World of Warcraft's Brand New Rootkit

Captain Kirk writes "We all know that World of Warcraft has checked for hacks to ensure a safe game environment for all players. The latest version of these checks goes beyond anything seen so far in that what is being checked is now completely encrypted. Obviously this hits bot writers as can be seen from these complaints, But it also strikes at the privacy of all users. Now Blizzard has a tool that is encrypted and can run any type of scan, transfer any file or edit any document on your computer. That can't be right."

This is a non-issue, as it stands

Summary of TFA: WoW Warden now selects one of many hash algorithms and uses it in server communication. Blog author gets his panties in a bunch because Blizzard could replace one of these hash algorithms with something that collects PRIVATE PERSONAL DATA, and NO ONE WOULD EVER KNOW. A misleading Slashdot headline and poorly-written blurb is generated, and the rest is academic.

Re:This is a non-issue, as it stands

Couldn't someone who's not Blizzard, but sufficiently clever replace the algorithm with such a mal-gorithm as well?

Re:This is a non-issue, as it stands

Smart people don't just throw caution to the wind and say "well, they already have avenues of attack, so I just won't prevent new ones from springing up".

Ah... no.

No one is saying that. What we're saying is that Warden (what a horrible choice for a name) is that, in response to one specific "what if" question about some third party with access to your machine making Warden do something naughty, "if they have access to your machine, then the fact that they can modify Warden to do something naughty is moot... they can modify ANY program on your system to do something naughty."

Your straw man needs to go see the Wizard....

Re:This is a non-issue, as it stands

Jenna: That's one way to become a hunted man: trust the powerful.

Yeah man, Trust No One! They could give up on profits and become a tool of the man. I'm not sure companies are really in it for profits anyways. There must be a secret, sinister reason they do things. They can't be just in it for the money. And even if they were, I'm sure they'd roll right over to whatever government offered them enough money to offset the $135 Million+ they collect every month in fees from their customers. I'm sure they'd risk a mass exodus from their game because they could make a couple more bucks on the side selling information.

Grow up, nincompoop. BTW, quoting lame science fiction != solidly prepared argument.

Re:This is a non-issue, as it stands

I am not forgetting the polymorphic nature of Warden; I just don't give a shit. There are plenty of polymorphic programs around, and if a haxor wants to use one to house his malicious code, he's got a bunch of skeletons to choose from (like the Sony rootkit, for example).

Since you mention a fear of such things, I would like to remind you that WoW itself runs with high privileges and receives commands from the Internet. I'd be a lot more afraid of Windows Update pulling crazy shit than WoW Warden.

Re:This is a non-issue, as it stands

The article is absolutely retarded. It never ceases to amuse me when such grandiose claims are made about customers etc... Of the 7 million WOW account holders, I would bet that 6.999 million don't even know about Warden. And I'd bet that same number, if you made them aware, still wouldn't give a toss. He's probably just a disgruntled bot author, dressing up his complaints in the guise of the public service. I can understand being paranoid to a degree, but this is just ridiculous. The author clearly has delusions of grandeur, and ideas far FAR above his station.

This articles headline is INCREDIBLY misleading, and whoever wrote it needs a slap for their melodramatic endeavours.

Re:This is a non-issue, as it stands

Of the 7 million WOW account holders, I would bet that 6.999 million don't even know about Warden.

Yep. That's me.

And I'd bet that same number, if you made them aware, still wouldn't give a toss.

Yep. That's me too.

The thing is, since starting to play WoW my life has descended into a meaningless treadmill of levelling and grinding. There's no longer anything of interest about me that's worth stealing.

Recommendation for online gaming

1 computer for gaming
1 computer for everything else

Sorry if you can't afford a second, but that's how I do it.

Re:Recommendation for online gaming

wow works great in Wine.

use a very restricted account when running it in wine. Problem solved.

Re:Recommendation for online gaming

Belches a few times and then passes out. There are still some compatibility bugs to work through.

Re:Recommendation for online gaming

But how would I make gold from selling clam meat then?

Re:Recommendation for online gaming

Become a pimp?

Re:Recommendation for online gaming

That's probably the best option. I'm a strong advocate of privacy myself, but I don't see Blizzard's actions as being particularly unreasonable. You aren't being compelled to play the game, and it's up to each individual to decide how much they trust Blizzard with this. If you don't trust them, don't play. It's quite common for people to be asked to reveal personal information in a voluntary exchange (like when you apply for a job or a bank account) and there is always the possibility that this information could be misused or abused, or that the power you give another person to access such information could be misused or abused. But these types of transactions are always voluntary, and it's really a case of caveat emptor. If you don't trust the company, then don't give them your money and your privacy will remain intact.

