3 ms·

> They will then deobfuscate two strings that they use together with LoadLibrary and GetProcAddress to obtain the address of the QueryFullProcessImageName funct

> They will then deobfuscate two strings that they use together with LoadLibrary and GetProcAddress to obtain the address of the QueryFullProcessImageName function from the Windows kernel32.dll library. You can already kind of see where this is going. The wordiness and begging the question is highly suspect. Any [Windows] developer who reads this should know how to enumerate processes, find their binaries and hash them (without having to "deobfuscate" and other scary words for non-technicals). No working set information is included in the hash (not that it would be much use) and so the leakage of information here is extremely low. The author then complains about the hashes being sent over an "insecure protocol" but, suddenly, all information regarding which protocol is missing - that would have been genuinely useful to know (unlike the prior wordiness). > It most certainly will be problematic once the GDPR gets into effect and Arena will definitely get a data request from me so I obtain a list of all data they have about me and my account. The disclosed information cannot be used to identify you as a natural person. This just sounds like someone who got caught and is trying to avoid responsibility.

cf498 9y ago
> but, suddenly, all information regarding which protocol is missing - that would have been genuinely useful to know (unlike the prior wordiness). And might be a reason for ArenaNet to sue. From what I have read, reporting about shortcommings in MMORPGs can get expensive quickly. There is a reason the Defcon 25 talk by Manfred was cut short. ZeniMax Online wasnt amused edit: I did remember correctly, the very same video was taken down from youtube by Arenanet https://www.youtube.com/watch?v=PfbMZJsb1cQ https://www.youtube.com/watch?v=PfbMZJsb1cQ >"DEF CON 25 - Manfred - Twe..." This video is no longer available due to a copyright claim by ArenaNet, LLC.
- drhodes 9y ago
  pssst. https://www120.zippyshare.com/v/qq5Tatj5/file.html https://www120.zippyshare.com/v/qq5Tatj5/file.html
18pfsmt 9y ago
I'm not a gamer at all, so this would normally escape my view, and I don't know if what you say is true and I can't evaluate yet. But, to me, it sounds like you are saying this potential bad actor is intending to use the GDPR to determine the 'secret sauce' used to detect bad actors? In other words, "Be transparent in your evaluation methods!" with the subtext of, "then I can subvert them."
- zamalek 9y ago
  That's one thing I hadn't considered. Pretty clever, almost like an oracle attack. What I'm saying is much simpler. Cheaters are a very interesting crowd. In first person shooter games it's absolutely possible to dominate cheaters (because cheats only help with raw mechanical skill, not strategy or tactics) and the cheaters will often be the first to complain about cheaters when you kill them. Despite their unfair advantage, they lash out when things don't go their way - which seems to be happening here: they truly believe that they are above reprimand and that Anet must be punished for reprimanding them. The threat of GDPR is being used for this. In the broad category of shifting blame, it's very very consistent behavior and would probably make for a fascinating study. There is always a chance that the author is being honest (having cheated in other games, but never GW2) but it's slim. I have my doubts as to whether GDPR would cover this (as it cannot be used to identify a natural person), but IANAL.
  - x0x0 9y ago
    So, the GDPR actually says two things - personal data is any data about a person which could, in combination with other data that you may not have, identify a person. That's much broader than your definition. In this case, I think the claim would be that if you knew all programs installed by a person, you could figure out who that person is. It's still probably a stretch. It's good that they prevented themselves from knowing what the program is, because that could sweep up health data. ie imagine they knew you were running a blood sugar tracking program, they could infer you had diabetes. Health data is in a heightened protection class under the GDPR. - The game would still have to service data requests, ie give me all your data about me.
  - 9y ago
deleted 9y ago
[deleted]
ryanlol 9y ago
>The disclosed information cannot be used to identify you as a natural person. What alternate GDPR reality is this?
- zamalek 9y ago
  GDPR doesn't automatically cover everything that can be harvested from your machine. It has to be demonstrated that the data can be used to identify you as a natural person (which is different to PII, which is an American legal term). You might be able to identify a natural person with this information, but it's incredibly variable as it only includes running processes (unlike browser plugins used for browser fingerprinting, which may not change for months). Assuming you can figure out how to reliably fingerprint someone with this information, GDPR allows collection of data that is reasonable for providing the service you are offering: a bot and cheater free game is part of the service that Anet offers. If you request this data, then what? MMO characters often become the embodiment of their players or visa-versa. There is also your CC and billing information, which in combination with your character name (often your nic/handle) could be used to identify you on other social media. This is far more threatening than a list of running processes on your machine. Anet may include these hashes in their GDPR compliance, but rest assured - forgetting someone means deleting the lot.

