4 ms·

This kind of behaviour is very standard in the anti cheating world. Some go much further like inspecting the Windows DNS cache for evidence of cheat servers. Ca

by r1ch 9y ago

This kind of behaviour is very standard in the anti cheating world. Some go much further like inspecting the Windows DNS cache for evidence of cheat servers. Calling this spyware is rather misleading. Cloud based antivirus services are even worse in this regard.

dylz 9y ago
One of the largest Korean "anticheat" companies also sells cloud antivirus and reuses the same code signing certificate for their anticheat rootkit. I've seen a few outright change DNS resolvers to themselves instead of just looking at cache too.
JadeNB 9y ago
> Calling this spyware is rather misleading. Does its ubiquity invalidate the term? It is software that spies on me, and its presence is, at best, less-than-explicitly communicated. That seems like spyware to me.
ryanlol 9y ago
It’s not misleading at all to call most client-side anticheats spyware.
knodi 9y ago
so you're saying I can simply bypass detection by having a remote proxy? Simple and cheap ($5 Digital Ocean server)
serf 9y ago
>Calling this spyware is rather misleading. No, it's clearly spyware. They are enumerating lists of software loaded on client computers without explicit permission other than what's granted broadly in their ToS/EULA, and without speaking of the feature. The component got removed right after their use of it -- indicating either sneakiness or internal qualms about the use of such methods -- and if one believes the guilty , it affected legitimate users, too. >Some go much further like inspecting the Windows DNS cache... Why is looking at DNS caches 'going further' than enumerating all software into hashes for remote analysis? DNS might have more embarrassing shit to expose on a personal level, but generally a glimpse into installed software is much more exclusive/rare/uncommon . DNS gets' discussed between your machine and a million others down the line; it hasn't been considered very private for some time now.

by r1ch 9y ago

dylz 9y ago

One of the largest Korean "anticheat" companies also sells cloud antivirus and reuses the same code signing certificate for their anticheat rootkit. I've seen a few outright change DNS resolvers to themselves instead of just looking at cache too.

JadeNB 9y ago

> Calling this spyware is rather misleading. Does its ubiquity invalidate the term? It is software that spies on me, and its presence is, at best, less-than-explicitly communicated. That seems like spyware to me.

ryanlol 9y ago

It’s not misleading at all to call most client-side anticheats spyware.

knodi 9y ago

so you're saying I can simply bypass detection by having a remote proxy? Simple and cheap ($5 Digital Ocean server)

serf 9y ago

>Calling this spyware is rather misleading. No, it's clearly spyware. They are enumerating lists of software loaded on client computers without explicit permission other than what's granted broadly in their ToS/EULA, and without speaking of the feature. The component got removed right after their use of it -- indicating either sneakiness or internal qualms about the use of such methods -- and if one believes the guilty , it affected legitimate users, too. >Some go much further like inspecting the Windows DNS cache... Why is looking at DNS caches 'going further' than enumerating all software into hashes for remote analysis? DNS might have more embarrassing shit to expose on a personal level, but generally a glimpse into installed software is much more exclusive/rare/uncommon . DNS gets' discussed between your machine and a million others down the line; it hasn't been considered very private for some time now.