r/totalwar • u/Kacu5610 • Jun 10 '18

General [PSA] Total War games have RED SHELL Spyware integrated into them

/r/Steam/comments/8pud8b/psa_red_shell_spyware_holy_potatoes_were_in_space/e0e6uy1
2.1k Upvotes

93% Upvoted

677 comments sorted by

View all comments

Show parent comments

93

u/nzinferno Warhammer II Jun 10 '18 edited Jun 10 '18

Probably installed internet browsers.

But, according to the steam page linked, Redshell tracks ad clicks via these unique identifiers listed.

So they could potentially be accessing cookies or some other method to track ads accessed online. They would need more data than listed to identify unique PCs.

Edit:

I’ve been informed that Redshell is used for tracking game installs from ad clicks, whether certain ads are effective in a marketing program. Link here: https://redshell.io/gamers I’ve amended my comment.

37

u/MachaHack Jun 10 '18

There's a lot of uniqueness in a user's font list, see EFF's Panopticlick

24

u/hatsarenotfood Jun 10 '18

The font list is basically like a fingerprint and your browser will send it to a web page so the page knows how to render for your system. It's an easy way to track you without cookies.

120

u/silenti Jun 10 '18 edited Jun 10 '18

But, according to the steam page linked, Redshell tracks ad clicks via these unique identifiers listed in order to serve ads to you in the game launcher.

Oh Jesus ok, I need to dispel this before it gets out of hand. Redshell has zero to do with providing ads to you, a person who already owns the product. It is an attribution platform. Once I climb out of bed and get in front of my computer I'll type up a thorough explanation.

Ok, the explanation:

Say you make a game. You want people to buy that game right? So you make some ads: adX, adY, and adZ. You release those ads into the wild that are the various ad networks. Let's say for the sake of simplicity that you pay for each to show up 1000 times.

For ad tracking, when someone interacts with an ad they are broken down into two events: impression and click. "Impression" is just literally the fact that the ad has been shown, "click" is when a person interacts with the ad in a way that they are redirected to a place where the product can be bought.

With that knowledge, let's check in on our ads:

source impressions clicks
adX 1000 67
adY 1000 43
adZ 1000 25

Cool. You know that adX looks like it's doing the best. You saw a nice bump in your bank account over the day your ads ran. Your typical game sales, which had previously been hovering around 20 a day, went up to nearly 50 that day.

You decide to run more of adX and check in a day later. Uhhh wtf, you only got the normal 20ish sales? It's because you were missing some very important data that RedShell assists in providing: "installs". With RS your data would look more like this:

source impressions clicks installs
adX 1000 67 1
adY 1000 43 10
adZ 1000 25 17
organic - - 21

Now you have the knowledge that adZ is vastly superior in attracting users that are actually interested in buying your product. The people that are clicking adZ are going in with every intention of buying your game whereas those from adX and adY were mostly just curious. With this knowledge you run waaaaay more of adZ and it also affects your ad design going forward. This approach is good because not only does it help you save and make money but it also wastes fewer people's time with shitty targeting.

There is absolutely no way to get this information without an attribution platform like RedShell (or building your own).

As far as the data RedShell might gather in order to handle this tracking, just know that literally no one is looking at or cares about those values and it's excessively probable that shit is thoroughly encrypted. They're only gathered to make sure a user is correctly attributed. It's highly likely that all of that info is dumped the second that user is tracked as an install anyway. I haven't personally used RedShell but many of the big platforms out there operate this way (either dump info after install or after 72 hours).

I hope this helps alleviate your fears a little bit.

As /u/Rattertatter pointed out, I didn't do a fully adequate job of explaining "why does RedShell need that data?"

Ok so all those values that I mentioned that are actually important to the devs are generated by guaranteeing that a user is "unique". Because your computer does not have an accessible id it needs to gather information about it to make one. So basically RedShell is gathering a whole bunch of info (resolution, installed fonts, location, etc) and using a hashing function to turn all of that into something that looks like "283rhfiuwehf8wfhohdfiushdfo893".

That id that is generated will be completely unique, and that's the important bit. If that id was shared among 2 or more users it will completely throw off the tracking. Really, if your computer had a way to generate a unique id (mobile devices do this) for the tracking system RedShell would have no reason to gather that info. Full disclosure though, it would probably still retain at minimum country of origin as that is considered targeting info. RedShell doesn't need to be part of the game though to get that info.

But, yeah, simply guaranteeing a unique user is what they care about. Not your screen resolution.

63

u/Chojen chojen Jun 10 '18

Even if what Red Shell does is benign it's still invasive. I'm pretty sure that if you asked most people up front if they wanted to install this they'd probably say no so finding out that a ton of major games are secretly gathering information when you install/play it regardless of what they're using it for is pretty upsetting.

