Mario's World Forums

This is a public warning to anyone that has the PC game Need For Speed: Undercover from Electronic Arts. Be aware that your unique CD key used to activate the game online, is stored in plain view and unencrypted in the save file for this game. This may not matter to most users, but if you upload your save file for others to use, your activation CD key is at severe risk. In my view this is yet another major snafu from Electronic Arts. Uploading or exchanging saved game files is normal and not unusual. Having the unique activation CD key stored in a save file on the other hand is. In fact I don't ever recall seeing or hearing about any PC game storing the unique activation CD key or serial number in the saved game(s) file. And even if this may have happened previously, that serial would not have made it possible for others to use your key to activate a copy of said game - since activating games online is a fairly new phenomenon - one that EA has embraced wholeheartedly. To give you an example how this could so easily be exploited, imagine that a user uploads their NFSU save game file after they finish the game - so that others can use it to load a completed game with all the cars and everything else unlocked. Then an unsavory character extracts said activation CD key and uploads it to a torrent site for all to see - and use. Once public, that poor sap's "unique" activation CD key would be unique no more. Assuming that the genuine owner activated the game once, that would leave him four activations. Would you care to guess how long those activations would last once on a torrent site ? Probably less then five minutes. The activation CD key doesn't have to be made public either, that was just an example where his key would be used up within minutes. Anyone could use this method to try and get unused NFSU activation CD keys that could still be used for activation - even if only once. In fact, I wouldn't have a problem doing this myself. If Electronic Arts chooses to embed this important key into a file that has a valid reason to be shared publicly, then so shall they or the end users reap the rewards. People use other people's save game files for many legitimate reasons like getting past a point in a game that they got stuck at, or to get in-game items or levels already unlocked by other players. There are hundreds of sites, including major ones like the Planet series (including several Need For Speed ones) that host and encourage the use of other people's saved games. It's something that PC user's have done since the dawn of gaming. Never has this practice been put at risk by such a stupid reason. In conclusion, sharing your NFSU save file exposes your unique activation CD key to the world, basically assuring that all your activations are used up within minutes, and additionally - no doubt - causing EA to ban your key as well. Even if this will not become normal practice, it's just another genuine reason to really dislike online activation. Need For Speed: Undercover uses SecuROM's online activation DRM scheme.

Here's a view of the save file with the unique activation CD key clearly visible.
(Except that I obfuscated my key for obvious reasons.)




Here is one that is already floating around on the net. It's possible that this one was made using a keygen.

And just to reiterate. Serial numbers or CD keys for games are normally placed in the Windows Registry, or another file other than the save game file. As an additional security measure it is often encrypted or at least obfuscated in some way. What we have here is not an issue where someone tries to fish out your serial from the registry or by tricking you in some way to release it or by using key loggers or whatever else. Anyone who gets your save game file also gets your unique activation key. So if you finished the game and are reading a post on a forum where someone requests somebody's save file so that they don't have to play the whole game to unlock the unlockables, and you're entertaining the idea of helping them by uploading your save, think again. And of course the activation CD key is stored in the file as soon as it's created, you don't have to actually finish the game, it's just that normally people want someone's save file after they have completed the game so that everything is unlocked.

Conclusion:
If somebody has your older NFS CD keys, the worst that could happen is that you may not be able to play online, or that you may compromise your EA account. If somebody has your NFSU CD key on the other hand, they can use up your activations in no time. That will in turn cripple your game - the next time you require to activate the game, it will inform you that you have exceeded the number of activations available. You may be able to convince an EA representative to give you a new activation, but you would have to do this again in the future - and keep explaining the reason. If the CD key gets posted publicly, you can pretty much assure that it would be used, or attempted to be used, hundreds of times - guaranteeing that it would be banned and blacklisted forever.