How blizzard detects if you are Botting - actual information here.

[SnowwyWolf]

Ok let me start by saying I see a lot of false and incorrect information being spread around here and I would just like to point a few things out for those of you who want to know if Honorbuddy is detected. Let me just start by saying that no, Blizzard is not allowed to scan your ram / memory for other running processes on your PC but they are allowed to see anything that is attached to the WoW process.

If you wish to know how Warden works for yourself then do some research, naturally some of this information can and probably will be outdated but it will give you a much more solid understand of how it works :
https://en.wikipedia.org/wiki/Warden_(software)

People who are saying "Oh Blizzard just see how many people keep running in the exact same location, then it flags them as botting" - This is simply not true, there is many reasons why this method of detection is a waste of time but the most simple one is that it is quite easy to make bots not run on the exact same path every time (which they don't anyway). This type of detection would be pointless for Blizzard to invest there time in to it.

Warden is not always running either, people who are experienced in reverse engineering are more then capable of reverse engineering WoW, knowing when Warden is and is not active and so on. Warden is a manual system in terms of, it requires different offsets (memory addresses) to be input in to it, then when it scans your WoW process it can check whether or not you are running a hack or ***** based on this. If honorbuddy is detected in this way, anytime you attach honorbuddy whilst Warden is running, you will get banned.

There are many different ways in which Warden can be bypassed or tricks, for those of you who played Warcraft III back a long time ago and used Zmap will know this from ZoiD's different levels of protection he used on his hack to trick warden, his hack ran for many years with 0 detections (whilst many other maphacks was getting many people banned). A more recent example would be Zynastor aka ValiantChaos, his Starcraft II maphack had a single ban wave after 9 months of being free + public, once he changed over to private, there was not a single ban wave. Blizzard shut him down via the use of the legal system (he beat them in-game so they had to tackle him out of it). There are ways to bypass and/or protect the hacks from being detected by warden, it is indeed a cat and mouse game.

Will it ever be safe to bot again?
The answer is ALWAYS the same, as I said above it is a cat and mouse game, if blizzard put enough effort in to tracking who is running *****s / bots, then they will be able to. Naturally the creators of the *****s can then change how the ***** works or add more protection to it but then it's back to square one and the ball is back in Blizzards court.

Anyway, I hope this was somewhat educational for some, all I am trying to say is if Honorbuddy was detected then anyone using it during the time periods they had warden running / active then it's a ban, without question. If they are using other detection methods not yet known, then of course I cannot say.

 

[allexffs]

This was my guess aswell, i guess noone is smart enough to bypass warden somehow

 

[SnowwyWolf]

This was my guess aswell, i guess noone is smart enough to bypass warden somehow

Indeed I do feel it must be due to warden scanning at certain times, I see some people say that "If Honorbuddy is detected, everyone would be banned" - I could speculate many different things here but I am not one to provide false or inaccurate information, the only thing that I can say is that given the huge number of players banned so shortly after the 6 month ban run out, I am pretty sure it was Warden who caught them.

More information as to what you agree Blizzard can scan your PC for here :
www.goo.gl/23gS95

 

[DocBrown]

didn't answer anything, we're still dumbfounded as before...

 

[jerome123]

Hello, thank you for the information , it would make a German translation French etc , maybe the answer is in our hands

Nice day

 

[swat]

blizzerd give me bannd againe how i am uesd onle for routen not farm the bot he just heal and dps you have problem with your profile

 

[SnowwyWolf]

didn't answer anything, we're still dumbfounded as before...

TLR -
Warden can scan for anything that interferes with WoW and also anything open in your windows process list.
You do not even have to attach honorbuddy to get detected, just have it running.
Warden does not run 24/7, blizzard usually turn it on for a few weeks, then once they collect so many they do a ban wave.
Ban wave was almost certainly caused by detection via Warden.

 

[mikley]

TLR -
Warden can scan for anything that interferes with WoW and also anything open in your windows process list.
You do not even have to attach honorbuddy to get detected, just have it running.
Warden does not run 24/7, blizzard usually turn it on for a few weeks, then once they collect so many they do a ban wave.
Ban wave was almost certainly caused by detection via Warden.

Bossland gave them access to who is running the bot... Do you really think in all this time that wow has been out that someone can't detect a system scanning YOUR system? Use your brain. I'm not angry at Bossland, to be honest this makes me feel more secure that Blizzard cares about it's player base to protect them. Both of them will take this to the grave. Blizzard will never leak this, as it would expose their security protocols. Bossland will not say anything for legal reasons, such as an agreement of a settlement to take the case out of court or such. There is a security risk and a liability on Blizzards part if they don't take legal actions against a company reading the memory of such a program such as wow. I don't necessarily think bossland is guilty of identity theft, but they are obviously opening a door for others to tunnel through. Stop all this theory crap and wasting your brain cells trying to figure out the "Warden". They are both a business and it's all about money. Blizzard will win any battle in any court in the world, just by proving the simple fact that people's information "could" be accessed through a back door such as honorbuddy and they are trying to do the right thing by protecting us. This will not be heard in public, as they will settle privately. By no means am I defending the actions of blizzard or honorbuddy, I care for them as much as they care for me. In the end we all want something that works and they of course want our $$$. Everything is always done in THEIR or OUR self interest.

