Verant Backs Down On Drive-Scanning

fastpage writes, "Verant, the people who bring you Everquest, are backing down on scanning users' computers for anything they want to prevent cheating." Read the CNET story. "I guess getting Web sites shut down to prevent the distribution of ShowEQ wasn't enough."

Cheating is fun!

Some of us approach games from a less naive point of view. Rather than seeing them as the man expects us to (heh), we see a technical challenge. Games tend to define a goal, and game developers tend to encourage a single approach to achieving that goal. Cheaters approach a game from a more open viewpoint. In this regard cheaters are the innovators. Cheaters see that there is more than one way to achieve the stated goal. It is when script kiddies of the cheating world misuse these cheats that problems occur.

logan

Re:Verant and Drive Scanning

Hey, I blew my top :)

Perhaps "incompetant management" would be a better description. Being part of the computer industry I've seen many cases where the engineers and coders want to do "the right thing", but management decides that they should do "the lazy thing" because it costs less or takes less time.

Latency is a part of internet games. It is and always will be. Giving clients extra information in an attempt to hide it is just asking for trouble. In general a game client really should just be a dumb terminal, periodically receiving state updates from a server, and never being trusted. The problem of client trust is way beyond the scope of this slashdot article, but for the purposes of a game, the basic idea is that "The Client Can Never Be Trusted".

When you assume a client is trustworthy, for whatever reason (trying to reduce the appearance of lag) you open yourself up to cheating. This is a choice Verant made when they developed the game, and one they should now accept and deal with.
________________________________

Re:A quick note:

>The scanner in question did NOT scan registry, HD, browser history, etc.

But the change in the EULA would allow them to do this. With no legal restrictions, no matter what they said.

>The Verant Management has maintained a very open line of communication with their customer base,

Really? They had an "April Fools" joke recently which cause an outrage from its customers, mainly because they didn't TRUST Verant that it was a joke.

>a mandatory poll of the users asking them about allowing Verant to scan for cheating programs

There was nothing mandatory about it. The poll was only created because so many people were outraged because of it.

>(80+% agreed with the scanning).

Which question? There were two forms of questions during the poll. The first being something like "Do you agree that Verant should stop hacking programs?" Don't you think thats a bit biased?

>I'm at a loss to think of a better resolution to deal with people acting like scumbags.

As I mentioned in another post, what they wanted to get rid of is ShowEQ. They can limit its functionality greatly just by not sending so much irrelevant information.

Devil's Advocate

First off, 90% of any post I see related to EQ is always bashing Verant for one reason or another. I think a lot of these posts aren't warrented, and their authors aren't giving Verant a fair chance. But this is the same for any corporation / company... when anything goes wrong, or doesn't go the way they want it to, people scream and yell and say "SEE! *THIS* is capitalism at work!" You're all crazy.
Capitalism at work is keeping your customers happy. If they're happy, they'll keep coming back to buy your product.

When Verant annoucned they were going to scan your tasklist for cheat programs, they also put a poll in at the login screen, stating something to the nature of "Do you have a problem with Verant checking for cheat programs when you run EQ?"

That's right - they *ask* their users for thier opinions.

And *despite* the fact that 83% (out of 15000) responded they were fine with running a check for cheating, *Verant decided not to do it*. Why?

Because enough people had stated they felt it was chipping too much into their privacy.

But the worst part is that people decided to make up ways Verant was checking for these hack/cheating programs... for example, scanning directory trees (false), internet files (false), internet history (false), cookies (false), and email (false).

What was the check suppost to do? "The client simply would examine a small subset of information on your system, none of it containing information personally identifiable to a third party, and only send it to our server in the event that you were "running" an illegal program at the same time you ran EQ." I'm assuming here "illegal program" means a program designed to give a user an advantage over other users in EQ.

I understand some people would say this is an invasion of privacy. Some of those people are honestly worried about the continuous breach in our privacy in general. I'm willing to bet that the majority of people who cried "Foul!" were worried they wouldn't get to use thier cheat programs anymore.
Or, they were the people who find a reason to scream "SEE! Capitalism at work! Invasion of privacy! Invasion of privacy!" when it isn't justified.

