Azeroth Security Advisor: WoW is watching you, part 2
by Jon Eldridge 
May 19th 2008 at 3:00PM
Every week, computer security expert Jon Eldridge is your Azeroth Security Advisor. He will delve into the darkest reaches of computer security rumor and bring the facts back home even if they're wriggling at the end of a pike. His goal is to provide useful information to gamers who don't think about security much and flame fodder for those self appointed experts who need to rationalize the cost of their expensive certifications. Like any good security force he's a mercenary at heart and is happy to take subject requests from the user community that he serves. So feel free to leave a comment below or just sit back and enjoy the show.
Welcome back to the Azeroth Security Advisor. Last week I discussed two of the three ways Blizzard keeps an eye on your computer. This week I'll cover the controversial Warden program whose discovery in Oct 2005 by Greg Hoglund caused a great deal of outrage and confusion not unlike accidentally joining a pickup group full of rogues. Reactions have been so strong that some trolls dwelling in their parents basements are still alternately posting "OMFG BLIZ HACKZ CALL COPS!!!" or "U SIGNED EULA SO STFU N00B!!!!!" depending on which of their medications are kicking in at the time. Most people forgot to care one way or the other within a few weeks and went back to life as usual. Lucky for Blizzard apathy is the universal solvent for organized resistance otherwise they might be facing a class action lawsuit by now.
The Warden's core mission is to continuously audit your PC for suspicious activity while you play. First it reads all the DLL's loaded into the WoW process space, which is a perfectly legitimate activity any way you slice it. After that, the Warden ditches its friendly park ranger hat for a ski mask and takes a look around the rest of your PC. It reads the text in the title bar of every window you have open including that really embarrassing Furry fan site you don't want your friends to know about. Yes Nekudotayim, Bliz knows about your pr0nz.! The Warden then creates a hash code (think fingerprint) of each window title and compares the results to a list of "banning hashes" for potential matches and subsequent divine retribution.
The second act of the Warden Power Tour is to sniff out and hash every single process running on your computer and compare them to the list of banning hashes. So while you are playing WoW, Blizzard takes complete stock of every program, every window, every website and every process on your machine and compares it to a list you will never see... every 15 seconds. Contrary to many fanboy and armchair security expert flames Blizzard does indeed know about your surfing habits while you are playing WoW and a whole lot more. The issue is not what they know but what they choose to audit and act upon via their secret list. For anyone who'd like to watch the Warden sniff around on your PC you can try the Governor written by Mr Hoglund.
Blizzard does not deny that the Warden exists. In one interview a senior producer assured everyone that "we're not the Nazis" but drew a curious parallel between not reading the EULA and contracts with the devil. The Warden is also mentioned within the documents of an ongoing litigation between MDY Industries and Blizzard Entertainment United States District Court, District of Arizona case number 2:2006cv02555 filed October 25th 2006. This lawsuit focuses on the WoW Glider cheat software and its creator. Buried within the mass of documents easily accessible as part of the public record is the following tidbit.
Blizzard's Technical Security Measures
34. Blizzard employs a software program called Warden as a technical measure that prevents unauthorized access to WoW and restricts users from loading unauthorized copies of WoW.
35. When users launch the WoW game client, authenticate to the WoW game server, and access the copyrighted elements of the WoW gaming environment, they must demonstrate that they are running an authorized copy of the game client.
36. Warden enforces Blizzard's rights by running targeted scans of the user's
environment for the presence and/or use of "signatures" of known unauthorized third party programs that facilitate cheating or allow the modification of the WoW interface, environment, and/or experience in any way not authorized by Blizzard.
37. When Warden detects that a user is attempting to run an unauthorized copy of
WoW, Blizzard denies that user access to the copyrighted WoW gaming environment.
"Warden enforces Blizzard's rights by running targeted scans of the user's environment..." This is a bit misleading as they neglect to clarify that at the end of these targeted scans the user's entire system has been examined alien autopsy style. Blizzard considers your entire PC within its jurisdiction and has remained very tight lipped about what they do with the information they gather. Even some forum links to Blizzard's initial response to the 2005 excitement now lead to deleted pages. This is unfortunate. Now that the cat is out of the bag Blizzard would do well to share enough information to establish credibility with their customers and prevent the bad press that would accompany a high profile legal battle.
The Warden establishes very specific information about how a computer running the WoW client is being used and ties that use to a specific account which is in turn tied to the name, address, and credit card number of an individual customer. Certainly enough information is gathered for Blizzard to feel justified in any ban/suspend/spank action they take and confident that they are taking that action against the correct user account. If you don't consider this "personal" stop reading this right now, turn off your TV, take off your rubber elf ears and enroll in a few history or ethics classes at your local college. Whereas Blizzard may not being doing anything sinister with that information it is certainly personal.
