Thursday, November 03, 2005

Warden

I dunno if any of you have heard of/been following the discussion around the process that WoW runs to actively scan your system for cheats.

Parallel to this: Sony's Music CD Rootkit, which auto-installs itself as soon as the autoplay is triggered by one of their protected music CDs. A rootkit basically alters the Windows kernel, allowing certain programs to cloak their presence from the operating system. They are pretty much immune to standard virus and spyware scanners, and are active even in safe mode.

How are these related? A group successfully managed to use Sony's DRM rootkit to cloak the presence of a cheat program from Warden. It's kind of like getting a flu to fight off a cold.

3 comments:

Joe said...

nerf warden! buff governor!

can rootkit come packaged with a virus?

if autoplay is disabled can rootkit still installs itself when the cd is played?

Gavin ・ ギャビン said...

Disabling Autorun is a good idea. There are other DRM applications that install themselves using Autorun, though this is the first one I've seen that cloaks itself. Nasty shit. As for warden, I wouldn't mind it so much if it only inspected the WoW executable and memory space, but the fact that it scans *everything* is pretty invasive.

From the description of that CD, it sounds like the *only* way to play it on your PC is to use the built-in media player. If the player can install that DRM app, then you'd get it no matter what. If it only assumes the app was installed by the autorun procedure, then disabling autorun should prevent it from installing.

Joe said...

http://us.gizmodo.com/gadgets/sony/sony-admits-screwing-up-with-drm-offers-replacements-137386.php

so no more flu?