EverQuest/Sony Fights Code Wars With Latest Expansion
The most recent expansion for EverQuest (Planes of Power) adds a lot of problem-solving quests to the game, so Sony beefed up the (long-since broken) encryption that they used for the client protocol. The expansion has been a major hit, pleasing some of the most critical voices in the EverQuest world, but one week later, the anonymous development team of ShowEQ had broken the new encryption. Read on for details of the ongoing battle over keeping secrets in plain sight.
First, the skinny on the latest EverQuest expansion, Planes of Power (PoP). Because this is an expansion chock-full of content for only the highest level characters in the game, Sony added some features that everyone would want (and thus, pay for): the ability to progress to level 65 (60 was the cap before); a new zone called the Plane of Knowledge which allows characters to moved freely to all of the old game areas and a feature that allows large groups to coordinate more easily. That's the carrot for the lower-end users, but really this is the first expansion to lock out even moderately experienced players in favor of large, strong in-game guilds.
Even so, the response has been almost all positive. Some players complain about the last-minute changes (especially the changes that made monks and druids less powerful in the high-end game), but those who are taking advantage of the new game areas are happy with the reduced time required for encounters and the fact that the game rewards strategy more than ever.
Planning, attention to detail and a fanatical focus on getting past every challenge that Sony presents are important in-game, but Sony is less than pleased by programmers who are just as happy to approach those challenges from outside of the game. Using Linux and Qt, ShowEQ is a packet sniffer that watches the EverQuest client protocol and displays a map of everything that the Windows client is privy to, but may not disclose to the player. Years ago, the ShowEQ developers discovered a weakness in the encryption that the client uses, and they have been able to reliably interpret the data ever since.
With the PoP release, Sony improved the encryption so that it used a larger key which was more securely chosen. At first, the talk on the ShowEQ IRC forum was gloomy and the normally secretive developers cloistered themselves off from the the group, returning only rarely to proclaim the difficulty of breaking this new scheme. The protocol is not unlike that used by ssh or SSL. A public key is sent from Sony to the client, and the client uses that key to encrypt a random session key and send it to Sony. Theoretically, this approach is open to only a limited number of attacks, all of which run the risk of being detected by the client.
A former ShowEQ developer who was hired by Sony was reported to have said it's over, "you'll never break this"... One week later, the new version of ShowEQ was available via CVS and was working again. The new keys were vulnerable, it seems, to an even simpler form of analysis and the result was simply that ShowEQ worked significantly faster. In many ways, this seemed to simply be a "bonus quest" that Sony threw into the PoP expansion, and it had been beaten.
On Thursday, October 31 ShowEQ broke once again. The protocol now compresses key data to prevent the analysis that was limiting the keyspace that has to be searched. As of this writing, ShowEQ no longer works passively, but this escalation is not over. The latest version allows a user to input the key directly, and developers are hard at work, trying to find further weaknesses in the key generation and/or exchange. The developers are even starting to question the long-held, unwritten truce that they maintained with Sony. The idea was that if Sony did not make decryption require a Windows-side component, there would never be a Windows version, limiting the use of ShowEQ to those capable of getting ShowEQ working under Linux. Now, the party line is, "there is absolutely, positively no reason not to have a WinSEQ."
The technical details are interesting, but the social and legal details may take center-stage for a while. The seq team is trying to figure out what they could put on the client-side without being detected and that brings into question the legality of Sony scanning running processes and reporting back. There's also the matter of Sony's rather astoundingly harsh EULA that tries to preclude activities like this in every way that it can (though the legality of click-through EULAs is still a hot topic).
One problem with this escalation is that, like another product (TiVo, which is partially backed by Sony) the very people subverting the product and making it more than the creator wants it to be are the best customers. In terms of EverQuest, they are often the ones maintaining several accounts and/or spending extra money for the "Legends" service. How does a company contend with a market where your best customers are also your most resourceful? With the TiVo, there was an uneasy understanding between the company and its modders. Sony has broken that balance with EverQuest.
Now that Sony has crossed this Rubicon, it is quite likely that ShowEQ will be ported to Windows and hundreds if not thousands of new users will be introduced to it. Was that Sony's goal? Certainly Prof. Felton showed us that such a battle is ultimately futile. Why does Sony want to fight it again on yet another front (remember that they are an RIAA member)? Is there any financial justification, here? Does mapping software really threaten the game more than the many in-game exploits that the high-end encounters suffer from?
