Forgot your password?
typodupeerror
Privacy Games

Activision Blizzard Secretly Watermarking World of Warcraft Users 272

Posted by timothy
from the information-theory dept.
New submitter kgkoutzis writes "A few days ago I noticed some weird artifacts covering the screenshots I captured using the WoW game client application. I sharpened the images and found a repeating pattern secretly embedded inside. I posted this information on the OwnedCore forum and after an amazing three-day cooperation marathon, we managed to prove that all our WoW screenshots, since at least 2008, contain a custom watermark. This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time. It can be used to track down activities which are against Blizzard's Terms of Service, like hacking the game or running a private server. The users were never notified by the ToS that this watermarking was going on so, for four years now, we have all been publicly sharing our account and realm information for hackers to decode and exploit. You can find more information on how to access the watermark in the aforementioned forum post which is still quite active."
This discussion has been archived. No new comments can be posted.

Activision Blizzard Secretly Watermarking World of Warcraft Users

Comments Filter:
  • Other games? (Score:5, Interesting)

    by SJHillman (1966756) on Tuesday September 11, 2012 @10:18AM (#41299343)

    Is this known to be the case for any other games? IE: Diablo III?

    • by Zocalo (252965) on Tuesday September 11, 2012 @10:28AM (#41299483) Homepage
      I know surfing the web using Internet Explorer can be a bit of an adventure, but even so, I think that's probably the first time I've seen it referred to as a "game".
      • Re: (Score:3, Insightful)

        by Teancum (67324)

        Internet Explorer is indeed a game. It is just a game played at a higher level and you are unwittingly a participant in that game acting as a pawn. That you may or may not actually be using that software is itself a part of the game.

        • by tepples (727027) <tepples@gmaiBLUEl.com minus berry> on Tuesday September 11, 2012 @10:49AM (#41299839) Homepage Journal
          So I take it the only way to win IE is not to play. In that case, how does one start with a store-bought PC and download something better such as Firefox, Chrome, or a whole different operating system, without playing?
    • Re: (Score:3, Interesting)

      by the simurgh (1327825)
      i wonder how long till a lawsuit is filled because activision basically gave hackers all the info they needed to hack accounts and never told account holders not to post screengrabs because it contained account info.
      • Re: (Score:3, Informative)

        by Anonymous Coward

        It contains the account name (which cannot be used to login anyways since you have to use a battle.net ID to login now), and the IP of the server you're playing on (which is public anyways), and the timestamp. Not sure if I know what info you're talking about that "basically gave hackers all the info they needed to hack accounts."

      • by ildon (413912)

        The account name posted is not what you use to login. If you created an account after the Battle.net 2.0 account merger, you have no way of even knowing what your own "account name" is.

  • There was an infamous cows shot from a hell level of diablo2 from years ago that my character surrounded by hundreds of cows. Wonder if that if that was watermarked?

  • by Valor958 (2724297) on Tuesday September 11, 2012 @10:19AM (#41299365)
    It's not actually a watermark on the picture. It's a watermark encoded in your brain from playing too much WoW.
  • Ouch (Score:5, Interesting)

    by ledow (319597) on Tuesday September 11, 2012 @10:19AM (#41299369) Homepage

    Ouch. That's gotta hurt. I think there's a case for even places like the EU commission there, if people are unknowingly distributing other's data.

    That said, I don't really care because I've never touched WoW. But, yeah, I can see the problem. 4 years of IP -> client records, plus things like date-time stamps. If nothing else, that's a whole host of web-crawling to link people to IP's, accounts.

    You kind of expect it in pre-release reviews or betas or something but in the full client and in every screenshot? Bit nasty.

    More interesting - what other games do that?

    • Re: (Score:3, Informative)

      by Anonymous Coward

      More then you think. It was a feature in spore. It let you drag the image to the game and the game would pick up the animal in the image. It was an awesome feature.

    • According to the summary it links user IDs to the IP of the server they were on, not the client's IP.
    • by Wovel (964431)

      It's the server IP...

    • by cpu6502 (1960974)

      This story is hardly news. "A megacorp acts like an asshat and reveals personal data online via photo watermarking." I've come to expect ALL megacorps act like asshats nowadays. It's a challenge to find one that doesn't.

      • Re:Ouch (Score:4, Insightful)

        by theArtificial (613980) on Tuesday September 11, 2012 @01:13PM (#41301981)

        A megacorp acts like an asshat and reveals personal data online via photo watermarking

        Personal information [wikipedia.org]?

        Information which can be used to distinguish or trace an individual's identity, such as their name, social security number, biometric records, etc. alone, or when combined with other personal or identifying information which is linked or linkable to a specific individual, such as date and place of birth, mother’s maiden name, etc.

