World of Warcraft Screenshots hold secret information about you?!

#1 Posted by phatcat (150 posts) -

World of Warcraft Screenshots hold secret information about you?!

I was reading a post over at Evil Avatar about Blizard embedding info about you with their in-game screenshot capture system.

http://www.evilavatar.com/forums/showthread.php?t=177783

A few days ago I noticed some weird artifacts covering the screenshots I captured using the WoW game client application. I sharpened the images and found a repeating pattern secretly embedded inside. I posted this information on the OwnedCore forum and after an amazing three-day cooperation marathon, we managed to prove that all our WoW screenshots, since at least 2008, contain a custom watermark. This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time. It can be used to track down activities which are against Blizzard's Terms of Service, like hacking the game or running a private server. The users were never notified by the ToS that this watermarking was going on so, for four years now, we have all been publicly sharing our account and realm information for hackers to decode and exploit. You can find more information on how to access the watermark in the aforementioned forum post which is still quite active.

They link to the source fourm here:

http://www.ownedcore.com/forums/world-of-warcraft/world-of-warcraft-general/375573-looking-inside-your-screenshots.html

Updated 10/09:

Dear everyone

This post may have been moved to WoW General, but it still remains an exploit - one which is used against us...

1) Go somewhere where there aren't any (or a lot) of textures. I used the druid blink bug to go to the north end of the world but you should go below Dalaran in Crystalsong Forest, as bluesius suggested, because you will get a better screenshot if you stick your face in the pure white trees.

2) Type:

/console SET screenshotQuality "9"

Make sure you use 9, not 10.

3) Take a few screenshots of the clear, no textures, white area by zooming into a tree and hitting ALT Z, so that your entire screen is white.



4) Open this image in an image editing program like IrfanView (it's freeware), click CTRL+E, select the Sharpening filter, use the highest possible sharpening value (99) and click OK. Now do this two more times, again: CTRL+E, Sharpen 99, OK.

5) You are now looking at your character's WoW watermark / custom bar-code / qr code look-a-like / call it what you will:



Apparently, each character has a different set of these repeatable patterns, which contain account and realm information, and it looks like if they are scanned by software that recognizes them, they canreveal our character's account name/id, the time of the screenshot and the the full information of the realm, including its IP address (think "private servers").

The pattern, which consists of approximately 88 bytes of data, repeats itself many times depending on the resolution of your screen. See below for a colored representation: the account id and realm information are depicted in red and the current time (seconds not included) is depicted in blue:



Based on Blizzard's ToS, Blizzard is allowed to communicate information about our hard drive, CPU, operating systems, IP addresses, running tasks, account name and current time and date. It never mentions anything though about embedding some of these data into every screenshot we capture using the WoW printscreen tool.

The contained information can be easily recovered and decrypted by hackers, which compromises the privacy and security of our accounts! For example, someone could use this to identify which account holds which characters and perhaps stalk and annoy its user, or help perpetrators choose their phishing victims with a more targeted approach. Perhaps someone is already using this since the watermark has been around for at least two years already.

It looks like Activision Blizzard has teamed up with Digimarc (http://www.digimarc.com) to provide us this wonderful service of secretly tagging our in-game screenshots with our account and realm information. Although it has not yet been verified, it is possible that Blizzard is using an automated monitoring service which downloads image files from various Internet sites and checks them for the presence of their embedded digital watermark data, kindly provided by Digimarc: http://www.google.co.uk/patents/US7653210

_Mike has managed to disassemble the watermark data and help us verify which pieces of information are contained inside. Do note that this covert watermarking has been going on since, at least (!), 2010 (Patch 4+) so you may want to delete/remove from the public domain all your post-Cataclysm screenshots captured by WoW.

Also note that if your screen resolution is too high, the pattern will look something like this:
(larger footprint)

Thanks to _Mike, we also verified that there is no pattern included in high quality screenshots like TGA and JPG/10. So, in order to avoid any further watermarking, type: /console SET screenshotQuality "10"which will set the quality of your screenshots to the maximum and create screenshots that do not include the watermark.

l0l1dk has developed a tool to disable the addition of watermarks in the lower quality screenshots but use it at your own risk/responsibility because it could corrupt the WoW client, which could then require a clean re-installation of the game (it's also against the ToS). It is much simpler to just set the JPG quality to max.