PoP is a finely crafted fantasy gaming experience, but Sony has once again chosen to spend extra time and money hurting themselves and their market. Perhaps their competition will not make the same mistakes.
the saying It's just a game isn't valid anymore, I wonder what would happen if Sony just shut off Everquest, the hardcore players would once again have to have a life.
Raph Koster's rule of "the client is in the hands of the enemy" seems to have been forgotten by EQ's developers- if ShowEQ is such a problem, it's time, perhaps, that they stopped telling the client all these nasty things they didn't want it to know. I mean, I first remember ShowEQ coming 'round *3 years ago*. Why they haven't simply made the client ignorant of things it shouldn't know in all this time is beyond me.
What we call folk wisdom is often no more than a kind of expedient stupidity.-Edward Abbey
This article paints the ShowEQ developers with a rather sympathetic brush. If these were aimbot developers for q3 or ut or cs, wouldn't we totally revile them? What is the difference?
Maybe there should be two sets of servers, one for all the ppl who want to play fair and play against ppl who are playing fair; and one for cheaters, and those who want to reverse engineer the protocol, etc.
Laugh at my Lisp and I keeell you.
The big advantage people get from decoding the zone information is the name, and to some extent, the position of monsters all over the zone. If Sony changed EQ to only send data about monsters that are near you (within a reasonable distance) there would no longer be a big reason to decode the zone data. 99% of what you'd be seeing you could also see by turning in place, and clicking on each monster.
:)
Due to how the servers are setup however, it seems to be more efficient for them to send out all the monsters, rather than do the range calculations and just send the nearby ones.
My prediction, if a Windows version is released and becomes widespread (and I consider the latter likely if the former occurs), is that Sony will, finally, bite the bullet and change the code. It's not quite as straight forward as I may have made it sound, as there are some other systems (such as tracking) that will have to be significantly rewritten as well. However, if they really want to stop people getting at this data, really the only way to do it is to stop sending the parts that aren't needed.
I'm intrigued by the story of ShowEQ -- and the fact that Sony seems to want to protect their system by deciding what users can and can't run on their computers.
Uh, no. What Sony is saying is that they don't want users cheating in their online game and therefore having an unfair advantage over the rest of the people who don't cheat.
What's the big deal here people? If you wish to use someone's service you have to abide by their rules. If you don't like it you can leave, you can try to convince them to change their system, or you can cheat. If you get caught cheating, don't be surprised if you get slapped around.
"An unarmed man can only flee from evil, and evil is not overcome by fleeing from it." Col. Jeff Cooper
Surely you kid, right? ShowEQ isn't used as a security program. It is a cheating tool. Even in its most beneficent uses, it is for cheating. Period. This has got to be the most sad apologies for cheating I've ever seen.
Sony made a game. Someone made a cheat program that unbalances the playing field. Sony has every right to try and disable this cheating program. However, their rights end where ours begin. But if they want to change the encryption in their program or make a client that monitors game traffic or the use of a specific cheat program manditory for using the game, guess what? That's their right. You don't have to play the game.
And your analogy with ad programs that uninstall Ad-Aware is both faulty and inflamatory. Those programs are unistalling a security program from your computer so that their spyware will work. Sony is just not letting you play their game if you have a known cheat tool running on your computer. Huge difference.
"Enough of this wretched, whining monkey life." -- Marcus Aurelius, _Meditations_, Book 9, 37
Firstly, no matter how you paint it as creative coding and a good hacking & cracking job at the code, it still is cheating. What the article failed to mention is what else the ShowEQ program does. It doesn't just show a map, it also shows all the monsters in that zone. So, someone who has that can walk through a very dangerous zone, unhindered by evil beasties should they desire. Or perhaps they are hunting the elusive Gobbleygook dragon, and they can find it within minutes. If Player A uses it and starts gaining levels and platinum faster then Player B, who elects to do it normally, what happens when Player A decides to attack Player B? (assuming this is on a PvP [Player versus Player] server) It is cheating, plain and simple. Like Microsoft's closing out of modders of the X-box (And as much as I am loathe to agree with MS on anything, I must on this), Sony is trying to keep the game fair for everyone. I wouldn't want to play a game where people could cheat like that. Who knows, now they can see the map and monsters....what's next?
As to the Click-thru EULA, I think that with the way that they force you to think about clicking on the button, it is legally binding. However, I still don't like the idea of companies attatching unreasonable things to their EULAs. Next thing you know, MS will be asking for the soul of your first-born in the Windows EULA, and a sacrifice of your spouse in the Office one. But the question is, would a clause against cheating be a fair addition to a game where dozens of others are paying to play? Your cheating makes it a worst deal for those others who pay and play nicely.