        The embedded IP address is the IP address of the server you're connected to. IP addresses are not personal information. The account name is not personal. If I follow this logic your email address is personal information, and so is your license plate? From their terms of service:

        I've come to expect ALL megacorps act like asshats nowadays. It's a challenge to find one that doesn't.

        What do you expect, they're made up of people. I can see this really impacting someone who signed an NDA not to disclose things which they willingly agreed to in the first place. I'm sure you've never played Wow for any period of time because if you had, you'd realize when updates happen to their Terms, they present them to you and require you scroll through them and agree to them before you'll be able to access the game. I don't have some hardon for Blizzard but none of what they're collecting is personal.

      • by noh8rz10 (2716597)

        This story is hardly news. "A megacorp acts like an asshat and reveals personal data online via photo watermarking."

        Well, that's the news, isn't it? I'm familiar with asshat corporations, but not familiar with nefarious jpg watermarking.

    • Ouch. That's gotta hurt. I think there's a case for even places like the EU commission there, if people are unknowingly distributing other's data.

      I can imagine it now, having to get model releases signed for any screenshots which have other characters present. If you look closely at the terms Blizzard specifically tells you that everything is their property (this is apparent if you ever try to sell 'your' account) from the contents of your characters inventory, to the character itself.

      That said, I don't really care because I've never touched WoW. But, yeah, I can see the problem. 4 years of IP -> client records, plus things like date-time stamps. If nothing else, that's a whole host of web-crawling to link people to IP's, accounts.

      The embedded IP address is the IP address of the server the game client is connected to. I imagine this to be a concern if you're operating an unofficial server.

      You kind of expect it in pre-release reviews or betas or something but in the full client and in every screenshot? Bit nasty.

      Initial

  • by Penurious Penguin (2687307) on Tuesday September 11, 2012 @10:20AM (#41299383) Homepage Journal
    HP (and others) used to, or maybe still do, use watermarking in printers to hide data revealing time, printer type, etc.
    http://news.cnet.com/8301-10784_3-5811739-7.html [cnet.com]
    https://www.eff.org/issues/printers [eff.org]
    ~ Meta data is watching
    • by firex726 (1188453)

      All printer manufactures do this.
      It's done at the request of the government, for officially anti-counterfeiting purposes.

      • 'request' ?

        yeah, they use pastel colored letterhead and say 'pretty please' when they ask you.

        sheesh!

        FORCED by the gov is more like it.

      • I didn't know all printer manufacturers did; I'll be looking into it further, despite not having a printer for 5 years. The "officially anti-counterfeiting" bit is pretty dubious (as an excuse, not your statement) though. I actually thought their excuse would be The Children. Either way, while I dislike criminal activity, I do like due anonymity.
        • If memory serves, it isn't actually a factor of printer manufacturer(and/or re-badger); but of the OEM behind the color laser print engine. Apparently there are relatively few of those, and some, thanks to a little leaning from Uncle Sam the details of which have never come to light, include the watermarking 'feature' in all their print engines. Since printer manufacturers can, and sometimes do, switch parts suppliers between models, a given manufacturer might have both bugged and clean hardware on offer at

          • by tlhIngan (30335)

            The tracking dots are for output devices and apply to all output, counterfeit or not.

            On the input side, there's a pattern of 5 dots on practically all currency that programs like Photoshop and scanners recognize to degrade scanned images of currency. It looks like a distorted X with a dot at the ends and in the middle..

        • by Anonymous Coward on Tuesday September 11, 2012 @10:51AM (#41299867)

          https://www.eff.org/pages/list-printers-which-do-or-do-not-display-tracking-dots
          http://miami.typepad.com/springyleaks/2012/05/foia-release-names-spy-printers.html

    • Sorry but it only applies to color printers per International agreements to prevent/track counterfit money

  • sketchy but legit (Score:5, Interesting)

    by v1 (525388) on Tuesday September 11, 2012 @10:25AM (#41299431) Homepage Journal

    Their TOS describes how and what info is SENT to them by the client. This is information on your own computer. They don't have to tell you all the places they store your information. Think copy protection. There's a good deal of sneaky things they're doing on your computer to make sure you're running a legit license. They don't have to tell you about any of that. If you take a file that their client makes, and upload it somewhere, it may contain identifying information in it. This just happens to be a screenshot / image, that you wouldn't normally expect metadata to be in.

    It's not too different than say, your digital camera embedding metadata. And it does. A lot. Usually common things like date/time, fstop, exposure, etc, but also can include model of camera, CAMERA SERIAL NUMBER, gps location, firmware version, total number of shots taken, etc etc.

    So you can take off the tinfoil hat. It's too late. They're already in your head.