Is the Warden spyware? A few security professionals and at least one watchdog group think so. Others argue that the EULA absolves Blizzard from any liability whatsoever. Both arguments have their merits. Frankly the label spyware is a matter of semantics and not worth warming your flamethrower up over. Yes, Blizzard warned you that your computer could be monitored. No, Blizzard didn't really give you a clear idea of how far they would take this liberty once it was granted to them. The Warden is certainly invasive and depending on the contents of that hash list it could be judged either benign or outrageous.
Could the Warden be abused? Sure. Depending on what data is being shared with the Blizzard mothership, subsidiaries of Vivendi easily could benefit from having knowledge of the usage patterns among the WoW user community as a whole or data mine answers to specific questions by verifying the presence or absence of particular hash codes. Law enforcement could provide Blizzard with hash codes of websites or programs that might lead to pinpointing anything from music pirates to the terrorists the US Intelligence community is trying to automatically detect based on user behavior within virtual worlds. Personally I'd pay big cash to watch a reality show based on the CIA analyzing the Second Life user community for suspicious behavior. Imagine how much fun it would be to watch some conservative Homeland Security agent discover their first vending machine full of detachable and interchangeable genitalia.
Is Blizzard the evil empire? Should we ask mom to make us a thicker tinfoil hat? I don't think so. Blizzard does a great job protecting their game from the hackers and grief mongers that would make WoW unplayable given half a chance. The fact that Blizzard allows users to customize their game play via AddOns while successfully guarding against cheating is Uncanny X-Men (before Gambit and Jubilee) cool. Your PC is likely to be infested with software that poses a much larger threat to your well being than the WoW client. What I would change is Blizzard's cloak and dagger approach to employing invasive software as a security guard. Rather than enrolling the user community in a way that would make them supportive of the Warden software they were lazy and shrouded in it mystery which can only result in poor PR.
So what does this all mean for the average user? That is a personal opinion so all I can do is share mine with you. Cheating ruins online multiplayer games. In order to provide a game environment worth paying a monthly fee for game companies are being forced to evolve strong defenses. Sadly this is leading them to make ethically and perhaps in the future legally questionable decisions. The battle over the legal strength of a EULA is just warming up and the results are likely to be different in each country. Ultimately you have a right to be concerned about what somebody could do with the information they gather about you, don't let anybody tell you otherwise. Never assume your computer is safe from unauthorized or unwanted probing, the opposite is frequently the case. Taking a back seat to important issues like your right to privacy is a slippery slope with a predictable outcome.
Filed under: Analysis / Opinion, Account Security, Azeroth Security Advisor
Reader Comments (Page 1 of 3)
Matthew May 19th 2008 3:22PM
I believe Warden is also in Diablo II now, at least according to some comments on boards. Unfortunately it makes maphack all but impossible to run, as far as I can tell. I was never a duper/townkiller or anything in D2, but maphack itself was always worth the risk of banning, simply for the utility. I recently reinstalled D2, though (it's all my laptop will run), and now I'm stuck wandering around for ten minutes in a level trying to find the stairs down. :(
Naix May 20th 2008 11:46AM
OHZ NOEZ! Blizzard Noes about the penis I looked at!
Ben Miller May 19th 2008 4:12PM
Thank you, Sir, for this announcement. I particuarly enjoy your stance toward privacy. Everyone should guard their own, and not worry about mine. Thank you for this enlightened view.
dengar May 19th 2008 3:26PM
all i can say is:
OMFG BLIZ HACKZ CALL COPS!!!
jrb May 20th 2008 6:24AM
all i can say is:
if warden was all that it's hyped up to be, how come it can never catch the plethora of key loggers that are helping compromise 1000's of users' accounts? Blizzard make great games, but i suspect that it checks for only a very limited set of processes that it knows 100% are bad, because blizzard are not mcafee, or norton, or kaspersky; they aren't security experts.
it's a privacy issue along the lines of google email. Yes, they have access to this ever-growing library of information of users' PCs, but they don't use it, yet. It's like a ticking time bomb.
Justin Nealis May 19th 2008 3:27PM
And this is why I do all my surfing on my laptops...
Just kidding. As paranoid as I am, I don't have much of a problem with Warden, surprisingly. I don't agree with it, or how Blizzard is very tight lipped about it, but I do understand that it helps keep my game environment that much cleaner. That said, you're absolutely right on the EULA points - the EULA has evolved into so much legal jargon that spans twenty to fifty odd pages that nobody reads them anymore, until it's too late (in the case of malware) or a lawsuit crops up.