Try it yourselves. Read the rest of the thread for more information. If you have any comments, ideas or suggestions please share. Politeness is appreciated.

For legit players this isn't an issue. But it does raise some privacy concerns. For example...

What if you are Felicia Day? You posted a screenshot of you WoW character. Now anyone knows your account name, and the server you are playing on. Any person who posts any screenshot has lost their anonymity.

#2 Posted by Milkman (16800 posts) -

WAKE UP SHEEPLE

#3 Edited by Ravenlight (8040 posts) -

The watermarks don't hold anymore info about you than is already available by merit of you being logged-in and online in the first place.

This story went from lulwut to Chicken Little far too fast over the course of the day.

#4 Posted by CaLe (3985 posts) -

You can guess by someone's gear how much of a life they have. If they have the best gear they also have the best life. This is true in any MMO. I hope you understand what I'm saying here.

#5 Posted by kindgineer (2727 posts) -

This sounds like a bunch of mediocre conspiracy theories that got blown way out of proportion for page visits.

#6 Posted by ShadowConqueror (3052 posts) -

Looks like a terminal from Marathon. Is Durandal gonna steal my identity and hack my Blizzard account?

#7 Posted by phatcat (150 posts) -

Like I said, its probably not a big deal for people like us.

I give 0 fucks if someone has an old screenshot and knows my USERID and server I play on.

But World of Warcraft is a popular game and there are private people who didn't want the public to know where they play. For example. there is a WoW guild for Microsoft Employees. if you can find a screenshot not only do you know the ID of that MS employee but you know the server they play on.

#8 Posted by BBQBram (2236 posts) -

But wait, if the pattern repeats itself, wouldn't that be redundant if it's an overlay on your screenshot. Does that mean it's embedded in all of the textures all over your personal render of Azeroth?

#9 Posted by bwheeeler (452 posts) -

BUSH DID 9/11

#10 Posted by phatcat (150 posts) -

@BBQBram: No its done after the fact. and I guess it repeats if one part is illegible?

#11 Posted by EXTomar (4737 posts) -

I definitely understand why they did this: To track down people leaking and alpha and beta info. The info isn't personal anyway.

#12 Edited by Athadam (692 posts) -

@phatcat said:

Like I said, its probably not a big deal for people like us.

I give 0 fucks if someone has an old screenshot and knows my USERID and server I play on.

But World of Warcraft is a popular game and there are private people who didn't want the public to know where they play. For example. there is a WoW guild for Microsoft Employees. if you can find a screenshot not only do you know the ID of that MS employee but you know the server they play on.

Only if that employee decides to take a screenshot using the WoW's own screenshot system, posts it online, and actually cares if people know their IDs.

And not only that but the only way to detect these watermarks is for them to coincidentally fall into a patch with very little texture detail. Then the person has to learn how to read the code and decrypt it.

All to find what server you are playing on, your name, and the time you took the photo.

It's not a big deal.

Look at it this way, your point and shoot can take pictures imprinted with GPS data, user name, time stamps, with notes on camera settings (ISO, Shutter, Aperture), and lens details. If you upload these photos online, people can find all this about you in REAL LIFE - yet very few people care.

/tin foil helmet

#13 Posted by Irvandus (2879 posts) -

So, things Blizzard would have known anyway. Fucking internet and their chicken little titles.

#14 Posted by phatcat (150 posts) -

@Castermhief117 said:

@phatcat said:

Like I said, its probably not a big deal for people like us.

I give 0 fucks if someone has an old screenshot and knows my USERID and server I play on.

But World of Warcraft is a popular game and there are private people who didn't want the public to know where they play. For example. there is a WoW guild for Microsoft Employees. if you can find a screenshot not only do you know the ID of that MS employee but you know the server they play on.

Only if that employee decides to take a screenshot using the WoW's own screenshot system, posts it online, and actually cares if people know their IDs.

And not only that but the only way to detect these watermarks is for them to coincidentally fall into a patch with very little texture detail. Then the person has to learn how to read the code and decrypt it.

All to find what server you are playing on, your name, and the time you took the photo.

It's not a big deal.

