World of Warcraft's Brand New Rootkit 576
Captain Kirk writes "We all know that World of Warcraft has checked for hacks to ensure a safe game environment for all players. The latest version of these checks goes beyond anything seen so far in that what is being checked is now completely encrypted. Obviously this hits bot writers as can be seen from these complaints, But it also strikes at the privacy of all users. Now Blizzard has a tool that is encrypted and can run any type of scan, transfer any file or edit any document on your computer. That can't be right."
Recommendation for online gaming (Score:5, Insightful)
1 computer for everything else
Sorry if you can't afford a second, but that's how I do it.
"That can't be right." (Score:5, Insightful)
Unbelivable (Score:4, Insightful)
Then don't play (Score:2, Insightful)
This is a non-issue, as it stands (Score:5, Insightful)
Define rootkit (Score:5, Insightful)
I thought a rootkit was a program designed to take control of a system remotely or offer access to that system? This is just an obfuscated program (encrypted is a bit strong for something that is "decrypted" on your own system where you can watch its behavior).
Seriously, if this is the worst that Blizzard does, I'm a happy camper. They really do have serious problems with their users being exploited, and detecting these problems early is all good. In my case, they'll see everything that's in my virtual Windows environment under Wine.
Now, if someone proves that they're reading personal files out side of the Windows system directory or the WoW installation, then we can talk. Until then, this is a non-issue.
How is this a root kit? (Score:5, Insightful)
Re:Draconian EULA (Score:3, Insightful)
They are an internationally-known company bringing in millions of dollars a month from the most popular online game in the world. I'm sure they pay attention to what is and isn't in their agreements.
A bit sensationalistic (Score:5, Insightful)
The likely hood of Blizzard hacking or stealing personal data is very small. They know that they could lose their cash cow by doing anything malicious with this information/software.
For those that fear credit card and personal information being lifted, I'm a little baffled. When you sign up for an account you enter most of the same personal info that is going to be on your PC anyway, and unless you are using game cards they already have at least one of your credit cards on file. All information that subscribers gave up willingly.
That aside, I did read the article and find the technology fascinating.
Re:Recommendation for online gaming (Score:1, Insightful)
Re:Call me a fool but... (Score:3, Insightful)
Yeah...it's this type of reasoning that lets the US government get away with wire-tapping w/out a warrant and other similar privacy violating activities.
Re:Draconian EULA (Score:2, Insightful)
Re:This is a non-issue, as it stands (Score:4, Insightful)
And all because they pooched their architecture (Score:5, Insightful)
If you start your architectural design from the assumption that the client is a malicious bot, then you can design out vulnerability. Blizzard chose not to do that. They thought that they could enforce trust on the client side, and let clients make decisions about (oh, just for example) player position. Well, that makes them idiots. Idiot savants, maybe, but idiots none-the-less.
The client cannot be trusted. Clients request, servers decide and dictate. Let the client anticipate and drift its local world state all you like, but the server must never, ever, accept a state change from the client, only requests. That's the way it has to be, unless you - demonstrably - want to play catchup for ever and a day. And if you get caught in that hole, then you need a spade the size of WOW's playerbase and Blizzard's resources in order to keep digging it deeper.
Duh... what's new? (Score:5, Insightful)
You do realize that *any* software you install on your computer can do this? Unless you have read the full source code and compiled it yourself (Ignoring the possibility of a trojan'd compiler) there is a possibility that a program could do these things. So what's new?
Re:Recommendation for online gaming (Score:2, Insightful)
So nope - must effectively have a second machine via HD hotswap/disable features. Then again, if a game is this invasive, I wouldn't touch it with a 10 foot pole.
Blizzard, their TOS, and you. (Score:5, Insightful)
They clearly state in their TOS that they do this (Section 14)
http://www.worldofwarcraft.com/legal/termsofuse.html [worldofwarcraft.com]
Don't like it? Don't play the game. Very simple.
And in fact, when you first sign up for an account, Blizzard gives you 30 days to return the game for a *full refund* if you don't agree to the TOS and don't wish to play. That seems pretty fair IMHO, and far more than most game companies will do.
- Roach
Re:Recommendation for online gaming (Score:3, Insightful)
Re:"That can't be right." (Score:3, Insightful)
b) This is exactly right. I don't have a problem with this personally, but I'm sure other people do, and the proper solution for them is to not play. By not playing (and letting Blizzard know why), you send a message to them that their behavior isn't acceptable to you, and, if enough people are upset about this, they'll do something about it. Complaining to Blizzard won't change anything, you need to take action.
