Slashdot Mirror

If you want examples on how to write your own, check out, http://www.wowsharp.net/

http://www.wowsharp.net/forums/viewtopic.php?t=702 4

Anyway that is the original, mostly un-bullshitified much longer post analysing what the Warden was doing. He took that, removed the parts that mentioned why he was looking at Warden in the first place, and turned it into his "ZOMG SPYWARE!!!" blog post.

Even so, this tells us a lot about Hoglunds attitude - at one point he actually compares Blizzard to the Gestapo. WTF? Talk about insensitive.

In other words, at no point is the actual title of any windows transmitted.

Let's review this situation:

• Hoglund makes money off letting people cheat in WoW. This damages the enjoyability of the game for many people, making him in my mind what is commonly called an "asshat".

• Blizzard hand his backside to him on a plate when the Warden becomes a polymorphic, encrypted maze of interlocking checks and scans.

• He writes some bullshit article comparing the Warden to spyware, despite it sharing no characteristics with spyware at all. It doesn't try and prevent itself being uninstalled, users are perfectly aware it is there and comes with WoW - many like it, as it helps make the game fairer - and it does not send personally identifiable information back to Blizzard. In fact the hashing seems to have been put in specifically in order to preserve privacy.

It amazes me that such a transparent piece of bullshittery could have got as much press as it did, given that it's clearly a case of him trying to spite Blizzard after they shut down the money-making business of Wow!Sharp (it only went open source after they felt it had become useless). Ever since this sordid incident, Hoglund has been a dirty name to me and many others familiar with it, and I don't trust him at all.

Like I said, it wouldn't surprise me a bit if he released code showing how to hack the BIOS, just like he teaches people how to write rootkits despite them having (as far as I'm aware) no legitimate uses.

Sony could be held liable in a class-action lawsuit. Anyone can design a virus and name it "$sys$" now, and AV software won't be able to detect it if this rootkit is installed. An IM worm could use this naming scheme, only infect a few thousand people, and the news would report, "SONY's DRM software used to hide latest virus". It'd be a horrible blow, and they'd totally deserve it. I still think we'll see a virus/worm that does this before the end of this month.

On a related note: World of Warcraft hackers are now using Sony's DRM rootkit to hide from "the Warden". I tried to submit this as a standalone story, but since I saw this DRM news update, I figured I'd post it here.

Is Sony aiding and abetting cheaters?

Use Sony's Ring0 rootkit to hide your WoW-cheat

Heh.

http://www.wowsharp.net/forums/viewtopic.php?t=725 1

1. Not very. They use cryptographic hashes, and the chances of an accidental hash collision (i.e., you're not trying to cause one) are negligible (depending on the size of the hash, of course). The rumor is also that Blizzard doesn't ban based solely on the outcome of the scan, but has a GM monitor you in-game to determine what action should be taken.

2. No, Warden only runs while WoW is running.

3. Yes. There is a default version of Warden that is part of the patched version of the game. When you run WoW, Blizzard can push another version of Warden to your machine that exists in memory only while you are playing the game. When you uninstall WoW, the basic Warden software is deleted along with it.

4. You can still use a proxy to monitor what data is sent across the connection, and such a proxy (as long as it doesn't try to alter any data) is pretty much undetectable. Blizzard has made general statements about their monitoring, but they haven't given any specifics on what is transmitted. The cheat authors, however, have been fairly verbose about what Warden does. (See http://www.wowsharp.net/forums/viewtopic.php?t=702 4).

5. Hard to say. Warden is polymorphic, and a new version can be pushed from the server at arbitrary times while you play, so it's fairly slippery. It's tough enough to beat that the WoW!Sharp developers decided that continued development and sales of their software was too risky, after they got caught. I suspect that Warden faces the same set of challenges that virus scanning programs face. At the same time, the cheat authors, because their game accounts are on the line when they test their software, could potentially get socked for $50 every time they get caught - and while a little cheating here or there doesn't damage the game too much, Blizzard only has to nail the cheat developers once in order to ban them. (And Blizzard can always take extra steps to try to prevent them from resubscribing.)

Some more insight into how Warden works (and how it caught the WoW!Sharp developers) is available here.