Ubisoft UPlay DRM Security Hole

[KingIsaacLinksr]

http://torrentfreak.com/ubisoft-drm-lets-in-remote-attackers-google-engineer-reports-120730/

One more reason I will never use DRM if I have the choice. This is just inexcusable to have to worry about gaming. From losing connection with the almighty server to now getting my computer hacked. Truly, this is worth it to keep those evil pirates out of the games. >=|

[keith.lamothe]

Oh good grief, and I was really enjoying Anno 2070 (picked it up during the summer sale).

Ah well, time to set up my firewall to block uplay's traffic and just play Anno in offline mode, because it's already activated.

[Aklyon]

Ubisoft: So Bad at DRM, they managed to make their security anti-security

[keith.lamothe]

Ubisoft: So Bad at DRM, they managed to make their security anti-security

They're definitely not the first ones to make that particular mistake.  DRM software has a relatively high rate of providing holes for hackers, for some reason.

[KingIsaacLinksr]

http://www.rockpapershotgun.com/2012/07/30/psa-possible-security-risk-in-some-ubisoft-pc-games/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+RockPaperShotgun+%28Rock%2C+Paper%2C+Shotgun%29

More in-depth article, plus updates. It..."seems" to be patched, but Ubisoft isn't commenting on the matter so be warned.


Ofc, they may never comment on it. They wouldn't want to admit they just opened the door to people's computer without warning.

[keith.lamothe]

Thanks for the RPS link; ninja browser plugins have been ninja'd

[Aklyon]

But who ninjas the nija-ing ninjas?

[KingIsaacLinksr]

Further Update: Ubisoft acknowledges the problem and believes the patch they just pushed out should address the problem. Why Ubisoft needs a browser plugin is unknown at this time. No apology is forthcoming either.

http://www.rockpapershotgun.com/2012/07/30/ubisoft-respond-to-uplay-security-drama/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+RockPaperShotgun+%28Rock%2C+Paper%2C+Shotgun%29

[Volatar]

I just made sure the browser plugins were gone. I am rather upset that they were installed at all without me knowing.

[keith.lamothe]

I just made sure the browser plugins were gone. I am rather upset that they were installed at all without me knowing.

Yea, I'm partly unhappy with Ubi for doing it, and partly unhappy with firefox/chrome for allowing it to happen without asking me first or at least notifying me "hey, there's a plugin here that wasn't there last time".

Are there any controls in firefox and/or chrome to require ask-for-confirmation or at least notification of a plugin install?

Not that it's primarily their fault for some other company not having the courtesy to ask, but a more general solution would appeal to me.

[TechSY730]

I just made sure the browser plugins were gone. I am rather upset that they were installed at all without me knowing.

Yea, I'm partly unhappy with Ubi for doing it, and partly unhappy with firefox/chrome for allowing it to happen without asking me first or at least notifying me "hey, there's a plugin here that wasn't there last time".

Are there any controls in firefox and/or chrome to require ask-for-confirmation or at least notification of a plugin install?

Not that it's primarily their fault for some other company not having the courtesy to ask, but a more general solution would appeal to me.

In more recent versions, Firefox will compare the state of the plugins folders at the start of each launch compared to what they should be based off of their internal list of registered plugins. If any new plugins were added outside of its knowledge, it will, by default, disable them, and tell you what is new in the plugins folder and ask you if you want to enable them.

Not sure about Chrome.

[BobTheJanitor]

Can't check if I have it or not, since I'm at work right now, but I do find it awfully odd that something could install in firefox without my say-so. If I want to install an addon it asks me if I'm sure two or three times and makes me watch a button count down before actually letting me do it. How in the world can something install in the background with no input?

[TechSY730]

Can't check if I have it or not, since I'm at work right now, but I do find it awfully odd that something could install in firefox without my say-so. If I want to install an addon it asks me if I'm sure two or three times and makes me watch a button count down before actually letting me do it. How in the world can something install in the background with no input?

In Firefox, it is because they use a plugins folder, that is an ordinary file system folder. Although this is convenient, it is also impossible ensure exclusive control (as it is a folder, anything can write to it using well known APIs outside of Firefox).
That's why they implemented the "change detection" and conditional loading of stuff in that folder, and stuff installed outside of Firefox now gets disabled by default. I think they added that in, I think, Firefox 11. (Surprised it took them that long to do it though)

[Volatar]

In more recent versions, Firefox will compare the state of the plugins folders at the start of each launch compared to what they should be based off of their internal list of registered plugins. If any new plugins were added outside of its knowledge, it will, by default, disable them, and tell you what is new in the plugins folder and ask you if you want to enable them.

Not sure about Chrome.

I am on a new Windows install so there is no contamination.

I installed one UPlay game. Assassin's Creed Brotherhood, last week.

I went to disable the addons today when I found out about them.

Firefox (running the latest version, even though I almost never use it) had the addon installed. I was never informed of this by Ubisoft or Firefox.

Chrome did not have the addon installed.

[TechSY730]

In more recent versions, Firefox will compare the state of the plugins folders at the start of each launch compared to what they should be based off of their internal list of registered plugins. If any new plugins were added outside of its knowledge, it will, by default, disable them, and tell you what is new in the plugins folder and ask you if you want to enable them.

Not sure about Chrome.

I am on a new Windows install so there is no contamination.

I installed one UPlay game. Assassin's Creed Brotherhood, last week.

I went to disable the addons today when I found out about them.

Firefox (running the latest version, even though I almost never use it) had the addon installed. I was never informed of this by Ubisoft or Firefox.

Chrome did not have the addon installed.

That's strange. Either there is a hole in Firefox's plugins changed externally detection logic, or Ubisoft is poking around Firefox's registered plugin repository directly. Either way, that seems very strange.

If you feel up to it, you may want to report this in Firefox's bug system, and have them see if there is an oversight or something in the logic.