MASSIVE SECURITY HAZARD in Spore!

[BastDawn]

Yes.  (I had to log out as Ibis to complete the change, and I figured I might as well reboot completely.)  So Spore keeps the name it knew at installation.  But I'm happy with it that way, because "Ibis" is not the name the computer is registered under.

[J. M. Pescado]

I have a few hunches on where it is stored at the moment, and have also made some progress is understanding the spyware components. Research is ongoing.

[Mirelly]

Can someone explain to me why someone knowing my account's log-in name on my PC is dangerous to me?

I submit that 90% of Windoze users operate with a single account using the generic MS account name and with no password set. I was one of those until a few ago when I migrated from dial-up to DSL. At that point I realised that I needed additional levels of security and installed a firewall and began operating password protected user accounts.

[J. M. Pescado]

Can someone explain to me why someone knowing my account's log-in name on my PC is dangerous to me?

If your login name is not sensitive information, then you are relatively safe. However, a disturbing number of computers I have encountered actually contain the user's real name, which is highly sensitive information that should not be shared with the world, especially given that other information tends to be incidentally attached to it by IP. All in all, the fact that it transmits potentially sensitive information to the entire world is cause for concern.

[Mirelly]

Ah, my computer's log-in name is my real name that my friends use to address me, but that name has no direct correlation with my "real" real name as found in government records and which I use only to notarise documents for the purposes of accepting liabilities and responsibilities.

I also have two signatures. One for official purposes and one for sundry purposes, for example signing for a delivery; I believe in plausible deniability ....

[Menaceman]

When I use the SCC the lower left of the screen shows my full name until it "phones home" when it changes to display my Spore account name. I never got to name my user account as the laptop was delivered to me with it already named after me and I never saw the need to change it. I've asked a friend what my creations show up as on his machine as he has downloaded some of them and he says they are listed with my Spore account name, not my laptop user account name.
Should I still be worried or not? I hate finding threads like this as they make me so paranoid.

[witch]

Question for JM.

If I'm running the game on a hardware profile that doesn't allow for networking and internet, will the EAxis phone home info be held after the machine has been rebooted?

[BastDawn]

I was checking out the forums at Penny Arcade for more creatures to download, and found this:

jonxp wrote:

The creature data is encoded in the actual PNG images not as metadata, but through stenographically altering the image. Each pixel is made of four bytes of data (Red, Green, Blue, and Alpha) to extract the data from the image, one needs to take each byte of the image, divide it by two, and use the remainder as a single bit (this is known as a modulus operation). So for each byte in the decoded image you get a bit of information, each pixel is a nibble, and every two pixels is a full byte. Since the thumbs are 128x128, you can store 8KB of information in this manner.

I have written a program to extract the creature data, unfortunately it seems to be signed and/or encoded in some fashion, so I can't actually manipulate it (as far as I can tell).

I will put up some proof-of-concept "spore rolled" creatures soon that appear to be one creature, but are in fact a different one when loaded.

Interesting, but not very useful until it's decoded.

[J. M. Pescado]

When I use the SCC the lower left of the screen shows my full name until it "phones home" when it changes to display my Spore account name. I never got to name my user account as the laptop was delivered to me with it already named after me and I never saw the need to change it. I've asked a friend what my creations show up as on his machine as he has downloaded some of them and he says they are listed with my Spore account name, not my laptop user account name.
Should I still be worried or not? I hate finding threads like this as they make me so paranoid.

You should panic now, yes. In the event that the Splorch server cannot be logged in, anything you make will contain your name in it. You can freak out now.

[wes_h]

I saw a post elsewhere claiming that the data is in the color channels at all the locations that are transparent (where teh alpha is zero). It seems like a reasonable conjecture and also a very clever method.

If it bears out to be true I will eat my words here publicly (and this may very well be necessary), although I am correct that there are only standard PNG chunk types in any of the files I examined (no private or metadata chunks). Since I do not have any significant tools here or previous experience to aid me in decompressing and checking these files, I will leave that research to the ongoing efforts of others.

