Warden and World of Warcraft

From AJS.COM

This article is part of the World of Warcraft: Raiding the Metagame series.

You may be hearing quite a lot about Warden, a program that runs along side World of Warcraft. This program has been the center of much controversy, and some people have even accused Blizzard (author of World of Warcraft) of installing a rootkit as a result. Even the BBC has gotten into the act, reporting: Warcraft game maker in spying row.^[1] The goal of this article is to explain what Warden is and why the controversy is a tempest in a teacup.

1 Warden
2 Why the controversy?
3 Why does Blizzard care?
4 But they said that Warden was a rootkit!
5 So is there a problem
6 References

Warden

Warden is a program that Blizzard bought in order to track the use of malicious programs that try to either control the World of Warcraft game (bot) or spy on a user running the game (keylogger). Bots and keyloggers are a major problem for World of Warcraft, and Blizzard takes them very seriously (we'll get int why later). What Warden does is akin to an anti-virus scanner. That's it. They look for programs that violate the terms of the license agreement such as bots and report that back to Blizzard's servers. For the average Warcraft user who doesn't even know for sure what a bot is, this is a moot point.

Why the controversy?

Ah, now we get to the meat of the issue. There are certain parties out there known as gold farmers. They make money gathering up in-game money and selling it to players. Blizzard strongly discourages this, and it is against the terms of use, meaning that you will be kicked out the game for doing it. The arms race between the gold farmers and Blizzard has been raging since the game was released, and Warden has long been a central tool in that arms race. Blizzard uses Warden to detect the programs that gold farmers use to increase the speed at which they can gather gold and mass-bans tens of thousands of accounts at once.^[2]

In a recent turn of events, the gold farmers have struck back in the press. When Blizzard started encrypting the report that Warden sends back to them, blogs appeared claiming that this could be the start of some kind of malicious attempt to subvert system security because encrypting data and providing ways for the company to change what data is sent and how it's encrypted is what viruses and worms do.^[3] Well, that's true, but what these software authors fail to tell you (yes, these are the people writing the tools to control WoW) is that World of Warcraft itself does the same thing, as do thousands of other games and applications that speak to a central server. Encrypting data, keeping the protocol for speaking to the server secret and allowing for server-side mandated client updates is the way most Internet-based software works these days if it has to be concerned with security at all.

It's important to realize here that Warden hasn't changed what it does. It still scans and reports like it has for years. What's changed is the ability for the abusers to find a way around it because it's now hiding what it does. That's it.

Why does Blizzard care?

It's a bit outside of the scope of this article, but the main reason that gold farming is a problem is because gold (in-game money) is the heart of the World of Warcraft economy, and like all economies, Warcraft's responds to external pressure. If gold farmers were allowed to sell practically infinite amounts of gold, then prices for items would rise and players would pretty much have to buy gold online in order to play the game. That's not what the game is supposed to be about, so Blizzard does everything they can to stop it. The larger problem for players is that gold farmers tend to automate their characters with these bots and take resources away from human players. For example, mining is one way to gather valuable items and make money. You have to run around to mining "nodes" that appear randomly and click on them to get ore and other items. When gold-farming bots are most active it's almost impossible to get any of these mining nodes, as they will be mechanically running around to every spot that the nodes might appear for hours and days on end. This is not a fun game.

Ultimately Blizzard has an agreement with their users and the people upset by Warden are the people who violate that agreement.

But they said that Warden was a rootkit!

A rootkit is a program that subverts the security of your system. Warden doesn't do that. All Warden does is look at your system and report on what potentially abusive software you have installed. If you don't want it to do this, you can stop it, but the cure is probably worse than the ailment (you would need virtualization software like VMWare and a separate Windows installation on the same machine, running under VMWare). You might even find this objectionable. That's fine, but it's not a rootkit, and the use of that term^[4] is clearly an attempt to gather press attention to this issue, not report on the program accurately.

So is there a problem

Yes. There's a concern here at a much higher level. Companies are taking the position that they need to monitor what a computer does in order to reliably communicate with an end-user. That's not a big deal for World of Warcraft, but as a trend it demands that we think about what it is that we want our computers to be doing on our behalf. We should be asking: why would my music CD have to install additional software?^[5] We should be concerned about the potential for security problems with software that wants to talk to the network, and when people find problems, we should expect the companies that wrote the software to promptly fix or remove it.

None of this is why people are attacking Blizzard over Warden. They're attacking Blizzard because they've made a business of subverting the Terms of Use for World of Warcraft, and Blizzards attempts to enforce those terms are growing increasingly effective.