Is this a Windows only exploit? I have RUSE installed via Steam on a Macbook Pro and the linked page reports a missing plugin in Chrome, Safari, and Firefox.
Ubisoft "Uplay" DRM exposed as rootkit
121–130 of 148 posts
Re: Ubisoft "Uplay" DRM exposed as rootkit
#122I think they just fixed this. It opened Uplay and it instantly downloaded a new update released today. Version 2.0.4 - Monday July 30th 2012 - "Fix addressing browser plugin. Plugin now only able to open Uplay application"
I would love to see how they patched it. Seems folks like these might implement a check like 'cmd.Contains("uplay.exe")' and let you do "C:\whatever\uplay.exe\..\..\bad.exe".
Re: Ubisoft "Uplay" DRM exposed as rootkit
#123I'm not sure if that's what the OP implied, but I'm not sure this was done on purpose. "Never attribute to malice that which is adequately explained by stupidity". Ubisoft is well know for their aggressive anti-pirating practices (cloud saves for instance), but that's just too idiotic. Here's taviso's mail on seclists: http://seclists.org/fulldisclosure/2012/Jul/375 I hope ubisoft reacts quickly.
Looks like they have: http://news.ycombinator.com/item?id=4312528
Re: Ubisoft "Uplay" DRM exposed as rootkit
#124I'm not sure if that's what the OP implied, but I'm not sure this was done on purpose. "Never attribute to malice that which is adequately explained by stupidity". Ubisoft is well know for their aggressive anti-pirating practices (cloud saves for instance), but that's just too idiotic. Here's taviso's mail on seclists: http://seclists.org/fulldisclosure/2012/Jul/375 I hope ubisoft reacts quickly.
[deleted]
Re: Ubisoft "Uplay" DRM exposed as rootkit
#125Earlier quoted context omitted.
Since we have no additional evidence to select between the two options, do you really think that malice is simpler than stupidity?
I'm not going to do any kind of full disclosure here (I know this is lame) but I work in video games so I know what it looks like from the other side. We're not all idiots here, we just do as we're told.
As a Vancouverite, I've seen enough layoffs to believe this entirely (you're fungible and replaceable). Still, I don't think that Ubisoft intentionally created a security issue, just that they didn't care about one that happened and deadlines were coming.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#126Oh hell no. I can't believe this shit... and Tom Clancy's Ghost Recon: Future Soldier was such a good game too. T_T Next time I want to play an Ubisoft game I'm just going to pirate it. EDIT: I buy 99% of my video games through Steam, and when the games I get through Steam want to use their own launcher (play, windows live games, or EA's Origin, for example) I always get peeved.. to find out it allows arbitrary remot…
Pirating the software does not do anything here. The security hole is not related to the DRM and pirated versions come with the same UPlay installs as legitimate copies.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#127I'm not sure if that's what the OP implied, but I'm not sure this was done on purpose. "Never attribute to malice that which is adequately explained by stupidity". Ubisoft is well know for their aggressive anti-pirating practices (cloud saves for instance), but that's just too idiotic. Here's taviso's mail on seclists: http://seclists.org/fulldisclosure/2012/Jul/375 I hope ubisoft reacts quickly.
This is a social integration feature and not part of their DRM.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#128I'm not sure if that's what the OP implied, but I'm not sure this was done on purpose. "Never attribute to malice that which is adequately explained by stupidity". Ubisoft is well know for their aggressive anti-pirating practices (cloud saves for instance), but that's just too idiotic. Here's taviso's mail on seclists: http://seclists.org/fulldisclosure/2012/Jul/375 I hope ubisoft reacts quickly.
This is a social integration feature and not part of their DRM.
Re: Ubisoft "Uplay" DRM exposed as rootkit
#129Not owning any Ubisoft titles and not really interested in opening up IE, can someone explain what it is that Ubisoft/IE users are seeing?
Re: Ubisoft "Uplay" DRM exposed as rootkit
#130Earlier quoted context omitted.
And should we also stop saying we've gotten "fucked" for similar reasons? Since you are the curator and sole arbiter of allowable phrases, I'd like to get it all clear while I've got your ear.
And should we also stop saying we've gotten "fucked" for similar reasons? Sorta. Tis roughly the similar overtones of 'people-who-take-it-are-bad' (i.e. everyone who isn't a straight cis male), however it's not as graphic and not as tied to the actual imagery of receptive sex as the previous example. Since you are the curator and sole arbiter of allowable phrases What? No I'm not. Who said I was? Not me. Just because…
What about usage of the word "use"? Surely that implies interacting with another person only for sex and we should stop using it lest we offend.
I was not deflecting, that was my way of talking about the merits of the complaint, to whit, what you object to might be a tiny subset of someone else's objections, in which case who gets to decide? By telling that person not to use that terminology, you are saying you get to decide.
I think we've also seen plenty of people who think they are the sole arbiter of programming languages, and they get called out on it.