And no, I don't play EverCrack...I just know lots of people who do.
.sig: It's what's for dinner.
I'm probably gonna get karma burned for this, but I'll answer to your post. I call this reply : "A word of sanity".
Your association of this story with the video player that removed Ad-Aware is a gross misassociation and an inexcusable exageration. You then proceed to linking Sony with that situation and advancing that they will be sued. A fine example of poor logic. What Sony is doing is simply trying to level the playing field by making it harder for cheaters to gain an advantage through outside means. They OWE it to the other 99% of ALSO PAYING CUSTOMERS that do not want others to have unfair advantage. The customers paid for the right to access the online world, not to try and break the rules.
There's a reason the client gets a lot of info about thing the player cannot see. For instance the tracking skill needs the info of all the mobs in the area to work properly. Sony is not uploading your e-mails to the CIA. And of all things, what people using ShowEQ are doing is anything but fair. Your post is seriously delusionnal.
There is no forced contract with EverQuest. You don't want to agree to the contract? Fine. Then you don't get to play the game. No one is putting a gun to your head and telling you to click the Yes button. You make a concious decision to agree to the contract each time you play the game. Its a VIDEO GAME, how you could even arrive at the concept of a "forced contract" in order to play is simply amazing.
Mac OS X and Windows XP working side by side to fight back the night.
It is a client/server game. By watching the information that goes to and from the server and decyphering it, you are cheating. Period. You have a choice if you choose to play the game: You can play the game and cheat, or you can play the game and not cheat. If you chose to cheat, you have to accept that Sony will try and stop you.
That is all this boils down to. MS is just a straw man that has nothing to do with this. Apples, oranges.
"Enough of this wretched, whining monkey life." -- Marcus Aurelius, _Meditations_, Book 9, 37
Pardon me for posting anonymously, but at this point I don't QUITE feel like losing my account... which wouldn't be so bad if I could give the character to someone else. But, I digress.
/loc system, and Sense Heading never told me much except where I was facing. Without a map to tell me where the hell I was, I was lost and useless. This game is absolutely worthless to me if I can't figure out where the hell I am. Other games such as World of Warcraft come with a built-in map function, so I really wouldn't need a packet sniffer for it. But for me, in EQ, I need it to play. Otherwise, I'd just cancel my account, and Verant/Sony would be the ones to lose, because they would not get my money.
I use ShowEQ. Does this make me a cheater? Yes, in the strict sense of the definition, it does. Here's comes the more important question: would I still play if I didn't have ShowEQ? No, but not for the reasons you might think.
I do not use ShowEQ to benefit myself at the expense of others. If I was playing on a PvP (Player vs. Player) server, that might be one thing, but I do not. When the packet decryption was working, I would use ShowEQ to avoid monsters that would assuredly kill me (I'm not a melee class.) I also used it to track down the location of groups that invited me, track how much experience I have left to level (as an iidle curiorsity), and find friends' corpses. None of these helped me at the expense of others; in fact, one might argue they helped in others' benefit.
Much more important, and this function still works without packet decryption, is that I use ShowEQ as a GPS. I have a horrible sense of direction in these games, and a lot of the time EQ's terrain in a zone is uniform. I could never get the hang of the
In the end, yes, you could say I cheat. But maybe, just maybe, if Verant made the game a bit easier for me to figure out where the heck I was, I wouldn't need ShowEQ. I can't be the only one with this problem; there are a LOT of us ShowEQ users out there. (We may not admit it, but we're out there.) As it stands, I really enjoy playing EQ, and helping out my friends. If Verant wants to lose me as a customer over this, that's their loss, not mine. (Friends of mine will tell you that while I like the game, I'm not addicted.) And for those of you who condemn me for being a cheater... well, go right ahead. But I still say that I need the tools Verant provides... not for my own score and glorification, but as a basic aid to help myself and others.
Flame me all you want. Mod me down.
But anyone who doesn't condemn the actions of this group is no better than them.
This game belongs to Sony. They make the rules, so either play the game as its creators intended the game to be played or don't play it at all.
If you think that this app is a valuable addition to the game, convince Sony to accept it and help those wankers develop it. If they say no, then just go away. It's their game.
Otherwise, you're no better than the people who exploit the in-game weaknesses. A cheater.
/. Where the truth
The force involved is that they already have your money, and aren't willing to return your money if you don't agree to the EULA.
Since you can't negotiate the return of your funds for the return of all services, the EULA is void as a contract.