Having said that, people like the author of TFA are free to object to Blizzard's policy and to attempt to persuade them to change it (like they did with the issue of gay-friendly guilds a while back). If it annoys enough of the playerbase, then it will go.

I'm a recovering WoWaholic myself, and although I loved the game, the one thing that really bothered me (other than warlocks) was cheaters. I worked hard at the game, spent a lot of time grinding and crafting, and spent inordinate amounts of time learning the game and getting to know good people so that I could join a decent guild and progress. If cheating isn't aggressively policed, it ruins the sense of achievement for legitimate players by allowing others to free ride. I'd personally be willing to risk it to have less cheaters in the game, but YMMV.

"That can't be right."

Then don't play. It really IS that simple. If you're having too big of a problem with that, put the mouse down and go join a support group.

Re:Or...

> why not organize and complain to Blizzard?

Players: "Blizzard, your malware sucks, and you suck for using it!"

Blizzard: "What? Sorry, these piles of money you keep forking over to us every month kind of muffle the sound in here."

Re:Or...

I don't play WOW, I don't get why people are obsessed with it, and that has absolutely nothing to do with the point, which is this:

1. Many people like playing WOW. It brings them happiness to play it.

2. The provider of WOW has instituted a policy that is objectionable.

There is no reason on God's Green Earth why 1 and 2 above need inevitably lead to:

3. Therefore people should give up WOW that brings them happiness because there is a problem with how it is provided.

Because, frankly, that's just stupid. Less extreme measures should be tried first, like salvaging that which is valuable by attempting to change that which is objectionable. Cutting your losses and running is, if ever, a last resort when attempts to fix the problem have utterly failed. Now, this is "just a game", and so it is reasonable for people to only put as much effort into salvaging it as pleasure they get out of it; it's not like fighting for your rights or anything. I just have a really hard time comprehending the general attitude around here being that as soon as someone (esp. a corporate entity) does something to find questionable that the only response is immediate and extreme measures(tm). Human beings who do care, if even fleetingly, about things other than money run these companies; they want people to enjoy their products, and would be fools not to listen to valid concerns even if only for self-interested reasons.

Re:Or...

This was from my post:

Now, this is "just a game", and so it is reasonable for people to only put as much effort into salvaging it as pleasure they get out of it; it's not like fighting for your rights or anything. I just have a really hard time comprehending the general attitude around here...

And this was from yours:

This is a video game. Finding another MMO to take up your excess time is a matter of $50 at worst, since just about all of them worth playing give free trial periods. Your friends that you met in WoW will still be your friends when you stop playing if they are real friends and not merely aquaintances. There is such a thing as instance messenger and voice chat. Gain some perspective.

I've got perspective (tm). It is only a game, and as such, like I said, people who have a problem with how it is provided should raise a stink only so far as the enjoyment they get from the game is worth it to them. Since, after all, it is their money, and not yours or mine. Me, I prefer to read books, watch movies, chat (in meatspace) with friends, and post to /. for my entertainment. That's what brings me enjoyment. These folks, who like WOW, like other things than I do and spend money in ways consummate with that enjoyment. If one were to look at the publishing industry with a magnifying glass, one would see all sorts of hideous warts; the way they treat most authors is abominable, their editorial policies are groupthink L.C.D. crap, etc. etc.. And yet, I think it would be plainly idiotic to suggest to a person that they should just stop reading books because there are problems with the way books are provided as a product. There are other, better ways. They are harder, less self-satisfyingly smug, and not always successful. And yet, they are the ways that actually make things better, as opposed to the prevailing message which seems only to suggest that one try to insulate oneself from the world as it goes to shit around you.

Look, the way in which people think and how they act when it comes to trivial matters reflects very well how they tend to react to important ones. People whose first reaction is cut and run from every negative thing tend to do so not just in MMO-land but also in politics. People complain a great deal about political apathy, but apathy comes from the mindset that the other methods I have been speaking about (e.g. organize, petition, complain) are ineffective and are thus never tried. Of course they fail; nobody does them. In many cases, they've forgotten how. The mindset here reflects the mindset in the wider landscape, and so if you think I fail to have perspective because it's "just a game", that may be because this attitude is corrosive wherever it appears and I find that way of thinking to be destructive in areas of life where it matters a damn well lot.

Re:"That can't be right."

A strange game. The only winning move is not to play.
 

Unbelivable

If i had a WoW account i would be cancelling it this second, no videogame has the right to violate the privacy of my computer

Re:Unbelivable

I canceled when they started adding things to their detection kit. When I saw it reading registry keys (regmon) it had NO business reading, I canceled. Did it need to read the activation keys for Windows? Absolutely not.

Re:Unbelivable

I canceled when they started adding things to their detection kit. When I saw it reading registry keys (regmon) it had NO business reading, I canceled. Did it need to read the activation keys for Windows? Absolutely not.

I'm sorry to hear that.

