Live data from Hacker News

Ubisoft "Uplay" DRM exposed as rootkit

news.ycombinator.com

141–148 of 148 posts

Re: Ubisoft "Uplay" DRM exposed as rootkit

#141
post #67

Earlier quoted context omitted.

Just spotted it, the Batman games hide it in the System requirements: > Online play requires log-in to Games For Windows – Live So I guess it's in the DRM list if you need it to play singleplayer, and in system reqs if you don't. Seems fair, but I'd still rather have it be consistent. No reason S8 couldn't list it in both spots.

Still, I habitually don't read System Reqs. I'd expect something more like one of the "Single Player", "Multi Player" bullets under the ESRB rating. "Requires 3rd party bullshit"

Agreed. There's no game that my desktop doesn't meet the minimum requirements for, and won't be for at least a few years. I don't make a habit of checking them.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#142

Why does Tavis Ormandy ( http://seclists.org/fulldisclosure/2012/Jul/375 ) keep putting fully usable proof of concept exploits out for widely deployed software without giving a vendor time to prepare a patch, or in this case, even notifying them? Off the top of my head, I remember he did this for the windows help center exploit and the java web start exploit. I can't understand why you would do this. You could at lea…

This appears to be an exploit one can mitigate simply by removing that plug-in from one's browser. As such, exposing it to all is a good thing. It needs to be patched ASAP, not hidden.

Ref: http://pc.gamespy.com/articles/122/1225585p1.html

Re: Ubisoft "Uplay" DRM exposed as rootkit

#143
post #12

Oh hell no. I can't believe this shit... and Tom Clancy's Ghost Recon: Future Soldier was such a good game too. T_T Next time I want to play an Ubisoft game I'm just going to pirate it. EDIT: I buy 99% of my video games through Steam, and when the games I get through Steam want to use their own launcher (play, windows live games, or EA's Origin, for example) I always get peeved.. to find out it allows arbitrary remot…

I hate the hoop jumping in modern games. I was playing Street Fighter 4 recently and it comes up with "oh, you want to save your single player game? You have to create a MicrosoftWindowsBingGamesPhone8ForXboxLive.Net account" . Then of course you have to wait for the damn thing to sign in every time you want to play the game "Connection failed, do you want to retry?"

I've found myself having to deal with roughly 100% more bullshit launcher-patch-launcher-settings-signup-login-wait crap since I've started buying games on Steam instead of just straight up pirating them like I did when I was dirt poor.

Honestly, about 1 in every 2-3 games I play I find myself wondering why I didn't just pirate it to begin with. When your software has the kind of extra "features" that make your user base actually consider downloading a cracked, illegal copy after buying the real deal, you know you've royally fucked up somewhere along the way.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#144
post #12

Oh hell no. I can't believe this shit... and Tom Clancy's Ghost Recon: Future Soldier was such a good game too. T_T Next time I want to play an Ubisoft game I'm just going to pirate it. EDIT: I buy 99% of my video games through Steam, and when the games I get through Steam want to use their own launcher (play, windows live games, or EA's Origin, for example) I always get peeved.. to find out it allows arbitrary remot…

Next time I want to play an Ubisoft game I'm just going to pirate it.

http://xkcd.com/488/

Re: Ubisoft "Uplay" DRM exposed as rootkit

#145
post #65

Earlier quoted context omitted.

Since we have no additional evidence to select between the two options, do you really think that malice is simpler than stupidity?

I'm not going to do any kind of full disclosure here (I know this is lame) but I work in video games so I know what it looks like from the other side. We're not all idiots here, we just do as we're told.

I didn't mean to imply that video game programmers were stupid... :)

I was saying it seems more likely to me that any random developer making a stupid mistake like this seems more likely than a company having real motivation to create this kind of security hole.

I suppose, alternatively, this could have been an individual developer's intent. An exploit like this would get a pretty penny on the exploit market, I'd think.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#146
post #139

Earlier quoted context omitted.

What about usage of the word "use"? Surely that implies interacting with another person only for sex and we should stop using it lest we offend. I was not deflecting, that was my way of talking about the merits of the complaint, to whit, what you object to might be a tiny subset of someone else's objections, in which case who gets to decide? By telling that person not to use that terminology, you are saying you get t…

What about usage of the word "use"? Surely that implies interacting with another person only for sex No, the word "use" means lots of things. To give you an idea, lots of people are OK with people saying "use" in polite, professional contexts, or day time TV, but lots of people would not be OK with "fuck" or "fisting with two hands" in professional contexts. There is a difference between them. If you cannot tell the…

I'm not trying to imply you have a problem with the word "use", I am directly implying that there is some boundary beyond which someone will be offended and you will not be. At which point whose delicate sensibilities should we defer to?

I, for one, take exception that your category of people who enjoy receptive sex seems to be explicitly excluding straight males, such that you've used the exact same "i.e." qualifier twice. It is well within the realm of possibility that a straight male would ask his partner to stimulate his prostate during sex, but you categorically reject that. Are you going to correct your mistake and stop making generalizations? Maybe start using e.g. from now on?

My position is this; it is obvious that the original poster is not making some kind of blanket statement that all people who participate in anal sex are bad, but rather is stating that having a large object in your anus is uncomfortable and having an entity do it to you while you are unwilling is horrible. It's not a statement that was attempting to marginalize minority groups. You are the one who misconstrued it to mean all gay men are evil. Maybe that's why you find people's objections to your attempted control over the English language to be common.

Finally, you seem to be annoyed that I "created a strawman argument" out of you, but you do feel free to contort my statements into "it's political correctness gone mad!", and "you can't say anything anymore!" as well as directly stating that I am someone who "wants to continue to say things that marginalize some minorities". Is ad hominem less of a logical fallacy than making a so-called strawman argument? I'm not going to continue arguing with someone that has such intellectual dishonesty because it's just a waste of time. I am done here and I won't be reading any responses you post, so you can save yourself some time there.

Re: Ubisoft "Uplay" DRM exposed as rootkit

#147
post #21

Earlier quoted context omitted.

I asked a question. If you're going to downvote me for having a wrong opinion, you should at least respond and tell me me the answer to my question, like 'this is proper behavior for a security researcher because X'.

Those games are pretty mainstream, I can't imagine how many gamers are getting rooted as we speak. I'm glad ubisoft are getting their asses kicked over this (especially with their history of aggressive DRM'ing) but for the users that's terrible. So no, I don't think that's very responsible. That being said, installing a "sudo" plugin in everybody's browser without any security validation (if I understand correctly wh…

If you could install a sudo plugin to my browser when I install your game would imply that I could have also installed a sudo plugin. If I (a non-root) user can do that, you already have a problem. (I am assuming you mean a sudo plugin that does not need a password to root)

Re: Ubisoft "Uplay" DRM exposed as rootkit

#148
post #12

Oh hell no. I can't believe this shit... and Tom Clancy's Ghost Recon: Future Soldier was such a good game too. T_T Next time I want to play an Ubisoft game I'm just going to pirate it. EDIT: I buy 99% of my video games through Steam, and when the games I get through Steam want to use their own launcher (play, windows live games, or EA's Origin, for example) I always get peeved.. to find out it allows arbitrary remot…

"Next time I want to play an Ubisoft game I'm just going to pirate it."

Another good reason to pirate Ubisoft's games is that none of them work when Uplay is down. Uplay is down a lot more often than never.

Post reply on HN