FSLabs tried to smuggle malware onto the computers of hundreds of players; they fell down, and instead of apologising, they threatened everyone…

The world of flight simulators contains anecdotes that would surprise any video game fan. While it’s true that we’re talking about a fill-in-the-blank genre, the user base has seen some absolutely insane moments. Such was, for example, the crushing failure of FSLabs, a developer specialising in high-quality aircraft add-ons and DLC packs that has completely lost the trust of its fans due to its stubborn “anti-piracy” and the introduction of malware into users’ systems.

With malware against malware

As FSNews recalls, it all started with a clever user and a now-deleted Reddit post. Specifically, a post by a player who innocently asked why his antivirus was triggered by a file called “test.exe” that was installed on his computer after he downloaded an add-on from FSLabs to play with an Airbus A320X in the Prepar3D simulator. This discovery, and subsequent investigation by him and other fans of the genre, led the community to demand an explanation from FSLabs for introducing the suspicious executable. The company merely advised fans to temporarily disable their antivirus to enjoy the purchased DLC.

However, it didn’t take long for the community to discover the true nature of “test.exe”. After some research, users discovered that this file is actually called Chrome Password Dump, designed by a company called Security XPloded. It works as its name suggests: it collected the usernames/passwords stored in Google Chrome, pasted them into a text file, encrypted the result, and sent it all to FSLabs servers.

The community realised that the extension developers were trying to steal their personal information.

At the time, FSLabs founder and head Lefteris Kalamaras shared the reason why the team reportedly introduced such a controversial element to their DLC. They claim it is an aggressive system in the fight against piracy. Of course, this was just fuel to the fire; as widely reported on Reddit and flight simulation forums, FSLabs admitted to embedding malware in their downloadable content. So, as the controversy grew, the creators quickly released an installer without suspicious files. This move calmed tempers…for a while.

Three months after the first Reddit post about “test.exe”, user walkday stirred up the standing water again on the same social network by asking what the “cmdhost.exe” file that came with the A320X DLC was and was automatically installed in the Windows system files. Digging deeper, the community discovered thanks to the company Hitman Pro that the executable file was hollowing: a typical malicious software method that puts a legitimate process (eg playing a program) into a suspended state, filling its memory with malicious code (a second, illegitimate program) and then restarts the process to run the malicious code under the guise of a legitimate program. The creators again downplayed the problem, saying that such a system is a way to prevent piracy of their products.

FSLabs: threatening fans instead of apologising

However, the situation angered many FSLabs fans. As is often the case with these types of disputes, social networks and forums specialising in flight simulation experiences criticised the add-on’s creators for bypassing anti-piracy systems and injecting malicious software into users’ systems. However, instead of apologising and ceasing to smuggle suspicious files onto its customers’ computers, FSLabs took a path that no one expected at all: it threatened to sue.

The team led by Kalamaras first approached the moderators of the aircraft simulation subreddit to request the removal of defamatory comments and posts against FSLabs; if this is ignored, the developers will send their lawyers. Something similar happened with the news portal FSElite, which was directly “blacklisted” by the studio (which led, among other things, to directly stop sending keys for analysis) because the media outlet refused to moderate comments related to the malware debate. FSLabs asked for personal data from users who shared their opinions about the developer’s bizarre strategy in order to use their own tools to warn them about the legality of their actions.

Of course, none of FSLabs’ threatening measures were successful. The malware drama never led to serious prosecution, and FSLabs’ add-ons are still remembered by gamers for their quality as much as their downloads. However, the company’s reputation will probably never be the same again…

Source: FSNews