Be Excellent To Each Other

There's a big clue in the word 'rootkit' though - root level access, this exploit can only run in the user space, it can't elevate itself in any way.

Indeed, but it's not a rootkit.

Mr Dave, cutting to the core of the issue. With a blunt phone.

A rootkit by any other name would smell as shittily.

The correct use of language is important to me, it may not be important to Mr Dave, that's fine. It doesn't make me 'wrong' because I don't like seeing this be called a rootkit when it isn't a rootkit.

And when we consider how JohnCoffey used to get his head stamped on if the BEEX mob decided he was wrong about something....

Except that by default on Windows desktop OSs, every user has elevated privileges, making the distinction pretty meaninless. Even UAC is a poor defence, given that it's either turned of or ignored by 90% of people.

You're the one that started complaining that the thread title was 'wrong' and should be changed.

Way to derail an interesting thread, grammar pedants. Now I could care fewer.

HTH

If it's not a rootkit, then what is it?

Dave said it doesn't matter what it's called, it's just shitty that it exists - the core of the issue. I was agreeing with him that the bickering was pointless, whilst having a josh at his phone, and in the process stepping out. Not sure how you took it, but it wasn't that way.

The fact that 'you' don't know about it doesn't mean it's trying to hide itself.

The exact definition of this stuff probably doesn't matter, but if the "designed to hide the existence" part of Wikipedia's definition is critical to something being a rootkit then this isn't. The browser plugin would need to be invisible when looking at your current list of installed plugins in the the normal manner for that to be the case.

What's a browser plugin?

Not sure if serious. And not sure which would be worse...

Security hole 'possibly' plugged by v2.04

http://www.rockpapershotgun.com/2012/07 ... -pc-games/

Well, feel free to answer, and don't forget to point out why it isn't an extension or an add-on, because I'm buggered if I can in English that people would be able to understand.

I have no idea what you're talking about.

Surely extensions, add-ons, and plugins are the exact same thing, just with different names depending on which web browser you're using?

I think, (really) broadly:

• Extensions attach to a piece of software somehow and can make it do anything
• Plug-ins also attach to software but are quite defined in what they do and have a much narrower functionality than extensions
• Add-ons are pretty much the same as plug-ins, except they can be hardware too

I fully expect that to all be wrong.

Note the difference (in Chrome) between chrome://chrome/extensions/ and chrome://plugins

Oh, right. I thought it was just that Chrome called them extensions, Firefox called them plugins, and IE called them add-ons.

That's not quite true in that, in Firefox for example, Add-ons and Extensions are slightly different things, but they both have the effect of 'extending' the functionality of your browser.

Either way, in the context of this discussion, I'm using plugins as a generic terms for any of these kind of things. And it doesn't matter either way because whether the software in question is an extension, add-on or plugin it's not hiding itself so doesn't meet the definition of rootkit (assuming, as I said, that the "designed to hide the existence" is a necessary part of the definition).

In the context of this discussion it doesn't matter if it's a rootkit, either

BUT ANYWAY.

The important question is: What am I going to tell the Beex website to do with vulnerable computers?

Make them open a headless browser, make that make a paypal payment to the server fund, and hope they left themselves logged in to paypal or have remember passwords turned on.

Fuck me, this thread took a turn for the deeply tedious after I left, didn't it?

Looks like Ubi have provided instructions on how to patch. Fair play for the speedy turnaround, but time to hire a security architect, eh?

It's not a rootkit.

You're just jealous!

You're a rootkit.

I rootkitted your mum.

I backdoor trojaned you face and SQL injected into it.

Good work.

I installed Lunix and f-pr0tted your tarball.

Going around the houses, it isn't beyond the bounds of probability that some people who have said product don't know what a browser plug in is. By extension, If they don't know it is there and it is allowing access, it could, quite comfortably fit the definition of "rootkit". When a rootkit is discovered, does it stop being a rootkit as it is then visible? It's the same thing, executed differently to my mind. I'd write one using a browser for the low hanging fruit but come up with secondary and tertiary ones to go for the better stuff.

I packet sniffed your mum & found all her ports wide open, so after a bit more penetration testing I decided to fsck her bad sector with my RAM module.