This post is way too long already, but I've got more to say on the issue. If you disagree, or agree, post and we'll talk.

The information I used in this post can be found at EQ Stratics [stratics.com] or The EQ Vault [eqvault.com].

lw

Is Everyone At Fault?

Is it Verant and the designers of EQ for being somewhat laxed in their design? It is one thing that the server has to tell the client where all of the dynamic objects in the world are position, it is something else to blantanly tell the client extra junk about them. There is no particular reason why the client needs to know the exact hit points of a creature. It should have been broadcast to the client as a percentage, which in the end is what the player ends up seeing. If they were really concerned about people "eavesdropping", they should have encrypted the data streams. Scanning the computer to see if hacker tools are employed is a weak attempt to stop this kind of exploit, at best, and, at worse, it is wrong.

In another sense, Verant and EQ are trying to act in the best interest of the game. How many people will continue to play a game of Chess against a person who is blantantly cheating? EQ should probably be no different. I want them to actively keep the game from descending into a hacker's paradise.

Is it the players are at fault for trying such junk in the first place? And please don't quote me "the players pay have a right to do what they want" because that isn't true. By agreeing to play any game, you agree to follow a certain framework of rules. If a cheater is playing someone in a game a real world Chess and the cheater is caught cheating, they really have no defense. EQ should be no different. The "neutral tool" argument doesn't really work here either(ie. 'hammer is a tool that does some good things and bad things...do we outlaw hammers?'). ShowEQ isn't a generic tool that has other applications. It was designed for one purpose and one purpose only. If ShowEQ was designed for "acedemic reason" that is one thing but I have a hard time believing so many people are interested in ShowEQ because it teaches useful programming skills.

In another sense, players should push Verant and the EQ Architecture to the limit. The only way the game will get better is if the players push on Verant to improve it. As mentioned before, the fact that you can listen to packets flying by and find out extra information indicates a weakness in their design. It should be pointed out that one of the useful things that came out of ShowEQ is that it was shown that reduntant information was coming back from the server. Verant did take note and said they would do something about it (although I'm unclear whether or not they actually fixed it. ^_^). How can the players do this without actually figuring out how some of the game works?

IMHO, both sides blew this way out of proportion. Verant didn't think things through when they wanted to stop players from packet listening and came up with the wrong solution. Instead of wasting time and effort into figuring out how to detect packet sniffing, they should be putting time and effort into fixing the real problem which: too much information is sent over the wire. Players blew this way out of proportion because because Verant basically said "We don't really care if you have hacking tools...just don't use them while playing EQ" but many read much more into it. If you are going to do something questionable, shady, etc. you probably shouldn't be doing it in "plain sight" (yes, on Windows 95/98, the hard disk is plain sight...everything in Windows 95/98 is in plain sight) especially after you've been warned.

Security in Online Games

I'm glad that this company has backed down over this. But whilst their method of trying to ensure a level playing field for all was clumsy, at least they had players interests at heart. The only game I play online right now is Unreal, and when I'm getting my butt kicked every which way I have to wonder... Is that guy that just fragged me really good, or has he got a software advantage? The thing is, I don't know. How would you go about making sure that no one is cheating in an on line game? You can checksum the executable, but that can be forged. And how do you go about making sure that there are no little packet interceptors which correct your aim?
/.ers are always willing to disregard "security through obscurity", but how would you design an open method go about this, aiming to get 100% surety that no one is cheating?

Strong data typing is for those with weak minds.

Doubleclick,the Feds and Verant

Doubleclick,the Feds and Verant all seem to be in the same business. Doubleclick for obvious reasons, the Fed this week pumping the Bill S. 2092, which will give the federal government's ``trap and trace'' authority, and now Verant. Law enforcement and now mainstream business views the Fourth Amendment as the problem. That's the piece of the Bill of Rights that protects ``persons, houses, papers and effects against unreasonable searches and seizures''-- with no mention of data and what it represents. And so now, the corporations and the government want to force manufacturers to build surveillance into technology, all but eliminating another basic right of privacy.