Look at it this way, your point and shoot can take pictures imprinted with GPS data, user name, time stamps, with notes on camera settings (ISO, Shutter, Aperture), and lens details. If you upload these photos online, people can find all this about you in REAL LIFE - yet very few people care.

/tin foil helmet

Ya, but you don't have to include that meta data if you don't want to.

The issue is the minority that don't want people to know who they are in the game.

#15 Posted by crusader8463 (14422 posts) -

LETS GET THIS FUCKER STARTED!!!1!

#16 Posted by Bwast (1342 posts) -
The contained information can be easily recovered and decrypted by hackers, which compromises the privacy and security of our accounts! For example, someone could use this to identify which account holds which characters and perhaps stalk and annoy its user, or help perpetrators choose their phishing victims with a more targeted approach.

Don't really see how that compromises the security. Privacy, sure, but maybe you shouldn't post screenshots of your character online if privacy is that important to you. Even if someone stalks you, you can ignore them and report them. As for the phishing nonsense, only idiots fall for that shit. And all they get is the server that you play on anyway, not your email address, so they could only spam you in-game.

So, in the end, the controversy isn't a controversy.

#17 Posted by phatcat (150 posts) -

Oh neat, an attorney on the forum that broke the news discuss his thoughts!

I’m not at all competent to discuss the technical aspects of this. TBH, when I first saw the thread I dismissed it as fear mongering nonsense. However, since the OP and others have been persistent in following through with their research, I’ve been converted and now think it is likely that indeed there are hidden watermarks in our images. So assuming that they are in fact embedding watermarks, here are my thoughts:
Originally Posted by Sendatsu
PS: Any lawyer here able to tell us if it's even legal to add a secret watermark with account info in the screenshots, without mentioning it in the ToS, and then using it to track the actions of the users and identify the private servers they may use?
IMHO, under US law, I don’t see anything in what Blizzard is doing that is likely to be held to be “illegal”. Remember the three contracts that we agree to in order to be able to use the game (The World of Warcraft Terms of Use Agreement (the “TOU”), The World of Warcraft End User License Agreement (the “EULA”), and theBattle.net Terms of Use Agreement (the “BNTOU”)) all clearly state that what we are purchasing is the right to use the service and limited license therein. They go on to further clarify that we do not have any ownership right in any of the part of the game.
In particular the EULA states in relevant part (emphasis added):

Ownership.
All title, ownership rights and intellectual property rights in and to the Game and all copies thereof (including without limitation any titles, computer code, themes, objects, characters, character names, stories, dialog, catch phrases, locations, concepts, artwork, character inventories, structural or landscape designs, animations, sounds, musical compositions and recordings, audio-visual effects, storylines, character likenesses, methods of operation, moral rights, and any related documentation) are owned or licensed by Blizzard. The Game is protected by the copyright laws of the United States, international treaties and conventions, and other laws. The Game may contain materials licensed by third parties, and the licensors of those materials may enforce their rights in the event of any violation of this License Agreement.
I think it is highly likely that a U.S. judge would read that laundry list to include screenshots. Meaning, that any screenshot we take, is still the property of Blizzard. As such, Blizzard could put any information it desires into their screenshots, provided such information does not share otherwise legally protected information of the user.

The EULA also states (emphasis added):

WORLD OF WARCRAFT®
END USER LICENSE AGREEMENT
Last Updated August 22, 2012

IMPORTANT! PLEASE READ CAREFULLY.

THIS SOFTWARE IS LICENSED, NOT SOLD. BY INSTALLING, COPYING OR OTHERWISE USING THE GAME (DEFINED BELOW), YOU AGREE TO BE BOUND BY THE TERMS OF THIS AGREEMENT. IF YOU DO NOT AGREE TO THE TERMS OF THIS AGREEMENT, YOU ARE NOT PERMITTED TO INSTALL, COPY OR USE THE GAME. IF YOU REJECT THE TERMS OF THIS AGREEMENT WITHIN THIRTY (30) DAYS AFTER YOUR PURCHASE, YOU MAY CALL (800)757-7707 TO REQUEST A FULL REFUND OF THE PURCHASE PRICE.

