IMPORTANT - Potential Security risk in SH5

[Oberon]

A heads up for all those using SH5:

http://www.rockpapershotgun.com/2012/07/30/psa-possible-security-risk-in-some-ubisoft-pc-games/#more-118064

[0rpheus]

Worth noting (at least as I understand it) that you don't need to delete uplay/SH5 - just go into your web browser (all of them if you use more than one), find 'addons' (IE) or 'Extensions' (Chrome) and disable the Uplay addon, if it's there.

AFAIK, if it's not there, and it isn't for me, then there should be no problem. :up:

EDIT: Clearer methods courtesy of RPS forums:

How to disable Uplay in Firefox:
Tools - Add-ons - Plugins - Disable the Uplay and Uplay PC Hub plugins

In Opera:
Settings - Preferences - Advanced - Downloads - Search "Uplay", delete

In Chrome:
Enter chrome://plugins/ in the bar and disable

To check the vulnerability, visit this page
http://pastehtml.com/view/c6gxl1a79.html

If your browser is vulnerable, Uplay will start and the Windows Calculator will run.

EDIT2:

Chrome lists the offending file as the following:
C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll

location will be different for other people no doubt, but if it doesn't show up in your plugin menus in your browsers, you can double check by searching for that file. REMEMBER: If you don't see Calculator pop up when you click the test link, you're ok!

[gap]

Thank you both Oberon and 0rpheus for the valuable information! :)

[THE_MASK]

Well i just clicked on that link and uplay came up with my username and the calculator . uplay and SH5 is uninstalled :yep: They can patch this garbage youplay out once and for all . I dont have uplay IE addon , just the uplay that comes with SH5 .

[Sailor Steve]

I just clicked the link and got a blank page. Well, not blank, but no calculator or uplay. I do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe? At this point it doesn't matter because I can't play it anyway. I'm going to remove it anyway, for that reason.

I have to agree though. I put off buying it until I could play it offline, but this is even more sinister than that. Had I known I never would have bought it, even for five dollars.

[0rpheus]

II do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe?

Sounds like you're fine. From what I can find out it's a fairly recent Uplay update that opened the vulnerability - I've not fired up 5 for a month or so and I don't have the problem file. And removing or disabling the browser plugins solves the problem immediately, so it's easily avoided.

It is pretty awful that browser plugins and the like are installed without the user's knowledge, but then what do we expect from Ubi? I can't see the point in letting it get in the way of the good work being done for SH5, so I won't be uninstalling the game itself.

[gap]

Well i just clicked on that link and uplay came up with my username and the calculator . uplay and SH5 is uninstalled :yep: They can patch this garbage youplay out once and for all .

have you disabled the U-play extension, as described by 0rpheus? I am using chrome, and after doing it I only get a blank page with the usual jigsaw puzzle piece icon, shown when a required plugin is missing or disabled. Before disabling the plugin, I was getting the same as you (my U-play page + calculator).

I dont have uplay IE addon , just the uplay that comes with SH5 .

You have it, but you were unaware of it. It gets automatically installed on your system the first time you install U-play, with no consent from the user. The plagin could be reenabled when U-play is getting updated, so take care guys...

I just clicked the link and got a blank page. Well, not blank, but no calculator or uplay. I do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe? At this point it doesn't matter because I can't play it anyway. I'm going to remove it anyway, for that reason.

If you get nothing after clicking that link, you should be safe anyway. Indeed, you are safer if you don't have U-play installed on your system :03:



It is pretty awful that browser plugins and the like are installed without the user's knowledge, but then what do we expect from Ubi? I can't see the point in letting it get in the way of the good work being done for SH5, so I won't be uninstalling the game itself.

Agree with you, 0rpheus :up:

[0rpheus]

Hey, look on the bright side - it'll mean a few clean installs, and a whole new wealth of mod-soup posts :up::har:

Post #2 updated with additional info/clearer wording.

[gap]

Hey, look on the bright side - it'll mean a few clean installs, and a whole new wealth of mod-soup posts :up::har:

:o .:doh:
:rotfl2:

[Trevally.]

My uplay has just been patched by ubi and I am now safe and sound:haha:

http://img837.imageshack.us/img837/6493/74844956.jpg

[SilentOtto]

Awesome...

Security was one of the few ways left, in which uplay was not annoying... yet.

[mookiemookie]

I was considering reinstalling and seeing what progress had been made.

FORGET THAT.

[Brag]

:shifty:The horrors of the Ubi DRM will never end, No?

[SilentOtto]

I was considering reinstalling and seeing what progress had been made.

FORGET THAT.

Sad thing is, the game is a good base, graphic engine looks so good, and modders are doing awesome and amazing stuff. A lot of progress has been made, indeed. :up:

But what we get from ubi, after 2 years is only this kind of love! :down:

[Trevally.]

:shifty:The horrors of the Ubi DRM will never end, No?

:hmmm:
Im sure they have fixed it. No?

[SilentOtto]

DRM will only be fixed when it's removed! :know:

[bill clarke]

I clicked on the link in the second post and got a blank screen. This mean I'm safe?