Anti-Windows Catalog

Chicken Little strikes Three Rings Design

Written by Gordon Fecyk, 12/31/2005

ALL IMAGES ON FORUM DISABLED UNTIL FURTHER NOTICE.

So says the Dread Ringers. This thread graced the Puzzle Pirates forums this week where "Lizthegrey" encouraged her 6000+ customers to stop using Internet Explorer and to disable a Windows system component just so they could use her product -- in this case the Puzzle Pirates forums -- safely.

Wonderful. Where have we seen this kind of bad advice before? Ahh, yes! During the SULFNBK.EXE hysteria of 2001 and the JDBGMGR.EXE hysteria of 2002 (and 2003, and 2004, and 2005...) Only those were perpetrated by non-experts as perhaps the longest running pair of chain letters in Internet history.

After five years of this, you'd think that real experts -- such as the designers at Three Rings -- would know better. Yet they disabled an important part of their product, the capability to display images in their forums, and along with it a community of art contests, fan art, personalization, an economy of trade in forum avatars... because of the fear of an easily mitigated vulnerability in the Windows XP operating system.

Let me repeat that: Fear of a threat, not the threat itself, destroyed a virtual community and a virtual economy consisting of real people.

HERE'S THE KICKER! Three Rings Design deliberately encourages reckless computing by requiring full administrative access on Windows XP just so you can play their game! Not to install it -- I expect you'd require admin access to install something -- but to play it!

In November and December alone they issued roughly five updates, which players need to install before playing. Not even Microsoft has such a frequent update schedule, and only anti-virus software requires more updates. Hmph. At least anti-virus software and Microsoft's Automatic Updates can update regardless of who's logged on.

Three Rings Design insults its customers by demanding they follow bad advice to use their products, and further insults its customers by demanding they cripple their PCs.

Before you follow their bad advice, consider following some good advice:

• Microsoft's Automatic Updates feature is there for a reason. Use it.
• Ditto for Sun's automatic updates for Java.
• Don't change browsers just because of a perceived security benefit. Change browsers only if you want to.
• Use your operating system's built-in safety features.
• Stick with games Designed for Windows XP. This might mean giving up Puzzle Pirates until Three Rings can fix it.
  
  Oh, and give up their forums, too. You can't say Lizthegrey didn't warn you.

ISN'T THAT IRONIC? It seems the simplest way to avoid problems in Puzzle Pirates is to avoid Puzzle Pirates! And it's a lot easier than mangling your system, changing browsers or updating anti-virus software!

One last bit of good advice: This Metafile exploit occurs in user-level code, which means it runs as the user currently logged on. If that user has a Limited account, the account reduces the potential damage to that account only, and will save you from a reformat and reinstall.

[2 JAN 2006] I will admit to an overreaction regarding "destroying a community of art contests..." since it's still possible to use the BBcode [img] in posts.

This begs the followup question however: Why not go the full nine-yards and disable the [img] tag? Or why not disable the [url] tag to stop people from placing booby-trapped links? After all, we don't need half-measures at a time like this! We need action, not criticism!

Or we could just prevent this kind of nonsense before the fact and stop being afraid.

It looks like they've stopped being afraid, too. As of 9 PM CST today, image functionality was restored.

Related Links:

• Windows Metafiles were exploited back in April 2004 -- US-CERT
• Read the forum's responses -- Three Rings Design
• Debunking bad advice
• CERT missed Melissa's Ultimate Lesson, learn the lesson that they and Three Rings didn't -- VMyths
• Stop Being a Victim -- SecurityFocus
• Remember the JPEG vulnerabilities? Wear your hazmat shirt with pride! -- Cafepress
• How many more programs will gullible users delete... -- Cafepress
• Here's how you're supposed to install a Windows game

[Catalog Home]

Resources:

Recently Edited Categories:

Browse All Categories

Recent Commentaries:

Browse All Commentaries