13 November 2015 "Unbanned"

[webhond]

Thanks, you saved me from a nervous breakdown!)

 

[Frayman]

I wasnt on during the tripwire event and still ended up with the May 13th Ban ..but what I did notice leading up to it was alot more random DC's from the WOW client and having to login repeatedly..

not that this is irrefutable evidence that is how Blizz tracks us or anything, for all I know It could be from using Bartender or Razer naga etc ..one of the addons that HB says causes issues

 

[roboto]

They don't necessarily require audit data so defined that it records all Navigation / Interaction within the game for all cases at all times. They already store plenty of data on each character by default; such as quests completed and completion time stamps. Basically anything to do with Achievements has to be stored in an easily accessible way.

Use these statistics to narrow down the reports to the most likely HB culprits, then start to run audits on those accounts. Take a sample of that Audit to actually analyze, we don't need to see what someone did for an 8 hour time period, maybe only 2 random 30 minute sections. Data cut down by that much would / could still highlight which Accounts have been using HB reliably while still being manageable. I also assume they spent more than a week pulling together all these flagged accounts into the Ban Bin to be hit with the Hammer. I would assume they have been doing this for many months.

I'm not saying what I'm suggesting is 100% the way Blizzard Banned via Wave but it's the type of method I think they used; maybe even hope because if not, and Honorbuddy is detected, we may see 6 Month bans on the regular and the slow death of HB and it's community.

Thanks for the well thought out response Roboto, you are correct, it would be a pain in the ass, but given enough time it is feasible and imo just as possible as putting malware on all our PCs or fooling the Bosslands team for the first time in 5 years or etc...

your theory is possible, however unlikely as there have been way more effective ways to detect honorbuddy.
just a simple example: prior banwave the process itself was visible on the system - now it is no longer (try for yourself, error 0x5)
everyone knew this was the fact but since the lang-day-ago court cases of the EFF against blizzard, scanning ram and processes was not allowed in area, not belonging to their own processes _by law_ - but still technicly possible. (yaya i know, the gm automated reponses and emails still state this as a fact...)

second, the ban wave way way too precise because it hit (almost?) everyone who was using honorbuddy in whatever way in a specific timespan.
this also includes manual botting, such as raid only with custom movement featuring alternate CRs and custom botbases
and how do we explain the banwave, happening to another "quite popular" bot, cmpeting with honorbuddy, a few days after? they litterally know who was using what bot.
since (almost) all professional wow bots work in the exact way, it would be way to hard to differ these two bots

on a side note: i lost a mule account in the banwave which was used for only 5-10 mintues of basic questing (did something like lvl 4-10) - the chances of this account matching reliable against any pattern should be near zero

third, IF they got this pattern, it wouldnt have changed, post banwave, the bot didnt change that much apart from the way as it injects into wow - i think there's an apoc quote in the old banwave thread about it - so if it was patterns and player reports, why did bans drop to almost zero? I honstly dont believe it's the lack of botters

I never saw that, link please? Last i heard Bosslands did not know or were not going to reveal any discoveries they have made.

dispite his wording he is right; in fact, I remember a post something alike this as well, but it was never confirmed by the core devs (at least as far as i know)

 

[tomcruise]

just a simple example: prior banwave the process itself was visible on the system - now it is no longer (try for yourself, error 0x5)

what the &£$* are you talking about

 

[roboto]

what the &£$* are you talking about

thats not a secret, someone please correct me if i'm mistaken, but it was possible at any time to actually read the processlist and find a process named honorbuddy via c# (or any other common language)

pre banwave this tends to work

Process.GetProcesses().ToList<Process>().Any(p=>p.ProcessName.ToLower().Contains("honorbuddy"))

i used it myself to automate my bots.

however, dont - in no circumstance - believe that blizz can do this without being noticed by the devs. there is a reason why they take their time on patchday, to ensure we, the customers, are safe.
there is a reason why there is tripwire and i'm certain the whole team knows pretty well what they're doing.

such a simple "detection" would have been noticed by even a 12 year old script kiddy, i guarantee, but a skilled team of professional bot authors dont fall for that
so please dont open the next ban-theory-its-the-process-name-train again, devs state several times that the naem of the process doesnt matter in either way

important addition to that: hb runs at elevated privileges (admin privileges), wow does not, so windows itself forms the first limitation to reading an elevated process from an non elevated one

 

[bommie]

Sucks that all our gold on those banned accounts will be removed, so we cant buy gametime tomorrow with token.

