Punkbuster the rootkit

[j0da]

I've been looking around my computer for last few days, trying to find out how good my security actually was. My computer was scanned against viruses (with NOD32), spyware (Ad-Aware 2007) and trojans (a-squared). I've visited Shields UP! to see if my ports are configured properly and I'm invisible to various "sniffing" individuals. My computer passed all security tests there, so after dozen hours of work, checking, cleaning and veryfing I thought everything was fine.

Well, it wasn't.

Since I usually check Task Manager (from now on Winsight as well) I remembered two processes about which I wasn't too sure if they should have been running. I checked again and voila:

PnkBstrA.exe
PnkBstrB.exe

These names reminded me of Punkbuster software, which supposedly prevented players from cheating in many multi-player games. Like I wrote somewhere else on this forum, I used to play Call of Duty, so I just thought this piece of software was somehow left on my system, after CoD was uninstalled. "Ok, so how do I get rid of it?" I asked myself. checking first "Start menu", then Settings->Control Panel->Add or Remove Programs I found nothing. This was a point where common user's options end and in such cases they just leave strange things sitting on their hard drives, for they avoid tinkering too much in fear of doing something wrong. So, in fact I had on my computer a piece of software which was difficult to get rid of. I've decided to search the web. First I checked Punkbuster creator's page, where I found:

How do I uninstall PunkBuster?

If you do not wish to use PunkBuster any longer, you may remove the entire "pb" folder inside your game folder. By removing this folder, the PunkBuster software will no longer be available. PunkBuster does not save information to other locations of your hard drive, nor does it change your system registry.*NOTICE* Starting with PunkBuster client version 1.300, our new Service components are kept in the Windows folder of the hard drive and they do store information in the registry. We offer a separate program called PBSVC with an uninstall option for our service components, it may be downloaded from here.

Jeez, I didn't have ANY game folder anymore, so what these guys were proposing was to install their software (which would then do god knows what) to unistall their software which shouldn't have been left on my hard drive in the first place! Something was fishy about this whole mess, so I started to dig deeper on the web. What I have found was quite a discovery, for I learned that there is more to the Punkbuster than meets the eye...

First interesting snip was found at digg:

Punkbuster anti cheat uploading personal info
In the wake of the all the rootkit scandals, it seems that Sony was not the only company not walking the straight and narrow. A group of reverse engineers recently debugged Punkbuster and found out that PB is actually uploading personal data to their servers. They are also actively scanning your harddrive, and uploading any "suspicious" .txt files

Holy cow! At that moment I knew how "good" my security was, but that was not all. The site _digg.com was linking to was down, but I think I found original article at web.archive, which I'm posting snipped here:

PunkBuster Anticheat a rootkit

While looking into PB’s “covert” activitys today, we noticed something particularly intresting. Punkbuster is actually scanning outside of its working directory and looking for suspicious files. While this *might* be alright to the avid gamer, It is explicitly illegal regardless of how secure a EULA* may be. You can reference the Vitalman V. CsGuard case from way back. In that case, It was determined that CSGuard- even though it had a EULA stating it scanned outside of its folder- was still a “Active security risk”. This is what forced the name change to “HL Guard”

Now, bending and breaking rules isnt neccesarily new to PB, but this next bit of data certainly takes the cake. PB is actually uploading txt and dll files which are currently running in memory. What does this mean to you? If you happen to be playing a game with PB enabled (BF2, COD2, etc..) And you also have notepad or wordpad open, and text or information inside these files will be streamed to punkbuster for further investigation. The intresting part is that nowhere inside Punkbusters eula does it state that it has the authority to “phone home” with your files. Now there is no definitive answer of if they are actually investigating these files (or why they are even uploading .txt files- even a hack menu isnt really a risk) Regardless of wether or not someone is physically reading these files, its a enormous security breach that anyone who uses punkbuster should be aware of.

