Be Excellent To Each Other

https://news.ycombinator.com/item?id=4311264

Ruh roh. Anyone one have one of the affected games (listed below) to test this?




<Insert rant about how much better PC gaming is than console gaming here.>

This in light of their being savaged in the media and even in reviews: PC Gamer notably made a point of deducting huge amounts off their scores and going into great detail describing how their attempts to play the game were interrupted by Ubisoft's DRM (notably being only able to play the first third of HAWX 2 before being unable to reconnect, ever; and Sam Fisher being stopped mid-punch by a 'connection lost' message)

That this is what they were up to all along... I don't know if I'm surprised or not, actually. While they clearly had it in for PC owners, you wouldn't think they'd ever go this far.

I'd be highly surprised if they did. It'd be really rather silly of them, surely?

What reasoning would be behind them doing this? I'm struggling to understand the benefit.

Is it not more likely that they've bought in some code that contained the nastiness? Stupidity and laziness rather than evil and malice?

More likely stupid implementation of evil.

"Hey, you know how people patch our executables to get around client-side DRM? Wouldn't it be great if we had a way of forcing down executable code to the client so if they did that we could over-ride it?"
"Isn't that a bit of a security risk?"
"Uh - whatever. Nobody will ever know it's there, so it's not like anyone would use it maliciously"

I've got Driver San Fransisco installed.

The exploit works on my PC

For the LOLs.

Feex.

What does that link actually do if you've got the relevant browser plugin on your machine?

The link-linked seclist posting de-obfuscates the gibberish base64-encoded command in the middle: it runs the Windows Calculator. That is, arbitrary code execution.

I'm not sure how useful that is with normal Windows tools; perhaps it could get ftp.exe to download something, then run it. Presumably with Administrator rights, since most people still do that.

Leekspin.

That costs you £2 a month.

I'd be interested to see what malicious use it actually gets put to, I'd imagine you'd have to visit a website set up with nefarious intent, or that was at least running some code linked from elsewhere, or something - it's not really my sort of area.

I've disabled the Ubisoft Firefox plugins and that's stopped the exploit working as linked from that site.

Thinking on, it could easily modify your hosts file to go via a nasty proxy to facilitate drive-by-ing, for one thing. And turn the Windows Firewall off for another.

Hopefully they will fix it in time for AC3 release

You would. Except, the usual way things like this get exploited is by attackers compromising vulnerable websites (Wordpress is a popular target) to hand out the malicious code to visitors. So it's not like it's only going to happen if you go clicking dodgy links. It could happen anywhere.

It can do pretty much anything it wants at that point; the machine is wide open. Installing a secondary rootkit would be the logical first step, and that would probably include a rights elevation attack to get around users running not-as-admin.

Hmm, I've got Silent Hunter 5 (very good game modded) but it's currently uninstalled, as is Uplay.

Where can I find these Ubisoft firefox plugins, in case I've got 'em? How do I remove them?

Cheers Ubisoft, you fucking clods.

Just go to Firefox > Add Ons and they're in the list.

As far as I can tell disabling the addons removes the ability for the exploit to operate, certainly the link in DocG's original post stops working with the add-ons disabled.

Ta. Phew, looks like I'm safe.

Theoretically yes, the question I asked was "what can they do with a standard Windows install + Uplay?", that being the only assumption a nefarious sort should be making.

Thinking more, they could definitely tell the Windows Script Host to not prompt the user about insecure content and run a jscript to download and execute something (amongst many other things).

Even better, they could just embed the payload in the jscript. And "somethingsomethingsomethinganti-virus."

Luckily I had the foresight to pirate it...

Don't think I have any uplay stuff on my machine after the rebuild anyway.

I'm not overly concerned by the whole thing TBH, exploits will always exist in all sorts of software, it's not a new phenomenon.

Obviously Ubisoft are cunts for putting it in there in the first place, but it's not the kind of thing I'm going to lose any sleep over.

Whats new is that its a known exploit , that requires some action (if your tech savy enough you disable the plugin or simply uninstall uplay) and that its on millions of machines.

There will be people writing code to exploit it right now , and i bet its weeks at least till Ubisoft release some type of patch

I imagine there will be a lot of people who will not know it’s there and that their machine is vulnerable

Story is on Eurogamer now.

http://www.eurogamer.net/articles/digit ... nerability

Its also on Rock Paper Shotgun

http://www.rockpapershotgun.com/2012/07 ... -pc-games/

And also the fact that Ubisoft put it there knowingly. This is not some small oversight that hackers found a way to exploit. This is a deliberate choice to add a gaping security hole its customer's computers.

