IMPORTANT - Potential Security risk in SH5

Oberon · 07-30-12, 05:46 AM

A heads up for all those using SH5:

http://www.rockpapershotgun.com/2012...s/#more-118064

0rpheus · 07-30-12, 05:57 AM

Worth noting (at least as I understand it) that you don't need to delete uplay/SH5 - just go into your web browser (all of them if you use more than one), find 'addons' (IE) or 'Extensions' (Chrome) and disable the Uplay addon, if it's there.

AFAIK, if it's not there, and it isn't for me, then there should be no problem.

EDIT: Clearer methods courtesy of RPS forums:

How to disable Uplay in Firefox:
Tools - Add-ons - Plugins - Disable the Uplay and Uplay PC Hub plugins

In Opera:
Settings - Preferences - Advanced - Downloads - Search "Uplay", delete

In Chrome:
Enter chrome://plugins/ in the bar and disable

To check the vulnerability, visit this page
http://pastehtml.com/view/c6gxl1a79.html

If your browser is vulnerable, Uplay will start and the Windows Calculator will run.

EDIT2:

Chrome lists the offending file as the following:
C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll

location will be different for other people no doubt, but if it doesn't show up in your plugin menus in your browsers, you can double check by searching for that file. REMEMBER: If you don't see Calculator pop up when you click the test link, you're ok!

gap · 07-30-12, 07:18 AM

Thank you both Oberon and 0rpheus for the valuable information!

THE_MASK · 07-30-12, 07:29 AM

Well i just clicked on that link and uplay came up with my username and the calculator . uplay and SH5 is uninstalled

They can patch this garbage youplay out once and for all . I dont have uplay IE addon , just the uplay that comes with SH5 .

Sailor Steve · 07-30-12, 08:52 AM

I just clicked the link and got a blank page. Well, not blank, but no calculator or uplay. I do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe? At this point it doesn't matter because I can't play it anyway. I'm going to remove it anyway, for that reason.

I have to agree though. I put off buying it until I could play it offline, but this is even more sinister than that. Had I known I never would have bought it, even for five dollars.

0rpheus · 07-30-12, 09:34 AM

Quote:

Originally Posted by Sailor Steve

II do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe?

Sounds like you're fine. From what I can find out it's a fairly recent Uplay update that opened the vulnerability - I've not fired up 5 for a month or so and I don't have the problem file. And removing or disabling the browser plugins solves the problem immediately, so it's easily avoided.

It is pretty awful that browser plugins and the like are installed without the user's knowledge, but then what do we expect from Ubi? I can't see the point in letting it get in the way of the good work being done for SH5, so I won't be uninstalling the game itself.

gap · 07-30-12, 09:43 AM

Quote:

Originally Posted by sober

Well i just clicked on that link and uplay came up with my username and the calculator . uplay and SH5 is uninstalled

They can patch this garbage youplay out once and for all .

have you disabled the U-play extension, as described by 0rpheus? I am using chrome, and after doing it I only get a blank page with the usual jigsaw puzzle piece icon, shown when a required plugin is missing or disabled. Before disabling the plugin, I was getting the same as you (my U-play page + calculator).

Quote:

Originally Posted by sober

I dont have uplay IE addon , just the uplay that comes with SH5 .

You have it, but you were unaware of it. It gets automatically installed on your system the first time you install U-play, with no consent from the user. The plagin could be reenabled when U-play is getting updated, so take care guys...

Quote:

Originally Posted by Sailor Steve

I just clicked the link and got a blank page. Well, not blank, but no calculator or uplay. I do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe? At this point it doesn't matter because I can't play it anyway. I'm going to remove it anyway, for that reason.

If you get nothing after clicking that link, you should be safe anyway. Indeed, you are safer if you don't have U-play installed on your system

Quote:

Originally Posted by 0rpheus

It is pretty awful that browser plugins and the like are installed without the user's knowledge, but then what do we expect from Ubi? I can't see the point in letting it get in the way of the good work being done for SH5, so I won't be uninstalling the game itself.

Agree with you, 0rpheus

0rpheus · 07-30-12, 09:48 AM

Hey, look on the bright side - it'll mean a few clean installs, and a whole new wealth of mod-soup posts

Post #2 updated with additional info/clearer wording.

gap · 07-30-12, 10:14 AM

Quote:

Originally Posted by 0rpheus

Hey, look on the bright side - it'll mean a few clean installs, and a whole new wealth of mod-soup posts

.

Trevally. · 07-30-12, 11:21 AM

My uplay has just been patched by ubi and I am now safe and sound

SilentOtto · 07-30-12, 02:58 PM

Awesome...

Security was one of the few ways left, in which uplay was not annoying... yet.

mookiemookie · 07-30-12, 08:46 PM

I was considering reinstalling and seeing what progress had been made.

FORGET THAT.

Brag · 08-04-12, 03:15 PM

The horrors of the Ubi DRM will never end, No?

SilentOtto · 08-04-12, 03:40 PM

Quote:

Originally Posted by mookiemookie

I was considering reinstalling and seeing what progress had been made.

FORGET THAT.