This software program, and any files that are delivered to you by Blizzard Entertainment, Inc. (via on-line transmission or otherwise) to "patch," update, or otherwise modify the software program, as well as any printed materials and any on-line or electronic documentation (the "Manual"), and any and all copies and derivative works of such software program and Manual (collectively, with the "Game Client" defined below, the "Game") is the copyrighted work of Blizzard Entertainment, Inc. or its licensors (collectively referred to herein as "Blizzard"). Any and all uses of the Game are governed by the terms of this End User License Agreement (the "License Agreement" or "Agreement"). The Game may only be played by obtaining from Blizzard access to the World of Warcraft massively multi-player on-line role-playing game service (the "Service"), which is subject to a separate Terms of Use agreement (the "Terms of Use") incorporated into this Agreement by this reference. The Game is distributed solely for use by authorized end users according to the terms of this License Agreement. Any use, reproduction, modification or distribution of the Game not expressly authorized by the terms of the License Agreement is expressly prohibited.
I think a screenshot is very likely to be classified as a “derivative work” and as such I think Blizzard would claim it owns the copyrights thereto. IMHO, it would likely be successful in making that claim.

With that in mind, I think there are potentially some interesting and unclear legal issues with regards to screenshots (suppose I take a screenshot that is Ansel Adams beautiful, and people want to buy it from me and I want to sell it, would I have the right? Could Blizzard stop it?), but those issues are separate from, and should not be confused with, the issue of whether or not Blizzard has the right to control what information ends up in the file dump that is created when you hit the screenshot button. The fact is that all the information that goes into the screenshots is dictated by Blizzard’s programing and this watermark information is just a small part of what their program creates. It would be very hard to argue that they are free to control all the other information (color info, etc) but not this information, since their program “makes it all”.

Originally Posted by [Pat]
By law no company can harvest PII without telling their customers and giving them an opt out, I'm going to just say that this is nothing but fear mongering and paranoia.
They give the disclosure, and the opt-outs, in the TOU, EULA, and the BNTOU. We all accepted that the first time we installed and used the game and after every patch since.

Originally Posted by Sendatsu
PS2: I know the ToS mentions that they can communicate our info back to Blizzard, but the user assumes they will use a safe channel via battle.net, not our screenshots that we share with the world, unaware of their secret contents.
That is probably a bad assumption on the part of the user. There is nothing in the TOU, EULA, or BNTOU (“the Agreements) that I read which would lead me to think I have an expectation of privacy in how Blizzard choses to enforce the Agreements when it comes to non-personal information (e.g. server name, server address, server time, etc.). If they were submitting, and “broadcasting” personal information (e.g. my credit card info, address, real name, etc.), that would be a different story. But, since:

Originally Posted by Sendatsu
It is essential to note that the only information we have found inside the watermark is: account id, timestamp and realm IP address.

No passwords have been disclosed, nor any user IP addresses.
I don’t think a judge would hold that Blizzard is under any obligation to keep account id, timestamp and realm IP address private. This is particularly true given that this information is arguably still private, it is well hidden and none of us knew about it for years. Even now we still can’t extract this information from a “normal” screenshot (i.e. if Blizzard was obligated to keep this information private, which I don’t think they are, then they have probably met their burden by using the current method).

Originally Posted by Sendatsu
PS3: I know that private servers are illegal to run, but it is probably also illegal to track them down using ambiguous methods such as this. It's like bugging everyone's phone in advance just in case they ever think of trying something against the law. Oh, wait.
I think that’s a bad analogy. What you are essentially saying, if I understand you correctly, is that you want the right to violate the Agreements, but still use the software with complete privacy. I think you give up what little expectation of privacy you might have, when you chose to violate the Agreements.

A better analogy might be a thief who steals my camera, but thinks I should not be allowed to look at the exif data on the photos to prove it was taken with my camera, since he took the photo and it’s his artwork? Not to imply you are a thief of course.

