No Barriers to Fun!

We met our friend Giddeon at the AbleGamers Accessibility Arcade in Atlantic City, New Jersey. When he first sat down with the AbleGamers crew, Giddeon didn't want to play any games. He told us that with his disability gaming was difficult. Giddeon has a rare disease that caused the growth of his arms .. Read More
A Window to the World

Shepherd University invited the AbleGamers Foundation to come on campus and do one of our Accessibility Arcades for the students and local disabled community. The event was a roaring success with hundreds of children and adults coming out to see the technology and in some cases experience gaming the first time. Read More

About the AbleGamers Foundation

Since 2004, the AbleGamers Foundation, a 501(c)(3) public charity, has served more than 56 million members of the disabled community by advocating greater access in video games. Today, AbleGamers is a leader in the development of equipment, programs and services to those living with disabilities, hardships, and quality-of-life issues that are a result of chronic illness or trauma. It is our goal to ensure that all people, regardless of their disability, can use gaming as a tool to have enriched social experiences with friends, family, and the world at large.

Last WOW Update Came With a Rootkit

Written by Mark C. Barlet

Published on 18 November 2007

World of Warcraft is not not only guilty of banning disabled gamers for using something other than a keyboard and mouse, but now they have released an update to the Warden program that is a real loss to the end user, because now it is a rootkit!

For those that do not know, Warden is a program installed by Blizzard that searches for the use of cheats. In the patch last week (11/13/07) Blizzard made some huge changes. As the On Warden Blog says, “The changes to Warden effectively remove our ability as a community to police Blizzard's activities, and may lead to undetected violations of personal privacy, among other possibilities.”

Now if you want your head to explode with technical information about how WOW scans your system (and may now be sending all sorts of information to Blizzard) you need to go to ON WARDEN. Can we trust Blizzard taking any information they want from your computer?

polymorphic code is code that mutates while keeping the original algorithm intact. This technique is sometimes used by computer viruses, shellcodes and computer worms to hide their presence. A rootkit is a general description of a set of programs which work to subvert control of an operating system from its legitimate operators. Usually, a rootkit will obscure its installation and attempt to prevent its removal through a subversion of standard system security. Techniques can include concealing running processes, files or system data from the operating system A Trojan horse, or simply trojan, is a piece of software which appears to perform a certain action, but in fact, performs another. Contrary to popular belief, this action, usually encoded in a hidden payload, may or may not be acutely malicious, but Trojan horses are notorious today for their use in the installation of backdoor programs.

One last thing, if you want to know what Warden is, and you are not an uber geek (like me), you should go here. Here are the first 10 of the "Plain English," they go on for 13.

I'll attempt to make clear and concise statements to help clear things up, and point to the real issues.

Warden is a piece of software that Blizzard Entertainment uses to help protect World of Warcraft (WoW) from a world of cheaters and other perceived enemies, since its inception in a patch of the game on July 12, 2005.

I am regarded as one of the most knowledgeable individuals outside of Blizzard Entertainment on the topic of Warden, and have first-hand knowledge of Warden through reverse engineering nearly every minute detail of the software since its inception.

Warden as a whole is composed of three basic pieces: a piece on servers run by Blizzard, a piece in the World of Warcraft client that remains there until patched with the rest of the game, and a piece sent during the WoW login process that can also be replaced any time afterward

The piece sent during the WoW login process is the piece generally spoken of as simply Warden (and this is the piece I will refer to as Warden hereafter)

Warden is polymorphic. What this means is that they generally create one set of functionality, and create hundreds of non-identical copies (which I will refer to as permutations) of it that produce the same end result. The reason for being polymorphic is to make Warden marginally harder to circumvent, and harder to detect when Warden has been updated with new functionality.

There is typically about 318 permutations of Warden in distribution at any given time, according to our tracking information. This may be different as of the last few days, as at present time, Blizzard is only rotating a single permutation into the wild every few hours. Bear in mind that can change at any time, and may go back to 318, or could literally be any other number bound only by Blizzard's computational power to produce them (without implying any such intent, WoW provides them with a lot of money, if they wanted to this could be a much bigger number than 318).

Warden currently has roughly a dozen scans available to it. Each scan searches for one type of thing, typically being informed of a specific thing of that type to scan for upon request by the server. For example, one scan that was previously used is a scan that could find a window open on your computer, and that scan would be told to run and look for a window titled "My cheat program" (not really that specifically, but for an easy to understand example).

Scan responses typically involve simply a YES or NO answer, for example a NO that it did not find a window titled "My cheat program". Other scan responses do involve bits of memory directly retrieved from the World of Warcraft process, usually not encrypted.

Warden performs a set of scans at random every 15 seconds during World of Warcraft play, per instructions from the game server. The scans are run, and the results sent back to Blizzard.

Warden is effectively useless the vast majority of the time. The process generally works by making the assumption that for some period of time after a Warden update (meaning one specific set of functionality consisting of any number of permutations, not an individual permutation), the scanning capabilities of Warden is unknown to the cheater, and furthermore that the time of the update is unknown to the cheater. During that period, any cheater unwise to the update is vulnerable. However, once it becomes known that Warden has been updated, and how to defeat it, cheaters are no longer vulnerable. Subsequently, during that period, Blizzard is the only entity that "knows" there is no concern for privacy, and customers are required to trust that.