Re:A bit sensationalistic (Score:3, Insightful)
Privacy (Score:4, Insightful)
I simply do not understand some of the people's comments on this matter. "I feel more secure with this" isn't a very good argument. Games have bugs: if a game can access and modify your entire system, a bug exposing this would be very dangerous.
Game developers have no right whatsoever to delve into your personal assets no matter what the intent might be. There are various examples known world wide such as in Argentina (1980's) when all of the communications were monitored by the government to "capture the terrorists." Hackers and cheaters are not even remotely in that realm, so my computer which holds very confidential information should not be monitored. (Though it might make an interesting paper comparing hackers to terrorists)
When I drive on the South Florida roads I am constantly monitored by cameras at each stoplight, I don't particularly would like to be monitored in my own home where I still have the illusion of privacy. However naive that might sound.
Re:Or... (Score:3, Insightful)
It's hard not to be quite so cynical these days, but there is little call for it here. Sure companies like money, but the smart ones don't go about strangling the geese that lay their golden eggs. WOW won't last forever; it will soon enough look butt-ugly and lacking in interactivity when the next generation of MMOs arrive, as is the way of all software games development. When that happens, keeping its current customer base happy and making them feel they can trust Blizzard is huge in getting the next such offering onto the market. Burning those customers and ignoring those concerns would be monumentally stupid, given that fact.
As I understand it, what Blizzard is doing now (albeit misguided) is in response to people complaining about cheats and bots that ruin the game experience for them. That is, plainly, evidence that Blizzard doesn't just care about the bottom line to the exclusion of the preferences and complaints of the customers. I imagine that if as many people complained about this rootkit-esque fix as complain about the problem it was intended to solve, Blizzard would respond accordingly.
Re:Draconian EULA (Score:5, Insightful)
(waves magic wand) Reducto ad absurdum!
Oh noes! (Score:3, Insightful)
If you don't trust Blizzard, why did you install the game? Why did you give them your credit card number?
But I love this stuff. It means my non-technical guildies are less likely to be exploited, it means the gold farmers have it that much harder, and drives away the vocal, whiny morons, who are likely the same vocal, whiny morons in the game.
Re:Unbelivable (Score:5, Insightful)
Anyway why would a bot or keylogger need to write to the registry?
Would be good if you could restrict the user account you use to run wow to only talking to blizzards IP range and local IP.
Re:Wine? (Score:4, Insightful)
I suspect a lot of the fuss over this is coming indirectly from the writers of bot software and from the gold farmers...and they can go to hell for all I care. First they started spamming people in-game with constant ads for gold and power leveling, and then when Blizz implemented anti-spam filtering they started creating dozens of level 1 trial characters and randomly inviting people to party, hoping you'll accept so that they can talk to you in party chat and bypass the spam filters. It's annoying as hell.
Re:Unbelivable (Score:2, Insightful)
This whole problem is cause because gold is so important to the game.
They could minimize these problems with a number of basic fixes.
1) Don't allow the AH to sell anything for more then 5 times the vendor cost.
2) Lower the cost of items. How you can charge 5000 Gold to learn to use a mount and not expect a spike in Gold selling and farming is beyond me.
It's a root kit in that it can gain access to anything on your computer and send it to Blizzard. i.e. it has root to your system. Root kits don't have to be hidden.
To trust warden is to trust that:
they will never hire a bad dishonest employee,
never hire someone with an alternative motive. Like if a memeber of Scientology was asked to get information for there religion.
never be asked by a police agency to scan your system,
and for the program to be bug free and not exploitable in any way by anyone else.
Now that it's encrypted, you have no idea what they are sending.
Re:Or... (Score:5, Insightful)
I don't play WOW, I don't get why people are obsessed with it, and that has absolutely nothing to do with the point, which is this:
1. Many people like playing WOW. It brings them happiness to play it.
2. The provider of WOW has instituted a policy that is objectionable.
There is no reason on God's Green Earth why 1 and 2 above need inevitably lead to:
3. Therefore people should give up WOW that brings them happiness because there is a problem with how it is provided.
Because, frankly, that's just stupid. Less extreme measures should be tried first, like salvaging that which is valuable by attempting to change that which is objectionable. Cutting your losses and running is, if ever, a last resort when attempts to fix the problem have utterly failed. Now, this is "just a game", and so it is reasonable for people to only put as much effort into salvaging it as pleasure they get out of it; it's not like fighting for your rights or anything. I just have a really hard time comprehending the general attitude around here being that as soon as someone (esp. a corporate entity) does something to find questionable that the only response is immediate and extreme measures(tm). Human beings who do care, if even fleetingly, about things other than money run these companies; they want people to enjoy their products, and would be fools not to listen to valid concerns even if only for self-interested reasons.