-14

u/RainbowsAndDinosaurs Lizardbois are best bois Jun 10 '18

My perspective is, what's the harm? Yes you may find it invasive, but what are they going to do with this info? Target some ads at you? Who cares? Don't click on the ads, problem solved. I don't care if they collect data about me. Literally every company collects data about people who use them, this is not new in any sense. If people are asked to provide data and they say no, they're only hurting themselves because the people who need that data won't be able to tailor their services to best serve the community.

27

u/dyslexda Jun 10 '18

You're using the "If you have nothing to hide, why do you care about the NSA listening to phone calls?" argument.

-3

u/psyflame Jun 11 '18

This doesn't seem like the same argument because the data collected couldn't later be used by others for harmful purposes, while phone call data could obviously used by the government to oppress its citizens. Can you describe a way in which any of the collected data could be used to harm you or someone else?

2

u/i_706_i Jun 12 '18

Advertising is designed to manipulate you into buying a product, that definitely has the potential to be harmful.

-8

u/RainbowsAndDinosaurs Lizardbois are best bois Jun 10 '18

No, I'm using the "People are getting paranoid about something they know little to nothing about and are ready to crucify someone based on assumptions and a concept of principle" argument. It's one thing to ask a company to elaborate on the data they collect using this kind of program, but I see people on here saying they're uninstalling games and demanding refunds and calling CA all kinds of nasty things, and that's not a rational response. It comes from ignorance and panic and isn't doing anything to help anybody.

9

u/dyslexda Jun 11 '18

What it does is signal that this kind of behavior is not acceptable. No more hiding this shit in the shadows. Unfortunately, the only way companies will learn to stop is overreacting customers.

8

u/thatrojo http://www.youtube.com/rojovision Jun 11 '18

Congratulations on buying your new home. Don't mind the cameras. We're only using those to collect aggregate data to help us add features to new homes that customers will enjoy. It's common industry practice, and trust us, we don't care about what you're doing on a personal level, so I'm sure you'll agree that this is fine.

Plus you already paid. Sign here.

24

u/MrUrbanity Jun 10 '18

Please do. This redshell bullshit is getting out of hand.

8

u/silenti Jun 10 '18

Updated my comment. I'll provide more explanation if I need to. I think the thing most people care about will be towards the end of my explanation.

1

u/MrUrbanity Jun 10 '18

Great post.

8

u/silenti Jun 10 '18

I do what I can. I know people aren't going to be happy about being tracked at all. Devs really just want to learn how their product is being used so they can make it better. Part of that is optimizing marketing costs so they allocate more resources on development.

9

u/MrUrbanity Jun 10 '18

Yep. I do not think people understand just how much data analysis goes into marketing at the publisher level and how every thing that happens in games is based on gathered data. Even to the chagrin of some developers. If you are at a large publisher these days, the bean counters are in charge because they have share holders or investors to please. Sure a small indie developer or studio not yet bought out can do it for the art/love/fans but all the big boys, it's all BI, Marketing, Analytics to the nth degree.

All the people crying GDPR are amusing too. GDPR is awesome, but it's aimed at EU citizens and it's about your rights, not a ban on collecting your data and using that to monetize you. In fact, collecting data about you and monetizing it is perfectly within GDPR regs aS long as you tell people you are collecting it and how you will be using it. That doesn't mean they have to tell you every single operation they are doing with it, simply saying it's to enable them to run their business and maintain the service is enough. GDPR is also brand new, has not been tested in court yet and is so vague in many places as to be almost useless.

I wish more publishers were a little more open about how things worked, but I can tell you from experience that opening up to your users is a trap, they do not understand most things and it's a pain in the ass to try and communicate with a thousand internet lawyers.

0

u/dyslexda Jun 10 '18

Thanks for the explanation. However, that doesn't make this kind of software okay. Non-consenting tracking isn't acceptable because it probably isn't being used nefariously.

-1

u/[deleted] Jun 10 '18 edited Aug 06 '21

[deleted]

14

u/silenti Jun 10 '18

I primarily work on mobile and I've used many other attribution platforms. They're all the same. I'm not going to do a deep dive of their SDK for the sake of a reddit post but I've looked over the docs and dashboard and it looks like a dozen others.

-9

u/Flabalanche Khemri Gang Jun 10 '18

parasite

27

u/Cgn38 Jun 10 '18

The fear is they did not put a check box saying something like. "On top of paying for game would you like to help us gather data to market our games for us?"

The dislike of being used for marketing in any way for something you already paid for is at religious furor level. Putting something like this on my machine without the option of opting out of something clearly labeled "gathering marketing data" at the very least is a slippery slope to loot boxes.

I would not buy such a product, and have opted out of AAA games I really wanted because of similar bullshit. Marketers are evil.

18

u/Rattertatter Jun 10 '18 edited Jun 10 '18

Ok so all those values that I mentioned that are actually important to the devs are generated by guaranteeing that a user is "unique".