I will say that I know the username is saved in .package files, along with the creature name and other data (likely ID values similar to the TS2 group and instance) after the file is downloaded, and that at least a significant amount of the creature data is an XML file. Unlike TS2, it appears when the file is donwloaded that the package file containing your creature data (created by you and that downloaded) is updated, rather than separate files existing for each creature.

[J. M. Pescado]

Where are these package files HIDING, anyway? I can't seem to locate them inside the directories.

I saw a post elsewhere claiming that the data is in the color channels at all the locations that are transparent (where teh alpha is zero). It seems like a reasonable conjecture and also a very clever method.

I wouldn't worry about that. An experiment is meaningful even when the hypothesis is proven to be false.

[Lorelei]

Photoshop has a "feature" where you can add data info (name of artist, source of image(s), address, copyright, contact data, whatever) to images. I haven't used it in ages, so I can't recall if this data is only for Photoshop-format files or if jpgs, pngs and gifs can also be data-enhanced. At any rate, there are ways to embed data that don't require a lot of nerdery or specialized knowledge. Said data can be very complex.

As far as reading info off a standard compy, also easy. Simplistic Javascripted code embedded in HTML has been used since practically the first days of the graphical (rather than text-based) WWW, and before.

Not a great stretch of the imagination that an unethical data-mining company like EA might seek to tweak existing old tech to steal your personal info. Fuckers.

[Mirelly]

In the event that the Splorch server cannot be logged in, anything you make will contain your name in it. You can freak out now.

Muahaha. I visited the Sporepedia today and broke it.

proof ... it's a screencap.

ETA Cold Fusion ... yeesh.

[wes_h]

Where are these package files HIDING, anyway? I can't seem to locate them inside the directories.

I am running the program here on a Vista machine. On Vista the packages are in C:\Users\myusername\AppData\Roaming\SPORE Creature Creator\

I would believe on XP there will be a SPORE Creature Creator in your user area in a folder called "Application Data". This folder or it's analog is, under both Vista and XP, a locked system folder, and to see the files in Windows Explorer you have to uncheck the option "Hide Protected Operating System Files", ignoring the dire warnings that messing with these files could ruin your system, and may perhaps be the source of all strife in the world.

SimPE Phails at opening them, because the format has been updated to version major 2. This has become the latest time sink for me.

[Menaceman]

In the event that the Splorch server cannot be logged in, anything you make will contain your name in it. You can freak out now.

Muahaha. I visited the Sporepedia today and broke it.

proof ... it's a screencap.

ETA Cold Fusion ... yeesh.

I get those error screens a lot when browsing the spore site.
As to my earlier post, I have since created creatures without being connected to the net and they have indeed been stored to my sporpedia with my real name attached. I figure I can just edit them and save as new creatures to get them to use my account name before uploading.

[CM]

Thank you for telling us this!  This only shows that EA is in it for the bucks and nothing else.  If they actually listened to the customers, this would have stopped awhile ago.  If this is any indication of what is to come for The Sims 3, count me out. 

[Zilla]

ACHTUNG!

As if SecuROM wasn't bad enough, there is also a MASSIVE SECURITY LEAK in Spore: If you EVER share ANY content with ANYONE, be warned that YOUR COMPUTER USERNAME is ENCRYPTED INTO THE CREATURE "IMAGE" FILE. YOU WILL NOT BE ABLE TO REMOVE THIS INFORMATION BY HEXING! This means that ANYONE who downloads it will know what your username is on your computer.

This represents a MASSIVE security breach because many people (foolishly) encode their real names into their Windoze username. Even if you don't, revealing this username to the world presents a point of vulnerability for attack by hackers. By sharing any Spore content ANYWHERE, you are leaving your computer open to attack and leaving yourself open to stalking and identity theft.

BEWARE!

All ass kissing aside Pes, but after not beiing here for awhile I was rather disappointed to read this. Certainly you must have a a trick or two up your sleeve to bypass this problem?  Not that I was going to buy it, but still.

