Blizzard chooses not to ban bots more frequently for profit reasons.
Josh Phillips and Mike Donnelly, doing a large presentation, both very knowledgeable on the subject:
“Does anybody wonder why it takes 3 months for a ban wave to happen? It’s because when you ban like 50,000 accounts in a week then those people who would rebuy those accounts never buy them again, because it gets expensive, but if you do it every 3 months or 4 months they will buy the accounts back so it’s actually profitable for the game company…”
A video of them saying this at the 35m15s mark, I wouldn’t go much past that, the vid’s pretty boring and high-level:
https://www.youtube.com/watch?v=hABj_mrP-no#t=35m15s
Also, specific to Diablo 3, There’s only one active D3 bot and they don’t change core although rotations/scripting changes. Botters expect that they could see about one ban wave per season. Ex:
It’s the same thing with D2 bots - they are easily detected they’ve been around forever and they’re incredibly simple bots to detect.
So again, the current bots are easily detected, their core code doesn’t bother to change, they could be banned frequently such that it becomes cost prohibitive but Blizzard declines to do this for financial reasons.
Therefore, this is a fallacy:
“Blizzard can’t detect bots”
And this is a fallacy:
“Blizzard doesn’t ban more frequently because botters would just change their code and make themselves undetectable again”
And this is a fallacy:
“There’s nothing we can do, we’ll always have bots”
Anyway that’s the end of the summary. If you want to glaze your eyes over with some details on Blizzard’s Warden and Donnelly’s Gliderbot, that’s below. It’s just stuff I ran into while looking into all this. There’s also a link to D2R and Blizz removing GitHub repos at the end. For many of you this is nothing new.
2004:
Blizzard: “When World of Warcraft first launched in 2004, our GM and hacks teams searched for bots manually – a process that became increasingly ineffective as bot technology evolved.”
2005:
In 2005, this manual process obviously changed. Warden was first outed and analyzed by cybersec expert Greg Hoglund in 2005:
"…it’s written like shellcode in that it’s position independent. It is downloaded on the fly from Blizzard’s servers, and it runs about every 15 seconds. It is one of the most interesting pieces of spyware to date…here is what it does, about every 15 seconds, to about 4.5 million people (500,000 of which are logged on at any given time):
-
dumps all the DLL’s using a ToolHelp API call. It reads information from every DLL loaded in the ‘world of warcraft’ executable process space
-
uses the GetWindowTextA function to read the window text in the titlebar of every window. These are windows that are not in the WoW process, but any program running on your computer. Window [URL strings] can easily contain [sensitive personal information], for example, if I have Microsoft Excel or Quickbooks open w/ my personal finances at the time.
-
Once these strings are obtained, they are passed through a hashing function and compared against a list of ‘banning hashes’—if you match something in their list, I suspect you will get banned. [This is called SBD or signature-based detection].
-
Next, warden opens every process running on your computer. When each program is opened, warden then calls ReadProcessMemory and reads a series of addresses—usually in the 0x0040xxxx or 0x0041xxxx range—this is the range that most executable programs on windows will place their code. Warden reads about 10–20 bytes for each test, and again hashes this and compares against a list of banning hashes. [This is to detect known bots and cheats using signature-based detection]. "
Another netsec expert did a section on Warden in his bot hacking book and said this about Warden:
"[Warden] is delivered as compiled shellcode and typically has two responsibilities:
- Detect bots.
- Periodically send a heartbeat signal to the game server. The value sent is not predefined but instead is generated by some subset of the detection code. If Warden fails to complete the second task or sends the wrong value, the game server will know that it’s been disabled or tampered with. Furthermore, a bot can’t disable the detection code and leave the heartbeat code running.
The Halting Problem:
A bot that could disable Warden’s detection code and still send the heart-beat signal would solve the halting problem, which Alan Turing proved to be impossible in 1936. The halting problem is the problem of determining, with a generic algorithm, whether a program will finish running or continue forever. Because Warden does two tasks using the same shellcode, writing a generic algorithm that can disable just one task is a variation of the halting problem: the algorithm can’t be sure which parts of the code will definitely execute, which parts won’t, and which parts are responsible for each task.
Warden is formidable because you not only have no way to know what you’re hiding from but also have no way to disable the toolkit."
The major takeaways for Warden - it uses SBD. It runs in user-mode, not kernel mode. Bots and cheats have not been able to disable it or remove it, thus they have to work around it and still remain undetected. Warden’s code does not change based on a Blizzard game’s patch or update schedule - Warden could be updated any time, there’s no telling when it will change. Some bot makers have their bots set up to automatically disable themselves if Warden changes. For example, If the bots remained active they might be detected with new changes to Warden so the bot maker gets paged to investigate, make bot coding changes, recompile, redistrib, and enable and so on.
2006-2009:
Mike Donnelly’s Gliderbot comes on the scene and makes a huge impact on WoW. Gliderbot operates in part by examining the data states in the game client program, running a shadow driver to remove its process object from Windows and hooking kernel functions. On the scripting side it uses keyboard and mouse inputs to appear as human as possible but it is still easily detected.
As of 2008, it had sold approximately 100,000 copies. MDY was a multimillion dollar company operating out in the open and selling the bots. Blizzard contended in a 2006 United States federal lawsuit that the program’s use violated their terms of service. Because MDY was in USA, Blizzard could easily get to them in the courts and did so. Gliderbot and MDY were completely shut down by Blizzard through the courts where Blizz won a $6 million dollar judgement.