Ubisoft DRM Fiasco: Allows Any Website To Take Control Of Your Computer

from the punishing-your-paying-customers dept

It's been nearly seven years since the great Sony rootkit fiasco, when it was discovered that Sony Music was using some DRM on its CDs that self-installed a rootkit (without letting users know) that had all sorts of security problems and vulnerabilities. The company took a massive hit for this, and you would think that others would be a lot more careful with their own DRM. You would think. But, then you don't know Ubisoft. The vast majority of times we've ever discussed Ubisoft in these pages, it's been because the company was doing something ridiculous with DRM. The company loves its DRM and seems to refuse to recognize that pissing off legitimate customers isn't such a good idea.

So would it come as any surprise that it may now be facing a "rootkit moment" of its own?

As a whole bunch of folks have been submitting, some hackers have figured out that Ubisoft's Uplay DRM appears to install an unsecure browser plugin. The details came out over the weekend, first on a security mailing list, and were then followed up with some test exploit code posted to Hacker News.

Basically, it appears that Ubisoft's DRM is installing an accidental backdoor that makes it possible for any website to effectively take control over your computer. That's... uh... pretty bad.

From the details, the real problem sounds to be one of exceptionally poor coding, rather than maliciousness. Basically, they wanted to let you launch the game via a website, but failed to limit it to just the game -- meaning that a site can make use of the plugin to basically do a whole bunch of stuff on your computer (including things you don't want it to do). The browser plugin is easy to remove (and you should, um, immediately, if you've installed any Ubisoft games), so it's not quite as messy as Sony's rootkit, which was pretty deeply buried. But it's still really bad.

Yet another case of DRM really making life difficult for legitimate customers who paid money for your product. When will companies figure out that DRM does nothing to stop piracy, but makes life really difficult for the people who actually give you money?

Filed Under: browser plugin, control, drm, rootkit, security, uplay
Companies: ubisoft

American Airlines Making Life Worse For Most Loyal Customers By Killing Useful Mile-Tracking Browser Plugin

from the lame dept

It's still really amazing to me how often we hear about companies making their own customers' lives worse off in an obsessive need for excess control. The latest such example comes via Rob Hyndman, who points us to the news that American Airlines has forced Award Wallet to stop providing a useful tool for American fliers trying to keep track of their frequent flyer mileage. American had cut off a bunch of web-based services in the past that would log into American's site for you and provide a different view and other useful tools. In that case, the airline argued -- perhaps reasonably -- that it was concerned about security of a third party logging into the site and having access to your account/password. There are ways that American could deal with those security concerns, but at least that argument made some sense. In response, however, Award Wallet built a browser plugin that never involved data going to any third party. Basically everything stayed local. All it did was give users a better way to view the information (and was apparently especially handy for families).

And American Airlines didn't like it.

It couldn't use the "security" argument this time, because everything was local. But, actually, it tried to use that same argument anyway, responding to a question from BoardingArea, saying that it shut down Award Wallet to maintain the company's...

...…long-held stance on how third-party websites access proprietary AAdvantage member details… Because travelers’ AAdvantage account numbers and passwords can be used to claim AAdvantage mileage awards out of their accounts and access personal details, American will always protect this information.

We simply cannot permit websites that have not satisfied our security requirements the access needed to track AAdvantage balances or any other function that is otherwise secured behind AA.com login credentials.

But that falsely assumes that the browser plugin is a "website." It's possible that American is just confused... but the more likely situation is that American Airlines is still just worried about controlling the customer, rather than making sure they have the best experience for them. What services like Award Wallet do is make American's frequent flyer program more valuable to consumers, but apparently American doesn't want that if it means having less control.

Filed Under: browser plugin, control, frequent flyer mileage, software, users
Companies: american airlines, award wallet