VROC security concerns

Hi group, Maybe this topic has been discussed before, though I haven't seen any message regarding VROC security issues. What I'm trying to point out here is that in order to use the VROC system, one has to give a program WinVROC or a Java applet (JavaVROC using Netscape) almost unlimited rights on the client machine. >> When JavaVROC asks you about permissions, grant them. >> applet needs UniversalExecAccess (Netscape) and EXEC (IE). >> applet needs UniversalConnect (Netscape) and NETIO (IE). >> applet needs UniversalListen (Netscape) and NETIO (IE). >> applet needs UniversalFileAccess (Netscape) and FILEIO (IE). Now, given the fact that those applications are of unknown functionality and from an unknown source (open for discussion) this looks to me like a huge security problem. Those program could do almost anything on a client machine running in the background while the user is busy surviving a lengthy race with GPL for instance. Please don't get me wrong. I'm not saying that any of this has happened or will happen. All I want to know is why do I have to use this mechanism in order to run online races. I'd rather trust my good old firewall and connect directly to a GPL server. Any comments or suggestions? Norbert

He he, that wasn't exactly the response I was lookin' for, but it has some interesting concepts :-) I should have mentioned that I'm in the IT business (software and hardware) for two decades, so I'm distinctly aware of the fact that > Any program you install on your machine has the possibility (I avoid saying > "rights" here) to do virtually anything to your machine, period. > As with everything on the Internet these days, it's a matter of trusting the > source. Why have you virtually no qualms about installing Internet Explorer?*INTERNET EXPLODER*, heaven forbid! I'm constantly tryin' to close security holes not opening new ones... > Same deal with VROC: you either trust it to do just what it says it does > (connect you to the online community of GPL simracers), or you don't. If you > do you install it/grant it the needed priviledges. If you don't, you don't.Ahem, that statement regarding trust is inherently true, but doesn't help in this particular case because... > *Anything* you download from the internet AND anything you install from CD > is of unknown functionality, if you look at it this way (do you know all the > functionality of MS Word? Microsoft says it's just a wordprocessor...).Wouldn't you agree that if I install software from a well known company and known source (i.e. installation disc/CD), that the potential risk is several orders of magnitude smaller than installing unknown software downloaded from a webserver somewhere. > You don't *have to* use VROC at all... you can connect to GPL servers > directly all you want. You just have to know their IP-address, when > they're running, how good you connection to them is, what tracks they're > running and at what skill-level, whether that annoying guy is also on > that server, whether your friends are also on that server,... All right, now this is *EXACTLY* the point. Execpt for the connection quality thingy everything you mentioned could be done without running some unknown executables on my system. > need I go on? Sure, you can do it, but it's hugely inconvenient. The webserver could * checking all known race-servers whether they're running at the moment. * list the tracks, skill level, users, whether my friend's there as well. Need I go on? Sure, you can do that with plain HTML stuff, but it would be hugely unimpressive :-) Norbert

