CTOForADay.com

Hacking World of Warcraft is big business; over 7 million players worldwide, making up over 50% of the Massively-Multiplayer Online (MMO) gaming market, give a tenner a month to Blizzard. Not only is World of Warcraft the biggest MMO in the business, it's bigger than the rest of the MMO market put together.

When people think of abuse happening in Warcraft, they think of gold farmers. "Chinese Gold Farming", those three words full of more spite and venom than most WoW players care to admit, covers three different kinds of behaviour: Farming, Exploiting, and Botting. When people think of chinese gold farmers, they're referring usually to people running bots, but the real-world behaviour runs the gamut of all of the above.

The basic premise is simple: Exploiters, farmers, and botters make use of the game world to get stuff; they then sell that stuff for real-world money to the players of World of Warcraft. These techniques are often used in combinations, making for very grey lines; they're also used, in the real world, by more than just commercial farmers - but the basic tools break down into those three sets, and they're all generally used to make money.

Old-Skool: The Gold Farmer

Gaming Workshops, the digital equivalent of the sweatshop, producing gold by playing the game as it was meant to be played, but selling off all of the assets over the net. To be truly honest about this, nothing will ever "fix" this problem, because nothing's actually wrong, here. Many of these players are extremely well geared, are exceptional players, and not only play the game for a living but actually enjoy doing it. Many of these workshops are more than capable of doing guild runs on some of the toughest bosses in the game; they're not all mindless automatons as they're made out to be.

Gold farmers can make decent money; some estimates put it at a couple of US dollars an hour. It requires a certain amount of infrastructure - the website, the paypal account, the access to e-bay, and all of the documentation requirements that go with it; inevitably, a US-run ebay account selling gold requires a certain amount of within-the-US business support. Moreover, it's a highly competitive business; companies doing it range from well-paid farmers who do it for fun to near-sweatshop conditions and dodgy working practices, up to and including holding teenagers' documents hostage in behaviour that mimics the worst of black market employment and economics.

The darker end of that spectrum is the part most people think of when they think of gold farming; forced virtual labor, sweatshop conditions, and working practices to make even the fashion industry look friendly. The truth is that while these places do exist, they're not the only places out there, and there's money to be made for even small to medium-sized businesses farming gold. Demand is high; western players spend most of their time blaming WoW for being too "grindy" - too steeped in the need to kill one thing after another - but ultimately it's player behaviour, not Blizzard, that is ultimately responsible for the prevalence of gold on ebay.

After all, if the game wasn't fun, the player would always be free to not play - but westerners are used to, and comfortable with, the idea of trading their time for their money, and for many that trade is the whole point of having money in the first place. The current microtransaction-oriented items available on XBOX Live is another example of this - pay real money to get in-game money in Godfather, or pay real money to play golf courses that would have otherwise required you to be good enough (e.g., time) in Tiger Woods' golf. The concept isn't new, it's just a new way of generating assets. The market is new, but the attitude that leads to the creation of that market is endemic to modern cultures worldwide - it's not a fixable problem.

These farmers aren't ever going away; they're here forever. They're here because we want them to be, whether we like it or not; their existence says something fundamental about human nature and the way that we approach and value time and money.

A number of fascinating documentaries on YouTube cover this phenomenon; a couple of the good ones are embedded below.

Exploits: Turning Bugs Into Money

The second most hated form of moneymaking is the one everyone wishes they could get away with: The exploit.

Now, this is often thought of as being restricted to farmers, but the reality is very different. Lots of people exploit - and I do mean lots. Take, for example, the extreme case of a guild named Overrated, banned en-masse. The post-rationalization says it all:

Since the majority of our guild's equipment is beyond that offered in the temple of AQ, there is little incentive for our raiders to go there at all. Basically all we get from there is a nasty repair bill. The only loot worth anything drops off of the last boss, so naturally it came to the point where only a handful wanted to go to AQ because of the incredible cost of time and gold, with little reward.

With this cheat, we could basically eliminate the repair bills, the gueling 4++ hour clear, and actually have the required raid online to kill C'Thun before people started getting sandy and logging out.

And here's a video of one of those exploits in action. Caveat visitor: this video contains some truly, truly dodgy music.

We want the loot without the time and effort; moreover, we value our own time so highly that the value of our time is almost always greater than the value of the items - and yet at no point do we lead ourselves to the obvious conclusion - that we can't have what we don't earn or don't pay for. We deserve this stuff. It's the same fundamental reasoning behind why people who think that the music industry is a monopoly also think it's OK to steal music as a result, or people who nick copies of Microsoft Windows while at the same time berating Microsoft's pricing strategy; if the thing in question is priced at a level that doesn't agree with our own valuation of that thing, many will happily berate the pricing as the reason they stole it; but the interesting part of the motivation, and the one that makes exploiting so common, isn't in the cost of the item - it's in our belief that we're somehow deserving of said item enough to exploit the system to get it.

And Overrated isn't alone - in terms of end-game raiding, exploiting is more than just a little popular; for about three months, it was the way many end-game instances were run, on a daily basis, by almost all of the end-game guilds out there. Whether it's Bloodlord Mandokir in ZG, tough end-game bosses in Naxxramas, or a multitude of others, exploiting in end-game is common.

But exploiting is more common, and more broad, than even that information might lead you to believe. Exploiting, as a definition, is simple: Making use of in-game bugs for fun and profit. Most exploits fall into three categories: Terrain/map exploits - getting to places you shouldn't and using it to your advantage - are the most common. Mob exploits invoke bugs in specific AI or programmed encounters are also heavily used and rapidly fixed. Finally, and most damaging, are duplication exploits.

