Sign in with
Sign up | Sign in

Ubisoft Patches uPlay Browser Plug-In Backdoor Flaw

By - Source: VG247

Ubisoft's uPlay poses a bigger threat than DRM annoyance.

Bringing up Ubisoft's always-online DRM through uPlay is sure to elicit groans of annoyance and protest from any PC gamer. The latest issue with uPlay is only sure to aggravate them even further.

Google information security engineer Tavis Ormandy discovered that the browser plugin to launch uPlay opened up a backdoor that allowed any website access to a user's computer.

" …I bought a video game called "Assassin's Creed Revelations". I didn't have much of a chance to play it, but it seems fun so far. However, I noticed the installation procedure creates a browser plugin for it's [sic] accompanying uplay launcher, which grants unexpectedly (at least to me) wide access to websites," wrote Ormandy in a post on Seclists.org. 

Luckily, Ubisoft was quick to respond to the exploit and managed to release a patch that fixed the issue within a day.

"We have made a forced patch to correct the flaw in the browser plug-in for the Uplay PC application that was brought to our attention earlier today. We recommend that all Uplay users update their Uplay PC application without a Web browser open. This will allow the plug-in to update correctly," said Ubisoft in a statement.

Considering that 21 Ubisoft titles use uPlay, among them some of Ubisoft's biggest titles—the Assassin's Creed series, Driver: San Francisco, and Ghost Recon: Future Soldier—it was imperative that Ubisoft quickly resolve the issue. So far, there's been no word on whether or not any uPlay users have been hacked as a result of the exploit.

 

Contact Us for News Tips, Corrections and Feedback

There are 11 Comments. B
Other Comments
  • 1 Ð
    azathoth , August 1, 2012 2:20 AM
    Remarkable that such a flaw could slip by, but at least they didn't throw fixing it on their 'list of things to do'.
  • 6 Ð
    DroKing , August 1, 2012 2:43 AM
    Im glad I called off Ubisoft/EA/Activihack-blizzcrapfest. These publishers cant touch anything without it dying a poor death.
  • 4 Ð
    teh_chem , August 1, 2012 3:19 AM
    I had never experienced UPlay DRM until I recently got Driver:SF on steam super-sale, and I have to say--this is the first time I've ever used the statement, "DRM only impacts the paying-users of the games" rant. And it's true. With my internet connection enabled, their uplay crap causes intermittent (and prolonged) game freezes. Disable your internet connection device and the game runs flawlessly. Others have documented this exact same thing, and get the excuse from Ubisoft saying it's they're graphics card drivers (load of crap).

    I will not buy another Ubisoft game ever again if they implement their Ucrap DRM. I'm not surprised that this security vulnerability in their software slipped through--they can't even get their program to run properly and not interfere with the games its bundled with, much less investigate possible security flaws...
  • 1 Ð
    shanky887614 , August 1, 2012 4:24 AM
    drm will never work because there will always be ways around it.

    look at the casinos as an example, how many years have they been trying to discourage cheating


    drm only affects the customer, this puts people off buying the game and encourages people to break it

    for example ive completed battlefield 3 on a borrowed ps3 copy because i do not like origin at all,

    nothing they do will change my mind and get me to play the game short of them removing it from the game, id quite happily use a program like steam where you only need to login once a month, which you are happy to do anyway because its a quick way to check for updates on all your games.

    besides you can't beat steams offers
  • -4 Ð
    whimseh , August 1, 2012 5:35 AM
    Really I don't mind DRMs, people make such a big deal out of it.
  • 0 Ð
    teh_chem , August 1, 2012 7:09 AM
    shanky887614drm will never work because there will always be ways around it.look at the casinos as an example, how many years have they been trying to discourage cheatingdrm only affects the customer, this puts people off buying the game and encourages people to break it for example ive completed battlefield 3 on a borrowed ps3 copy because i do not like origin at all,nothing they do will change my mind and get me to play the game short of them removing it from the game, id quite happily use a program like steam where you only need to login once a month, which you are happy to do anyway because its a quick way to check for updates on all your games. besides you can't beat steams offers

    Steam is DRM. DRM done better than most others, but DRM just the same.
    whimsehReally I don't mind DRMs, people make such a big deal out of it.

    I felt the same way, until like I mentioned, I tried to play one of their games, and the DRM itself was interrupting the gameplay.

    I'm fine with DRM when it's done fine. It wasn't until recently that I had a not-good experience with DRM.
  • -1 Ð
    Maxor127 , August 1, 2012 9:29 AM
    I didn't even know I had a uPlay browser plugin installed, and I don't know how it got installed. Why does uPlay need a browser plugin? I actually have two, and both are disabled, and uPlay seems to still work fine.
  • 0 Ð
    tomfreak , August 1, 2012 9:42 AM
    DRM are fine as long as it actually work without affecting the legit user at all or cause inconvenience to legit user.

    but UPlay is like a complete opposite of what I asking for.
  • 0 Ð
    rantoc , August 1, 2012 1:08 PM
    I dont mind DRM as long as its fully transparent to the customer, the software industry have the rights to protect their investment. However the sad part is that few drm schemes are truly transparent to the customer and should we now add security into the drm conserns?

    It would seem the pirates are not only getting the drm infested software to behave better but should it be more secure as well! WTF!

    Perhaps its time to stop adding to the 250+ titles strong steam account!
  • 0 Ð
    john_4 , August 1, 2012 6:59 PM
    I want nothing to do with Ubisoft or your games and your draconian DRM. That goes for EA and Activision too.
  • 0 Ð
    andreaperkins , August 2, 2012 12:09 PM
    thank you for the informative post
Tom’s guide in the world
  • Germany
  • France
  • Italy
  • Ireland
  • UK
Follow Tom’s guide
Subscribe to our newsletter