There's been a lot of hype all of a sudden about a paper published back on February 28th of this year by a security company known as [Re]Vuln. In the paper, found here, researchers claim that attackers can use EA's Origin software, specifically the way it handles URIs, to exploit a player of EA's games.
Read the paper for the details. You can also see a video of what an exploitation supposedly looks like here (http://vimeo.com/61361586/).
Anyway, all the noise and warnings and panic are a bit strident considering what has to happen for attackers to actually be successful with this so called “design flaw.”
1. The attacker has to know, or brute force, a game ID for an Origin game that exists on the victim's system,
2. The attacker must craft a special Origin link in the format show below (taken from the [Re]Vuln paper):
3. The victim must be convinced or otherwise tricked into browsing to the link to initiate the attack.
That's a lot that the attacker has to get right.
In short, is this an issue? Yes and it's something that EA and even Steam before them (http://revuln.com/files/ReVuln_Steam_Browser_Protocol_Insecurity.pdf) should look into.
But is it “OMG the sky is falling for 40 million EA gamers”? No not quite. Yes it looks scary in the lab but in the real world, not so much. After all, the Steam “exploit” was released in October 2012 and Steam still hasn't “fixed” it. Why? Because users aren't actually being affected by it.
So read the paper, initiate the workarounds and temporary fixes that they recommend, practice good Internet hygiene, and go back to enjoying your gaming.
Feel free to comment, disagree or even yell at me either in the comments section of this blog or on twitter @joeknape. I look forward to hearing from you. No really, I do!