Feeds

Ubisoft admits major hacking breach, advises password change

Will latest straw make Assassins seek a new Creed?

Internet Security Threat Report 2014

French games publisher Ubisoft has confirmed a major breach of its Uplay servers and the theft of user names, email addresses, and encrypted passwords – although it claims financial data is in a separate silo and looks safe so far.

"We are recommending you to change your password," the company said in a statement. "Out of an abundance of caution, we also recommend that you change your password on any other Web site or service where you use the same or a similar password."

The hacking of the Uplay online gaming database will only increase fears about the system's security. There were persistent reports of users getting their accounts hijacked earlier this year, and Ubisoft users are particularly at risk as many of its most popular games now require an online account and a nearly always-on internet connection.

The company has been one of the prime movers in getting such internet-reliant DRM systems into place – hardly surprising, since Ubisoft's CEO thinks nine out of ten gamers are pirates. The company first trialed an always-on requirement back in 2011, but backed down over user outrage before gradually easing the DRM system back in.

To say users were less than thrilled about the company's fondness for DRM is something of an understatement, particularly after an alert from Google security researcher Travis Ormandy, who revealed that the Uplay system had a suspected rootkit attached. Ubisoft said that in fact this was a coding error and it had a patch out the same day.

To help with this latest security breach, Ubisoft has set up a page to allow for a quick password reset for the Uplay accounts, although some members on its forums report it's crashing under the strain of use. Others are somewhat verbose in expressing their annoyance with the current situation.

"I'm sick of incompetent people holding onto any amount of my data," said one irate user. "I'm sick of them not being held accountable for their incompetence. I'm sick of them passing the buck onto other parties when securing these sorts of things should be routine to anyone responsible for a system like this. Especially at an organization as large as Ubisoft."

All this furor over DRM and security hasn't hurt the game company's bottom line too much – profits were up 73 per cent last year – but gamers are showing an increasing antipathy to games that require an internet connection to function.

The disastrous launch of SimCity online, and the decidedly cool reception of Microsoft's Xbox One's DRM and internet requirements, have focused attention on the issue. As Sony has shown, there's a lot of market share to be gained by not assuming your users are pirates, and if Ubisoft can't protect its servers, it might at least make them optional rather than compulsory. ®

Internet Security Threat Report 2014

More from The Register

next story
George Clooney, WikiLeaks' lawyer wife hand out burner phones to wedding guests
Day 4: 'News'-papers STILL rammed with Clooney nuptials
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.