 

[UnderratedPost]

OP's post is quite wrong yet it is still far closer to the truth than most of the stupid theories uninformed people post from a position of absolute ignorance. The way bots are detected for some time now is by adding detection code to the WoW client itself. Example of such thing can be read about here.

 

[lickalime]

How they detect bots is as likely to be on public forums as hb way of staying undetected. Everything you hear about either sides approach is pure speculation and people are making there own theories the truth for comfort. I as well do not know how they detect people but I can tell you driving yourself crazy over trying to find out how they do it is in vein.

 

[Schabracke]

Yeah! It is Bosslands Job to deliver a Bot, it is Blizzards Job to detect the Bot and our Job to use it finally. As soon as possible i will restart my drity Work again. I allready orderd some Battlechest on Internet today, but even not from Blizzard. By they Way i sold my Activision Shares to buy it, because the Shares are falling permanent an have allready a red Arrow!

 

[Kurant]

Bossland gave them access to who is running the bot... Do you really think in all this time that wow has been out that someone can't detect a system scanning YOUR system? Use your brain. I'm not angry at Bossland, to be honest this makes me feel more secure that Blizzard cares about it's player base to protect them. Both of them will take this to the grave. Blizzard will never leak this, as it would expose their security protocols. Bossland will not say anything for legal reasons, such as an agreement of a settlement to take the case out of court or such. There is a security risk and a liability on Blizzards part if they don't take legal actions against a company reading the memory of such a program such as wow. I don't necessarily think bossland is guilty of identity theft, but they are obviously opening a door for others to tunnel through. Stop all this theory crap and wasting your brain cells trying to figure out the "Warden". They are both a business and it's all about money. Blizzard will win any battle in any court in the world, just by proving the simple fact that people's information "could" be accessed through a back door such as honorbuddy and they are trying to do the right thing by protecting us. This will not be heard in public, as they will settle privately. By no means am I defending the actions of blizzard or honorbuddy, I care for them as much as they care for me. In the end we all want something that works and they of course want our $$$. Everything is always done in THEIR or OUR self interest.

So now the conspiracy is that Bossland sold out his own product?

Lol. This just keeps getting better and better.

 

[Juggernaut44]

My question is Raphus or Tony said tripwire was not running properly...well Why is tripwire of any safety net they have in place checked on a daily or weekly basis?

 

[Frayman]

My question is Raphus or Tony said tripwire was not running properly...well Why is tripwire of any safety net they have in place checked on a daily or weekly basis?

I work at a sour gas plant ..we have Gas detection and also fire eyes ALWAYS ON!!! its a safety net and an absolute necessity when you deal with critical process.

I am not a computer programmer but I cant see why they dont have failsafe procedures in place for protection.

its seems fishy to me...its just too convienient to say oops I forgot to enable that and keep this program going, instead of admitting its detected 100% of the time.

 

[mikley]

I work at a sour gas plant ..we have Gas detection and also fire eyes ALWAYS ON!!! its a safety net and an absolute necessity when you deal with critical process.

I am not a computer programmer but I cant see why they dont have failsafe procedures in place for protection.

its seems fishy to me...its just too convienient to say oops I forgot to enable that and keep this program going, instead of admitting its detected 100% of the time.

I work in IT for a restaurant and by no means am I a programmer either. One thing I can tell you, is that a few years ago PCI compliant law passed making credit card security a top priority for any US company or they will pay millions in fines up to losing the ability to accept credit transactions. By allowing Bossland to read the memory of your wow process unchecked, would put Blizzard or any other company for that matter, in violation of the PCI compliance regulations, among MANY other security risks. It's common sense what has happened. Recently, wow even added a feature to purchase items in game... Think about it. Plain and simple, all the know it alls that keep trying to silence me and keep trying defend Bossland with their all surpreme knowledge of programming and hacking is a joke. I am only opening your eyes to reality. I'm not taking sides. In the end we are all going to do what we want. Even though they are giving Blizzard our information, do you think we will stop botting? Hell no, it's like *****. We will just wait until it has quieted down and start again.

 

[Frayman]

I see what you mean there Mikley, but what I was getting at was how come HB didn't know the most up to date tripwire wasn't installed and activated? ..this is what I would assume is the top priority before realeasing the bot to the public. Instead they claim some old inferior tripwire installation possibly caused this banwave...seems weird to me.

Whats done is done, no big deal now.

I was ready for a break anyway

 

[NavyAV89]

I work in IT for a restaurant and by no means am I a programmer either. One thing I can tell you, is that a few years ago PCI compliant law passed making credit card security a top priority for any US company or they will pay millions in fines up to losing the ability to accept credit transactions. By allowing Bossland to read the memory of your wow process unchecked, would put Blizzard or any other company for that matter, in violation of the PCI compliance regulations, among MANY other security risks. It's common sense what has happened. Recently, wow even added a feature to purchase items in game... Think about it. Plain and simple, all the know it alls that keep trying to silence me and keep trying defend Bossland with their all surpreme knowledge of programming and hacking is a joke. I am only opening your eyes to reality. I'm not taking sides. In the end we are all going to do what we want. Even though they are giving Blizzard our information, do you think we will stop botting? Hell no, it's like *****. We will just wait until it has quieted down and start again.

