Game Publishers: If Your DRM, Anti-Cheat Software Does Creepy Installs, Warn Your Customers First

from the creepware dept

Any cursory review of our stories involving DRM will leave a sane reader with only one impression: the spectrum of customer viewpoints on video game DRM ranges from total and complete disgust and hatred to tolerance of DRM as an annoyance. In other words, there is no positive side of this spectrum. There are no gamers that are pro-DRM, only those that put up with it. On the flip side, there are many folks who not only hate DRM in video games, but also many who are quite wary of what that DRM is and is doing on or to their machines. There are historical reasons for this, from DRM support falling off and bricking previously bought games to DRM practices that appear to install shady shit on gamers' PCs.

In these modern times, it would be absurd to suggest that the general public has mostly graduated to a new level of technical proficiency... but I think we can also say that the average gamer is probably more aware of how these games operate and install on their machines than they have been in the past. Which is probably why, in 2021, it was a really bad idea for one game publisher to use anti-piracy measures that install what sure looks like unknown, shady software on customer machines.

Fans of the RPG Another Eden—out this month on PC—this week discovered that, alongside installing the game itself, copies of the game obtained on Steam were also installing something called ‘wfsdrv’ which seemingly had nothing to do with the game.

Initially believed to be some kind of driver, then suggested as something more sinister, fans scrambled to try to discover just what was nestling itself into their system32 folders, and could have been...literally anything.

Finding a game randomly installing something unexpected obviously throws up all kinds of red flags. Then, when you go looking for any information on this mysterious software and come up with nothing, it's likely to send your concern into overdrive. People on Steam and social media went nuts trying to figure out what this software is and why it was being installed on their machines.

As you've probably already guessed, it turns out it's a DRM/anti-cheat software. Another Eden developers eventually jumped into the Steam forums to try to calm everyone down.

We have been recently made aware about concerns users are having with the “wfsdrv” program that is installed along with the Steam version of Another Eden.

We take information privacy seriously at WFS and would like to alleviate any fears our users might have about the security of the recently released Steam version of Another Eden. The program in wfsdrv is an anti-cheat kernel driver, and is installed to protect the integrity of the Another Eden experience so that all players are able to operate in a fair play-environment.

This just isn't good enough. We'll leave aside for a moment that DRM and anti-cheat software is largely trash. Instead, it seems like a decent proposition that in 2021 you should give your customers a heads-up if you're going to be installing stuff on their machines that doesn't appear to be part of the game they bought. Something on the Steam page, or in the release notes. Maybe an FAQ that names the software by name so that anyone searching for information on it can see it.

Anything other than simply dropping it onto customer PCs without telling anyone and then trying to manage the fallout afterwards. Or, hey, maybe don't use this software that probably doesn't work anyway.

Filed Under: another eden, anti-cheat, drm, wfsdrv
Companies: wfs

Anti-Cheat Student Software Proctorio Issuing DMCA Takedowns Of Fair Use Critiques Over Its Code

from the fail dept

As we've discussed before, the COVID-19 pandemic has forced many educational institutions into remote learning and with it, remote test-taking. One of the issues in all of that is how to ensure students taking exams are doing so without cheating. Some institutions employ humans to watch students over video calls, to ensure they are not doing anything untoward. But many, many others are using software instead that is built to try to catch cheating by algorithmically spotting "clues" of cheating.

Proctorio is one of those anti-cheat platforms. The software has been the subject of some fairly intense criticism from students, many of whom allege both that the software seems to have trouble interpreting what darker-skinned students are doing on the screen and that it requires a ton of bandwidth, which many low-income students simply don't have access to. Erik Johnson, who is a student and security researcher, wanted to dig into Proctorio's workings. Given that it's a browser extension, he simply downloaded it and started digging through the readily available code. He then tweeted out his findings, along with links to Pastebin pages where he had shared the code he references in each tweet. Below are some of the tweets that you can reference for yourself.

