BBC Tells World About The Warden 573
Anonymous Cowpat writes "The BBC is running a story about the Blizzard title World of Warcraft. Specifically an article about, 'The Warden', Blizzard's highly-invasive anti-cheating software, which some, including The EFF have labelled as spyware. Most of the people around here have probably heard of it by now, but it's interesting to see the story in the mainstream press and (at time of writing) on the front page of the BBC's technology news section, no less." From the article: "The watchdog program, called The Warden by Blizzard, has been known about among players for some time. It makes sure that players are not using cheat software which can, for example, automatically play the game and build up a character's qualities. However, knowledge of it crossed to the mainstream thanks to software engineer Greg Hoglund who disassembled the code of The Warden and watched it in action to get a better idea of what it did."
Not Again (Score:1, Insightful)
Re:Not Again (Score:3, Insightful)
Re:I've been following this... (Score:5, Insightful)
As a player .. (Score:5, Insightful)
Why I don't support the EFF (Score:2, Insightful)
Re:ummm..ok (Score:5, Insightful)
The difference is that you have the right to private property, WoW has the right to deny you access to THEIR private property based on their own criteria. If this you feel this criteria is too invasive then, by all means, do not use their software/services.
This is like drug testing, you have the right to choose not to work for an employeer that does drug testing, you do not have the right to change their policy on drug testing.
Re:ummm..ok (Score:2, Insightful)
Re:ummm..ok (Score:3, Insightful)
No, I wouldn't say that's a good thing - but the rules are different out here. In the US the citizenry is guaranteed a certain measure of privacy and protection from egregious law enforcement by way of the Constitution. We have Amendments that protect against unlawful search and seizure, we have Amendments that guarantee a certain due process, etc.
When you go to a foreign country, these rules do not apply. If you traveled to Spain, your United States civil rights would hold no water. You would be operating under the legal system of the region you were traveling into.
So what on earth makes you think that the rules that govern US law enforcement apply, in any way, to whatever virtual world it is that WoW runs under?
Blizzard built that environment from the ground up. They invested time, money, and countless man hours to make it into something real. They invited players like you to step in and enjoy their creation. Some jackasses feel the need to bend and break the few rules that exist. I feel Blizzard is entitled to end cheating by any means necessary.
It is their product.
As always, if you don't like how they enforce their rules, you are welcome to take your dollars elsewhere. Just don't make the mistake of thinking that you have some right to tell them how to run their show.
Spilt milk, but make some cheese from it (Score:4, Insightful)
Didn't read the license agreement? Sorry, but that's not Blizzard's problem. It would be nice if Blizzard had made it more obvious that they would be doing this.
But you know what? Tough titties, you agreed to it.
That said, it's good that people are drawing attention to this -- maybe next time around, Blizzard will be faced with losing revenue should they try to implement the same kind of solution.
What MMORPGs need to do is implement better server-side analysis to identify cheaters. Difficult? Yes. Expensive? Yes. But probably less difficult and less expensive that losing craploads of clients, and hiring craploads of lawyers. Then they won't need to have the invasion clause in the license for their games.
Spread the word, and maybe we won't have to deal with this next time.
Re:nothing new (Score:2, Insightful)
Re:Waaaah (Score:2, Insightful)
Re:Not Again (Score:2, Insightful)
Re:Not Again (Score:1, Insightful)
Re:I've been following this... (Score:4, Insightful)
Do you want to play a fair game and a have a good time, or will tin foil hats get the best of you because you feel like you have big secrets to hide from the world?
** Yes, I realize that a number of those claims can be well founed, but a lot of it is just paranoia.
Re:Not Again (Score:5, Insightful)
The current top anti cheat for medal of honor allied assault is a third party program that makes the warden look like a freaking panzy on what it does.
It checks memory to verify there are no spyware signatures, verifies all files before they run, locks the files, runs its own explorer shell so that a person cant alt tab and run things. The game can only be executed within the context of the anti cheat software, the hardware is checked to make a key that can be bannable even if the person re-installs or reformats.
It locks the memory of itself, and the MOHAA software.
Even at that point it isnt good enough, it also launches two other executables with similar protections built in that check each other to make sure that none of the executables is being shut down or altered by an outside program.
People have to agree with this, because nothing else works, if you slip in one area, they write a cheat to exploit it. You slip in another area you get a cheat in another area. If you dont validate all files, even files with odd extensions, they write a kernal thingy that goes around it.
Cheaters have too many dedicated fucktards trying to ruin the games for everyone else.
When you sign up for World OF WarCraft, or use another type of anti cheat, you are saying that you agree to this kind of thing because you want to participate.
