[-Tigger-]

Punkbuster Anticheat privacy invasion
Saturday April 29th 2006, 5:57 pm
Filed under: Uncategorized, hacking, technology, news

Today, one of my friends sheep found out something intresting about Punkbuster. As it is well known, I am one of the admins of msxsecurity, a large game hacking site. While on our quest to develop new bypass methods, we found out something very disturbing- Punkbuster is sending personal data back to its servers. We found this by monitoring pb’s file accesses- While in the past PB would only scan for running processes, it is now actively scanning the hard drive, and looking for .txt files in certain folders. It was logged with ethereal that punkbuster actually SENT the contents of a txt file to its servers (presumably for further investigation) Now while in this case it wasnt a huge issue, as the text file was just some install data for a codec, it could have been much more serious. (Think tax information, Social securitys #’s, Finances, etc..) While the streams of “dialog” arent exactly open between myself and punkbuster, I consider this to be a huge breach of trust with the public. The fact that PB is even actively scanning text files is a huge security issue that needs to be addressed, as it isnt even scanning inside the bf2 folder, it is computer wide, and any file that becomes ‘flagged’ is uploaded to PB.

I would like to reccomend to everyone that you write PB and let them know how wrong what they are doing is. Trying to aggressively detect cheats is one thing, but scanning and uploading private files is another.

Here is a screenshot showing a passive scan while searching for a .txt file.

http://www.wkccp.com/image/uploads/1b720b69f7.jpg

Some particulary intresting EULA info

Check out the parts in bold…

————

SOFTWARE LICENSE AGREEMENT

The terms of this Software License Agreement (this “Agreement”) shall apply to all versions, editions, and future updates of PunkBuster software and constitute a legal agreement between you (the “Licensee”) and Even Balance, Inc. (the “Licensor”).

BY INSTALLING, ENABLING OR USING PUNKBUSTER SOFTWARE, THE LICENSEE IS CONSENTING TO BE BOUND BY AND IS BECOMING A PARTY TO THIS AGREEMENT. IF LICENSEE DOES NOT AGREE TO ALL OF THE TERMS OF THIS AGREEMENT, ACCEPTANCE MUST NOT BE SPECIFIED BELOW AND LICENSEE MUST NOT INSTALL OR USE THE SOFTWARE.

EVEN BALANCE, INC. RESERVES ALL RIGHTS NOT SPECIFICALLY GRANTED HEREIN.

Licensor grants Licensee a non-exclusive and non-transferable license to use PunkBuster software only for non-commercial entertainment purposes. Licensee may not disassemble, decompile, reverse engineer, redistribute (in any form), create derivative works of, or modify PunkBuster software in any way. Licensor reserves the right to terminate the license at any time and for any reason, or no reason at all, and without notice to licensee. Additionally, upon breach of any term of this Agreement, the license granted under this Agreement shall automatically terminate without any additional notice to Licensee. Upon termination of the license, Licensee shall destroy all copies of PunkBuster software in Licensee’s possession.

Licensee acknowledges that PunkBuster software is optional and is not a requirement in any respect for using or enjoying games that integrate PunkBuster software technology. Licensee also acknowledges and agrees that PunkBuster software is self-updating, which means that future updates will, from time to time and without any notice, automatically be downloaded and installed as a normal and expected function of PunkBuster software. Licensee further acknowledges and accepts that PunkBuster software may be considered invasive. Licensee understands that PunkBuster software inspects and reports information about the computer on which it is installed to other connected computers and Licensee agrees to allow PunkBuster software to inspect and report such information about the computer on which Licensee installs PunkBuster software. Licensee understands and agrees that the information that may be inspected and reported by PunkBuster software includes, but is not limited to, devices and any files residing on the hard-drive and in the memory of the computer on which PunkBuster software is installed. Further, Licensee consents to allow PunkBuster software to transfer actual screenshots taken of Licensee’s computer during the operation of PunkBuster software for possible publication. Licensee understands that the purpose and goal of PunkBuster is to ensure a cheat-free environment for all participants in online games. Licensee agrees that the invasive nature of PunkBuster software is necessary to meet this purpose and goal. Licensee agrees that any harm or lack of privacy resulting from the installation and use of PunkBuster software is not as valuable to Licensee as the potential ability to play interactive online games with the benefits afforded by using PunkBuster software.

Licensee agrees not to export or re-export into any country subject to U.S. trade sanctions or to which the U.S. has embargoed goods or to any nationals or residents of such countries unless such nationals are permanent residents of a country that is not subject either to such sanctions or embargoed goods. LICENSEE AGREES NOT TO DOWNLOAD, INSTALL, OR USE PUNKBUSTER SOFTWARE IN A COUNTRY OR LOCALE WHERE SUCH ACTION WOULD VIOLATE ANY LAW OR ORDINANCE.

This Software License Agreement shall be construed in accordance with and governed by the applicable laws of the State of Texas and applicable United States federal law. Exclusive venue for all litigation regarding this Agreement shall be in Harris County, Texas. Licensee agrees that any portion of this Agreement found to be invalid or unenforceable shall be modified, to the extent allowed by law, so as to allow for the enforcement of the original intended meaning of the portion found to be invalid or unenforceable.

PUNKBUSTER SOFTWARE IS PROVIDED ON AN “AS IS” BASIS, WITHOUT WARRANTY OF ANY KIND INCLUDING, BUT NOT LIMITED TO, AND WITHOUT LIMITATION, THAT IT IS FREE OF DEFECTS, FIT FOR A PARTICULAR PURPOSE, OR THAT IT IS MERCHANTABLE. LICENSOR DOES NOT WARRANT THAT THE OPERATION OF PUNKBUSTER SOFTWARE WILL BE UNINTERRUPTED OR ERROR-FREE OR THAT IT WILL MEET LICENSEE’S SPECIFIC REQUIREMENTS OR DESIRES. LICENSEE AGREES THAT NEITHER EVEN BALANCE, INC., ITS OFFICERS, DIRECTORS, SHAREHOLDERS, EMPLOYEES, CONTRACTORS, LICENSORS, BUSINESS PARTNERS, SUCCESSORS NOR ASSIGNS SHALL BE LIABLE FOR ANY CLAIM WHATSOEVER INVOLVING PUNKBUSTER SOFTWARE IN ANY WAY. FURTHERMORE, SHOULD ANY VERSION OF PUNKBUSTER SOFTWARE, INCLUDING FUTURE VERSIONS, PROVE DEFECTIVE IN ANY WAY, LICENSEE ASSUMES THE ENTIRE COST, IF ANY, OF LOSS OR DAMAGE OF ANY TYPE AND TO ANY DEGREE. THIS WARRANTY DISCLAIMER SHALL SURVIVE TERMINATION OF THE LICENSE OF PUNKBUSTER SOFTWARE BY LICENSEE, REGARDLESS OF WHETHER THE LICENSE IS TERMINATED BY EVENBALANCE, INC. OR LICENSEE.

This Agreement constitutes the entire agreement between Licensor and Licensee and supercedes any prior statements, whether written or oral.

*Please note that the comments of this post are the opinion of the author, and not to be taken as fact.

cant give u a link to the source as it would break the rules..

its unconfirmed at the min, but who knows theres always something sneaky with all these companies..