[deleted]
"(tested with Assassin's Creed on Win7 and FireFox)." Since when exactly does Firefox allow ActiveX components?
There's apparently an NPAPI version of the plugin with the same hole.
Ubisoft "Uplay" DRM exposed as rootkit
41–50 of 148 posts
Re: Ubisoft "Uplay" DRM exposed as rootkit
#42Earlier quoted context omitted.
Do you have any evidence they put that here on purpose or are you just spreading rumors? It could as well be shoddy programming.
I don't subscribe to "never attribute to malice that which is adequately explained by stupidity". I'm not citing sources - hence it's just my opinion. Reminds me of google wifi slurping and hundreds of other cases where everyone plays dumb and swears it was all a misunderstanding. It never is. Until you get caught. And if not that it's a rogue trader, rogue reporter, rogue programmer, rogue scapegoat.
"I can't prove it through fact, but I feel it to be true."
Re: Ubisoft "Uplay" DRM exposed as rootkit
#43Earlier quoted context omitted.
Because the company wasn't acting in good faith? IMHO they put that there on purpose and they deserve to be exposed as evil bastards that they are.
Do you have any evidence they put that here on purpose or are you just spreading rumors? It could as well be shoddy programming.
The fact that the line contains "dev" twice is probably indicative of forgetting to disable it.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#44Earlier quoted context omitted.
Very few comapnies will pay for this type of exploit, even fewer will offer a thanks. It's easier to get them fixed this way.
The question is whether it's easier for the security researcher or the users. I don't think it's easier for the users if they end up being exploited for weeks while the vendor rushes to fix it. If the vendor tries to delay you for months or ignores you, sure. But it doesn't even seem like he tested the exploit here to understand whether it was a serious threat.
They're not his users, and the company- who allowed these vulns. in the first place- isn't trying to pay him for his work; see Google, CCBill, Mozilla, ect.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#45I wouldn't say that this is a rootkit (there's no kernel-based magic or even just privilege elevation going on), nor that this was done with bad intentions.
This is just inexperienced developers («it's "encrypted" using base64 - we're fine!!») that had a "great idea" (= launch games from an embedded IE control) that has, kinda, backfired.
The sad thing is that it would be trivial (I'm using the word "trivial" here are I have implemented something like this just last friday in 3 hours) to add a signature to that command line and only execute signed command lines - I mean, these Games require an internet connection anyways, so there's nothing stopping them from serving the launcher from somewhere in the web and have a private key there to do the signing.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#46Earlier quoted context omitted.
I don't subscribe to "never attribute to malice that which is adequately explained by stupidity". I'm not citing sources - hence it's just my opinion. Reminds me of google wifi slurping and hundreds of other cases where everyone plays dumb and swears it was all a misunderstanding. It never is. Until you get caught. And if not that it's a rogue trader, rogue reporter, rogue programmer, rogue scapegoat.
"I can't prove it through fact, but I feel it to be true."
Not subscribing to malice what can explained by stupidity is just a feeling too.
The question is: do you believe the perpetrator to be malicious or dumb?
Re: Ubisoft "Uplay" DRM exposed as rootkit
#47Why does Tavis Ormandy ( http://seclists.org/fulldisclosure/2012/Jul/375 ) keep putting fully usable proof of concept exploits out for widely deployed software without giving a vendor time to prepare a patch, or in this case, even notifying them? Off the top of my head, I remember he did this for the windows help center exploit and the java web start exploit. I can't understand why you would do this. You could at lea…
The full disclosure debate goes back a long time. I recommend doing some light Googling to understand some of the counterpoints.
http://en.wikipedia.org/wiki/Full_disclosure
As for your "raging hacker who ...," dig, consider the idea that malware authors already knew about the vulnerability and have been using it.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#48Any mitigation ? Is it possible to disable this browser plugin ?
In Firefox, open "about:addons" in the location bar, select "Plugins" on the left, then you can disable/remove as necessary.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#49I wouldn't say that this is a rootkit (there's no kernel-based magic or even just privilege elevation going on), nor that this was done with bad intentions. This is just inexperienced developers («it's "encrypted" using base64 - we're fine!!») that had a "great idea" (= launch games from an embedded IE control) that has, kinda, backfired. The sad thing is that it would be trivial (I'm using the word "trivial" here ar…
Just for your information; rootkits can exist in any of the rings[1]. However, kernel-mode rootkits are most often harder to detect and get rid off. There are several definitions of a rootkit, a common definition is "software designed to hide the existence of certain processes or programs from normal methods of detection and enable continued privileged access to a computer."[2]
[1] http://en.wikipedia.org/wiki/Ring_(computer_security) [2] http://en.wikipedia.org/wiki/Rootkit
Re: Ubisoft "Uplay" DRM exposed as rootkit
#50Any mitigation ? Is it possible to disable this browser plugin ?
Google and Mozilla will certainly add it to their plugin blacklists. Trojan capabilities remote-controlled through a browser, that's a very serious security risk to their users.
A bug is filed to blacklist it in Firefox: https://bugzilla.mozilla.org/show_bug.cgi?id=778686