I think Blizzard needs to dedicate a page on the main website to all the information about Warden you'd ever want - why it runs, what it collects, etc. They need to poll users on what's collected and sent back versus what isn't (For instance, they could tailor the program to only send back URLs of webpages viewed if the user is detected cheating, and not before). In addition, we as a community need to be vigilant and watch the Warden program, making sure that, if we indeed have no problem with it in its current form, that it *stays that way*. It could be veyr problematic if the Warden starts sniffing network traffic or scanning other PCs on your network - a big security no-no.
I'm apprehensive about Warden's future, but for the time being, it's something I'll live with - albeit only barely.
Blake May 19th 2008 8:21PM
So you state they hash your window titles and compare them against a list of bannable hashes. Does this happen on the client side or the server side? If it's on your client side, who cares? If it's on the server side, it's still a hashed list, so they'd still have to brute force crack the hash if the hash didn't correspond to one of the bannable hashes - right?
Doesn't sound like a huge problem.
Jonathan May 19th 2008 3:52PM
As someone who is going to school for security, its difficult to balance the rights of the customer with the responsibility of the company to protect its IP.
Is scanning every process running on your computer a bad thing? Not really. They can identify 3rd party programs that enable cheating/hacking. They can also identify Virus/Trojan activity and notify you. Is tracking your browsing habits bad? Yes thats a lot worse than monitoring the processes. As stated in the article they could use this info to datamine the crap out of their player base. if you think spam is bad now, imagine if it had your name and the product/service you were looking at mere moments ago. Scary.
Also im quite conservative, and ive seen plenty of vending machine with interchangeable parts. THANK YOU VERY MUCH. :D
Jonathan May 19th 2008 3:55PM
PS:
Another reason to move to linux.
SimpleSurvival May 19th 2008 10:48PM
no operating system is safe when you purposefully execute code.
all the security models in the world can't defend your user space from user space applications that you purposefully ran
in the long run, an operating system is only as secure as the user behind it...
SKiP May 19th 2008 3:36PM
Is Warden a Windows-only phenomenon, or are Mac users given the same stink-eye treatment too?
William May 19th 2008 3:59PM
Yeah, am I safe on my mac?
mdmadph May 19th 2008 5:32PM
I could be wrong, but I'd say you were safe. Mac users are too small a minority to be that much of a threat -- to be honest, even if every single mac user cheated in some way, I betcha Blizzard would just live with the consequences than try to spend money trying to make Mac spyware (not saying it can't be done, though.)
I say this as a Mac user, too.
SimpleSurvival May 19th 2008 7:06PM
Lemme post a lil disclaimer first... I am NOT mac bashing here
---
Its a common misconception that the Mac OS is a more secure than many (read: windows) other platforms. Each and every platform is 100% vulnurable when the user willingly and purposefully executes an application. It is a very simple matter for a script to query all of your running processes.
do me a favor, open a terminal, don't use an admin account, and type 'ps -a'
thats a list of all your currently running processes owned by you. If you can see them, any application you run can see them too... there isn't some mystic mac voodoo that keeps your processes in their own secret garden where they can't see over the wall.
I'm not horribly well versed in the Mac windowing app, so I can't give you a friendly simple command to query the names of all your open windows. But, I assure you that such a hook exists.
Please, do not assume that your platform is more secure than another... ignorance is the biggest security hole in every piece of software.
codeninja Jul 8th 2010 7:59PM
to view the processes you may view issue "ps aux"
Truckin May 19th 2008 3:36PM
Good read, thanks Jon. I think the entire situation could have been handled in much a better emissary given the caliber of products Blizzard has produced. People don't associate "Spyware" with Punkbuster do they? An approach of this type would have probably been embraced by the community and mostly likely defended without question.
Matt May 19th 2008 3:41PM
Anyone know if Warden or a similar process runs on the OS X version of WoW?
Lolpvp May 19th 2008 4:27PM
Good question. I'm also curious abut the Macintosh version - however I think it's safe to assume that Blizzard would enforce the same thing on the Mac.
Taurinq May 20th 2008 10:20AM
I have a feeling OSX's security model wouldn't allow Warden to peer into other processes on a whim, unless it was running as admin - and there's no request to run WoW as admin.
SimpleSurvival May 19th 2008 10:44PM
it doesn't take admin rights for OSx to look at your processes
if you own the process, other processes you own (aka warden) can interact with them
the only thing warden can't do is look at processes owned by other users, or admin processes
This is true for all *nix based operating systems...
If you purposefully execute an application, you are granting it full rights that you as a user are allowed. If you, the user, can see your other processes, they can see each other.
see my other comment for further explanation
please, don't assume your mac is bullet proof because its a mac, thats the best way to have your system compromised