(snip)

Here is Punkbuster EULA, check out the bold parts. (snipped to the bold part and few additional lines)

Licensee acknowledges that PunkBuster software is optional and is not a requirement in any respect for using or enjoying games that integrate PunkBuster software technology. Licensee also acknowledges and agrees that PunkBuster software is self-updating, which means that future updates will, from time to time and without any notice, automatically be downloaded and installed as a normal and expected function of PunkBuster software. Licensee further acknowledges and accepts that PunkBuster software may be considered invasive. Licensee understands that PunkBuster software inspects and reports information about the computer on which it is installed to other connected computers and Licensee agrees to allow PunkBuster software to inspect and report such information about the computer on which Licensee installs PunkBuster software. Licensee understands and agrees that the information that may be inspected and reported by PunkBuster software includes, but is not limited to, devices and any files residing on the hard-drive and in the memory of the computer on which PunkBuster software is installed. Further, Licensee consents to allow PunkBuster software to transfer actual screenshots taken of Licensee’s computer during the operation of PunkBuster software for possible publication. Licensee understands that the purpose and goal of PunkBuster is to ensure a cheat-free environment for all participants in online games. Licensee agrees that the invasive nature of PunkBuster software is necessary to meet this purpose and goal. Licensee agrees that any harm or lack of privacy resulting from the installation and use of PunkBuster software is not as valuable to Licensee as the potential ability to play interactive online games with the benefits afforded by using PunkBuster software.

*End User License Agreement

source

Summing up, I had spy software on my computer, which didn't ring the alarm in any scanner I used. Software which I probably agreed to install while playing Call of Duty, but which should have been erased along with the game. Software, which was starting along with Windows, doing who knows what. Software, which didn't reveal it's presence to common user (how many people keep track on what's going on in "processes" window) and which couldn't be uninstalled by usual means accesible to common user.

Let's see, what "authorities" say about it:

PunkBuster is software that purports to help stop cheating in certain online, multiplayer games. According to its website, PunkBuster prevents cheating by scanning a player’s computer for known exploits, but the program’s End User License Agreement (EULA) states it can do much, much more:

(snipped)

Based on the above text, PunkBuster may share financial records, family photos, online chat sessions, and any other information stored on the computer with anyone on the Internet. Instinctively, many consumers would label such a program as spyware, if for no other reason than the overly broad scope. However, the program’s creators argue that it is not spyware because “the activities performed by PunkBuster are generally described on our website and we have also developed and published a Privacy Policy Statement.”

Indeed, the United States Computer Emergency Readiness Team (US-CERT), a division of the Department of Homeland Security, published an article that expressly excludes from its definition of spyware any program that provides the user notice of the software’s data collection activities through a clear privacy policy. Thus, as outrageously invasive as PunkBuster may be, organizations like US-CERT would not consider it spyware.

source

So, according to Departement of Homeland Security everything is fine and dandy. Why? Because they get regular reports and any data they ask from Punkbuster's operators - that's why. There is more to this story, even though it's already long. In fact, Punkbuster is only one of many "anti-cheat" programs installed on millions of computers around the world. Whether one is an avid gamer, plays only occasionally or has played in the recent past, there is much probability that somwhere inside his box sits a spying program, which transfers hell lot of data to places unknown. Does this conclusion seem too farfetched? See here:

4.5 million copies of EULA-compliant spyware

I recently performed a rather long reversing session on a piece of software written by Blizzard Entertainment, yes - the ones who made Warcraft, and World of Warcraft (which has 4.5 million+ players now, apparently). This software is known as the 'warden client' - its written like shellcode in that it's position independant. It is downloaded on the fly from Blizzard's servers, and it runs about every 15 seconds. It is one of the most interesting pieces of spyware to date, because it is designed only to verify compliance with a EULA/TOS. Here is what it does, about every 15 seconds, to about 4.5 million people (500,000 of which are logged on at any given time):

(snip)

I watched the warden sniff down the email addresses of people I was communicating with on MSN, the URL of several websites that I had open at the time, and the names of all my running programs, including those that were minimized or in the toolbar. These strings can easily contain social security numbers or credit card numbers, for example, if I have Microsoft Excel or Quickbooks open w/ my personal finances at the time.

(snip)

Next, warden opens every process running on your computer. (snip) I watched warden open my email program, and even my PGP key manager. Again, I feel this is a fairly severe violation of privacy, but what can you do? It would be very easy to devise a test where the warden clearly reads confidential or personal information without regard.