> Maybe this topic has been discussed before, though I haven't seen any > message regarding VROC security issues. > What I'm trying to point out here is that in order to use the VROC > system, one has to give a program WinVROC or a Java applet (JavaVROC > using Netscape) almost unlimited rights on the client machine. Any program you install on your machine has the possibility (I avoid saying "rights" here) to do virtually anything to your machine, period. Applets are a little different, because they run into a controlled environment inside the browser (the so-called "sandbox"), so you explicitly have to grant them the right to do anything outside that sandbox (like reading/writing stuff on your computer, connecting to another computer on the Internet, etc). > >> When JavaVROC asks you about permissions, grant them. > >> applet needs UniversalExecAccess (Netscape) and EXEC (IE). > >> applet needs UniversalConnect (Netscape) and NETIO (IE). > >> applet needs UniversalListen (Netscape) and NETIO (IE). > >> applet needs UniversalFileAccess (Netscape) and FILEIO (IE). Obviously, (Win/Java)VROC needs to be able to do this in order to operate as it does (save/change GPL config files, open connection to servers, etc). As with everything on the Internet these days, it's a matter of trusting the source. Why have you virtually no qualms about installing Internet Explorer? Because it's from Microsoft, and you trust Microsoft (just illustrating a point here ;-). But for all you know, Microsoft could be using IE to collect information about your surfing behaviour wihtout your knowledge, or secretly monitoring what software you install on your PC and notifying the BSA of every transgression... Same deal with VROC: you either trust it to do just what it says it does (connect you to the online community of GPL simracers), or you don't. If you do you install it/grant it the needed priviledges. If you don't, you don't. > Now, given the fact that those applications are of unknown functionality > and from an unknown source (open for discussion) this looks to me like a > huge security problem. > Those program could do almost anything on a client machine running in the > background while the user is busy surviving a lengthy race with GPL for > instance. *Anything* you download from the internet AND anything you install from CD is of unknown functionality, if you look at it this way (do you know all the functionality of MS Word? Microsoft says it's just a wordprocessor...). > Please don't get me wrong. I'm not saying that any of this has happened > or will happen. All I want to know is why do I have to use this mechanism > in order to run online races. I'd rather trust my good old firewall and > connect directly to a GPL server. You don't *have to* use VROC at all... you can connect to GPL servers directly all you want. You just have to know their IP-address, when they're running, how good you connection to them is, what tracks they're running and at what skill-level, whether that annoying guy is also on that server, whether your friends are also on that server,... need I go on? Sure, you can do it, but it's hugely inconvenient. > Any comments or suggestions? Uhm... nope ;-) > Norbert Cheers, Herko "Hooked to VROC" ter Horst PS. I did not write VROC. For all I know, VROC is monitoring this email right now. In that case, it will never reach it's destination. But that could also be my ISP's fault.

On Tue 21 Nov 2000 06:16:42p, Herko ter Horst wrote: <snip> >secretly monitoring what software you install on your >PC and notifying the BSA of every transgression...<snip> BSA? As in bikes? ;-) -- David. (GPLRank handicap: -5.92) The GPL Scrapyard - http://www.hillclimbfan.f2s.com "After all, a mere thousand yards - such a harmless little knoll, really" - Raymond Mays on Shelsley Walsh.

In article <[email hidden]>, [email hidden] says...

Quoted text (12 lines)

> Not really related to WinVROC (as far as I know) but there is an > increasing amount of "spyware" around from supposedly legitimate > companies, that "report back" on what you are actually doing > with the software. RealPlayer is the one that alerted me to this, > I wondered why each time I finished playing a clip, that it would > want to access the Internet (I knew this as I had a firewall and > hadn't given permission for RA to access the internet). > > Turns out there lots of this type of stuff around. One I just > read about was GetRight, which many people use to aid > in the downloading of files. >

Maxx, that's exactly the point here. I'm using Linux (OS for adults) as a masquerading firewall as well, both in my company and @home. It never ceases to amaze me how many systems try to ping me, try to connect on various ports (TCP and UDP) and so on. Like you are, I'm aware of the fact that there's an increasing amount of "spyware" (I like that description) which I always avoid to install. Sometimes one wonders whether the firewall blocks more violations from the inside than from the outside :) Anyway, back to the original topic, that VROC Java applet does only very few things that would require all those rights it asks permission for. Furthermore, according to Verisign the certificate is a private ID and expired more than a year ago. If I interpret al those inf. right, that means there's no legal company backing this system, but a private person. Stated on the VROC website:

Quoted text (8 lines)

> The creators of VROC assume no responsibility for any damage or loss > arising out of the use of VROC. By accessing the VROC Web site, > you agree to this condition. Use VROC at your own risk! > While VROC has been designed to scrupulously avoid any potentially > damaging actions, it is possible for hostile programs to attach > themselves to software such as VROC's. Granting any applet these > permissions, therefore, does entail a certain risk.