"Who is the Journal of Quantum Physics going to believe?" --Stephen Hawking
I just have to say this. If cheating was meant tob e part of the game then Sony would have added it themselves. They would have added special commands or buttons or what have you, to allow you to cheat.
They did not and they are trying to fight the battle understandably. Is it going to hurt their market? I doubt it, but who is to say. If it is going to make a series of high end multi-account gamers quit then so be it. I am sure that is minor to the 400,000 subscribed users. (That is what I heard at last read on an EQ article)
It is in my opinion that Sony is in the right to fight this. It is also in their ability to do whatever they please to keep ShowEq from working as I am sure breaking the encryption is violation of the DMCA.
Frankly I think this whole topic of debate on whether ShowEq is okay or not is a waste. If you can't tell right from wrong now, then you never will be able too.
Play the game as it was intended. Without 3rd party software.
~Char Lander
Brothers and sisters I have none, but this mans father is my fathers son
The comparison to TiVo is an interesting one. TiVo's policy is that they will gladly look the other way for some hacks, and in fact even make some of the hacks as easy as possible to pull off, in exchange for being able to declare certain hacks off-limits.
Specifically, they make it easy to upgrade a TiVo with a large hard disk by designing their single-disk designs to have a place where the second disk can fit nicely in the box. They also it possible for users who want to accomplish their "daily call" over the Internet rather than a phone line by just happening to leave the server that handles those sessions at an Internet-accessable location rather than requiring that the only way into their network is through their chosen dial-up providers. The company sponsors (but does not actually run) message boards at TivoCommunity.com where hacking discussion is encuraged, and people can compare notes and share experiences.
The tradeoff is that there are certain hacks that the company does not want to see made, and will not allow the TivoCommunity.com boards to discuss. There are the hacks that would either harm the company, like any hack that would provide another source of listings, which would eliminate the need to subscribe to TiVo's listing services, or any hack that would allow content to be extracted from the device which would surely bring down the wrath of the MPAA and friends.
By allowing wide open back doors into their system, TiVo has been able to direct hacking efforts into the areas the company wants to see them go. Yes, there are a few people trying to drill through the concrete and get the "forbidden hacks" to work, but their numbers are few and they operate in obscurity compared to the company-sponsored forums.
It's a total 180 from Everquest's "Thou shalt not hack us!" perspective. TiVo's offering carrots, Everquest is using rather ineffective sticks.
The phrase "most resourceful" in the article is a rather thin disguise. The author is trying to say "Sony's best customers are also the ones most capable of becoming cheating bastards with the potential to ruin the game for the wider and less technically adept player pool."
Hacking the protocol is great, nothing wrong with that. Actually USING the hack during public gameplay is cheating, plain and simple. I personally don't think it's something the courts should have to deal with, but it's still a game exploit and rampant cheating has ruined more than one online game in the past. Sony has every right AND THE OBLIGATION TO IT'S NON-CHEATING USERS to do whatever it can to hamper efforts to use game cracks/hacks/whatever to gain an unfair advantage over other players.
That said, Sony better come up with something other than legal action in their efforts or they will suffer an amazingly embarassing loss. Short of pulling the game off the shelves, it's unlikely they'll actually succeed in "winning" this battle.
Every patch can change the license. How often am I expected to read it all. No, I click a button that for all intents and purposes reads "get me the f**k into EverQuest".
I think the only factor that prevents a Palladium-based security model from being applied here is the fact that if they did that, they would have to make Palladium the only platform on which the game is available. Microsoft has quite a lot of skeptical people to sell on that concept before that becomes a viable business decision.
Like other ShowEQ users, I'll happily admit I used it. And I knew a LOT other people who used it too.
Using ShowEQ is cheating, I'll admit that much as well. But the truth is, ShowEQ IS a benefit to Sony/Verant and they know it. Most of the ShowEQ users like myself would have quit EQ LONG ago if not for ShowEQ. It's kind of hard to explain, but I played EQ RABIDLY for about two years. I mean it was a total obsession. I had a level 60 Shaman, and level 57 Rogue...played both characters at the same time, and was pretty bored with the game. When I installed ShowEQ, I ended up playing at least 8 months longer, because EQ became FUN again.