It's important to note that these tweets are part of a regular string that Johnson has put out critiquing the way Proctorio functions. In other words, due to all the consternation over how Proctorio works among students, this is public criticism from a security researcher showing his work from source code that literally anyone can see if they download Proctorio. And, while you can see the tweets above currently, Proctorio initially had them taken down via DMCA takedown requests.

Those three tweets are no longer accessible on Twitter after Proctorio filed its takedown notices. The code shared on Pastebin is also no longer accessible, nor is a copy of the page available from the Internet Archive’s Wayback Machine, which said the web address had been “excluded.”

A spokesperson for Twitter told TechCrunch: “Per our copyright policy, we respond to valid copyright complaints sent to us by a copyright owner or their authorized representatives.”

Johnson provided TechCrunch a copy of the takedown notice sent by Twitter, which identified Proctorio’s marketing director John Devoy as the person who requested the takedown on behalf of Proctorio’s chief executive Mike Olsen, who is listed as the copyright owner.

When asked to comment at the time, Proctorio noted that just because anyone can see the code by downloading the software doesn't mean reproducing it is not a copyright violation. And that's true, although quite a stupid bit of copyright enforcement. What Proctorio didn't mention is that this sort of critique and use of copyrighted content in furtherance of that critique is precisely what Fair Use is meant to protect. That the company clearly did this as a method for getting some critical tweets taken down also went unmentioned.

“This is really a textbook example of fair use,” said EFF staff attorney Cara Gagliano. “What Erik did — posting excerpts of Proctorio’s code that showed the software features he was criticizing — is no different from quoting a book in a book review. That it’s code instead of literature doesn’t make the use any less fair.”

“Using DMCA notices to take down critical fair uses like Erik’s is absolutely inappropriate and an abuse of the takedown process,” said Gagliano. “DMCA notices should be lodged only when a copyright owner has a good faith belief that the challenged material infringes their copyrighted work — which requires the copyright owner to consider fair use before hitting send.

Which is probably why Twitter eventually reinstated Johnson's tweets in their entirety, although the message sent to him was that it did so because Proctorio's DMCA notice was "incomplete". Whatever the hell that means. You sort of have to wonder if the incomplete-ness of the notices would have been discovered if Johnson and the EFF hadn't kicked up a shitstorm about it.

Meanwhile, because of course, a lot more people know about the criticism of Proctorio thanks to its efforts to try to silence criticism. Isn't there a moniker for that?

Filed Under: anti-cheat, cheating, dmca, erik johnson, proctoring, remote learning, remote test taking, security research, software
Companies: proctorio, twitter

Denuvo's Anti-Cheat Software Now Getting Ripped From Games At Record Speed Too

from the failing-upward dept

Remember Denuvo? Back in the far simpler times of 2016-2018, which somehow seem light years better than 2020 despite being veritable dumpster fires in and of themselves, we wrote a series of posts about Denuvo's DRM and how it went from nigh-uncrackable to totally crackable upon games being released with it. Did we take a bit too much pleasure in this precipitous fall? Sure, though our general anti-DRM stance sort of mandated dunking on a company that once touted itself as invincible. Either way, it started to get comical watching publishers release a game with Denuvo, have the game cracked in a matter of days, if not hours, and then release a patch to remove Denuvo entirely from the game.

Due in part to this, Denuvo eventually announced it would be shifting its focus away from producing DRM that didn't work to making anti-cheat software. So, how is that going? Well, let's take a look at Doom Eternal, a game which only a week ago added to Denuvo's anti-cheat software via an update.

Doom Eternal has only had Denuvo anti-cheat software for a week, and already Id Software has agreed to take it out following the backlash from some PC players.  The anti-cheat software was added last week in Doom Eternal’s first major post-launch update and was aimed at curbing the use of exploits in its online multiplayer mode, specifically on PC. At the time of the update Id Software also said it would be more aggressive in banning players caught cheating and locking them out of all online content.