Out of curiosity, how would you go about detecting keyloggers and/or bots without reading the registry? Or do you just feel that Blizzard shouldn't attempt to detect abuse? Myself, I'm a player and I WANT Blizzard to look for such abuse. If someone finds that Blizzard's bot is doing something that's actually wrong (e.g. sending personal data back to home base, not just reading the registry), then I'll be the first to pressure them to fix it. However, if they're just scanning for malicious software that doesn't actually seem like a problem.

It is CERTAINLY not a rootkit according to any definition I've ever heard.

Re:Unbelivable

He said activation keys for windows, so if the detection kit was really reading those then that's bad.

Anyway why would a bot or keylogger need to write to the registry?

Would be good if you could restrict the user account you use to run wow to only talking to blizzards IP range and local IP.

Re:Unbelivable

Well, they could use a better design.
This whole problem is cause because gold is so important to the game.

They could minimize these problems with a number of basic fixes.
1) Don't allow the AH to sell anything for more then 5 times the vendor cost.

Which results in artificial control of the market, which primarily impacts those who don't have enough gold to exploit the system, and results in anything that's unreasonably capped being sold player-to-player outside the auction house. Turns out economies (virtual or not) are quite resilient to this kind of ham-handed attempt at control.

2) Lower the cost of items. How you can charge 5000 Gold to learn to use a mount and not expect a spike in Gold selling and farming is beyond me.

Actually, they did the reverse, and it's worked VERY well. The only people buying gold now are typically the newbies who need 10-100 gold to get started. 5000g costs an astronomical amount of money because it takes so long for a low-level player to get.

It's a root kit in that it can gain access to anything on your computer and send it to Blizzard.

So can the World of Warcraft game itself. That's a rootkit too? Oh PS: rootkit != any invasion of privacy. Rootkits are specifically those programs that subvert the security of your system. This simply doesn't do that.

To trust warden is to trust that:
they will never hire a bad dishonest employee,

You can replace "warden" in that sentence with the name of any software you've ever run.

Re:Unbelivable

I can't believe I'm forgoing a full complement of mod points to respond to you, but I get tired of seeing people go ape-shit whenever they use tools like regmon and filemon without having clue one as to what they're seeing.

Pretty much any program will make tons of accesses to registry keys that would at first glance appear to have nothing to do with that program, because the program loads a bunch of Windows libraries that access those registry keys whenever they're loaded. The same goes for IE cookies, for any program that uses the IE rendering libraries to render HTML (including things like the frontend patchers for games like EverQuest), because those libraries go through your cookies just the same as IE does when it first loads.

Sorry that you felt it necessary to cancel your WoW account because you didn't understand how your computer works, but at least it gives you a lot more spare time for making tin-foil hats.

Re:Unbelivable

If you had a WoW account, you would already voluntarily have given Blizzard your full name, snail address, email address, and credit card number.

when I was playing wow I used prepaid game cards exactly for this reason... or aren't prepaid cards available anymore?

Privacy?

You've already given up your life when you start playing WoW. What do you have to keep private?

Re:Draconian EULA

And all Sony did was install a program on their music CDs that ensured someone had a legit copy of the CD (copyright infringement is a HUGE problem with IP).

(waves magic wand) Reducto ad absurdum!

Re:What is worse?

Steam games have "Valve Anti-Cheat" (VAC), which is similar in principle to the Blizzard Warden. Other games use Punkbuster, which uses the same strategy to detect cheats. All of these programs scan your machine's memory and look for the signatures of known cheats. The mechanism used to carry out the scanning and report the results is deliberately obfuscated to make it difficult to reverse engineer the process and send fake results. All three of these programs are spyware. But you agree to the use of each within the EULA of whatever game you are playing.

Warden has always had the ability to be updated with arbitrary code as you play. The observations of this article are nothing new: Blizzard has always been able to access files on your computer, just by sending the appropriate program to Warden. It seems that they have recently been sending more complex programs, generated for each client, so the current generation of programs that spy on Warden no longer work. The arms race continues.

Re:Wine?

Works fine under Wine, which is how I play. This just goes to show you it really isn't a rootkit despite what the sensational headlines are claiming. Yes it peaks at the registry, and the process list and the window list. It's looking for key loggers and bot software. These things hide themselves well so there is no way to find them without doing some semi-invasive digging around.

I suspect a lot of the fuss over this is coming indirectly from the writers of bot software and from the gold farmers...and they can go to hell for all I care. First they started spamming people in-game with constant ads for gold and power leveling, and then when Blizz implemented anti-spam filtering they started creating dozens of level 1 trial characters and randomly inviting people to party, hoping you'll accept so that they can talk to you in party chat and bypass the spam filters. It's annoying as hell.

Define rootkit

So, now a "rootkit" is any program that