In sports, umpires can watch the players and make sure that they arent cheating, in on-line games the umpires have to get right on the computer. AS LONG as those people only use information required to successfully stop a cheater (IE they arent going in and finding out what programs you have installed in your registry and uploading your outlook e-mail book etc...) then what is their to complain about?
All of the stuff where it scans the URL of web sites, and views peoples MSn etc.. thats all tertiary to what its doing. It is scanning those because it is showing up as open windows processes, there is nothing for the anti cheat program to use to determine that the open windows ARENT cheats, until it checks there names to see if it matches the signature.
I dont think people realize just how clever cheaters can be. One of the cheats turned in for MOHAA involved using a bug with MSN and video drivers for ATI. If a notification was up, you could see through the walls!
Then people wonder at the lengths anti cheat software is beggining to take.
Hyperbole (Score:5, Insightful)
Since when would a site submit a URL in the title? I assume this is for sites which don't have a <TITLE> tag, and just display the URL as the title. Even in that case, any website that submits a document with such information in the GET string is asking for trouble. It would allow it, among other things, to be viewed in the document history etc.
We need to stop jumping every perceived violation. There seems to be a witch-hunt on for privacy/security violators, and often the assumptions of what 'could' create a security risk falls into the realm of pretty silly...
of vigilantes (Score:4, Insightful)
Holy Grail 2 (Score:5, Insightful)
A cheater-robot gets caught because it plays a game better than any human could... right? So then, the real challenge for a human player is to be mistaken for a machine... a kind-of reverse Turing test...
Re:I've been following this... (Score:3, Insightful)
Re:nothing new (Score:4, Insightful)
Under whose radar? Blizzard announced that they were going to be doing this near the beginning of this year, and they've been reasonably upfront about it. There have been multiple forum postings as well.
IF they want to prevent cheating, watch for behaviour patterns
They do that as well. But, funny thing, guess which is more effective?
And, frankly, the amount of whining and tin foil hat complaining going on over this is just ridiculous. They do not expose any private data at any point in time. The sniffing occurs only while you are playing the game, it does not negatively impact any other programs, all "gathered" data is hashed and compared purely on the client side, and only if the hashed data matches a list of "known bad" hashes is an indicator (again, only an indicator -- not the raw, unhashed data) sent back to Blizzard.
If you want to complain, then complain about the possibility of false positives. Hash functions, by their very nature, do not ensure uniqueness. Multiple values will hash to the same value. I haven't seen a technical discussion of the hashing function, so it may be exceptionally rare, but it's still possible.
And no, I don't play WoW or any other Blizzard game at this time. And I'm not a fanboy. I'm just tired of people blowing this out of proportion -- it just dilutes the response against real privacy/security threats.
Re:Oh for pitty's sake. (Score:5, Insightful)
You agree not to cheat. Then you cheat anyway. What's not immoral about that?
NEVER trust the user input (Score:4, Insightful)
Just as you can hack some javascript to prevent validation, what makes them think we can't run some remote control software whose client happens to run on... *GASP* your own machine!
But what are they gonna do next? Introduce captchas into the game every 5 minutes?
No, sir. The answer is changing THE GAME RULES (the equivalent of validating user input in the server, not the client) so that quick advancement is not done. i.e. restrict repetitive training to N hours, and such.
Trying to control the client is nonsense.
Paranoia (Score:5, Insightful)
Mr. Hoglund is an idiot.
Re:Not Again (Score:5, Insightful)
I have a hard and fast rule -- if I'm not actually paying you any money, I'm not providing you with sufficient information to subsequently bill me.
I absolutely will not provide CC information to use a 'free' trial. I also typically refuse to allow people to take moneys out of my accounts in the future without my interaction. You may send me an invoice. You may not just decide to take what you need.
But, I'm probably being unrealistic. Nobody would ever misuse that, right?
Re:ummm..ok (Score:1, Insightful)
so if i didnt agree with it, i have a worthless $50.00 USD game sitting here that I can't return, because no1 will accept software returns these days.
Re:You've missed the point (Score:3, Insightful)
Well, I actually don't play the game so I haven't read the EULA. But I really have to wonder - does the EULA mention all the screwy stuff that this client checks? I'm guessing not since someone had to disassemble the sucker to find out what all this thing does.
Mind you, I'm not against it at face value. I just think that consumers should be able to make informed decisions. If the EULA says the client software will probe your IM and figure out your friend's email addresses and you install anyway, then no problem. But that's probably not the case here.
Re:Waaaah (Score:2, Insightful)
Something like that can only be controlled on the operating system level.
Re:Not much of a challenge at all (Score:3, Insightful)
I take your point. But people are easy to fool. The irony (re the Turing reversal) is to get a machine to think you're a machine.
