Ubisoft Uplay DRM security hole exposed, promptly fixed

Ubisoft’s always-on DRM mechanisms have been a point among a majority of gamers who feel they are a hassle to paying customers and ineffective at thwarting pirates. Well, it appears that even more worrisome side-effects are possible too, with the revelation that installing the company's UPlay game management system can open up your computer to malicious code insertion through the web browser.

The flaw was disclosed by Google security engineer Tavis Ormandy this morning, who noted that a browser plugin installed alongside Uplay, meant to launch locally-stored games from the web, doesn't have a filter for what websites can use it. This essentially left an open door on thousands of machines that can be exploited via a maliciously crafted web page.

Ormandy posted a few lines of JavaScript code as a tentative proof of concept. The story later made it onto Hacker News and so did a working implementation of the proof of concept that launched the built-in calculator in Windows. The code was confirmed to work on a Windows 7 PC with Assassin's Creed and Firefox installed.

Ubisoft has since released an update for their browser plug-in (found in over 20 different titles) to address the issue. You can also disable the plug-in altogether in your browser settings. Below is the company’s official statement and the full list of games that install the plug-in in question:

“We have made a forced patch to correct the flaw in the browser plug-in for the Uplay PC application that was brought to our attention earlier today. We recommend that all Uplay users update their Uplay PC application without a Web browser open. This will allow the plug-in to update correctly. An updated version of the Uplay PC installer with the patch also is available from Uplay.com.

Ubisoft takes security issues very seriously, and we will continue to monitor all reports of vulnerabilities within our software and take swift action to resolve such issues.”

List of Uplay enabled games

• Assassin’s Creed II
• Assassin’s Creed: Brotherhood
• Assassin’s Creed: Project Legacy
• Assassin’s Creed Revelations
• Assassin’s Creed III
• Beowulf: The Game
• Brothers in Arms: Furious 4
• Call of Juarez: The Cartel
• Driver: San Francisco
• Heroes of Might and Magic VI
• Just Dance 3
• Prince of Persia: The Forgotten Sands
• Pure Football
• R.U.S.E.
• Shaun White Skateboarding
• Silent Hunter 5: Battle of the Atlantic
• The Settlers 7: Paths to a Kingdom
• Tom Clancy’s H.A.W.X. 2
• Tom Clancy’s Ghost Recon: Future Soldier
• Tom Clancy’s Splinter Cell: Conviction
• Your Shape: Fitness Evolved

Witcher 2 devs suing pirates, claim to be sure who downloaded illegally

The Witcher 2: Assassins of Kings was very well received last May, gathering mostly positive reviews with an aggregate critics' score of 90/100 according to our Product Finder. The game was made exclusively for the PC -- and unlike many others a console version is in the works for later release and not the other way around -- and since the launch of patch 1.1, The Witcher 2 was made DRM-free for all.

That certainly spells confidence on the platform, as developer CD Projekt is said to have sold over a million copies of the game thus far. That's not only thing they feel confident about however. The Polish developer is going after pirates of the game, claiming that only people who they are sure downloaded a copy of the game illegally are receiving a threat of legal action, not very different to the pay-up-or-else scheme used by other organizations that track torrent downloads.

“We’re addressing only 100% confirmed piracy causes that are 100% possible to prove,” said Michal Nowakowski, CD Projekt's VP of Business Development to PC Gamer. “We are not worried about tracking the wrong people. As this is the trade secret of the company working on this, I cannot share it. However, we investigated the subject before we decided on this move, and we aware of some past complications. The method used here is targeting only 100% confirmed piracy cases. No innocent person was targeted with the letter so far. At least we have not received any information as of now which would indicate something like that.”

Reports indicate that in the past few months several batches of notices have been sent in Germany asking for a settlement equivalent to 911,80 euros ($1190) as compensation for illegally obtaining a copy of the game.TorrentFreak estimates over a thousand of these letters have been sent in this country alone, while worldwide piracy for The Witcher 2 (measured in BitTorrent downloads) is around 2 million copies.

It's also known CD Projekt is relying on an unnamed third party to monitor downloads and target individuals based on that information, though once again the company is claiming 100% accuracy on who is receiving legal threats. Michal Nowakowski said to PC Gamer they haven't had to go to court yet on any of these cases and that the real settlement sum asked from pirates is lower than the figure circling around the web.

Ubisoft our DRM “is a success”

We recently reported on how Driver: San Francisco will require a constant internet connection to play. It’s a controversial measure put in place to defend against piracy, and we don’t like it. We don’t like pirates either, mind.

Ubisoft see the DRM as a success. Speaking to us earlier today, a Ubisoft representative admitted that the developer has seen “a clear reduction in piracy of our titles which required a persistent online connection, and from that point of view the requirement is a success”.

Ubisoft have traditionally been the developer with some of the harshest DRM in the industry. In the games that use their always online “connected services”, players can no longer to play if no internet connection is detected. The publisher first implemented this always-online DRM with Settlers 7. Since then, it’s featured in Silent Hunter V and Assassin’s Creed 2 and Assassin’s Creed: Brotherhood.

Sadly, legitimate players often take the brunt of such security measures. Intermittent internet connections and server issues at Ubisoft’s end can stop PC Gamers from playing the game entirely. Not cool.

Similarly frustrating measures were also introduced in the recent Super Street Fighter IV: Arcade Edition, where offline players were restricted to playing a small selection of the characters. Capcom later withdrewthe DRM after fan criticism.

Driver: San Francisco is out on August 30 in the US, and September 2 in Europe