Ubisoft Uplay DRM Found To Include a Rootkit

← Back to Stories (view on slashdot.org)

Ubisoft Uplay DRM Found To Include a Rootkit

Posted by samzenpus on Monday July 30, 2012 @01:35AM from the a-little-something-extra dept.

An anonymous reader writes "It has been discovered that the Uplay system Ubisoft uses to both check a game is legal and offer up gaming achievements, multiplayer, and additional content, actually contains a rootkit. The discovery was made by Tavis Ormandy, an information security engineer at Google, when he installed Assassin's Creed: Revelations on his laptop. He noticed that during the installation Uplay installed a browser plug-in that allows any website to gain access to your machine through a backdoor and take control of it.The plug-in can be classed as a rootkit because it is thought to allow continued privileged access to a machine without a user's consent."
Update: Ubisoft has released a statement saying it has issued a forced patch to correct the flaw in the browser plug-in for the Uplay PC application.

13 of 473 comments (clear)

Min score:

Reason:

Sort:

Not really surprising. by Black+LED · 2012-07-30 01:38 · Score: 5, Insightful

It's reasons like this that I refuse to buy anything from Ubisoft.
1. Re:Not really surprising. by afidel · 2012-07-30 01:44 · Score: 5, Insightful
  
  Yep, I own every HoMM game except VI due to the retarded DRM. I wish Steam had a filter button to remove anything with third party DRM so I wouldn't have to get my hopes up just to end up not buying a title due to publisher stupidity.
  
  --
  There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
2. Re:Not really surprising. by gman003 · 2012-07-30 03:41 · Score: 5, Insightful
  
  I've said this before: DRM, in and of itself, is not evil.
  If all the DRM does is check whether I have or have not purchased the [whatever], and reliably detects paying users as such (low false-positive rate; the false-negative rate is meaningless to me), and the only thing it does is conditionally run (or not run) the [whatever], and it requires minimal work on my own part, I'm fine with it. And, it seems, many others are fine with it as well.
  Now, many, even most, DRM implementations fail at least one of those evilness checks. This Ubisoft one violates the "don't do anything on the system not related to your product" clause. Many others fail the "reliably detect paying users as such" clause - always-online systems detect offline-but-paying users as nonpaying, for instance.
  Steam passes the evilness checks with only a few caveats (it's not perfect, but it's one of the better ones, and probably the best with that level and quantity of games). You will have to go online at least once to authenticate, you need to prepare a bit ahead of time before going offline (random internet dropouts or the Steam servers themselves going down can stop you), and it does encrypt pre-loaded games. And then there's the whole "no reselling/used games" thing, but honestly, I'm fine with that. I've never found selling my old games to be financially worth it, and the very phrase "used digital games" is an absurdity.
3. Re:Not really surprising. by Baloroth · 2012-07-30 03:46 · Score: 5, Insightful
  
  You'd like Steam - a DRM system - to help you buy only DRMed games that don't use a competing DRM system?
  People really have drunk the Steam kool-aid, haven't they?
  Yes, because unlike every other DRM system I've ever seen, Steam actually helps to improve the experience, by making sure the game is up-to-date, storing saves and config files in the "cloud" (for developers who implement it), allowing me to re-download and re-install games on as many computers as I please, allowing me to easily play with friends (or not, as I see fit), and still allowing me to play games offline (unlike *ahem* Blizzard). And of course their famous sales. I know people who dislike Valve who still like Steam. Granted, the DRM isn't necessary for all that technically speaking, but it is to provide a decent selection (most developers wouldn't put their games on Steam if it didn't have copy-protection of some kind).
  Honestly, Steam is almost always as easier, sometimes more, than pirating games.
  
  --
  "None can love freedom heartily, but good men; the rest love not freedom, but license." --John Milton
Is anyone actually surprised? by h4rr4r · 2012-07-30 01:38 · Score: 5, Insightful

Who is actually surprised?
This is the one thing that has me worried about Steam on linux. Using it in wine I can be fairly sure I have it limited to one user account and no real ability to mess with the machine, but when it installs natively who knows.
Re:under the DMCA any antivirus software can get s by MarioMax · 2012-07-30 01:42 · Score: 5, Insightful

under the DMCA any antivirus software companies can get sued for remove or even marking this.
On the other hand, Ubisoft is probably guilty of violating Federal wiretap laws.
Re:Enough with giving Windows a pass by h4rr4r · 2012-07-30 01:42 · Score: 5, Insightful

This is software installed by the user on purpose, it is no flaw in windows that allowed it in. You could write software to do the same thing on any number of OSes.
I am no windows fan, but you can't blame them for this.
Re:under the DMCA any antivirus software can get s by Anonymous Coward · 2012-07-30 01:51 · Score: 5, Insightful

You can't always waive your rights, even if you agree to it.
Re:All DRM is rootkit by Anonymous Coward · 2012-07-30 01:52 · Score: 5, Insightful

IMHO ANY software that allows someone to delete/alter/lock up something on my machine without my permission is essentially a rootkit.
DRM does not allow someone to "delete/alter" anything. It only "locks up" in the crypto sense, as DRM is basically crypto code. I dislike DRM, but will defend a software company's right to encrypt their software, and even allow them to require an Internet connection to "unlock/decrypt" that software so that it can be used. This is their choice, and in that respect, "buyer beware". Vote with your cash.
OTOH, installing a rootkit which allows possible unauthorised access to my machine, by the company or any other 3rd party without specific permission for each and every access??? They deserve to be fined out of existence by every legal system on the planet.
And they wonder... by mycroft16 · 2012-07-30 02:08 · Score: 5, Insightful

And they wonder why there is piracy of video games. Seems quite obvious to me. "Buy game and get a rootkit installed on my machine, compromising my system's security or get the game from pirates without that."
Re:under the DMCA any antivirus software can get s by Anonymous Coward · 2012-07-30 02:16 · Score: 5, Insightful

So? Ubisoft is a corporation, its not like anything bad is actually going to happen to them.
Re:Enough with giving Windows a pass by SharpFang · 2012-07-30 02:27 · Score: 5, Insightful

Wait, not really.
You install a computer game
The game claims to install counterfeiting and cheat protection
What you also get in the bundle without consenting is a backdoor/rootkit
This is the very definition of a trojan.

--
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Re:under the DMCA any antivirus software can get s by wvmarle · 2012-07-30 03:42 · Score: 5, Insightful

In most if not all jurisdictions in this world, the law is always above any contract or agreement. And rightfully so, just think of the mess we would have if that is not the case. It's also why in all proper contracts you will find a "survivability clause", stating that if anything in the contract is overruled by another law, that the rest of the contract remains in force.