Some terrain exploits are harmless - using client bugs to get into special areas of the game world that you weren't intended to be able to get to. The World of Warcraft servers are full of people who use exploits to do sightseeing; being able to go around and see the sometimes incredibly beautiful world that Blizzard has wrought, without the headache of having to fight your way through the world; sometimes, you just want the artist's tour of Azeroth, and terrain exploits are one way of doing that. Some are certainly not victimless - Battlegrounds exploits are some of the most commonly used exploits, and there are a frightening number of them. Then there's tricks like the Bloodlord Mandokir stuff mentioned previously, used on everything from end-game bosses to climbing under the city of orgrimmar to kill Thrall.

Then there are mob exploits; exploiting bugs in the behaviour of an individual mob to kill it, sometimes with little or no effort. These are used in much the same way as the terrain exploits - but instead of the problem being in the art, the problem is in the game scripting for a given mob.

The most valuable of all exploits, however, are duplication exploits: given 1 of object X, use the exploit to get 2. There are also gold duping exploits - given 5 gold, make 10 out of thin air. These are the ones that Blizzard spends most of its server-side engineering time on - in terms of ensuring that these bugs aren't introduced, writing code to monitor world economies and spot unusual behaviour (in much the same way that Visa or MasterCard's internal systems might, for example), or shipping hotfixes and patches to eliminate discovered exploits. When discovered, these can literally destroy a server's economy, inflating the price of basic items beyond the ability of individuals to afford and dramatically increasing the likelihood that individuals on the server in question will buy gold, thereby closing the vicious circle - people buy gold, people buy stuff, stuff becomes more scarce and people have more money so prices go up, so people buy gold.

Sites exist which charge monthly fees to subscribers to get the latest news on exploits; people pay good money to find out how to game the system, and people make good money spending their time documenting every bug they can find in the hopes of selling that information for profit.

Botting: When Players Auto-Attack

The most damaging form of exploits, in the eyes of most of the players, is the bot. The definition of botting is vague, but essentially, it means that instead of actually playing the game, you get the game to play the game.

This involves a broad number of technologies; in the early days, some of this was done via in-game scripts and add-ons, but Blizzard has been slowly chipping away at the internally-automatable portions of the game. 2.0 is bringing a range of client enhancements which introduce more roadblocks along this particular road; add-ons like Decursive (which automatically selects and removes damaging affects from any characters in your party with a single keypress) are the targets, here - remove those "one-button scripts" that do everything for you if you just keep pressing the same button over and over.

And while those are good things, those changes don't actually address botting. They address the difficulty of content in the game; they remove the advantage gained through AI-like addons, so that people play the encounters at the difficulty level they were intended to be played at. It's important to remember that WoW is played by a broad range of people, at various levels of gearing and competency; and that the introduction of the AI wildcard into the mix makes it that much harder for Blizzard to introduce balanced content. Their arguments and reasons for making these changes are sound.

But botting stopped using those interfaces long ago. Once upon a time, someone wrote a program that looked inside the game code and made visible stuff that shouldn't have been. They found ways to make you run five times faster than a normal player, or walk straight up walls at 90 degree angles. They found ways to teleport anywhere in the world. Later, using those principles, someone wrote the first standalone bot: it used the APIs inside the game, through skilled decompilation and reverse engineering, and injected its commands directly into the game. Fundamentally, this is how they still work today: Programs that pretend to be a user and play the game. They've gone from rudimentary, unsophisticated programs that did little more than wander aimlessly and swing a sword to today's sophisticated bot, capable of using a broad range of player skills and coded with multiple strategies.

Blizzard began to react. They started with code tricks; making it harder to get to various internal resources, or making some things move around so that they were never in the same physical place twice, making it harder for these programs to get to the bits of information they were looking for. Then the arms race started in earnest; one of the popular programs went subscription - and the author started to charge for the tool that everyone was using to make their bots and exploit with. Blizzard did something unprecedented in gaming, and in one fell swoop, wiped out all of the "low hanging fruit" - they introduced a program called "The Warden" - a thing that runs alongside World of Warcraft, and scans your system, and itself, for anything that might show them that you're cheating.

The War Ends: Kernel-Level Hacking of World of Warcraft

This arms race - of the Warden being improved over time to find more and more exploiting programs, and people writing those exploit programs to hack WoW in undetectable ways, has led to the ultimate conclusion of such a case: In a presentation at BlackHat 2006, Greg Hoglund and Jamie Butler gave a presentation on Hacking WoW with a rootkit; essentially, hacking your own operating system, in the way that viruses or dodgy porn sites might, to introduce the World of Warcraft hacking system at such a low level that it can essentially be made completely undetectable to anything in the system.

The presentation is a collation of the entire history of World of Warcraft hacks, and shows where the cutting edge is - farms of computers running low-level hacks that allow them to run an unmodified World of Warcraft and do all the things that previously required programs to behave in fundamentally detectable ways.

What this presentation shows, unquestionably, is that hacking in World of Warcraft is changing. It has already (mostly) transitioned away from information on hacking being public to being availablle almost exclusively on commercial sites; now people make their money off of that information. And Warden's success has killed off the majority of freely-available programs for hacking; but its weaknesses are just shifting the market to a more elite, more focused group of developers who are writing programs and sharing information on how to, but not actually distributing the binaries themselves; more profitable for the authors of the bots, and designed more specfically to meet the needs of not just individual machines playing warcraft for profit, but dozens of computers gaming the system.

Don't expect the Burning Crusade to fix the botting problem. If anything, the resourcefulness of the botters has led them to up their game, and the war might just have been lost.