PSA: Think twice about what you have open when you play private servers

Blizzard have always advertised that just connecting to a private server brings risks. This used to be scoffed at in the community, until Warmane started exploiting a clever remote code exploit in the client to run arbitrary code through an exploit without the player even knowing. As this became more popular, patches were built to try and prevent the RCE, but ultimately there is no good solution. There is no known example of this being used maliciously, but I think it very unethical and open to abuse.

I have recently been showing evidence of large private servers scanning outside of the WoW process as part of anti-hacks.

https://i.imgur.com/lvs1XzZ.png

This is logging your IP address, account details, and open window titles to a Discord and private database. It is not being used maliciously, but obviously this data breaches various data protection laws and what got Blizzard in a lot of bad press for in 2005 and which they subsequently discontinued.

Blizzard's version was far less intrusive. There was known window titles they wanted to look for, and they asked the client to compare the window title to a known hash and send back true/false as a confirmation of whether it is open. Large private servers are now arbitrarily scanning open processes on your computer and sending and publishing all that data. I think that is far too intrusive personally.

Sources for the old Blizzard drama:

• https://onwarden.blogspot.com/2007/07/privacy-and-you.html

• https://onwarden.blogspot.com/2008/12/why-are-people-still-referencing.html

So this thread acts as a public service announcement. There is no evidence of anything malicious happening, but you do need to be careful about what you do when you are playing these private servers and what data could be captured by them. Even if the original server owners never plan to do anything malicious, that database could be exploited in the future. These private servers operate as large illegal businesses, and they are not beholden to common data protection regulations and standards. This is not meant to be fear-mongering, but rather raising awareness of what these servers are doing behind the scenes and what data they are capturing.