World of Warcraft Screenshots hold secret information about you?!
I was reading a post over at Evil Avatar about Blizard embedding info about you with their in-game screenshot capture system.
A few days ago I noticed some weird artifacts covering the screenshots I captured using the WoW game client application. I sharpened the images and found a repeating pattern secretly embedded inside. I posted this information on the OwnedCore forum and after an amazing three-day cooperation marathon, we managed to prove that all our WoW screenshots, since at least 2008, contain a custom watermark. This watermark includes our user IDs, the time the screenshot was captured and the IP address of the server we were on at the time. It can be used to track down activities which are against Blizzard's Terms of Service, like hacking the game or running a private server. The users were never notified by the ToS that this watermarking was going on so, for four years now, we have all been publicly sharing our account and realm information for hackers to decode and exploit. You can find more information on how to access the watermark in the aforementioned forum post which is still quite active.
They link to the source fourm here:
This post may have been moved to WoW General, but it still remains an exploit - one which is used against us...
1) Go somewhere where there aren't any (or a lot) of textures. I used the druid blink bug to go to the north end of the world but you should go below Dalaran in Crystalsong Forest, as bluesius suggested, because you will get a better screenshot if you stick your face in the pure white trees.
/console SET screenshotQuality "9"
Make sure you use 9, not 10.
3) Take a few screenshots of the clear, no textures, white area by zooming into a tree and hitting ALT Z, so that your entire screen is white.
4) Open this image in an image editing program like IrfanView (it's freeware), click CTRL+E, select the Sharpening filter, use the highest possible sharpening value (99) and click OK. Now do this two more times, again: CTRL+E, Sharpen 99, OK.
5) You are now looking at your character's WoW watermark / custom bar-code / qr code look-a-like / call it what you will:
Apparently, each character has a different set of these repeatable patterns, which contain account and realm information, and it looks like if they are scanned by software that recognizes them, they canreveal our character's account name/id, the time of the screenshot and the the full information of the realm, including its IP address (think "private servers").
The pattern, which consists of approximately 88 bytes of data, repeats itself many times depending on the resolution of your screen. See below for a colored representation: the account id and realm information are depicted in red and the current time (seconds not included) is depicted in blue:
Based on Blizzard's ToS, Blizzard is allowed to communicate information about our hard drive, CPU, operating systems, IP addresses, running tasks, account name and current time and date. It never mentions anything though about embedding some of these data into every screenshot we capture using the WoW printscreen tool.
The contained information can be easily recovered and decrypted by hackers, which compromises the privacy and security of our accounts! For example, someone could use this to identify which account holds which characters and perhaps stalk and annoy its user, or help perpetrators choose their phishing victims with a more targeted approach. Perhaps someone is already using this since the watermark has been around for at least two years already.
It looks like Activision Blizzard has teamed up with Digimarc (http://www.digimarc.com) to provide us this wonderful service of secretly tagging our in-game screenshots with our account and realm information. Although it has not yet been verified, it is possible that Blizzard is using an automated monitoring service which downloads image files from various Internet sites and checks them for the presence of their embedded digital watermark data, kindly provided by Digimarc: http://www.google.co.uk/patents/US7653210
_Mike has managed to disassemble the watermark data and help us verify which pieces of information are contained inside. Do note that this covert watermarking has been going on since, at least (!), 2010 (Patch 4+) so you may want to delete/remove from the public domain all your post-Cataclysm screenshots captured by WoW.
Also note that if your screen resolution is too high, the pattern will look something like this:
Thanks to _Mike, we also verified that there is no pattern included in high quality screenshots like TGA and JPG/10. So, in order to avoid any further watermarking, type: /console SET screenshotQuality "10"which will set the quality of your screenshots to the maximum and create screenshots that do not include the watermark.
l0l1dk has developed a tool to disable the addition of watermarks in the lower quality screenshots but use it at your own risk/responsibility because it could corrupt the WoW client, which could then require a clean re-installation of the game (it's also against the ToS). It is much simpler to just set the JPG quality to max.
Try it yourselves. Read the rest of the thread for more information. If you have any comments, ideas or suggestions please share. Politeness is appreciated.
For legit players this isn't an issue. But it does raise some privacy concerns. For example...
What if you are Felicia Day? You posted a screenshot of you WoW character. Now anyone knows your account name, and the server you are playing on. Any person who posts any screenshot has lost their anonymity.