 

[mhell]

Whaaatttt????? Nooooooooooooooooooooooooooooo!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! They cant steal my precious golds ((

 

[supersurfer]

so if it was patterns and player reports, why did bans drop to almost zero?

never forget one thing and that is the priority of blizzard, maximizing money and nothing else.

lets see how blizzard thinks

Blizzard (CEO): Dudes you cant ban so many botters, dont you know how much money we loose ?
Blizzard (Marketing Dude) : That is no problem, they will come back, because we dont rape them too fast. And we will make the non botters happy with reporting the ban of a million bots. Plus we can report how many new copies we sold *evil laugh*
Blizzard (CEO): Man you are some clever dudes.
Blizzard (Bot Hunter Dude) : We have a new list of a 500k bots, just tell me when you need them.
Blizzard (Marketing Dude) : Not at the moment, we will let them live for a while, otherwise they wont come back.

 

[tb76]

Blizzard could have achieved the exact same by taking our gold and mail it to us. We wouldn't be able to buy token with gold and we would be very happy to still retain our gold, but they have to be pricks and make us sad

 

[pirhb]

I cant sleep tonight, its so exciting to get unbanned

 

[bommie]

I feel sorry for the people bought the 20euro wow token to make gold, only to have the gold taken away from them. such a waste of real money :l

I lost about 500k total but it was gained with bots, so meh i dont care much.


accounts will probably be unbanned at 11:59pm tomorrow the 13th, knowing blizzard

 

[WolfpackPB]

It will probably be how we've seen all the changes in the wave up to now, in waves *ha*. So we'll probably see accounts re-activating throughout the day, I'm sure we'll start seeing posts about renewed accounts starting at 12:01 AM tomorrow morning / tonight.

dispite his wording he is right; in fact, I remember a post something alike this as well, but it was never confirmed by the core devs (at least as far as i know)

I do think I remember that now, but I think it was a community Dev and was never accompanied by any evidence outside of a simple statement. Not exactly an official statement like that guy was making it seem. Anyway, very good well thought out posts Roboto, always appreciated.

 

[ryftobuddy]

Direct quote from Bossland:

"Its been a week since we closed down the authentication servers for Honorbuddy. In this time, we tried to figure out what happened. We must say that we have no idea what really happened and all we have are speculations.

We speculate, that at some point, Blizzard used parts of the World of Warcraft client that acted in a hidden manner like malware. Then they scanned everything they could scan on a given computer and flagged the ones they thought were operating against their TOS/EULA. They are fine to install any such malware-type hidden software at any given time according to their End User Agreement.

There have been rumours, spread by Blizzard, that over 100,000 WOW Accounts have been banned during the ban wave on 13th May 2015 and that they are most likely all Honorbuddy users. We have to dispute this; there has never been that many active Honorbuddy users. We are still unaware if this was a real detection or some shady malware that was injected into everyones computer for a short period of time.

Be aware that we have not seen the cause of the bans. We have an anti-malware and anti-detection tool called Tripwire that aims to identify unexpected behaviour by gaming companies. We can just try to make sure, that the next time something shady has been done, that Tripwire detects it. Tripwire is the only hope we can rely on right now; it has been improved and hopefully will watch over your shoulder much better now.

Again, we will give no guarantee and we have never given a guarantee, that our software is immune to detection or bans."

https://www.thebuddyforum.com/archives/216248-honorbuddy-announcement-21th-2015-a.html#post1965128

 

[BlacKPeC]

1. Will YOU begin botting again after this banwave?
As I know 6 month is the last step before permanent ban and are you scarred that we have no any chance for mistake? It's means that we must do by ourself with borring farm and do not use the HB?