This behavior places the warden client squarely in the category of spyware. What is interesting about this is that it might be the first use of spyware to verify compliance with a EULA. I cannot imagine that such practices will be legal in the future, but right now in terms of law, this is the wild wild west. You can't blame Blizz for trying, as well as any other company, but this practice will have to stop if we have any hope of privacy. Agree w/ botting or game cheaters or not, this is a much larger issue called 'privacy' and Blizz has no right to be opening my excel or PGP programs, for whatever reason.

source

But the worst of all is that while all those (entertainment!?) companies are spying on us legally, reverse engeneering those programs, investigating and reporting one's findings borders illegal activity!

The Warden Sees All

(snip)

And what about Warden itself? Could it be considered a technological measure controlling access to a work that is therefore illegal to circumvent under the Digital Millennium Copyright Act? If so, Hoglund is skating a very thin line in discussing his findings at all.

If you think it wildly improbable that Blizzard would try to push such over-reaching legal claims in court, then you just aren't aware of the Blizzard v BnetD case. There, against defendants who were probably even less guilty of any real wrongdoing than Hoglund is, Blizzard took its EULA reverse engineering ban and DMCA anti-circumvention claims all the way to federal appeals court. And won. What it won was the right to deprive all of its customers of all of their fair use rights with a few words in their EULAs. So when their terms give them virtually unlimited right to abuse your privacy, you'd better take it seriously. After all, it's obvious our courts will.

Blizzard unquestionably has the EULA-sanctioned right to snoop on its customers with Warden, but does Hoglund have the right to tell us what that program is doing? That's what he now realizes is in fact a very serious question. "It's really been an education these last few weeks," he says. "I had no idea these EULAs were being taken so seriously. It's just amazing to me that anti-reverse engineering language in a EULA or the DMCA could keep people like me from publishing information what the Warden does. Isn't it the right of consumers to know what their software is doing?"

You'd like to think so, because somebody needs to be spying on those who are spying on us. I'm sure Blizzard would prefer I call Warden something other than spyware, but how else are we to refer to software that sits there watching everything you're doing in order to report back to its masters who-knows-what? And I think that's particularly so for a spymaster that happens to be a multinational corporate giant that's proven its willingness to send armies of lawyers anywhere to argue that its customers have clicked away all of their rights. If no one has the right to spy on their spies, the only eyes that will see what's happening on our computers will be those of the Warden.

source

All this made me think again about my "security", my "privacy" and other personal rights, which nowadays can be only written in quotes. After all, if Window's "Search" function "calls home" reporting what one is looking for on his own hard drive, when user's own printer is spying on him, when one's entertainment software snoops around one's system then how much privacy we have left? Should we even care and spend hours tweaking our computer systems? Maybe we should, even if it only prevents some kid next door from stealing our information. If anything, we should definately share such information with other people - who knows, it might be a "wake-up" call for someone.

As for the Punkbuster itself - sneaky bastard wasn't sitting even in startup registry (HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run).

I've disabled the damned bug just like Microsoft bugs - through Control Panel->Administrative Tools->Services. Anyone interested can find out how to disable services safely by checking Black Viper's site and free some system resources along the way using this table.

 

[Ryan]

Nice detective work j0da! More evidence that assuming "privacy" or "security" on one's PC can be a big assumption to make. If I was running Windows these days, I'd be inclined to run any software that I hadn't explicitly vetted or white-listed on a separate hard drive, switching at boot time, or using virtualization software.

 

[dant]

I have found that it pays to be a computer/registry expert and to take advantage
of F8 when removing traces of spyware, malware, trojans, and so on within the
registry and this means removing ALL traces of GUID's, dll references, exe references,
etc. *completely* from the registry including that which is found in startups (run) and
window shells, and so on. You should never assume that offending programs will show
up in process windows as really innocuous programs usually are hidden within as threads
of another program. Keep in mind that you see only 'snapshots' when using process viewers
of which is also controlled by the kernel. Keep in mind that most programs almost NEVER
completely remove itself from the registry and/or from other places in your operating system
which itself leads to bloat and performance degradation in general. Also, there are hidden files
from which the kernel prevents them from being seen and this is also known and not so well
known as these are hidden from within. There are many concentric circles when it comes
to code in the OS.

