If you've ever signed up for a Uplay account, your information could now be in the hands of criminals. Ubisoft's confirmed that a security breach at one of its sites, now closed, has granted hackers access to sensitive user data (i.e., usernames, emails and passwords). Critically, no actual financial information was leaked, owing to the fact that Ubisoft doesn't retain personal credit or debit card account numbers on its servers. Regardless, the Assassin's Creed developer is taking proactive measures, contacting account holders directly and strongly advising them to update any related passwords. You can find the full email just after the break.
when.eng("eng.perm.init")
Dear Member,
We recently found that one of our Web sites was exploited to gain unauthorized access to some of our online systems. We instantly took steps to close off this access, investigate the incident and begin restoring the integrity of any compromised systems.
During this process, we learned that data had been illegally accessed from our account database, including user names, email addresses and encrypted passwords. Please note that no personal payment information is stored with Ubisoft, meaning your debit/credit card information was safe from this intrusion.
Out of an abundance of caution, we also recommend that you change your password on any other Web site or service where you use the same or a similar password.
You can find more information here https://support.ubi.com/en-US/FAQ.aspx?platformid=60&brandid=2030&productid=3888&faqid=kA030000000eYZ2CAM.
For any additional support enquiries, please contact our customer service via our support web site at https://support.ubi.com
We sincerely apologize to all of you for the inconvenience. Please rest assured that your security remains our priority.
The Ubisoft team
Anyone who's tried to tether to their iPhone or iPad will recall how iOS manages to craft its own passwords when used as a personal hotspot. The aim is to ensure that anyone sharing a data connection will get some degree of security, regardless of whether or not they tinker with the password themselves. However, three researchers from FAU in Germany have now worked the structure behind these auto-generated keys -- a combination of a short English word and a series or random numbers -- and managed to crack that hotspot protection in under a minute. To start, the word list contains about 52,500 entries, and once the testers were able to capture a WiFi connection, they used an AMD Radeon HD 6990 GPU to cycle through all those words with number codes, taking just under 50 minutes to crack with rote entry. Following that, they realized that only a small subset (just 1,842) of the word list was being used.With an even faster GPU -- a cluster of four AMD Radeon HD 7970s -- they got the hotspot password cracking time to 50 seconds. The Friedrich-Alexander University researchers added that unscrupulous types could use comparable processing power through cloud computing. "System-generated passwords should be reasonably long, and should use a reasonably large character set. Consequently, hotspot passwords should be composed of completely random sequences of letters, numbers, and special characters," says the report, which outlines the trade-off between security and usability. However, as ZDNet notes, Apple's cycled password approach still offers more protection than static options found elsewhere. Check out the full paper at the source. when.eng("eng.perm.init")