WTF? UbiSoft installs (effectively) a root kit with their games

[Athan]

Source: https://news.ycombinator.com/item?id=4311264

Basically any recent UbiSoft game comes with this 'UPlay' thing, which works via a web browser plugin. ANY site can include javascript to tickle this plugin into running anything on your computer.

Likely only a small step away from a website downloading a known file to your computer (think cacheing a given 'image' or somesuch) and having the plugin run it.

I'd already been boycotting UbiSoft for years now over the DRM 'always on' nonsense, and now this stupidity as well.

 

[Tuthmes]

Every large gaming company does something of this sort witht their current games. Scanning your computer files for information for example.

 

[Athan]

This isn't an issue of "I installed game A from company Y and either the installer or the game itself gathers local information and uploads it". This is "installing any recent UbiSoft game with UPlay places a web browser plugin on your machine such that ANY website could contain code to run any file on your computer".

I assume the whole UPlay thing is aimed at letting you launch games from your web browser. In which case they could have implemented it through the creation of a single folder where stub .exes are placed. Those would have strict limits on their filenames (a-z a-Z 0-9 - .) and the web plugin would only attempt to run anything that matches those limits and only in the central location. If any UbiSoft game wants to be UPlay launchable then its installer places a stub .exe in that location.

Instead they've made a browser plugin that will run ANYTHING it's asked to.

 

[Madmaxx]

I assume the whole UPlay thing is aimed at letting you launch games from your web browser. .

Doesn't BF3 do the same thing is that similar to it?

 

[Raven]

Yeah it does. Horrible thing.

 

[Poag]

Origin is such a terrible piece of software. The concept is good. Implementation bad.

 

[Ctuchik]

Article that explains it better.
http://www.rockpapershotgun.com/2012/07/30/psa-possible-security-risk-in-some-ubisoft-pc-games/

This is almost sony rootkit all over again...

 

[Athan]

At least UbiSoft appear to have been quick to issues a patch. Although I wonder just what said patch changes (I can't check myself due to aforementioned boycott).

http://www.bbc.co.uk/news/technology-19053453