Re:Recommendation for online gaming (Score:3, Insightful)
Re:Unbelivable (Score:5, Insightful)
Pretty much any program will make tons of accesses to registry keys that would at first glance appear to have nothing to do with that program, because the program loads a bunch of Windows libraries that access those registry keys whenever they're loaded. The same goes for IE cookies, for any program that uses the IE rendering libraries to render HTML (including things like the frontend patchers for games like EverQuest), because those libraries go through your cookies just the same as IE does when it first loads.
Sorry that you felt it necessary to cancel your WoW account because you didn't understand how your computer works, but at least it gives you a lot more spare time for making tin-foil hats.
Maybe I'm missing the point (Score:3, Insightful)
But, apparently, installing four CDs full of unsigned, unaudited third party code which can do anything on your computer is okay. And having third party software which is in constant communication with its authors is okay. And having it download and execute new code every Tuesday, with or without your approval, is okay.
It's only _now_ that it's becoming a problem?
If you don't trust Blizzard, don't buy their software and don't install it on your PC. How hard is that?
Re:This is a non-issue, as it stands (Score:2, Insightful)
Re:This is a non-issue, as it stands (Score:5, Insightful)
This articles headline is INCREDIBLY misleading, and whoever wrote it needs a slap for their melodramatic endeavours.
Re:Unbelivable (Score:5, Insightful)
This whole problem is cause because gold is so important to the game.
They could minimize these problems with a number of basic fixes.
1) Don't allow the AH to sell anything for more then 5 times the vendor cost.
they will never hire a bad dishonest employee,
Re:Recommendation for online gaming (Score:5, Insightful)
Having said that, people like the author of TFA are free to object to Blizzard's policy and to attempt to persuade them to change it (like they did with the issue of gay-friendly guilds a while back). If it annoys enough of the playerbase, then it will go.
I'm a recovering WoWaholic myself, and although I loved the game, the one thing that really bothered me (other than warlocks) was cheaters. I worked hard at the game, spent a lot of time grinding and crafting, and spent inordinate amounts of time learning the game and getting to know good people so that I could join a decent guild and progress. If cheating isn't aggressively policed, it ruins the sense of achievement for legitimate players by allowing others to free ride. I'd personally be willing to risk it to have less cheaters in the game, but YMMV.
Re:Duh... what's new? (Score:1, Insightful)
>You do realize that *any* software you install on your computer can do this?
On YOUR computer, probably yes. On MY - hell no. That's what filesystem ACLs and different user accounts are for. Lemme guess, do you use Weendows and Administrator privileges? Ouch, sucks to be you, then.
Re:This is a non-issue, as it stands (Score:5, Insightful)
Since you mention a fear of such things, I would like to remind you that WoW itself runs with high privileges and receives commands from the Internet. I'd be a lot more afraid of Windows Update pulling crazy shit than WoW Warden.
Re:Recommendation for online gaming (Score:3, Insightful)
1 ACCOUNT for everything else
Sorry if you don't have protected memory and proper permission set up.
Re:Or... (Score:5, Insightful)
This was from my post:
Now, this is "just a game", and so it is reasonable for people to only put as much effort into salvaging it as pleasure they get out of it; it's not like fighting for your rights or anything. I just have a really hard time comprehending the general attitude around here...
And this was from yours:
This is a video game. Finding another MMO to take up your excess time is a matter of $50 at worst, since just about all of them worth playing give free trial periods. Your friends that you met in WoW will still be your friends when you stop playing if they are real friends and not merely aquaintances. There is such a thing as instance messenger and voice chat. Gain some perspective.
I've got perspective (tm). It is only a game, and as such, like I said, people who have a problem with how it is provided should raise a stink only so far as the enjoyment they get from the game is worth it to them. Since, after all, it is their money, and not yours or mine. Me, I prefer to read books, watch movies, chat (in meatspace) with friends, and post to /. for my entertainment. That's what brings me enjoyment. These folks, who like WOW, like other things than I do and spend money in ways consummate with that enjoyment. If one were to look at the publishing industry with a magnifying glass, one would see all sorts of hideous warts; the way they treat most authors is abominable, their editorial policies are groupthink L.C.D. crap, etc. etc.. And yet, I think it would be plainly idiotic to suggest to a person that they should just stop reading books because there are problems with the way books are provided as a product. There are other, better ways. They are harder, less self-satisfyingly smug, and not always successful. And yet, they are the ways that actually make things better, as opposed to the prevailing message which seems only to suggest that one try to insulate oneself from the world as it goes to shit around you.