    • by fuzzyfuzzyfungus (1223518) on Tuesday September 11, 2012 @10:56AM (#41299951) Journal

      The difference with digital camera watermarking is that EXIF is a (not always obvious depending on the UI, and sometimes less standard that it ought to be) standardized metadata storage system. The internet is rife with amusing mistakes made by people who don't know about exif and upload anyway; but that's a UI/user problem. The fields are well known, easily viewed and edited with commonly available software, and not designed to be covert or strip-resistant in any way. Some imaging devices are, quite arguably, excessively chatty by default, and that is a legitimate concern given user ignorance; but there isn't anything sneaky about the technology.

      Watermarks, at least in this incarnation, are designed to be covert, strip-resistant, and are not intended for the creator of the image to be aware of.

      This is a 'prisons and fortresses share certain architectural similarties; but do not share purposes' situation...

      • by v1 (525388)

        Whether or not they're steno'ing the data only affects what you KNOW is in the file. They're still allowed to PLACE anything in the file, and they're neither required to tell you what data, nor even be obvious about it being in there in the first place.

  • So what? (Score:2, Flamebait)

    by aekafan (1690920)
    This is what I think Blizz/Activision will say if you complain. What are you gonna do, go play another game? Even though they are losing subscribers, they have enough that they really don't care. I don't play WoW, nor do I even like it, but I have some relatives who are so addicted to it that Blizzard executives could break into their house and rape their children, and they would give it a pass. This is meaningless on that scale.
    • Exactly. As every user has read the TOS which they agreed to (*snickers*), they should know that they can't hold Blizzard reliable anyway...additionally, the "Acknowledgments" section sounds a like an interesting butt rape to me...well, not much worse then many other licenses, though.
  • Backmasked Message? (Score:2, Interesting)

    by trevc (1471197)
    If you look at the JPEGs in a mirror you can see a hidden message "Hello, hunters. Congratulations. You've just discovered the secret message. Please send your answer to Old Pink, care of the funny farm, Chalfont."
  • and ask him wtf is going on? MMorhaime@blizzard.com
  • Got fed up with all the BS and emailed privacy@blizzard.com to have my account and all my games perma-deleted from their system. Took an untold number of weeks for them to finally follow through on it but I'm now no longer a zard-tard.

    Doesn't look like many slashdotters here care, but if you actually do then claim your info back and stop affiliating with this once decent company.
    • by Khyber (864651)

      I got you beat. I never touched WoW at all. I did EverQuest for about two months and got bored of it. Too easy.

      No challenge (and I mean a real challenge, not once you can solve with an army of friends and brute force) means no go for me.

  • The only people who'd need to worry are those exploiting the game who've distorted their toon names thinking that's all they need to do hide their identities.

  • Uh just read that thread guys, it's confirmed. Already with POC in several languages.
  • Interesting, but... (Score:5, Informative)

    by ildon (413912) on Tuesday September 11, 2012 @12:20PM (#41301135)

    This is pretty interesting, but I think the OP is trying to spread FUD about what the implications of this data are. There is no personally identifying information contained in this watermark. It contains the server IP, server time, and account name. That's it. Now there's a lot of confusion about what "account name" means, so let me explain it for those who don't know.

    About the same time that this watermark apparently showed up (2008, the 3.0 patch associated with the WotLK expansion), Blizzard converted the WoW login system so that it was integrated with their new Battle.net 2.0 login system. At this time, it became necessary to login to WoW using your account's email address instead of your traditional account name. That traditional account name is what's being encoded into the watermark, not your email address login. If you created an account after the Battle.net 2.0 merger, then your "account name" is a unique string that isn't even display to its owner. Anywhere in the account management webpage or login screen that this string would appear, it instead displays "WoW1", "WoW2", etc. (if you have more than one account).
    So there's basically no way to associate this "account name" with your login information, real identity, etc. If you play on a private server, that account name is going to be based on the private server's login system, not Blizzard's login system.

    It's pretty obvious what the real purpose of these watermarks were: to identify users who violated the NDA of their closed betas and ban them from the beta, identify users attempting to sell their account, and possibly to identify the IP address of private servers to assist in attempting to shut them down.

    Further, the probability that these info could be used to help harvest accounts for gold selling or to phish for accounts seems ridiculous. It'd be highly inefficient to spend so much time on a single user when for far less effort you could just spam a million harvested email addresses.

  • I am sure that WoW's EULA covers this watermark, as it does the installation of The Warden service which actually tells Blizzard all the apps running on your computer at the time that you play their game. This is extremely intrusive, much more than this watermark.... I therefor suspect the wording used to perpetuate this EULA to encompass the warden would also apply to the watermarks.

    Long Live WoW!

  • "Activision Blizzard Secretly Watermarking World of Warcraft Users"

    Cool man!

    That explains why I've seen all these people on the streets with that appears to be a photoshopped watermark on them.

  • IP address of the server, that seems harmless. Time, harmless.

    Is the User ID secret or something that other players could see anyway?

Numeric stability is probably not all that important when you're guessing.

Working...