This is one reason why China and other countries do not trust M$ and chooses an OS of their
own implementation. Why do you think the Govt and (big) businesses LOVES M$? Swiss-cheese
galore, if you catch my drift. ALL Operating Systems have it's back doors and it is only as secure as
the person maintaining it, and is no guarantee when it comes to security. Security is, but an illusion.

OSIT.

 

[ScioAgapeOmnis]

GREAT tool to show you *everything* that starts up on your computer:

_http://www.microsoft.com/technet/sysinternals/Utilities/AutoRuns.mspx

Very small, no installation, just runs out of the box. Yes I know it's microsoft but it really is a must-have. You can uncheck anything (or even delete the shortcut that makes it start up from wherever it may be) to stop it from starting up. This doesn't work in some spyware because they have other components elsewhere in your system monitoring each other, and if you delete or inactivate one, the others put it right back. But it will still show you everything that starts up on your windows system from every possible startup method, and there's a lot of ways things can start.

The reason it's so helpful is that what doesn't show up elsewhere (like task manager) or isn't detected by anti-virus/spyware/trojan will most likely show up in this program, and at least you'll know it exists, so you can start looking at ways to get rid of whatever it is.

Also, to complement what j0da said, if you don't know what some DLL file or some running process is, like "PnkBstrA.exe" "shstat.exe" or whatever it may be, type that exact process into google and chances are someone ran into it too and posted questions/info about it somewhere, or a more "official" source has information - like this one that I got by searching on shstat.exe, apparently a website that indexes and catalogues different running processes people find on their computers:
_http://www.liutilities.com/products/wintaskspro/processlibrary/shstat/

Personally, I don't put any information on my computer that is "sensitive" like credit cards, social security, passwords, whatever. Windows OS is like swiss cheese, full of holes. And that's only the the holes hackers expoit - but what about intentional backdooors that Microsoft may have put in either to access your computer themselves or at "the government's" behest? So I "expect" that if my computer is plugged into the internet, I can be "visited" by unknown parties at any time, whoever they may be. Now I'm sure the government doesn't care about my social security or credit card info (that stuff might be more interesting to the low-level visitors, like hackers), but they have their own interests to see what we store on our PC's - like conspiracy-related things, what you say on this forum, whatever.

Here's something I was actually thinking about before - could "they" blackmail me? Have I done illegal/embarrasing/really stupid things on my PC/internet that have been "logged" and "collected" over the years by parties who care about this and have the resources to do so, only to be used at a future date to blackmail me if they feel the need? Well look at it this way, EVERYTHING you do online goes through your ISP - so that's at least one source that can potentially know absolutely everything that you have ever done on the internet, and can provide that information to other parties who may be interested.

And blackmail doesn't have to be just legal threats, it can be something as simple as threatening to tell someone you know or associate with (family, friends, co-workers, anyone) about things you don't want them to know for whatever reason about your past activities or what not. Honestly thinking back over my entire "computer use history" I can definitely say there are things I'm not proud of and it might be pretty "bad" to say the least if the "wrong" people find out about it, etc. I'm sure this may be true for many people. But I can't do anything about the past, so I'll cross that bridge if/when it may show up. Right now, armed with the knowledge of how the world works, my rule of thumb is - don't do anything that can be tracked and used against me in the future.

I don't mean to come off like I have some horrible history of evil or deviant activities lol. I'm just saying that as any ignorant/curious teenager I have my share of "in retrospect, I really wish I had not done that" things. Or just things that most of us have done but wouldn't want our co-workers or immediate family to really know about for obvious reasons, even though in and of themselves these things may not be "bad", but perhaps embarrasing/awkward/etc. Bottom line is, knowledge protects.

 

[GRiM]

Prio is a utility for saving the priority of applications.

The main purpose of Prio is -

1. Saving the priority of each process.
2. Detecting the full path to the executable file and providing detailed information about it from the name of the process in the list of running processes in Windows Task Manager.
3. Viewing services hosted by processes.
4. Quick access to system services and controlling them.
5. Analyzing the current TCP/IP connections of the computer.

Its a great freeware showing loads of useful information.. It integrates into "task manager"

http://www.prnwatch.com/prio.html


Hope someone likes it.