Re:I've been following this... (Score:3, Insightful)
Re:Not Again (Score:2, Insightful)
am i the only one with a credit card that has online fraud protection? i don't remember the last time i actually worried about my credit card number being stolen. every time i've disputed a charge that i didn't make or that i was not happy with, it was removed and i paid NOTHING.
there are plenty of credit card companies out there! use the competition to your advantage! credit card companies are one of the few places where you can still get good customer service.
Re:Not Again (Score:2, Insightful)
Not all banks/credit cards have these. So unless you go out of your way to get one, it may not be available to you. Some places have maglev trains, that doesn't make it a viable alternative for my commute to work tomorrow since there are none nearby. Simply saying "there exists something you may not have" is hardly a helpful suggestion.
And, the act of trying to track down a disposable set of credit card numbers means I'm getting ready to purchase from a bunch of vendors in whom I have no trust. My solution is not to find how I can safely interact with such vendors, but to stay the hell away from them in the first place.
But, it is true, that for a subset of all people with credit cards, there is a non-empty set of people who have this available to them. However, I bet more people don't have this available to them than those who do.
Re:Pertinent quote from "Terms of Use" (Score:2, Insightful)
You're right. The benefits of not meeting the odd player expoliting holes in Blizzard's own software, far outweighs the essential complete annexation of your entire personal and private computer system by Blizzard entertainment, the creator of said exploits.
I could draw parallels to the whole War on Terrorism keeping us all safe thing here, but I think it speaks for itself.
Re:Spilt milk, but make some cheese from it (Score:3, Insightful)
Actually, it may raise revenue because I, for one, like the idea. It's not real spyware and it's keeping some script kiddies from twinking. That's fine in my book and frankly I'd feel better about playing a game where the attitude of the host(s) was more "we keep a level playing field for our users" then the "we got your cash now, sucker. Get use to it."
As far as I'm concerned the whiners are complaing for a small number of reasons: they lost out in cheating, they want to cheat but fear the warden or they've fallen victim to FUD by the use of the word "spyware".
I feel no pity for these people.
Re:ummm..ok (Score:2, Insightful)
Re:Spilt milk, but make some cheese from it (Score:3, Insightful)
I'm sure that there are lots of things that Blizzard does server side to detect cheating. The problem is, their view of cheating is broad enough that it cannot be completely detected server side. Consider the following (real) example:
During the WoW Beta, in game fishing was fairly easy to do. It was so easy, in fact, that people were able to completely automate the process. So Blizzard changed the mechanics of fishing so that you had to cast your line, observe a small splash if something got caught in your lure, and quickly click to reel your fish in before it escaped. People then wrote more elaborate fishing macros which had an external program constantly scanning sections of the screen for certain kinds of pixel changes that would indicate a splash. Blizzard then responded by slashing the prices of fished items that are sold to vendors. Macroing fishing went from highly profitable at a low level to unprofitable at all levels.
The point of all this is that macroing fishing was completely within game mechanics. Except for noting the time that someone spends fishing (which may or may not be a good indicator of cheating), there was no way to detect this "cheating" server side. But it was cheating. It caused a few people to create wealth for themselves with no effort, which leads to an imballance in other areas of the game (like equipment).
People are (almost) not stupid enough anymore to use hacks that would change game mechanics for them. They would get caught very easily and they know it. With very few exceptions, cheating in WOW is limited to botting. There are small differences between how a human might play as opposed to a decent bot, but I'm not entirely sure that it is the kind of thing that can be detected server side.
Do I want them scanning my computer? Not if it can be helped. However, if they are nice about it (reasonable disclosure, plus scanning only hashes and file sizes but not actual text, and not sending back any information that isn't absolutely necessary), it seems the best solution. Cheating is a serious problem in a game like this, and I'm not sure there is another viable approach to stopping botting.
Re:Not Again (Score:3, Insightful)
Re:Oh for pitty's sake. (Score:2, Insightful)
Re:ummm..ok (Score:4, Insightful)
Should I be expected to forfeit my original $50 and a years worth of subscription fees because they changed the terms?
What - did you suddenly lose the years worth of gameplay you already experianced? Do you call up HBO when they cancel a show you liked and demand a refund from the moment you subscribed with them?
I mean, you can stop playing the game! And stop paying for it.
I would hope people understand that subscription based games are going to be like any subscription service rather than like the old single player CD based games which were like books (sort of).
Of course, this among other issues is exactly why I have yet to buy or play a MMORPG.
Re:Pertinent quote from "Terms of Use" (Score:3, Insightful)
That is, if you want them to be more important.