Has Warden Gone Too Far? I think so. Warden = Rootkit

[Xzin]

"Coinciding with the most recent World of Warcraft patch (Tuesday, November 13, 2007), Blizzard has begun a more aggressive campaign with Warden. The changes to Warden effectively remove our ability as a community to police Blizzard's activities, and may lead to undetected violations of personal privacy, among other possibilities."

Here is the "plain english" version:
http://onwarden.blogspot.com/

The more technical read:
http://onwarden.blogspot.com/2007/11...s-brewing.html

I can't say I like these developments. I can understand the reasons for encrypting what they are doing. But the side effect..... and law of unintended consequences.... may even be considered illegal. I encourage you to read about the new WoW Rootkit.

Slashdot also has a say on the matter:

http://it.slashdot.org/article.pl?sid=07/11/15/1611208

[Wilbur]

I find this outrageous. The code they could potentially put into Warden is now almost on a viral level. I keep a check on huerustics and this is certainly going too far.

[Xzin]

I don't like the concept of ANY program with NO oversight. Sure, the encryption will be broken.... but I find this level of intrusion (or even the POSSIBILITY OF INTRUSION) to be far more than necessary for a GAME.

[Wilbur]

/me agrees

As has been stated by Lax (and proven by several communities) that Warden does not stop botters. The server-side detection methods are far more effective than the client-side methods have ever been. The new modifications to Warden effectively eliminate people who manipulate the game client on a packet level, leaving memory modification as the only *real* method for "hacking".

Personally I agree with Lax that Blizzard would never intentionally do anything to harm or infringe on its customers rights, however what they are doing sets a precedent. Companies in the future may not be as "secure" or trustworthy and this presents a huge problem with the users being less worried/concerned about their privacy.

If say America's Army (Made by the US government) distributed this software then there would be a world-wide outcry about it. I don't see why we should allow a corporation like Vivendi get away with it.

[kayb]

Making money is the ultimate motivator. Some random thoughts.

* Why would I make some of the FSW set-pieces be the best end-game pieces for shadowpriests for example?

* Why would I try to combat goldselling by adding a 5000G mount? Then continue to add new (expensive) flying mounts that you basically can just go out and purchase for gold.

* Why would I restrict access to some types of mobs? I don't have time to stand in line to grind fire elementals, and many others with me. I value my free time by the hour. I'd gladly pay 50g for a Primal Fire if it saved me half an hour.

* Why would I make the game so damn easy? And on top of that adding a powerful macrosystem to it?

Point is the longer it takes you to reach your goal, the more money I'll be making.

Gotta go to lunch...

[Djarid]

I have nothing constructive to add except my support that this is a step too far.

I find some of the comments on the technical blog disparaging the author ludicrous and lets be honest here, ignorant of the larger implications

[Otlecs]

My first, glib, response is "I don't care what Warden does". I don't cheat, have no intention of cheating, and applaud absolutely any method that defeats those that do.

I find the potential wider implications discussed on the above linked-article quite thought-provoking though. I think it's probably a sign of the times, and simply signifies the re-drawing of long-existing battle lines.

The same argument has been applied to online DRM in the past, and for as long as businesses see the need to "protect" their property (now, there's an argument to be had........) there will be people willing to defeat it.

Interesting stuff. Not something I find myself getting outraged or excited about though

[Wilbur]

The same argument has been applied to online DRM in the past, and for as long as businesses see the need to "protect" their property (now, there's an argument to be had........) there will be people willing to defeat it.

This is completely un-related. DRM did not have the potential to forcibly insert a virus into your computer, Warden *could* now do so, circumventing all anti-virus protection because it already has a hook.

I don't think it will ever happen, but the point is that there shouldn't be a possibility of it happening.

The only people that the new Warden will currently effect is the botters who are using extremely low resource custom built clients that are spoofing warden and are transmitting commands to WoW servers on a packet level. I'd say there are maybe one or two bot-farms in the world that do this, hardly sufficient to potentially compromise the security of almost 9 million customers.

[henrik.falk]

My first, glib, response is "I don't care what Warden does". I don't cheat, have no intention of cheating, and applaud absolutely any method that defeats those that do.

Thing is, how can we now know that stopping cheaters is what Warden actually does? Sure, we think it's meant to do that, but we can no longer know. So how can any of us really be happy this is going to help stop botters and cheaters?

I should add i think Blizzard of course have good intention at heart. But i don't like having this sort of structure built up, it can then easily have it's purpose changed, and we will all be screwed.

[Otlecs]

how can we now know that stopping cheaters is what Warden actually does

I don't think we ever really knew that. In fact, looking at the available resources, I think it's safe to say that it never did that very effectively *because* it was so easily fooled.

Now it's not so easily fooled, I suspect it will stop more cheaters than it did before.

I'm playing devil's advocate a little here, because I'm not blind to the wider implications, but if I squint with one eye through my blinkers, I can actually see how this is a Good Thing for the game.

In terms of re-purposing Warden, I tend to go with common sense, dangerous though that is

Blizzard are not going to change the use of Warden because it makes no business sense to do so.

Somebody's going to crack the encryption soon, Blizzard will update it, it will get cracked again, ad infinitum, so in the very near future and intermittently for as long as Warden and similar programs exist, we (or at least those who are interested) will know exactly what's being sent.

I doubt they're kidding themselves into thinking that whatever information they collect will remain secret for long.

The worst possible thing that could happen is that Warden becomes in some way exploitable leaving 9+ million subscribers' machines vulnerable in some way, but that was always a risk.