Remaining undetected while running a high number of bots with a single machine?

[Reginald]

Hi,

I'm guessing if Blizzard sees that a single person is running WoW 25 times simultaneously, they'll know something unusual is happening. What I'm wondering is, what do they do to detect this, and how can we avoid it?

Apparently there was a good thread by bossland's on this topic, but the link appears to be dead: http://www.thebuddyforum.com/all-kn...k-knowledge-]-ip-address-[-lesson-ii-]-4.html

Anyway, it seems like the people typically speculate that Blizzard looks at the IP and various hardware ids/uids/guids. Has anyone actually reversed the code to see which of these things actually is sent to Blizzard?

Is it safe to use multiple virtual machines (with something like virtualbox) in conjunction with a socks proxy? Is changing the uuid of each virtual machine good enough? Are there certain hardware ids that virtual machines typically inherit from the host pc?

Oh, and if anyone has the original bossland post saved, I'd love to give it a read.

Thanks!

 

[Inrego]

I don't rly think it matters if it's the same IP.
What about net caf?s? I'm guessing all the computers there are on the same IP adress.

 

[Altoids]

This much I can tell you without a doubt...

Blizzard can tell not only that you are on the same IP, but that you are on the same machine... I say this because I have 3 computers at home behind a wireless modem. That modem only gets 1 IP of course, and behind it we use APIPA (the modems automatically assigns a private IP to each of our 3 internal machines plus the other wireless connections to it like our phones). Blizzard only 'sees' the IP of the broadband modem.

However...when I log on from my machine, it only asks for an authenticator about once every 2 weeks or so... but when I logon from my Wife's or Son's computer, I get the authentication challenge every single time. SO it knows it's not the machine I normally sign on from - even though it's got the same IP address.

So the qeustion isn't whether Blizz knows... they know and they automatically track it - otherwise they wouldn't know when I login from a different computer behind the same modem. The real question is, does Blizz use that info for pursuing botters? That is much harder to answer because we don't have a botter than works for Bliz and you can't trust what they publically put out.

All we can do is go by what people report to each other here about what they are doing - what they've gotten away with and what has gotten their accounts suspended and banned.

 

[Reginald]

So the qeustion isn't whether Blizz knows... they know and they automatically track it - otherwise they wouldn't know when I login from a different computer behind the same modem. The real question is, does Blizz use that info for pursuing botters? That is much harder to answer because we don't have a botter than works for Bliz and you can't trust what they publically put out.

All we can do is go by what people report to each other here about what they are doing - what they've gotten away with and what has gotten their accounts suspended and banned.

If they log the info, then it's fairly safe to assume that they use it to help detect botters. Even if they aren't actively using the information, they certainly would have the capability. While we can't know what they do with the info they receive, it is possible to determine what information they receive. Has any experienced coder reversed the code to see what computer identifying information is sent to Blizzard? And what are the best ways to change this information?

Thanks!

 

[yt0k]

Only thing that I would guess is when you use an authenticator, it stores a temporary file somewhere on the local machine saying to bypass the authenticator check. When this file is created it is also time stamped. So if you're constantly logging into the same machine each day, it locates that files and sees its only been 24 hours or so and it lets you bypass the check. When you go to your wife's machine or another machine on your network you normally dont use, when it checks that authenticator temp file, it will see that its outdated or non existant, so it asks you to input your code.


ps: I am pretty tired and haven't been able to bot for 3 days due to hardware issues, so I am sure what I just said is 100% crap.

 

[Redberet9912]

Everything you do on wow is recorded, where you connect from (Yes, they can see the individual computer, not just IP) what you do in game (IE Farming the same coords over and over), raid, even tellng trade chat that you like little boys. All is recorded dating back to a maximum of 4 years.

The info is never called upon unless there's suspicion - Player reports. (or hey, this guys been on for 80 hours... hmm..)

Though, you can box the 25 accounts on one computer, it won't matter. if one gets banned, the rest may or may not depending on if the GM is an asshole. (Usually, they don't care enough to ban them all)
No clue if the proxy thing works though.

 

[xsol]

MAC address. Everything is sent in packets, packets include your mac address. If you have more than one network card you have more than one mac address. The routers know where to send what based on the ip + mac address -> this a very old form of a basic handshake in computer communications.