For me that means IF I invite VROC to run on a system behind my firewall, I'll have to use one that cannot talk to other PC in that subnet and have a clean installation (just OS, browser, GPL) without any private data access. That's a lot of work and preperation. Cheers, Norbert

Herko ter Horst wrote:

Quoted text (28 lines)

> > Maybe this topic has been discussed before, though I haven't seen any > > message regarding VROC security issues. > > What I'm trying to point out here is that in order to use the VROC > > system, one has to give a program WinVROC or a Java applet (JavaVROC > > using Netscape) almost unlimited rights on the client machine. > > Any program you install on your machine has the possibility (I avoid saying > "rights" here) to do virtually anything to your machine, period. Applets are > a little different, because they run into a controlled environment inside > the browser (the so-called "sandbox"), so you explicitly have to grant them > the right to do anything outside that sandbox (like reading/writing stuff on > your computer, connecting to another computer on the Internet, etc). > > >> When JavaVROC asks you about permissions, grant them. > > >> applet needs UniversalExecAccess (Netscape) and EXEC (IE). > > >> applet needs UniversalConnect (Netscape) and NETIO (IE). > > >> applet needs UniversalListen (Netscape) and NETIO (IE). > > >> applet needs UniversalFileAccess (Netscape) and FILEIO (IE). > > Obviously, (Win/Java)VROC needs to be able to do this in order to operate as > it does (save/change GPL config files, open connection to servers, etc). > > As with everything on the Internet these days, it's a matter of trusting the > source. > Same deal with VROC: you either trust it to do just what it says it does > (connect you to the online community of GPL simracers), or you don't. If you > do you install it/grant it the needed priviledges. If you don't, you don't.

I was curious so I checked my browsers security lists and found that the only javascript permissions I have allowed are to my own company (for our own online game) and also to: Alison Hine [email hidden] (snip) Serial Number: 5C:E6:4B:7A:99:2F:3B:6C:AF:67:18:31:A5:47:C3:EE This Certificate is valid from Thu Oct 01, 1998 to Sat Oct 02, 1999 Certificate Fingerprint: 98:51:68:04:E1:D6:E3:21:4A:5E:11:44:BA:83:71:82 for VROC. For me, it's nice to know that an actual conscientious person is standing behind the program. -- Matthew V. Jessick Motorsims, a division of Moto1 [email hidden] http://www.moto1.net Vehicle Dynamics Engineer (972)910-8866 Ext.125, Fax: (972)910-8216

On Sun, 19 Nov 2000 14:16:16 +0100, [email hidden] (Norbert D�rer) wrote:

Quoted text (7 lines)

>Hi group, > >Maybe this topic has been discussed before, though I haven't seen any >message regarding VROC security issues. >What I'm trying to point out here is that in order to use the VROC >system, one has to give a program WinVROC or a Java applet (JavaVROC >using Netscape) almost unlimited rights on the client machine.

Hi Norbert, Not really related to WinVROC (as far as I know) but there is an increasing amount of "spyware" around from supposedly legitimate companies, that "report back" on what you are actually doing with the software. RealPlayer is the one that alerted me to this, I wondered why each time I finished playing a clip, that it would want to access the Internet (I knew this as I had a firewall and hadn't given permission for RA to access the internet). Turns out there lots of this type of stuff around. One I just read about was GetRight, which many people use to aid in the downloading of files. Check this site out out for more info : http://grc.com/ and you can also pick up a freeware app to detect this sort of stuff. Maxx

Quoted text (7 lines)

> > <snip> > >secretly monitoring what software you install on your > >PC and notifying the BSA of every transgression... > <snip> > > BSA? As in bikes? ;-)

Nope, as in "Business Software Alliance", Microsoft's anti-piracy police. > -- > David. (GPLRank handicap: -5.92) > The GPL Scrapyard - http://www.hillclimbfan.f2s.com > "After all, a mere thousand yards - such a harmless little knoll,really" - > Raymond Mays on Shelsley Walsh.