Originally Posted by Sendatsu
It is important to note that after 2008, when Activision took over and apparently installed this secret watermark without mentioning it in the End user license agreement, private servers started dropping like flies (Blizzard legal targets private servers) which eventually led to the amazing $88 million dollars lawsuit they won (Gamasutra - News - Blizzard Wins $88M Judgment Against WoW Private Server Owner). I am not saying they shouldn't have protected their intellectual property but the important factor one should consider is that: if they used illegal (covert) methods of tracking these private servers, by "bugging" all users to act as their "unaware informants", while at the same time endangering their privacy and security in the name of profit, then you see how this whole case can take a completely different turn...
As I stated above, I don’t think they used illegal methods of tracking private servers. The code for these watermarks was assumedly in all released copies of , it was not somehow stealthily injected into only the copies of suspected private server users. I also have a hard time seeing how this information can be seen to be “endangering their privacy and security in the name of profit”. Frankly, I respect the work you’ve done in this thread, but these sorts of statements needlessly undermine the creditability of your legitimate technical findings.

I’ve been a member of this forum for a long time (mainly a lurker), please don’t read any of the above to mean that I support what Blizzard is doing, or that I am against the creative activities we enjoy and discuss: I just don’t think it’s worth wasting much effort or hope on thinking that “we have Blizzard by the balls this time! What they are doing is illegal!!” I think the truth of the matter, is that they are likely fully within their rights to embed such information into screenshots.

Thanks for making us aware of this, and I for one will certainly take it into consideration when posting public screen shots in the future.

Disclaimer: I am an attorney, but I am not your attorney. The thoughts expressed in this post are my own personal opinion on the issues discussed therein, and should not be viewed or interpreted as legal advice. My thoughts expressed do not represent the opinion of anyone else on the forum or the forum itself (or the owners, employees, officers, or directors thereof). My opinions should not be relied upon to make decisions regarding any course of action you may or may not have against Blizzard. If you think you have been wronged, you should consult your own personal attorney.

There are alot of people getting bent out of shape about this, glad this guy gave some insight :)

#18 Posted by DeadVillager (77 posts) -

Welp, guess we should have been reading the ToS after all.

Ba dum tiss.

#19 Posted by phatcat (150 posts) -

Also I would like to note I'm not rebel rousing by posting this article.

This is just a weird/neat thing. Freak'n secret barcodes in screenshots?

We live in Burn: Cycle !

#20 Posted by Athadam (692 posts) -

@phatcat said:

Also I would like to note I'm not rebel rousing by posting this article.

This is just a weird/neat thing. Freak'n secret barcodes in screenshots?

We live in Burn: Cycle !

Yeah, some people are over reacting. It's not a big deal but this is pretty cool how they had to make the watermark all hidden and encrypted.

#21 Posted by DCam (125 posts) -

@phatcat said:

Thanks to _Mike, we also verified that there is no pattern included in high quality screenshots like TGA and JPG/10. So, in order to avoid any further watermarking, type: /console SET screenshotQuality "10"which will set the quality of your screenshots to the maximum and create screenshots that do not include the watermark.

What's so weird is the more you turn down the quality, the more info they embed! I tried some with /console SET screenshotQuality "4" and they included my long and lat while I was playing, a complete hardware profile of my character, and information about my characters on other realms. So weird. Seriously.

#22 Posted by phatcat (150 posts) -

@DCam: I ran some filters on an wow image of yours... I think there is even more in there.

#23 Posted by xpogox (48 posts) -

@phatcat:

Oh my god....how deep can this go!!!!!?

#24 Edited by Mnemoidian (955 posts) -

So, here's why it's not a conspiracy:

It's information to identify you using your character's account ID, which is not the same as your Battle.net account. The IP included is the IP pointing to the server the client is connected to, not yours.

This is a way for Blizzard to be able to track down those who break NDAs, play on private servers (and tracking down the servers) as well as exploiters.

And it's stupidly easy to circumvent. Either you can change the image quality of the saved screenshot (in WoW), or you use an external screenshot manager - like Steam or FRAPS. Hey, presto - no water marks.

(Disclaimer: there may be more to this than I've seen, but so far... if anything, I think it's a cool use of technology, which has gone unnoticed since Wrath of the Lich King was launched... in 2008.)

#25 Posted by henry1989929 (26 posts) -

maybe this is a cheat, or maybe the system is broken.

This edit will also create new pages on Giant Bomb for:

Beware, you are proposing to add brand new pages to the wiki along with your edits. Make sure this is what you intended. This will likely increase the time it takes for your changes to go live.

Comment and Save

Until you earn 1000 points all your submissions need to be vetted by other Giant Bomb users. This process takes no more than a few hours and we'll send you an email once approved.