Ubisoft DRM Lets In Remote Attackers, Google Engineer Reports

KIA · 30 Jul 2012 at 13:36

Hacker Tavis Ormandy has discovered a serious vulnerability in a well-known PC game DRM system. The Google engineer said that after buying a game from Ubisoft he became aware that its “Uplay” browser plug-in might prove problematic. In the early hours of this morning Ormandy confirmed that the add-on allows remote and “wide access” to machines running the DRM, potentially giving malicious attackers free reign to wreak havoc.

http://torrentfreak.com/ubisoft-drm-lets-in-remote-attackers-google-engineer-reports-120730/

Another Ubisoft fail. :rolleyes:

captainrobwash · 30 Jul 2012 at 13:46

Yea just seen this on fb I disabled it ages ago so should be safe.

barmyllama · 30 Jul 2012 at 13:48

I don't buy Ubisoft games anymore so I'm safe.

ZombieFan · 30 Jul 2012 at 13:49

RockPaperShotgun have also covered it here. Basically, if you've got the uPlay browser plug-in installed then disable or uninstall it.

The plug-in allows a web page to execute anything on your pc, so an attacker could clear out your documents, download and install a root kit etc. just from you visiting a web page.

almoststew1990 · 30 Jul 2012 at 13:54

I have a couple of uplay games installed but I can't see the plugin in the list in Chrome... Not sure if I'm safe or not!

Scythian · 30 Jul 2012 at 13:55

Does the uPlay browser plug-in automatically install it self when you purchase a game?

Installed AC:R awhile ago, but wasnt aware there even was a plug-in :confused:

Shamikebab · 30 Jul 2012 at 13:57

So wait it's nothing to do with the DRM, just some browser plugin? This doesn't install with the games does it?

ZombieFan · 30 Jul 2012 at 13:58

Scythian said:
Does the uPlay browser plug-in automatically install it self when you purchase a game?

Installed AC:R awhile ago, but wasnt aware there even was a plug-in

Yep, it installs itself silently without you knowing. It applies to Ubisoft games installed from Steam as well.

[edit] - The plug-in installs itself during the game installation.

Aesir · 30 Jul 2012 at 14:25

This is the last straw for me I'm done with ubisoft on pc. I knew I shouldn't have bought a ubisoft game in the steam sale but I ignored my hesitations because of the discount, I thought the drm wasn't a big deal at a discounted price but this is too much to except. :mad:

Bergkamp · 30 Jul 2012 at 14:33

Not only are this lot scumbags, they're incompetent scumbags! Glad I've not had anything of theirs near my system for a long while.

KIA · 30 Jul 2012 at 14:56

Soon to be blocked in Firefox. https://bugzilla.mozilla.org/show_bug.cgi?id=778686

iviv · 30 Jul 2012 at 15:12

http://pastehtml.com/view/c6gxl1a79.html

That should be a test page (Linked to by the RPS page). If you have the plugin then it will open uPlay and Calculator.exe on your computer. If you don't have it then your browser will just complain that you don't have the plugin installed.

pestt · 30 Jul 2012 at 16:38

Updated?

dante6491 · 30 Jul 2012 at 16:45

iviv said:
http://pastehtml.com/view/c6gxl1a79.html

That should be a test page (Linked to by the RPS page). If you have the plugin then it will open uPlay and Calculator.exe on your computer. If you don't have it then your browser will just complain that you don't have the plugin installed.

Didn't open the calculator, but did Uplay :confused:

EDIT: Once it updated it opened calculater :mad:

Qel · 30 Jul 2012 at 16:49

Weird, got some of the AC games installed and had Uplay installed but no browser plugin... and that test page does nothing. I suppose I should be happy but instead I'm just wondering where the stupid things hiding...

dante6491 · 30 Jul 2012 at 16:54

Just disabled both Uplay addons in Firefox. No idea how to get rid of them though.

MissChief · 30 Jul 2012 at 17:06

In a small amount of credit to ubisoft they've been quick to update it but i don't have anything from Ubisoft on the PC since i reinstalled windows onto my SSD.

Omaeka · 30 Jul 2012 at 17:15

If Rainbow Six comes with this ****, I'm gonna claim jihad on their HQ and go earn me some virgins.

pestt · 30 Jul 2012 at 17:25

The option to have the launcher start in offline mode, and other choices, is in the settings.

Scythian · 30 Jul 2012 at 22:08

iviv said:
http://pastehtml.com/view/c6gxl1a79.html

That should be a test page (Linked to by the RPS page). If you have the plugin then it will open uPlay and Calculator.exe on your computer. If you don't have it then your browser will just complain that you don't have the plugin installed.

Strange, opened in a new tab but nothing happened other than I needed to install a new plug-in. I assumed this meant I safe but if it automatically installed then something may be going wrong? or am I being paranoid?