Oh don't get me wrong I'm not excusing Ubisoft's actions in any way, it's twattery of the highest order for sure.

Chrome users can find the plugin by going to chrome://plugins

Any explanation of how it would get elevated privileges? Or does it just rely on the fact that 90% of users will either have turned UAC off or would just click "Allow" for any UAC prompt?

Not entirely sure TBH, and we have to remember that it isn't a rootkit, or at least not what I understand to be a rootkit, anyway - so the thread title is somewhat misleading IMO.

For starters a rootkit hides itself, this Uplay bollocks can be disabled in about three clicks and the exploit is then entirely mitigated.

I'd suggest a rootkit is anything that deliberately permits remote code execution without the user's explicit knowledge. It may not be intended to be malicious, and it may be easy (ish) to disable, but I'm pretty sure it still fits the definition.

Don't forget that a huge number of users won't read any tech gaming sites, and will sit there with their PCs happily running what is effectively a remote exploit without having any idea - and now working exploit code has been published.

Its not a rootkit in the normally accepted sense of the word however its an exploitable weakness in the software that was installed without any user prompt / question (expect via the general 'do you want to install this game')

It does not have any automatic way to get elevated privileges , however it has full command line access in user space so there are plenty of other exploits which can be used to get higher privileges (or if you happen to still be running XP then your stuffed :-)

One question for those who have disabled the Uplay browser plug in , do the games still run (I've seen plenty of posts that if you uninstall it then the games will not launch)

Erm, no.

I realise we're arguing semantics to an extent but this is an area in which so much bollocks gets spouted, even by generally reputable sources, that being accurate in the terminology we use is important.

This is not a rootkit, it's an exploitable backdoor in a web browser plugin that can be entirely mitigated with a few clicks of a mouse.

Then it's not a rootkit.

The thread title is misleading and should be changed.

Just to be clear as well , this mitigation you've done *may* be undone the next time you launch one of your games and it pulls down another update from Ubisoft

(Yes I think they would be stupid to go about it that way but they put the thing in there in the first place and there's no guarantee that they will not release a 'patch' which they think closes the exploit and thus puts the browser plug in back into action)

If you don't know about it and it lets other people do stuff without you knowing, it's a rootkit.

The original news stories all mentioned it as a rootkit as well , its only really the RPS and the Euro-gamer articles which came along later and correctly identified it as a security hole

I disagree. If it's put there deliberately to allow remote code execution, it's a rootkit. That's the very definition of a rootkit.

To the Wikipedia-mobile!

You can't change what words mean based on your own criteria, that's not how language works.

It really depends on your definition

The definition of a rootkit originally was some code which could be run to get 'root' (i.e. superuser) access to the system - this does not give that level.

Recently the term rootkit has also been used specifically to include an attempt to hide the code so its invisible to the system (e.g. the Sony DRM rootkit actually hid itself from windows so windows would lie to you if you asked it about the files in question).

Terrible to be using Wikipedia for this but

http://en.wikipedia.org/wiki/Rootkit



This does not hide itself from detection / hide the processes it runs , and does not enable privileged access

Have a read of this instead http://en.wikipedia.org/wiki/Sony_BMG_c ... it_scandal

Of course it's a rootkit. The first (Windows) rootkits were fairly "trivial" to find, getting more and more sophisticated as AV vendors picked up on their tricks and MS were forced to start taking privileges out of users' hands because users don't care. Early ones simply relied on Windows preventing user-level apps seeing file- and folder- names prefixed with $. No L33T HAXXX0Ring at all.

A rootkit is "software installed without users' knowledge that provides unauthorised access to resources." Anything else is superfluous to the definition.

Yes it fucking is. How else does language evolve?

Sausages.

But this makes no effort whatsoever to conceal its presence on the afflicted machine, which is an accepted element of a rootkit by any definition.

Alright then, specifically, MaliA can't change what a rootkit is just because he thinks this is a rootkit.

It doesn't tell you it's installing, installed or running. You have to hunt it out, even if that's "easy".

Go on, ask everyone you see in real life over the next 24 hours how they find out what plugins their browser has. If it's more than 0 you're lying or I'm really unlucky.

Edit: I don't know how to do that. At least I didn't until Grim... said earlier (type in a fucking URL? Who are Google kidding?). I'd still have to go looking in IE. At least I'm competent enough to know how to do that; most people would get confused when you said "Alright, go into the Internet Options menu...."

aIm struggling to see why you care.
egardless of its classification, it comes under tge general header of "shit that you dont want on your computer"r