..in a related story..

...the authors of hacking tools included code that checks for the presence of EverQuest during installation, and, if present, installs the "extra-strength super-dooper stealth" version.

Those who attempt 'security through obscurity' achieve 'obscurity through stupidity'. Frankly, I prefer 'security through perversity'.

I play EQ

I play Eq and as anyone else who plays knows EVERYTIME you log on they require you to read and agree to the license. It has been a long standng joke that they change the license regularly without telling us.

This is, while I can see there side, just the latest in turning the world of Norrath into more of a police state. Over the last few months they have recuited more guides (read police) to enforce their new play nice policy.

Basically the policy is that anyone who pisses off anyone else is up for disciplinary action that include suspension and expulsion. (sounds like high school no?) While on the one hand they have created a very nice game and are wildly successful, theat success has caused growing pains on their side.

A few examples of the pains are the fact that each server is disigned to have 1000 - 1200 people playing on it at any one time, you are hard pressed to find any server that has less than 1800 users and many are hitting 2000 during peak hours. For those that haven't experieinced once you select a server that is where your avatar lives it's life, forever. No crossing from one server to another. As your friends join up they want to hang w you so they joing your server compunding the problem.

This excess of players stresses the system on two fronts of course the technical side with zones and servers crashing sometimes for days losing the entire player database, but also the in game resources are pushed having not been designed for that many people. This causes a shortage of things to do with people camping waiting for the first enemy to appear and not only battle the enemy but argue with other players over who it belongs too. This breeds animosity among players who are NOT allowed to kill one another (except under certain mutally agreed circumstance. So now maybe you understand. While Verant has learned from the mistakes of Ultima they have still created their own special problems.

Overall though the game is so very well done and when it works the experience is so cool that we all hang out and keep playing. For the unititated all I can say is that the social aspects of the game are in my opinion what keep people playing.

daddio

Its covered blow by blow here

http://lum.xrgaming.net scroll down a bit, its got about 6 posts with letters from Verant President John Smedley himself, + Verant lawyers.

Why shouldn't they worry?

Lets face it, people who game online like to get the edge over their opponents, and one of the ways they do this is to cheat. There is a proliferation of tools to do this for various online games, and users can easily find them on the net.

When even one person cheats it makes the entire game less fun for everyone else playing it. Instead of a test of skill it becomes a farce, with little or no skill being required to win or proceed. Verant, obviously worried about the quality and fun of their game EverQuest, were being entirely reasonable by wanting to prevent the use of cheating tools.

Given this concern, the only reasonable and effective thing for them to have done was to scan the user's hard drive for said cheating tool. This isn't a privacy issue - they're only scanning for a tool which will lessen everybody's enjoyment of their game. If you are are against this then you are letting people ruin the game by cheating, which is hardly fair to other users.

Privacy Violation over EVERQUEST?

Ridiculous. I can't say I'm surprised though. A bunch of suits sitting around a board room discussing their moneymaker and saying "Hmm. we need a way to keep the game fair. I know, let's require anybody who wants to play to give us total access to their computers. They ought to go for that."

The game has YET to be invented that will make me want to trade in my privacy in order that I might keep some other guy from getting some extra HP or resources by cheating.

Not to mention that if you have to cheat at a game just to be competative -- how much fun can it possibly be?

... kinda like the problem with playing Quake online... The levels are completely unimaginative, and it comes down to ping speed & hardware to decide the winner. Adding things like LIMITED weapons, ammo & powerups would require people to conserve their ammo and to play strategically, rather than switching over to rocket launcher, putting it on autorun and holding down their fire button.

But it's all just games anyway, right? Relax, people. Have fun. Stop nosing around on my PC.


