World of Warcraft's Poor Security

By default, World of Warcraft fails to run properly under a limited account. The game will start and run fine, but no settings are saved (e.g. UI, setup, or addon changes) because everything is stored under the folder that WoW is installed (Program Files) which should be read-only. A reasonable work-around might be to make some of the subfolders under the WoW folder writable (such as WTF, Screenshots, etc.).

A new failure of WoW security design was recently added with the game launcher. On every single run, the game launcher seems to randomly generate a brand-new exe at some random place on your computer. Firewalls are about as thrilled by this as I am. It defeats any kind of whitelist security, and a game has no business complicating computer security like that.

Additionally, there is an uncommon trick World of Warcraft uses that blocks other programs from inspecting its process in memory. This can also prevent other programs from forcefully shutting it down. The technique has to do with Window's Discretionary Access Control List (DACL). It is related to the security tab you see on Windows XP Professional that defines who has what access to various parts of your computer.

A processes's security limitations can be changed dynamically during runtime by the process itself, and that's exactly what WoW does. A process changing it's own security at runtime is not particularly valuable because any other process with equal or greater security access can change it back. It's also meaningless when running as an administrator because every process automatically has all access to everything.

None of this is new. People have known that WoW does for years now. I even ran across a small bit of code specifically to adjust the security of WoW. I've updated it bit to simply remove WoW's security settings then exit.

I'm new to this whole DACL business, so I might have missed some things.

Warning: Any use of this information, whether benign or malicious, might result in having your World of Warcraft account terminated. Take heed, lest you anger the Blizzard gods.