Ubisoft DRM Security Breach - If you own any "Uplay" DRM game - you're affected!

[lithos]

Originally Posted by Sundance

The sickening thing is I expect Ubisoft to arrogantly brush it off. And it will really wind me up and make me angry. Appalling company.

So, thousands, possibly hundreds of thousands, of people could get their computers utterly violated and their digital life destroyed, in the worst case scenario. Passwords taken, credit card numbers stolen, identities lifted.

But that's a sacrifice Ubisoft's willing to have you make; remember, the minor (according to Ubisoft...) profit they make off PC game sales is far more important than your security!

[Chris McMahon]

I'm going to sticky this thread.

From the article:

Here’s how to locate and disable the errant plugin:
Firefox:
Tools – Add-ons – Plugins – Disable the Uplay and Uplay PC Hub plugins

Chrome:
Visit aboutlugins and disable

Opera:
Settings – Preferences – Advanced – Downloads – Search “Uplay”, delete

I just checked my browser and found, then disabled, the plug-ins.

[Chris McMahon]

Ubisoft has now issued a patch.

“We have made a forced patch to correct the flaw in the browser plug-in for the Uplay PC application that was brought to our attention earlier today. We recommend that all Uplay users update their Uplay PC application without a Web browser open. This will allow the plug-in to update correctly. An updated version of the Uplay PC installer with the patch also is available from Uplay.com.

Ubisoft takes security issues very seriously, and we will continue to monitor all reports of vulnerabilities within our software and take swift action to resolve such issues.”

Source.

[Lucifers Mentor]

Thanks for keeping this updated Chris.

[Pinkeh]

Ah what a shame. Stopped buying UbiDRM crap years ago.

[power]

buy then install/download Ubi game, crack never worry again - sorry Ubi but your DRM shits me... But occasionally you make a good game, however I will never put up with intrusive DRM.

[Mithickus]

Is Uplay = Ubisoft game launcher?

I have some Assassin's Creed games installed through steam, but my browsers don't have the Uplay plugin.

I can't find anything called Uplay on my computer. What should I be looking for/how should I be looking for it?

[Sledge]

even though it's been patched now with the new UPlay install..
http://uplay.ubi.com/en-GB
I'm pretty sure i got some free games from Ubisoft at one stage.. though i can't remember what, or how to access them lol...
Assassins Creed 1 & 2, Hawx 1 & 2... got the serial for Hawx 2.. none of the others..anyone know if the others need serials to work?
i've got the downloaders for the above games..and a TagesSetup_x64.exe

Edit, just logged into my Ubisoft account, it says no orders found..
But i found an email i sent to myself with the other Keys
So is UPlay different to the Tages protection?

[Chris McMahon]

Originally Posted by Mithickus

Is Uplay = Ubisoft game launcher?

Yes.

I have some Assassin's Creed games installed through steam, but my browsers don't have the Uplay plugin.

Uplay was removed from Steam copies of AC some time after release. But AC isn't the only game affected. Eg if you bought Anno 2070 at the recent steam sale, it has Uplay.

I can't find anything called Uplay on my computer. What should I be looking for/how should I be looking for it?

Read the article linked in the first post. It tells you there.

Originally Posted by Sledge

even though it's been patched now with the new UPlay install..
So is UPlay different to the Tages protection?

The cause of the problem is that as well as acting as an always on DRM, Uplay also functions as a "steam-like" system with achievements, game purchases and points. You get points from gameplay of a Ubisoft game. eg Beat Settlers 7 on average get 70 "Uplay points".

As the Uplay launcher is running constantly while the game is (the DRM part), the game tells Uplay you earned the reward and Uplay tells Ubisoft's servers - that keep your Uplay user account.

The Uplay account on the Ubisoft servers also allows you buy games, maps and other in-game items (with points or real money) . Once you buy something from Ubisoft, via your browser, the Ubisoft website launches Uplay to tell it what you're purchased.

And there's the problem.

How do they tell Uplay to launch? Easy, they install addons to all browser that accept the code from Ubisoft's website and then launch Uplay. The only issue with that is they didn't hard code it to just launch Uplay. It will launch anything you tell it to.

So not only will the addon launch "uplay.exe" it will launch anything already installed on your PC. Eg ftp to download a trojan. Policy editor to turn off restrictions, Telnet, remote desktop, anything.

That's why this issue is serious.

And because the vulnerability is in a browser addon already marked as "safe" no anti-virus will pick it up, no Microsoft patch will remove it, even updating your browser just reinstalls it along with all your other addons.

The problem is that you have to logon to Uplay for the fix to launch. People who don't read this thread and haven't played a Uplay game in awhile still have the vulnerability. ie If you purchased AC two years ago, finished it and haven't played it since.

Now that this exploit is widely know, I expect it to be added to every fishing website out there.

[issa2006]

you can disable in firefox 13.0.1, but how do i uninstall it completely?

[Chris McMahon]

Originally Posted by issa2006

you can disable in firefox 13.0.1, but how do i uninstall it completely?

http://www.ghacks.net/2010/10/02/how...-from-firefox/

[issa2006]

Originally Posted by Chris McMahon

http://www.ghacks.net/2010/10/02/how...-from-firefox/

dos not work in v13 no info where plugin is installed, it just says ver + name of plug in, not location(am i wrong?)

forgot to put in aboutlugins in address bar...says name of plugin , not location, but i should find it

[Chris McMahon]

Originally Posted by issa2006

dos not work in v13 no info where plugin is installed, it just says ver + name of plug in, not location(am i wrong?)

forgot to put in aboutlugins in address bar...says name of plugin , not location, but i should find it

You have to enable the plugin first. The it will tell you the .dll location.

[Philll]

No more Ubi DRM

http://bit.ly/Tl5thp

[FiShy]

Originally Posted by Philll

No more Ubi DRM

http://bit.ly/Tl5thp

Thats huuuge, i might start playing ubi games..... if they are any good