This is a public warning to anyone that has the PC game Need For Speed: Undercover from Electronic Arts. Be aware that your unique CD key used to activate the game online, is stored in plain view and unencrypted in the save file for this game. This may not matter to most users, but if you upload your save file for others to use, your activation CD key is at severe risk. In my view this is yet another major snafu from Electronic Arts. Uploading or exchanging saved game files is normal and not unusual. Having the unique activation CD key stored in a save file on the other hand is. In fact I don't ever recall seeing or hearing about any PC game storing the unique activation CD key or serial number in the saved game(s) file. And even if this may have happened previously, that serial would not have made it possible for others to use your key to activate a copy of said game - since activating games online is a fairly new phenomenon - one that EA has embraced wholeheartedly. To give you an example how this could so easily be exploited, imagine that a user uploads their NFSU save game file after they finish the game - so that others can use it to load a completed game with all the cars and everything else unlocked. Then an unsavory character extracts said activation CD key and uploads it to a torrent site for all to see - and use. Once public, that poor sap's "unique" activation CD key would be unique no more. Assuming that the genuine owner activated the game once, that would leave him four activations. Would you care to guess how long those activations would last once on a torrent site ? Probably less then five minutes. The activation CD key doesn't have to be made public either, that was just an example where his key would be used up within minutes. Anyone could use this method to try and get unused NFSU activation CD keys that could still be used for activation - even if only once. In fact, I wouldn't have a problem doing this myself. If Electronic Arts chooses to embed this important key into a file that has a valid reason to be shared publicly, then so shall they or the end users reap the rewards. People use other people's save game files for many legitimate reasons like getting past a point in a game that they got stuck at, or to get in-game items or levels already unlocked by other players. There are hundreds of sites, including major ones like the Planet series (including several Need For Speed ones) that host and encourage the use of other people's saved games. It's something that PC user's have done since the dawn of gaming. Never has this practice been put at risk by such a stupid reason. In conclusion, sharing your NFSU save file exposes your unique activation CD key to the world, basically assuring that all your activations are used up within minutes, and additionally - no doubt - causing EA to ban your key as well. Even if this will not become normal practice, it's just another genuine reason to really dislike online activation. Need For Speed: Undercover uses SecuROM's online activation DRM scheme.
Here's a view of the save file with the unique activation CD key clearly visible.
(Except that I obfuscated my key for obvious reasons.)
Here is one that is already floating around on the net. It's possible that this one was made using a keygen.
And just to reiterate. Serial numbers or CD keys for games are normally placed in the Windows Registry, or another file