I exceeded your mum's I/O threshold.

Ah, she wondered why you had to keep stopping to buffer.

She was doing the buffing.

I think that was the nerdiest ZING! In the history of the internet.

Edit, that was to Craster

Yeah, see, no; that's utter nonsense, please stop.

Does a rootkit try to hide itself from user discovery?

Yes.

Does this try to hide itself from user discovery?

Yes.

Does a rootkit allow privileged access to a third party without the knowledge of the user?

Yes.

Does this allow privileged access to a third party without the knowledge of the user?

Yes.

It's a rootkit, it fits the definition.

It's not trying to hide itself from user discovery though.

For most users, as a not immediately obvious addition to the computer, I'd argue that it is. A reasonable person would not expect, nor go looking for such a thing.

How 'hidden' would it have to be, in your eyes?

I'm really not sure if your trying to troll here or not - however to answer these questions :



What does this do to try and hide itself from discovery ?

The fact that you may not know where the options are to view it does not mean its actually hiding



This really depends on your definitions

Privileged access normally means being allowed root or superuser access to the machine - by default this does not have that right (unless your running XP or have consciously gone in and turned it off)



It doesnt really fit , can I suggest you look at the two wikipedia links i posted earlier one on the definition of a rootkit and one on the Sony DRM rootkit

I would also suggest going to a reputable security website and reading their notes on rootkits - try Symantec / Kaspersky / Avast and see how they classify things as rootkits and the definitions they use.

I would suggest that it doesn't fit a dictionary definition of a rootkit. It also doesn't fit a dictionary definition of a vulnerability, because those don't tend to be deliberate. So it falls somewhere between the two, making the discussion a little moot.

Mostly for MaliA and Craster.

Seriously guys, jesus christ.

At the moment there's nothing to say that it is deliberate (and as far as I know Ubisoft have not made any comments about it other than saying "we have a new version - download it now")

BTW Microsoft have a good Vulnerability definition here : http://technet.microsoft.com/en-us/libr ... 51383.aspx and cover things in detail but this is a good summary



Which sounds like what we're talking about here.

** Edit ** - btw if your interested in rootkits anything written by the Sysinternal guys (before they were bought out by Microsoft) is worth a read - try this although its old (2005) it really covers what you would look for : http://blogs.technet.com/b/markrussinov ... o-far.aspx - this was the first post to bring the Sony Rootkit DRM to public attention

It would have to actually be hidden, not just in a place that some people don't know exists. If this thing turns up right there on the screen on which all other browser plugins (or whatever) can be viewed then it's not attempting to hide itself; it's exhibiting the same behaviour as all other entities of the same type. If there was some purposeful effort to hide it on that list then you'd have a point, but it didn't so you don't.

I don't understand how this isn't patently and irrefutably obvious to all but the dimmest of intellects of the most persistent of trolls.

At at least one person here didn't know how to look for it, and it's affected at least two people here. It's a shallow definition of 'hidden' but I'm still sticking with 'hidden'.

Ad hominems aside, it isn't trolling, it's a discussion about what qualifies as a rootkit. So far, you've offered up "no, it isn't" and a picture that someone else drew.

My argument is that is that if something sits somewhere where a reasonable user of a computer either never looks, or hardly ever looks, and even if they were to look, they would require knowledge of what such a program does, then it is hidden. Pete asked where to look, your computer was affected (and I'm considering you as an experienced user), so i'm crossing "obvious and out in the open" off the list of things that it was here. Added to that, Assassin's Creed 2 was released in March 2010 for windows, so it's has taken almost 30 months to come to light. I'd say that isn't easily found.

I don't think "how hidden must it be?" is an unreasonable question, nor my view that this was hidden. If you could take the time to explain why it wasn't, then I'd appreciate it.

I'll ignore the "dont feed trolls" mantra for a moment



Read my last post.



The version released in 2010 did not have this uplay software , V2 of uplay was released a few weeks ago so it could have been there for a few weeks only - however since uplay updates itself we have no idea how long it has been there and whats been found is the exploit not that the software was there.



Read my last post.

News story on the BBC about it http://www.bbc.co.uk/news/technology-19053453