And you'd be suprised how many ShowEQ users are out there... I'd guess nearly 20-30 percent of the current EQ users use it. I know for a fact that ALL of the high level guilds use it. It's just too powerful of a tool. Here is an example, and excuse me for not remembering the names, but there is a super rare giant turtle in EQ, that spawns in an very large and usually devoid of users zone. If he did spawn, he'd usually wipe out any players in the zone that wandered to close, and then he'd despawn. Well I happen to be passing through the zone with my two characters, when this guy spawned right next to me, way out in the water. I check my ShowEQ map and see that there is only 20 people in the zone. most of them lower levels like 30-45. The funny thing was though, all of the higher level players in the zone, anyone level 59 or 60 where running on a BEELINE to my location. I'm talking level 60 warriors with NO TRACKING ABILITY, for some reason running RIGHT AT THE turtle, from accrossed the zone. Obviously all of the high level players where using ShowEQ, because there would be NO other reason to be running way out over the water for no reason, unless you KNEW the turtled had spawned.
In the end, the "elite" guild on our server (Cazic Thule) got the kill, and I could tell all of them were using ShowEQ.
Sony is definitely in a tough spot because they know as well as I do that ALL of the elite EQ guilds use ShowEQ. If Sony ever did find a way to block ShowEQ users I'd be willing to bet 20 percent of their user base would quit EQ, because once you've used it, you'd never play EQ without it.
..but the reason why ShowEQ works is because of core design decisions. Core issues are pervasive and will never be solved trivally. They will probably be in the game till it dies....
Planes of Power in general is the smoothest, best release of an Everquest expandsion yet. It does some things that render ShowEQ weaker. They've removed as much client side monekying as they could. "Cheating" now is more about information wars than gaining a tactical engagement advantage.
Information is power in EQ (there is a huge stink about the players who were allowed to close Beta POP had a HUGE advantage over those who did not). If you know what drops to look for, what monsters are key, what pitsfalls to avoid then you'll be spending more time advancing than picking up the pieces. With POP the barries for entry are quite high. Power Players who feel the crunch now more than ever are relying on external ways to farm information.
So the things Sony/Verant are fighting are the non-obvious shortcuts. They want players to hunt high and low for the 4 monsters (out of the 1,000) that live in hidden caves. ShowEQ is used as a valuable short cut. ShowEQ can show you where the 4 monsters in the zone that you need to progress but only lightly helps you kill them.
Any competent guild can survive without ShowEQ. With that being said, its something that most competent guilds use because it lets them focus on solving problems instead of farming information. How much of this is cheating and how much of it is getting around annoying RP-isms that don't work well in games is still up to debate.
One thing that is being touched on in the debate is the idea of 3rd Party programs. Every game including EQ has shown that the developer does not have enough time and energy to extend the game's functionality exactly the way the players want it. However the players do. The spiffy UI is extensible and a great boon to players. If Verant/Sony is unwilling to extend the game to match Player's requirements then why not let them? If one wants to create a bot that hooks up a character to an irc channel then why not? If one wants to create a bot that emails people who aren't online then why not? This kind of extensibility I really love and all game makers should do more to promote.
There is no license on the outside of the box. I buy a piece of property- game cds and install it on my computer and after the seal has been broken and who knows what is now on my computer they say I have to accept this license to play the game. And they do it again after I pay ten bucks a month?
For any normal contract you are told the terms before you pay. This was the case with my apartment, car loan, and ISP. Why should any software be subject to a different set of rules?
Just a Tuna in the Sea of Life
...Phantasy Star Online for Dreamcast was all hacked up within months of release. I think hacking will probably put a serious dent in the number of people that play MMORPGS...and Sony knows it, hence their efforts to stop it. It's really sad that some miscreants get power trips off cheating in online games. It pretty much limits players to playing with people they know, which greatly limits the pool of available people to play with, thus stealing from us the internets greatest promise...a vast number of people from all over the world to interact with.
CPU time costs money, the more CPU time they burn on the server, the more money it costs them in terms of CPU time.
OTOH, client machines have tons of CPU cycles that they aren't using or don't really need. The more you can offload to them the better.
Cheaters can ruin a game for a lot of people, and people upset at cheaters leave and cost sony money.
So it becomes an optimization problem, (in the statistical sense, not the computational one).
Do enough to prevent cheating so that you wont lose more customers' income then the cost of the server load that's caused by your anti-cheating software.
Throwing monkey wrenches into the cheater-coder's work is a very cheap way to prevent cheating that changes the equations around.
autopr0n is like, down and stuff.
The fact that privacy is not referred to in the Constitution does not strike me as a particularly convincing argument that we have no right to privacy. In fact, it seems much more likely that the Constitution omits privacy because the Founding Fathers did not in their wildest dreams imagine that privacy could be taken away.
There is simply no way the Founding Fathers could have conceived of satellite photography, long range directional microphones, thermal imaging sensors that work through walls, or any of the incredible array of privacy-violating devices that society has at their disposal today.