those games were available on Origin I would buy them on there instead of Steam.

I guess your on virgin then

Yes I am, because if I was on any other provider I would only be able to get 4Mb where I live and when Infinity is available in my area I will only be able to receive around the 30Mb mark.
Horizon 20th March 2013, 17:34 Quote
Quote:
Originally Posted by tuk
Quote:
Originally Posted by rollo

People make a big hubu over nothing 90% of the time
While that may be generally true ..it has little bearing on this thread.
Quote:
A security vulnerability in EA's Origin digital distribution platform could allow attackers to use the software to load malware and other unwanted packages onto a target system

^^not exactly nothing

I believe that would be the 10%.
Log in

You are not logged in, please login with your forum account below. If you don't already have an account please register to start contributing.



Discuss in the forums