Silly people still feeding the cash cow. All one is ask is, why?

[J. M. Pescado]

All ass kissing aside Pes, but after not beiing here for awhile I was rather disappointed to read this. Certainly you must have a a trick or two up your sleeve to bypass this problem?  Not that I was going to buy it, but still.

Yeah, don't put your name on your computer and/or don't share your files. It's really a problem that afflicts Sheeples, but there's an awful lot of them.

[zolabee]

You know, I don't post ofter - usually when I need help (stupid non tech here), but I just have to say EA stinks! *read sucks*  What chance does someone like me who is miles below you guys, but miles above even more people? 

Thanks for sharing this info.  I hadn't intended to get spore, but will pass this on to student's parents when school starts back.

[SilentDream]

spore will use the name of the account it was installed under so even though you changed your login name it will still use the name it was installed with. (if you uninstall,reinstall it will use your new one ).

I don't think so. When I got my computer, the account was named something other than it is now. In documents and settings, the account folder still has the previous name and I have had games pull from that name before. So I wouldn't doubt that spore, though installed after I changed the account name, would pick up the previous name.

[kuronue]

Out of curiosity, JM, how dangerous are slightly-unusual firstnames? I've heard varying opinions from varying people, most of which can't tell their heads from their asses...


ETA: And are we sure the computer name isn't stored anywhere? I got this lappy from my school, so if there's both that gives a first name and a school. . .

[J. M. Pescado]

Out of curiosity, JM, how dangerous are slightly-unusual firstnames? I've heard varying opinions from varying people, most of which can't tell their heads from their asses...

Extremely. I mean, if your name is something like "John" or "Emma", you probably have little to worry about...

ETA: And are we sure the computer name isn't stored anywhere? I got this lappy from my school, so if there's both that gives a first name and a school. . .

DEAD MEAT. Reformat that sucker NOW. Tell them it got hacked by mudkipz. A name alone may not be enough, but three points of data in the form of a name, an organization, and an IP is enough to definitely peg you to within 50 meters. With that much information, someone with the resources of EAxis can take you out with an artillery strike right there.

[kuronue]

Out of curiosity, JM, how dangerous are slightly-unusual firstnames? I've heard varying opinions from varying people, most of which can't tell their heads from their asses...

Extremely. I mean, if your name is something like "John" or "Emma", you probably have little to worry about...

It's not, it's one of those last names that is sometimes used as a first name, for a boy, when spelled differently. Googling it shows no relevant results in the first five pages (after that I lost count)

ETA: And are we sure the computer name isn't stored anywhere? I got this lappy from my school, so if there's both that gives a first name and a school. . .

DEAD MEAT. Reformat that sucker NOW. Tell them it got hacked by mudkipz. A name alone may not be enough, but three points of data in the form of a name, an organization, and an IP is enough to definitely peg you to within 50 meters. With that much information, someone with the resources of EAxis can take you out with an artillery strike right there.

Glad I haven't installed the Creature Creator yet then. I'll put it on the more anonymous computer after checking to ensure there's nothing on it.

[edalbformat]

According to last thing I read, EA/Maxis accuse to have more than 100 million copies of their games sold. Everyday you read users saying "I'm totally excited waiting for the new Ep, or whatever".
You are BUYING boy, no matter what kind of rape is done to you. I don't have Spore, or any other product from EA and I decided that no one in my circle will ever buy anything else with EA logo in it. We avoid even the shops that place the logo on the window.
No one has to care about what you have to say, because you say it and run to buy the next crap released.
Game players are developping the same relation as the whore to the pimp. You destroy me but what am I without you?

-x-x-x-x-x-
90% of the people in this planet, should use the brain outside the cranium.  It is only decorative anyway!

[Zazazu]

Game players are developping the same relation as the whore to the pimp. You destroy me but what am I without you?

-x-x-x-x-x-
90% of the people in this planet, should use the brain outside the cranium.  It is only decorative anyway!

Who needs Gali?