-The Reverend

Re:Further progress in protecting online privacy

You bring up a very good point. Customers are able to influence a big company's decisions, especially on issues like privacy. One key point I'd like to highlight is this: they can only do this if they are informed. I think it's extremely important that we try out best to make the average Joe user aware of all the potential violations of privacy that's going on today. The reason that so many users today have such poor habits online (in terms of protecting their own privacy) is because they aren't aware of it.

This may be a bit off-topic, but I think this principle can be applied to other things too. Such as things like DMCA. It went by because very few were actually aware of the threats it represents. But if the average Joe user is made aware of these issues, I'm sure the masses will be able to force the powers that be to change things. Just like this case: imagine if nobody knew that the latest Everquest upgrade scanned their computers. Nothing would be done about it, and privacy will be compromised. But once people found out about it, they took action, and things changed. I'm sure this can happen on other areas too, like DMCA, etc..

Verant Reveals Its Hand

The question is no longer whether Verant *ought* to rummage through its user's computers looking for whatever it feels like.

The question is, what prevents anyone else from doing so?

If Verant can modify Everquest such that it ships with Back Orifice 2000, and the only thing that prevented them from doing so was the (thankfully effective!) fear of inadequate liability disclaimers, what *exactly* prevents anyone else, who *doesn't* particularly worry so much about the law, from attacking any Everquest player they please with a trojan'd update?

I betcha nothing but the network, as if "well, it came from Verant's DNS name, so it *can't* be spoofable." *sigh* I'm reminded of the Genie from Alladin..."PHENOMENAL COSMIC POWERS...itty bitty security." Oh, and toss in a little bit of obscurity to be on the safe side.

I should be fair. There's an off chance that there's some cryptographic protection against such an attack being sued by Verant. That'd be nice. I'd like that, as I do cryptography. Day in, day out, it's what I've been living, breathing, thinking, and scheming. And ya know what? I had a total compromise sitting around in my design, because I forgot the (rather simple, but marginally obscure fact) that it's rather trivial to convert a private key back into its public key equivalent. (Moral of the story, folks: Possession of a public key authenticates NOTHING.) Stupid problem, easy to fix, but then, that's my *job* right now.

I doubt I have an equivalent at Verant.

At best, Verant is employing some painfully inadequate public signature verification key to make sure that an update actually came from them. Rather likely, they're using some symmetric algorithm(RC2/RC4 most likely, as they're easily exportable) with a broken key length--not that it matters, since if they're using a symmetric key to authenticate the packages, then the same key that Verant used to sign the update shipped with every copy of Everquest--*cough* itty bitty security. Same shtick if they use a MD5-signature variant--the "key" used to authenticate the package as coming from Verant and not Joe Cracker necessarily gets shipped with each box.

Of course, who am I kidding. We'd be lucky if there's an XOR in the lot. (XOR, for the non cryptographers out there, is a thoroughly broken but easy to implement logic operation that one can run on data to make it "appear" encrypted. Appearances...can be deceiving.)

Folks, this is a *real* problem. Whenever you're doing crypto, you have to separate the world into Us vs. Them. I don't have a problem trusting Verant--they've got deep pockets, they've got skittish lawyers, and if they try anything, we'll see 'em telegraph it in the licensing agreement. (And if they do things without changing the agreement, We Know Where They Live.) So, for the moment, "Us" is Verant and Me, as an Individual Gamer. Them is every *other* gamer, malcontent, and kangaroo down under.

The question to ask yourself, is: What allows Us to determine what code is executed on the client machine, and not Them?

The next question to ask yourself is, since *you're* the one at risk with the client machine, and not Verant, how likely is it that Verant even broke a sweat regarding the answer to the previous question?

Great. Verant isn't going to hack their users, out of the goodness of their lawyers paranoia. So who will?

What about other games here, folks? Am I the only one noticing that large portions of the Windows software space are suddenly becoming net enabled for no other reason but to deliver ads(at best) and trojans(over time)?

This isn't the first time I've run a company through the ringer over automatic execution of code(both Microsoft and Novell have painfully inadequate checking on their login script functionality; more at www.doxpara.com), but as much as /. likes to bash Microsoft, at least MS can be assured to have considered cryptographic protections.

