Except it'd also install a program via UBISoft's DRM plugin which wiped your hard drive. Says the expert we spoke to, "you could click on a weblink, thinking you were visiting the BBC News Website from a friendly list of bookmarks.
The web security expert we chatted to says this could even occur via an email link, making this exploit a phisher's dream if it's as a bad as it sounds.
Were someone with malevolent intent to inject the code onto a commonly-visited website, they might be able to gain control over any number of PCs - or install keyloggers, viruses and the like, or just plain old wipe your hard drive. See below for details on how to rid your PC of it.Įssentially, as described here, with the right piece of code any website can call up a Uplay window and from that might be able to slip a program install or launch of their choice onto your PC. Update: the flaw lies specifically in a browser plugin Uplay quietly installs, and the general consensus is now that's all you need to remove to protect yourself. If Uplay is on your PC, I urge you to uninstall it and any games that use it immediately, until we know more. It isn't confirmed as definite, but certainly proof of concept code is calling up Uplay windows and then loading other programs from websites that have nothing to do with Ubisoft. For now, the important thing is to warn folks who have certain Ubisoft games installed on their PCs that an apparent backdoor has been discovered in the Uplay infrastructure/DRM which may in theory allow any anyone so minded to install God knows what horrors on your PC. We're currently investigating the full extent of this, but moralising and recrimination can come later.
To be honest I'd get rid of the plugin regardless, until we're sure the problem's been resolved. Plugin now only able to open uPlay application." If your Uplay hasn't/won't update to version 2.04, I'd get rid of it and its plugin for now. There are reports on the Ubi forums (thanks, Imperial Dane) that Uplay has been updated to version 2.04, which if the commenter is accurate bears the note "'Fix addressing browser plugin. Update - Ubisoft may have plugged the hole, but it's difficult to know for sure as they don't appear to be discussing the issue.
0 kommentar(er)