Look, the way in which people think and how they act when it comes to trivial matters reflects very well how they tend to react to important ones. People whose first reaction is cut and run from every negative thing tend to do so not just in MMO-land but also in politics. People complain a great deal about political apathy, but apathy comes from the mindset that the other methods I have been speaking about (e.g. organize, petition, complain) are ineffective and are thus never tried. Of course they fail; nobody does them. In many cases, they've forgotten how. The mindset here reflects the mindset in the wider landscape, and so if you think I fail to have perspective because it's "just a game", that may be because this attitude is corrosive wherever it appears and I find that way of thinking to be destructive in areas of life where it matters a damn well lot.
Re:This is a non-issue, as it stands (Score:3, Insightful)
Multitasking has its pitfalls. When are people going to learn not try try to do EVERYTHING on just ONE computer.
Re:Recommendation for online gaming (Score:1, Insightful)
Not a rootkit. (Score:3, Insightful)
1. Hides itself from the user.
2. Remains on the system even after World of Warcraft is uninstalled.
So while privacy concerns may be valid, I don't see how this is a "rootkit."
Re:Blizzard, their TOS, and you. (Score:3, Insightful)
And the original TOS says they can change it at any time.
If you're a paranoid git, that's the time to request your refund.
If, on the other hand, you realize that any process running on your machine (with sufficient user rights and can access the internet) can steal your precious information and that WoW actually isn't, you can happily go on playing.
Anyone that paranoid shouldn't have a lick of "sensative information" on a general use machine hooked to the internet, especially if the OS is windows.
And if you really are a paranoid git
- Roach
Re:And all because they pooched their architecture (Score:2, Insightful)
Unfounded paranoia (Score:4, Insightful)
As a very casual WoW player (I only have 1 level 70 main toon and I only just started raiding Karazhan), I'm glad that Blizzard is doing what they can to combat botting. On another toon of mine I just got into a guild where one of the guys was talking about how his friend had botted 75,000 honor during AV weekend. That pretty much pissed me off. I don't care too much because I'm not playing the game in any sort of competitive manner, but it kind of irks me.
I'd really like to see something like Warden being used to combat the problem of aimbots and wallhacks in FPS games. I stopped playing FPS games all together because of that issue.
Re:This is a non-issue, as it stands (Score:3, Insightful)
The whole point of ever faster and more powerfully robust computers is that you *can* multitask, or would you have us just return to the command prompt days. Or you could buy a console that has no other purpose than videogaming.
Regardless, people should be able to expect some level of privacy, as their computers reside within their homes, and I don't allow guests in my home to look in whatever closet they like, or just run my vacuum cleaner, read my mail, test my security system or turn up/down the air-conditioning at whim; I don't even let people in my home that I would vaguely suspect of doing such things, and I should be able to expect a similar level of civility from the people who make programs that they want me to pay them to use. They DAMN sure don't get an alarm code to my security system to just let themselves come and go at their whim, nor a camera to see what I'm doing just to make sure I'm not doing something they don't care for; when I leave my house and go over to THEIR home (i.e. log in to the game) then they are more than welcome to monitor what I do in THEIR home or place of business, but otherwise, all bets are off. I play PC games because they are so often superior to console games, but that doesn't mean I should have to give away control of my expensive gaming machine to play them, nor does it mean I should have to spend thousands of dollars in other computers just so one theoretically legit program can't take control of it. Just because I go play paintball at your place of business doesn't mean you get to put camera's in my home to make sure I didn't crank the PSI on my paintball guns above acceptable levels or freeze my paintballs - you discover those things via due diligence AT the painball place, and you kick the ass of anyone found cheating such a way, before you kick them out.
Re:This is a non-issue, as it stands (Score:3, Insightful)
Post a fake game update, there are many other avenues of attack if you can reach this point.
Re:This is a non-issue, as it stands (Score:5, Insightful)
Grow up, nincompoop. BTW, quoting lame science fiction != solidly prepared argument.
Re:This is a non-issue, as it stands (Score:1, Insightful)
http://www.lavishsoft.com/ [lavishsoft.com] -- His site
Of course, he's worried about protecting our security from those malicious hackers at Blizzard rather than, say, his parasitic business which cheapens every game it touches.