Sure, they rejected 'em, but still...you gotta know they at least considered 'em. Verant, on the other hand?

Does anyone know?

Email or reply if any of this concerns you. I've had some interesting reponses planned to this trend that I just haven't had the resources to implement. With some help, we might actually be able to...deal with this situation.

Yours Truly,

Dan Kaminsky
DoxPara Research
http://www.doxpara.com

The real story...

For those that don't have the time or inclination to look at the whole story here's the deal as I observed it over the last little while.

First Everquest doesn't have that large of a real cheating problem, they're very good at logging any strange client behaviour and banning people the minute they're caught. However, a program was released to the public domain a while back called ShowEQ, this program is a passive sniffer that reads the data stream between the client and the server and displays data that gives the user an advantage over other players, basicly it's a realtime map of all the monsters in a zone with their hps and level.

Verant has been trying to combat this for a while by constantly changing their encryption scheme but has thus far been unsuccessful in locking the people maintaining the program out for more than a few days.

ShowEQ ran on Linux, recently someone released a Windows version and this is what verant claims they were scanning for (The passive client on linux is really impossible for them to detect)

Someone recently posted a message on the EQ message boards asking why verant was scanning the task list of their computer and uploading what was running back to the servers, this is prior to the announcement that they wanted to do this btw, Verant was extremely quiet about this thread until the announcement was made that they were changing the end user license which you have to agree to every time you start the everquest client.

All these threads are still available and it's somewhat interesting to read what Verant's reps posted in response. If you want to see check http://everquest.station.sony.com and click on the message boards link.

Part of Verant's problem is they've been fostering a real Us vs the Players attitude (Although they probably don't intend to, but anyone who's been on a MUS* before realizes that it's just part of the lifecyle of such games) By refusing to answer player questions about game mechanics and such, some people have used ShowEQ to get real answers to these questions, such as how the experience system works and such.

I was marginally involved in developing ShowEQ

And its simply an RE job on the datastream. Passive, nothing more. All it does is lets you see the REAL numbers behind the game that Verant tries to hide with handwaving and frantic knees-bent running about behavior.

The reason? They have some severe design flaws in their game, as well as a piss poor and arrogant attitude toward their player base. The only reason they are raking it in is because nobody else has such a thing on the market yet. They were stomping sites until it got moved to www.hackersquest.gomp.ch, (notice the NON-us addy?) a host site that doesnt have anyone that clicked the Verant EULA, and so far seems immune to their lawyers.

And the prog runs on a separate Linux box: using NAT/ipchains and routing the win box thru the linux box is best, but it can also put the ethX device into promisc and sniff the data. So, really, there isnt jack they can do about detecting it. They seemd to live with this until... What brought this "corporate sniffing" on is that someone took the open source and did a windows port. So every little k3w3l d00d and wannebe could use it.

Verant went into Corporate panic mode - typical of their nasty anti-gamer managerial mindset. Verant went psycho trying to stop it.

But the scariest thing is: when they polled 15,000 of their users, 83% agreed to let Verant search their HD as a precondition of playing the game!!!

What kind of sheep are these? I pity the folks who will need to depend on such weak and obedient asses who will kneel down for a compny just to be allowed to play a game that they are already paying for!

EQ players who said Yes in that poll, you should be ashamed!

Further progress in protecting online privacy

Isn't it interesting how this particular arena (privacy) seems to put so much more power in the hands of the consumer than any other?

I think it's because when someone's privacy gets threatened, they feel much more quickly capable of taking significant action, to the extent that they're willing to switch provider, give up a forum or a game they enjoy, or use alternatives (sometimes of dubious legality), in order to protect it.

In terms of the influences faced by online companies today, it seems to be quite a high priority to satisfy the privacy needs of customers, even though this is not a natural consequence of their desire to make profits, but rather caused by an obsession (healthy, in my opinion) with privacy on the part of individuals.

We've seen quite a few radical reversals of policy on the part of some very large corporations (Doubleclick or Intel for example), which would seem to imply that online consumers, as a separately identifiable group, are becoming quite powerful in their own right.

