Wow Is Spyware

bmchugh · Oct 22, 2005 at 9:53 AM

Entertainment, yes - the ones who made Warcraft, and World of Warcraft (which has 4.5 million+ players now, apparently). This software is known as the 'warden client' - its written like shellcode in that it's position independant. It is downloaded on the fly from Blizzard's servers, and it runs about every 15 seconds. It is one of the most interesting pieces of spyware to date, because it is designed only to verify compliance with a EULA/TOS. Here is what it does, about every 15 seconds, to about 4.5 million people (500,000 of which are logged on at any given time):

The warden dumps all the DLL's using a ToolHelp API call. It reads information from every DLL loaded in the 'world of warcraft' executable process space. No big deal.

The warden then uses the GetWindowTextA function to read the window text in the titlebar of every window. These are windows that are not in the WoW process, but any program running on your computer. Now a Big Deal.

I watched the warden sniff down the email addresses of people I was communicating with on MSN, the URL of several websites that I had open at the time, and the names of all my running programs, including those that were minimized or in the toolbar. These strings can easily contain social security numbers or credit card numbers, for example, if I have Microsoft Excel or Quickbooks open w/ my personal finances at the time.

Once these strings are obtained, they are passed through a hashing function and compared against a list of 'banning hashes' - if you match something in their list, I suspect you will get banned. For example, if you have a window titled 'WoW!Inmate' - regardless of what that window really does, it could result in a ban. If you can't believe it, make a dummy window that does nothing at all and name it this, then start WoW. It certainly will result in warden reporting you as a cheater. I really believe that reading these window titles violates privacy, considering window titles contain alot of personal data. But, we already know Blizzard Entertainment is fierce from a legal perspective. Look at what they have done to people who tried to make BNetD, freecraft, or third party WoW servers.

Next, warden opens every process running on your computer. When each program is opened, warden then calls ReadProcessMemory and reads a series of addresses - usually in the 0x0040xxxx or 0x0041xxxx range - this is the range that most executable programs on windows will place their code. Warden reads about 10-20 bytes for each test, and again hashes this and compares against a list of banning hashes. These tests are clearly designed to detect known 3rd party programs, such as wowglider and friends. Every process is read from in this way. I watched warden open my email program, and even my PGP key manager. Again, I feel this is a fairly severe violation of privacy, but what can you do? It would be very easy to devise a test where the warden clearly reads confidential or personal information without regard.

This behavior places the warden client squarely in the category of spyware. What is interesting about this is that it might be the first use of spyware to verify compliance with a EULA. I cannot imagine that such practices will be legal in the future, but right now in terms of law, this is the wild wild west. You can't blame Blizz for trying, as well as any other company, but this practice will have to stop if we have any hope of privacy. Agree w/ botting or game cheaters or not, this is a much larger issue called 'privacy' and Blizz has no right to be opening my excel or PGP programs, for whatever reason.
Click to expand...

Ok lol well they have messed up big time, hope i have helped you beware of the dangers. And if you cant be bothered reading it just means while playing it edits .dll files and stuff.

Added some more info.

Plus rep creds if you think this helps

cycan · Oct 22, 2005 at 9:55 AM

Thanks budd I was gonna download it.

icky · Oct 22, 2005 at 9:56 AM

Wow that's weird. Lets hope Blizzard doesn't have any bad intensions ^_^

~Icky

bmchugh · Oct 22, 2005 at 10:00 AM

Originally posted by cycan@Oct 22 2005, 01:55 PM
Thanks budd I was gonna download it.
Click to expand...

yea sure i just want to help people out, you can all +rep me if this has made you more aware of this

Its from logging into dangerous servers aswell

Otaku23 · Oct 22, 2005 at 10:01 AM

I knew there was something fishy about that thing./..

Mai Hem · Oct 22, 2005 at 10:02 AM

What's the source of this info? Very interesting..

R3M€DÝ · Oct 22, 2005 at 10:03 AM

Im Not too high in on WoW but i think that could be very bad news for the blizzard team :S

bmchugh · Oct 22, 2005 at 10:05 AM

yea well its pritty bad news it could ruin Wow and its server

Source for Mai Hem: http://www.rootkit.com/blog.php?newsid=358

bmchugh · Oct 22, 2005 at 10:06 AM

Just glad to help everyone out, So it may be a good idea to keep anti-virus and spyware scanners running while you play, even tho it lags

lllAE86lll · Oct 22, 2005 at 10:12 AM

ermmmm if that so the goverment should close that game l0lz ...... i didnt even see the game

bmchugh · Oct 22, 2005 at 10:14 AM

Originally posted by lllAE86lll@Oct 22 2005, 02:12 PM
ermmmm if that so the goverment should close that game l0lz ...... i didnt even see the game
Click to expand...

maybe maybe but i think that is a bit too far, too many ppl playing it

Giony · Oct 22, 2005 at 10:14 AM

ha my idiot brother doesnt believe it and he's still playing it

KrazyNick · Oct 22, 2005 at 10:17 AM

Wow that sucks everyone plays Wow

bmchugh · Oct 22, 2005 at 10:18 AM

Originally posted by Giony@Oct 22 2005, 02:14 PM
ha my idiot brother doesnt believe it and he's still playing it
Click to expand...

Well hit him over the head and show him this http://www.rootkit.com/blog.php?newsid=358

Giony · Oct 22, 2005 at 10:22 AM

lol i would but he's 5 years older than me :lol:

Log in or Sign up

Wow Is Spyware

bmchugh Guest

cycan Well-Known Member

icky New Member

bmchugh Guest

Otaku23 Well-Known Member

Mai Hem Well-Known Member

R3M€DÝ Well-Known Member

bmchugh Guest

bmchugh Guest

lllAE86lll GR Since 2005

bmchugh Guest

Giony Well-Known Member

KrazyNick Well-Known Member

bmchugh Guest

Giony Well-Known Member

Share This Page

Log in or Sign up

Wow Is Spyware

bmchugh Guest

cycan Well-Known Member

icky New Member

bmchugh Guest

Otaku23 Well-Known Member

Mai Hem Well-Known Member

R3M€DÝ Well-Known Member

bmchugh Guest

bmchugh Guest

lllAE86lll GR Since 2005

bmchugh Guest

Giony Well-Known Member

KrazyNick Well-Known Member

bmchugh Guest

Giony Well-Known Member

Share This Page

Useful Searches