 

[dant]

Thanks SAO and Grim. Don't forget SysInternals.com website. They have
a chockful of great tools there. Check out the process-viewer (ProcessExplorer v11.0)
they have and it is awesome as well. M$ has acquired them now.

 

[ScioAgapeOmnis]

Thanks SAO and Grim. Don't forget SysInternals.com website. They have
a chockful of great tools there. Check out the process-viewer (ProcessExplorer v11.0)
they have and it is awesome as well. M$ has acquired them now.

Actually, I was just checking, the autoruns program I mentioned above is sysinternals.com, I didn't even realize. The fact that M$ acquired them basically means that if M$ wants something hidden running on your machine, they can modify those tools to be "blind" to it on purpose. But M$ seems to be small potatoes compared to how many different pots Google has its paws in. It's almost like they want all the popular tools/services on the internet controlled by the same couple of companies.. gee I wonder why :P (Sure reminds me of how mainstream media is owned by just a few companies too now).

 

[Russ]

Just a small digression - the main thing that seems to be planned for the future is to have super computers which people connect to, which you purchase processing power and storage space from, instead of having your own PC. This draws parallels with the banking system - all the money in one place, all the data in one place (well not one but not very many places). This means the PTB can control the whole game from centralised points, and have the power to monitor everything easily.

They will probably market it by saying it is safer, cheaper, faster, more accessable, more secure etc. Not a bad idea if its not abused, which it will be. Firstly it will be used in military/research endevours (kind of is already), and will then move to residential users. As far as I know it will be a PC you will use, but it will only be enough to connect to the super computer and run smoothly with it, so more like a monitor with a box on it, and some basic operating system which connects with the main one on the super computer.

Anyway I could be wrong I suppose, maybe people just won't accept it, but I doubt it. In the end money will make people switch over, also environmental guilt will come into play, you will be demonised for using high powered equipment. They will probably say something like "if everyone used the supercomputer, we could save the environment".

 

[dant]

Russ,

What you say has been the goal and for a long time, and Sun MicroSystem called it
"Network-Centric-Computing", where all application data are stored elsewhere, just
not on your local computer. Remember the network-box they tried to sell us? It did
not take ahold since M$ and Mac swept it out from under them and rattled the Big-Brother
theme with data security. I remember it well. Google seems to be the one to try to revive
the idea, they did not coin the concept, Sun Microsystem did, I think. But basically, you
pay for the use of the Os/software/applications and perhaps for the the connection/time.

But asaik, the problem is with timing, and do you think that all of this will happen in 5-10
years from now?

Seriously, I'd say no at this time, but then again, when the screws are tightened with the
fascism and so on, who knows just how fast everyone will need to 'get in line' and 'get
with the program, or die'. Under that scenario, I'd say it could ramp up pretty damn
quick, perhaps?

We'll see soon enough.

OSIT.

 

[Floyd]

I wouldn't put so much faith into what these jokers wrote

mazeleet wrote:
bostondan wrote:

They are the same people. He is a CHEAT WRITER. He is known in the anticheat & cheat world as being an pos scumbag. Not only is he known to steal money from the suckers that buy his cheats, He is known for stealing other peoples code then selling, He is known for writing cdkey stealers, He is known for a lot of things.

He’s an pathetic loser that will do whatever it takes to steal your money/cdkeys. And since he uses code he steals, his cheats are picked up fairly quick from evenbalance.

His handle is MAZ from Msxsecurity.com

And yeah, don't believe the stats on his website, He uses bots to stimulate website traffic.

 

[j0da]

Hey Floyd,

Even if what you write about mazleet/bostondan is correct, it doesn't make general findings of this thread invalid, or does it?

He may be seen as playing (consiously or not) a role of a straw man, IF your information is true. But that's not what really matters here.

 

[Floyd]

True j0da, But the other sources you quoted as being true, can also be bogus. And probably is..

If the "authorities" as you quoted, had any credible information, Evenbalance would have been shut down already.

Point is, Don't believe everything you read on the net.. Especially some random persons digg comments.

Hell, evenbalance had to remove it's md5tool checks from going outside of the game directory because it' violates German laws. Knowing that, You really think they share personal information? think again.. Real law suits would have been slapped on them by now..