Long may it last!

A quick note:

I think it's important to note before the standard Slashdot privacy feeding frenzy starts that Verant has done their best to act responsibly on this issue. A couple things to pay attention: The scanner in question did NOT scan registry, HD, browser history, etc. It was doing latency checks (for proxy server goofiness) and running task checks. The Verant Management has maintained a very open line of communication with their customer base, including a producer letter, EULA modifications (with explanations to the users), IRC chats with Sony lawyers, and a mandatory poll of the users asking them about allowing Verant to scan for cheating programs (80+% agreed with the scanning). Admittedly, I don't like people looking at whats going on with my computer in any way shape or form, but I'm at a loss to think of a better resolution to deal with people acting like scumbags. -Matt Burch Everquest Junkie

Verant and Drive Scanning

I run a fairly large EverQuest-related humor site [stratics.com], so I've been following this issue since it started (even if only to make fun of it).

What's happening here is a thorny problem where individual "privacy" headbutts with everyone's best interests.

A quick background for those not in the know, Verant Interactive [verant.com] produces and maintains EverQuest [everquest.com], a massively-multiplayer online role-playing game. Thousands of players connect to Verant-administered servers and play alongside other players in a persistent world. It's the second major-market title in the MMORPG genre started by Ultima Online [uo.com].

The way these games work is centralized servers store all the state information about the virtual world. To be general, nothing is stored client-side. This is required, because unlike games like Quake [idsoftware.com], the world is persistent. An early incarnation of this type of game was Diablo [blizzard.com]. The main difference between the newer games (UO and EQ) and Diablo is that with Diablo, all your character information was stored client-side. This became a major problem for the game, as it was only a matter of time before the file formats were reverse-engineered and people started modifying their characters to be super-powered.

By storing the information server-side, this type of cheating is avoided. No matter what you do, there will always be people who want to cheat, and if the information is stored server-side, people will try to exploit the server to cheat, or will "enhance" their client software in order to give them an unfair advantage in the game. Ultima Online has had a long history of dealing with this type of problem. Many security weaknesses in the UO servers were discovered (and fixed), but at the same time, these weaknesses were exploited by people, most often to do devestating things to other players of the game.

Recently, EQ has had the same things happening to it. A program known as "Show-EQ" has been around for quite some time, which simply gives a player an unfair advantage in the game. Verant has dealt with this in a subtle manner, changing their client/server data stream every so often to set back development of the utility.

In the past couple weeks, other programs for EQ have begun to pop up, with more nefarious purposes. The EverQuest servers have been crashed on more than one occasion by these programs. This is what brought Verant to suggesting drive-scanning. It's one thing if someone is just cheating, but it's another thing completely if they're maliciously trying to crash the game.

They took their first countermeasures not too long ago, by adding a feature to the client software that scans your Windows task list and looks for these "external utilities". If it finds one, it flips a "I'm a cheater" flag on your account and you end up with a cancelled EQ account.

They proposed to extend their search to the hard drive, to see if any of these programs even exist on your system... and this is where people started to get upset.

Verant has been very open and forthcoming about the proposed changes, keeping active discussions regarding the issue on the various websites dedicated to EverQuest, offering reasoning and explantions of the scanning process, and they even required all users to answer a poll question regarding the issue on login to the game (which turned up 80%+ in favor of the scanning).

Even with the overwhelming support of the scanning by their playerbase, they responsibly decided to back down on the issue.

Now granted, what they suggested could be a huge tool for abuse and privacy intrusion, but they did not try to "sneak" it past their users in any form. What they were proposing was nothing compared to some of the things that people thought they were planning on doing (there have been some heated arguments about it the past few days).

In short, its not really that they intended to intrude on people's privacy, but that they were seeking to increase the quality of their service and actually have a way to enforce their "no cheating" rules.

Verant should be commended on their responsible handling of this entire incident, not trashed in the court of public opinion based on reports that only tell half the story, like the one posted here on Slashdot.