I got 72 hr ban (on main account, on which I also raided) back in 2013, and then in 2014 I got perma banned straight away. I didnt get 6 months, not even a reason as to why I was banned, they straight up anwsered me "We do not have to answer to that as you were banned previously and didnt stop using 3rd party software." So I had to creat new account.

 

[Pierlala]

I think our accounts will be unbanned at 00:01 "tonight". Because in the email it said November 13th. It didn't say any specific time which it usually does when you get a suspension.

 

[redstagl]

A bit pissed they wiped my gold, about 40k of the 125k was given to me from a friend who did not bot, because he quit. Then half of that was farmed by hand before I even started botting, questing to 100 and money I had made before the expansion. I never used the bot to gather, fish or anything, only used the CR during raids. Never gained money from the raids since it all went to repairs and then some.

Definitely will be opening a ticket, but my botting days are over, they are going to closely be watching all the flagged accounts anyway.

 

[Exystredofar]

A bit pissed they wiped my gold, about 40k of the 125k was given to me from a friend who did not bot, because he quit. Then half of that was farmed by hand before I even started botting, questing to 100 and money I had made before the expansion. I never used the bot to gather, fish or anything, only used the CR during raids. Never gained money from the raids since it all went to repairs and then some.

Definitely will be opening a ticket, but my botting days are over, they are going to closely be watching all the flagged accounts anyway.

If the gold was removed, I seriously doubt they'll give it back even if you do put in a ticket for it. Although I'm not sure if the gold really was wiped. My armory says I have 0g on my main, but I copied him over to the PTR today and still had my 418k, so maybe it's just that the system won't show us how much we have until we're unbanned?

 

[starlite68]

Direct quote from Bossland:

"Its been a week since we closed down the authentication servers for Honorbuddy. In this time, we tried to figure out what happened. We must say that we have no idea what really happened and all we have are speculations.

We speculate, that at some point, Blizzard used parts of the World of Warcraft client that acted in a hidden manner like malware. Then they scanned everything they could scan on a given computer and flagged the ones they thought were operating against their TOS/EULA. They are fine to install any such malware-type hidden software at any given time according to their End User Agreement.


https://www.thebuddyforum.com/archives/216248-honorbuddy-announcement-21th-2015-a.html#post1965128

Just FIY, there is literally zero chance that blizzard "installed malware that scanned everything". Or that wow.exe was acting as such. It's pretty funny that bosslands would use that trope (look it says in the eula that blizz can scan your HD and see your process list etc etc) since it's been debunked so many times, including by people at bossland like Apoc.

If nothing else it's completely impossible to do without people noticing it. There's a bunch of folks that have been running wow nonstop literally from the day it appeared 11 years ago, in protected computer environments and monitoring every action and every byte going in and out. if wow was acting as malicious malware they'd know.

What happened most likely is exactly what happened several times before leading to massive banwaves (eg Glider): during one of the mini patches they added to wow.exe a component that detected HB attaching to it, and the devs missed it. This only lasted a couple or 3 weeks, since accounts that didn't bot in the immediate weeks before May 13 were unaffected. It's funny because previously (Last summer I think), they actually found some lines in WoW.exe code literally saying "detection of honorbuddy".

They don't use warden to combat something like HB because of the tripwire, the moment warden is updated everything shuts down till they figure out what new addresses warden is scanning.

 

[Pierlala]

If the gold was removed, I seriously doubt they'll give it back even if you do put in a ticket for it. Although I'm not sure if the gold really was wiped. My armory says I have 0g on my main, but I copied him over to the PTR today and still had my 418k, so maybe it's just that the system won't show us how much we have until we're unbanned?

The gold IS removed. Several people made tickets about it yesterday, confirming it. Incluiding myself.

 

[nightram]

I recently got an account back that was perma banned 5 years ago.

Sooo happy as it had rare mounts on it. So that is now a bit account again.