There were protests almost immediately. Some players complained that the anti-cheat software was setting off their virus protection programs’ alarm bells. Others took issue with the software requiring kernel-level access to their computers, fearing that it would leave them more vulnerable if the software was later hacked. Although Id Software tried to preemptively assuage players’ fears, saying that Denuvo anti-cheat is only active while the game is on and doesn’t take screenshots or scan file systems, thousands of players still took to review-bombing the game on Steam.

Now, review bombing kind of sucks as a rule, but then so does pushing out software that is as invasive as Denuvo's anti-cheat software after people had already purchased the game. In fact, given some of the security concerns and holes that Denuvo's software potentially opens up, one has to wonder seriously about liability here. Either way, you have to work really hard to get a bunch of online gamers for a wildly popular game to not want a tool to stop cheating in that game. And to that extent at least, Denuvo is a success.

For what it's worth, the folks behind Doom Eternal still want to tackle cheating, but perhaps do so in a way that gives players some more choice.

“As we examine any future of anti-cheat in DOOM Eternal, at a minimum we must consider giving campaign-only players the ability to play without anti-cheat software installed, as well as ensure the overall timing of any anti-cheat integration better aligns with player expectations around clear initiatives—like ranked or competitive play—where demand for anti-cheat is far greater,” Stratton wrote.

Whatever choice is presented, however, it appears that Denuvo will not be an option.

Filed Under: anti-cheat, doom eternal, drm
Companies: denuvo, id software

Valve: No, Our Gaming Anti-Cheat System Isn't Tracking Your Voracious Porn Habits

from the honesty-is-the-best-policy dept

Valve Software this week found themselves at the center of an Internet hissy fit after reports emerged claiming that the company was using their Valve Anti-Cheat System (VAC) to monitor the browsing activity of the company's user base. A Reddit post specifically claimed that Valve's VAC was digging through your DNS cache entries and sending the lot of them back to Valve servers hashed with md5. The post quickly escalated, with Reddit users suddenly jumping to the conclusion that Valve was just as bad as EA, and the company was covertly trying to monetize user browsing data using DNS records.

The entire kerfuffle forced Valve CEO Gabe Newell out of his fantastic nerd fortress to provide what was an interesting bit of insight posted to Reddit on how the normally very hush-hush system works. Newell noted that the company normally doesn't talk much about VAC because it simply provides cheaters with more ammo to hack the system, but he explained VAC wasn't perusing and storing DNS records wholesale, it was looking for very specific "calls home" made by cheat software:

"VAC checked for the presence of (kernel-level paid cheats). If they were detected VAC then checked to see which cheat DRM server was being contacted. This second check was done by looking for a partial match to those (non-web) cheat DRM servers in the DNS cache. If found, then hashes of the matching DNS entries were sent to the VAC servers. The match was double checked on our servers and then that client was marked for a future ban. Less than a tenth of one percent of clients triggered the second check. 570 cheaters are being banned as a result."

According to Newell, this particular effort lasted all of thirteen days before cheat developers found a way around it. The CEO proceeded to note that highlighting how sneaky VAC is in a somewhat sinister light is a form of "social engineering" that's cheaper than trying to develop better cheats:

"Kernel-level cheats are expensive to create, and they are expensive to detect. Our goal is to make them more expensive for cheaters and cheat creators than the economic benefits they can reasonably expect to gain. There is also a social engineering side to cheating, which is to attack people's trust in the system. If "Valve is evil - look they are tracking all of the websites you visit" is an idea that gets traction, then that is to the benefit of cheaters and cheat creators. VAC is inherently a scary looking piece of software, because it is trying to be obscure, it is going after code that is trying to attack it, and it is sneaky. For most cheat developers, social engineering might be a cheaper way to attack the system than continuing the code arms race, which means that there will be more Reddit posts trying to cast VAC in a sinister light."

The CEO insists that the Half-Life developer is entirely uninterested in tracking your interest in busty vixens. While the cat and mouse aspect of the story was pretty fascinating to watch, it's also a nice, all-too-rare example of how quickly issuing a clean, honest statement without assuming your customers are stupid can completely defuse a public-relations minefield.

Filed Under: anti-cheat, gabe newell, steam, vac, video games
Companies: valve