cf498 9y ago

> but, suddenly, all information regarding which protocol is missing - that would have been genuinely useful to know (unlike the prior wordiness). And might be a reason for ArenaNet to sue. From what I have read, reporting about shortcommings in MMORPGs can get expensive quickly. There is a reason the Defcon 25 talk by Manfred was cut short. ZeniMax Online wasnt amused edit: I did remember correctly, the very same video was taken down from youtube by Arenanet https://www.youtube.com/watch?v=PfbMZJsb1cQ https://www.youtube.com/watch?v=PfbMZJsb1cQ >"DEF CON 25 - Manfred - Twe..." This video is no longer available due to a copyright claim by ArenaNet, LLC.

drhodes 9y ago
pssst. https://www120.zippyshare.com/v/qq5Tatj5/file.html https://www120.zippyshare.com/v/qq5Tatj5/file.html

18pfsmt 9y ago

I'm not a gamer at all, so this would normally escape my view, and I don't know if what you say is true and I can't evaluate yet. But, to me, it sounds like you are saying this potential bad actor is intending to use the GDPR to determine the 'secret sauce' used to detect bad actors? In other words, "Be transparent in your evaluation methods!" with the subtext of, "then I can subvert them."

zamalek 9y ago
That's one thing I hadn't considered. Pretty clever, almost like an oracle attack. What I'm saying is much simpler. Cheaters are a very interesting crowd. In first person shooter games it's absolutely possible to dominate cheaters (because cheats only help with raw mechanical skill, not strategy or tactics) and the cheaters will often be the first to complain about cheaters when you kill them. Despite their unfair advantage, they lash out when things don't go their way - which seems to be happening here: they truly believe that they are above reprimand and that Anet must be punished for reprimanding them. The threat of GDPR is being used for this. In the broad category of shifting blame, it's very very consistent behavior and would probably make for a fascinating study. There is always a chance that the author is being honest (having cheated in other games, but never GW2) but it's slim. I have my doubts as to whether GDPR would cover this (as it cannot be used to identify a natural person), but IANAL.
- x0x0 9y ago
  So, the GDPR actually says two things - personal data is any data about a person which could, in combination with other data that you may not have, identify a person. That's much broader than your definition. In this case, I think the claim would be that if you knew all programs installed by a person, you could figure out who that person is. It's still probably a stretch. It's good that they prevented themselves from knowing what the program is, because that could sweep up health data. ie imagine they knew you were running a blood sugar tracking program, they could infer you had diabetes. Health data is in a heightened protection class under the GDPR. - The game would still have to service data requests, ie give me all your data about me.
- 9y ago

deleted 9y ago

[deleted]

ryanlol 9y ago

>The disclosed information cannot be used to identify you as a natural person. What alternate GDPR reality is this?

zamalek 9y ago
GDPR doesn't automatically cover everything that can be harvested from your machine. It has to be demonstrated that the data can be used to identify you as a natural person (which is different to PII, which is an American legal term). You might be able to identify a natural person with this information, but it's incredibly variable as it only includes running processes (unlike browser plugins used for browser fingerprinting, which may not change for months). Assuming you can figure out how to reliably fingerprint someone with this information, GDPR allows collection of data that is reasonable for providing the service you are offering: a bot and cheater free game is part of the service that Anet offers. If you request this data, then what? MMO characters often become the embodiment of their players or visa-versa. There is also your CC and billing information, which in combination with your character name (often your nic/handle) could be used to identify you on other social media. This is far more threatening than a list of running processes on your machine. Anet may include these hashes in their GDPR compliance, but rest assured - forgetting someone means deleting the lot.