1. No credit card information is passed within the WoW client. There is no PCI issue.
2. In game purchases are made with credit cards already on file.

 

[Ilja Rogoff]

Ok let me start by saying I see a lot of false and incorrect information being spread around here and I would just like to point a few things out for those of you who want to know if Honorbuddy is detected. Let me just start by saying that no, Blizzard is not allowed to scan your ram / memory for other running processes on your PC but they are allowed to see anything that is attached to the WoW process.

If you wish to know how Warden works for yourself then do some research, naturally some of this information can and probably will be outdated but it will give you a much more solid understand of how it works :
https://en.wikipedia.org/wiki/Warden_(software)

People who are saying "Oh Blizzard just see how many people keep running in the exact same location, then it flags them as botting" - This is simply not true, there is many reasons why this method of detection is a waste of time but the most simple one is that it is quite easy to make bots not run on the exact same path every time (which they don't anyway). This type of detection would be pointless for Blizzard to invest there time in to it.

Warden is not always running either, people who are experienced in reverse engineering are more then capable of reverse engineering WoW, knowing when Warden is and is not active and so on. Warden is a manual system in terms of, it requires different offsets (memory addresses) to be input in to it, then when it scans your WoW process it can check whether or not you are running a hack or ***** based on this. If honorbuddy is detected in this way, anytime you attach honorbuddy whilst Warden is running, you will get banned.

There are many different ways in which Warden can be bypassed or tricks, for those of you who played Warcraft III back a long time ago and used Zmap will know this from ZoiD's different levels of protection he used on his hack to trick warden, his hack ran for many years with 0 detections (whilst many other maphacks was getting many people banned). A more recent example would be Zynastor aka ValiantChaos, his Starcraft II maphack had a single ban wave after 9 months of being free + public, once he changed over to private, there was not a single ban wave. Blizzard shut him down via the use of the legal system (he beat them in-game so they had to tackle him out of it). There are ways to bypass and/or protect the hacks from being detected by warden, it is indeed a cat and mouse game.

Will it ever be safe to bot again?
The answer is ALWAYS the same, as I said above it is a cat and mouse game, if blizzard put enough effort in to tracking who is running *****s / bots, then they will be able to. Naturally the creators of the *****s can then change how the ***** works or add more protection to it but then it's back to square one and the ball is back in Blizzards court.

Anyway, I hope this was somewhat educational for some, all I am trying to say is if Honorbuddy was detected then anyone using it during the time periods they had warden running / active then it's a ban, without question. If they are using other detection methods not yet known, then of course I cannot say.

This post is... pointless. Nothing new, and some speculation.

 

[Kurant]

I work in IT for a restaurant and by no means am I a programmer either. One thing I can tell you, is that a few years ago PCI compliant law passed making credit card security a top priority for any US company or they will pay millions in fines up to losing the ability to accept credit transactions. By allowing Bossland to read the memory of your wow process unchecked, would put Blizzard or any other company for that matter, in violation of the PCI compliance regulations, among MANY other security risks. It's common sense what has happened. Recently, wow even added a feature to purchase items in game... Think about it. Plain and simple, all the know it alls that keep trying to silence me and keep trying defend Bossland with their all surpreme knowledge of programming and hacking is a joke. I am only opening your eyes to reality. I'm not taking sides. In the end we are all going to do what we want. Even though they are giving Blizzard our information, do you think we will stop botting? Hell no, it's like *****. We will just wait until it has quieted down and start again.

First of all, it isn't a law. It was created by the card companies, not the government.
Secondly, I seriously doubt the CC payment process deals with an .exe file, for various blatantly obvious reasons. Think about it, it isn't that difficult.
Lastly, CC information is not stored and/or processed client side, thus the reason your card is stored on battle.net - and why the Blizzard store forces you to use payment on file - in fact this is why they remain PCI compliant.

Source: I dealt with PCI compliance quite often for almost 2 years when I was working IT for a private healthcare provider, and compliance became an issue.

 

[mekrenon]

I see what you mean there Mikley, but what I was getting at was how come HB didn't know the most up to date tripwire wasn't installed and activated?

I may have misread but the gist of their post seemed to be that Blizzard patched WoW in a way that circumvented their new code. Whether this is true or not, I don't know, but tripwire was activated. It just wasn't reading what it needed to. And again, this is what they think happened. They don't know and they are testing now, but what you have to ask yourself is whether even this tiny bit of information is too much for them to reveal. Take them at their word and assume that they know how to fix this. Blizzard can simply deactivate whatever they were using while HB staff tests.

So it requires a degree of faith or acceptance of what can happen to your account. These are the risks.