Sad thing is, the game is a good base, graphic engine looks so good, and modders are doing awesome and amazing stuff. A lot of progress has been made, indeed.

But what we get from ubi, after 2 years is only this kind of love!

Trevally. · 08-04-12, 04:36 PM

Quote:

Originally Posted by Brag

The horrors of the Ubi DRM will never end, No?

Im sure they have fixed it. No?

07-30-12, 05:46 AM	#1
Oberon Lucky Jack Join Date: Jul 2002 Posts: 25,976 Downloads: 61 Uploads: 20	IMPORTANT - Potential Security risk in SH5 A heads up for all those using SH5: http://www.rockpapershotgun.com/2012...s/#more-118064

07-30-12, 07:29 AM	#4
THE_MASK Ace of the deep . Join Date: Jan 2006 Posts: 9,226 Downloads: 901 Uploads: 73	Well i just clicked on that link and uplay came up with my username and the calculator . uplay and SH5 is uninstalled They can patch this garbage youplay out once and for all . I dont have uplay IE addon , just the uplay that comes with SH5 . Last edited by THE_MASK; 07-30-12 at 08:29 AM.

07-30-12, 08:52 AM	#5
Sailor Steve Eternal Patrol Join Date: Nov 2002 Location: High in the mountains of Utah Posts: 50,369 Downloads: 745 Uploads: 249	I just clicked the link and got a blank page. Well, not blank, but no calculator or uplay. I do still have SH5 installed, but I haven't played it since my computer had problems with it months ago. Am I safe? At this point it doesn't matter because I can't play it anyway. I'm going to remove it anyway, for that reason. I have to agree though. I put off buying it until I could play it offline, but this is even more sinister than that. Had I known I never would have bought it, even for five dollars. __________________ “Never do anything you can't take back.” —Rocky Russo

07-30-12, 11:21 AM	#10
Trevally. Navy Seal Join Date: Apr 2007 Location: AN1536 (Orkney) Posts: 5,451 Downloads: 166 Uploads: 28	My uplay has just been patched by ubi and I am now safe and sound __________________ [SIGPIC][/SIGPIC] Trevally Mods for SH5

07-30-12, 08:46 PM	#12
mookiemookie Navy Seal Join Date: Nov 2005 Location: Houston, TX Posts: 9,404 Downloads: 105 Uploads: 1	I was considering reinstalling and seeing what progress had been made. FORGET THAT. __________________ They don’t think it be like it is, but it do. Want more U-boat Kaleun portraits for your SH3 Commander Profiles? Download the SH3 Commander Portrait Pack here.

07-30-12, 05:57 AM	#2
0rpheus Grey Wolf Join Date: Jul 2011 Location: UK Posts: 857 Downloads: 87 Uploads: 3	Worth noting (at least as I understand it) that you don't need to delete uplay/SH5 - just go into your web browser (all of them if you use more than one), find 'addons' (IE) or 'Extensions' (Chrome) and disable the Uplay addon, if it's there. AFAIK, if it's not there, and it isn't for me, then there should be no problem. EDIT: Clearer methods courtesy of RPS forums: How to disable Uplay in Firefox: Tools - Add-ons - Plugins - Disable the Uplay and Uplay PC Hub plugins In Opera: Settings - Preferences - Advanced - Downloads - Search "Uplay", delete In Chrome: Enter chrome://plugins/ in the bar and disable To check the vulnerability, visit this page http://pastehtml.com/view/c6gxl1a79.html If your browser is vulnerable, Uplay will start and the Windows Calculator will run. EDIT2: Chrome lists the offending file as the following: C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll location will be different for other people no doubt, but if it doesn't show up in your plugin menus in your browsers, you can double check by searching for that file. REMEMBER: If you don't see Calculator pop up when you click the test link, you're ok! Last edited by 0rpheus; 07-30-12 at 09:55 AM.

07-30-12, 07:18 AM	#3
gap Navy Seal Join Date: Jan 2011 Location: CJ8937 Posts: 8,215 Downloads: 793 Uploads: 10	Thank you both Oberon and 0rpheus for the valuable information!

07-30-12, 09:48 AM	#8
0rpheus Grey Wolf Join Date: Jul 2011 Location: UK Posts: 857 Downloads: 87 Uploads: 3	Hey, look on the bright side - it'll mean a few clean installs, and a whole new wealth of mod-soup posts Post #2 updated with additional info/clearer wording.

07-30-12, 02:58 PM	#11
SilentOtto Engineer Join Date: Mar 2002 Location: BF79 Posts: 209 Downloads: 71 Uploads: 0	Awesome... Security was one of the few ways left, in which uplay was not annoying... yet.

08-04-12, 03:15 PM	#13
Brag Navy Seal Join Date: Nov 2006 Location: Docked on a Russian pond Posts: 7,072 Downloads: 2 Uploads: 0	The horrors of the Ubi DRM will never end, No? __________________ Espionage, adventure, suspense, are just a click away Click here to look inside Brag's book: Amazon.com: Kingmaker: Alexey Braguine: Books Order Kingmaker here: http://www.subsim.com/store.html For Tactics visit:http://www.freewebs.com/kielman/