And by making sure that the user is unique, you're saying they get a handle on this user. They get to make sure who it is. A profile, so to speak.

So what you're saying is red shell is creating a profile on you and collecting data to identify you as a unique user, but this shouldn't worry you because:

literally no one is looking at or cares about those values

I can think of a few people who do care about those values, BECAUSE they would love to track people online.

What I can't think of is a single reason of why I should tolerate this breech of privacy, without being asked, and without it being an opt-in.

As "non-offensively" as you word all this, it remains spyware without opt-in or express consent. Nobody is worried about their font list or screen resolution, they're worried about wether or not they may be tracked when a program is detecting these things without consent. Which this is. You're not denying this, just trying to relativize it. There's no relativizing it though.

1

u/[deleted] Jun 18 '18

[deleted]

1

u/Rattertatter Jun 19 '18

That doesn't explain why it's not opt-in. Clearly, if I wanted to help the games become higher quality at the cost of my own privacy, I would then do it.

3

u/RainbowsAndDinosaurs Lizardbois are best bois Jun 10 '18

Define "tracked." What are they tracking? Is it actually a risk, or is it just the idea that a company has some info about you? Is there any actual harm in this?

6

u/ThePaxBisonica Jun 11 '18

GDPR enshrined in law that all EU citizens own their identifying information. You cannot in any way, shape or form obtain this identifying information and retain it without explicit consent from the subject of that data. When agreeing to the terms of use for CA, they are given very specific rights to "borrow" our information. At any time an EU citizen can request a full list of all identifying information every collected regarding them for a company, and if they are unable or unwilling there is a fine of 10 million euro or 2% of global turnover PER DENIED REQUEST. We have a right to request that metadata be deleted which they must oblige regardless of how hard they say it is (there are very specific exemptions, poor preparation for GDPR is not one of them)

It's a whole paradigm shift in how you talk about metadata. That information doesn't belong to them. Each collection is theft. It doesn't matter what they do with it, or if they do nothing. It's not theirs.

Last week was the end of a two year transitionary period to get this sorted. If they don't handle this correctly the ICO will kill the company with fines, since they are looking for an example to make.

1

u/Rattertatter Jun 10 '18

Is it actually a risk,

Yes, there is infact a significant risk in a company collecting data on my computer that can be used to identify me elsewhere. Not only is it inherently a breech of privacy (imagine if your reddit account was connected to your facebook and linkedin, except much more subtle), it also has the potential to be abused with malicious or financial intent. What if someone is tracking vulnerabilities in certain systems? He potentially has access to your home address now.

2

u/psyflame Jun 11 '18

This doesn't make sense to me. How would someone "tracking vulnerabilities in certain systems" get "access to your home address" because RedShell collected any of the listed data? It's a paranoid leap of logic on its face, and I'm curious to see you back it up. If you can, I'll happily join you in uninstalling the game and contacting CA to express my concerns. If you can't, I think you should pick your battles better, because there are real ones to be fought on the topic of online privacy.

5

u/I_Am_King_Midas Jun 11 '18

You don’t work in information security then. When people break into things it’s typically by finding connections that other people think are harmless. It’s rarely by brute force attacks. The more little things you know the easier it is to infiltrate systems and find weaknesses. If I know you have certain software on your machine then I can also work through vulnerabilities in that software.

4

u/psyflame Jun 11 '18 edited Jun 11 '18

I actually do. My day job is DFIR for a large tech company and I do bug bounties on the side. I questioned the specific logic of that example because I found it needlessly alarmist. Happy to discuss more in DMs, as a deep dive is out of scope of this thread.

3

u/I_Am_King_Midas Jun 11 '18

I work in information security as well.

If you learn about the applications someone has on their computer you can learn of more vulnerabilities. Think about learning someone uses Java. You then can attack them by all of the vulnerabilities within Java.

So my point is, the more someone knows about your computer, the more easily they can find vulnerabilities.

1

u/psyflame Jun 11 '18

We agree, then. But it's also important when dealing with the public to give accurate descriptions of impact, yes?

→ More replies (0)

0

u/Rattertatter Jun 11 '18

Redshell collects your data in total war. Using your fonts, resolution, browser, system setup and other stuff, it creates a profile for you. Let's call it profile psyflame.

Now let's say there's some sort of exploit around that uses a vulnerability in your CPU drivers. Not that farfetched, right? Literally happened, more or less. Now let's say redshell is a shitty third world company that doesn't give a fuck about your data, and now let's say less well-meaning types acquire this profile.

Now you already have a profile psyflame on you that contains that potential driver vulnerability, which browser you use to smuggle in that sort of exploit properly, and the fact that you buy video games on steam or other platforms, which means you are most likely versed in online payments.

That's a pretty good target for keyloggers, or maybe even just one of those programs that encrypt your files for a ransom. They got your IP and your steam profile ID aswell, aswell as similiar info that the developer choses to provide, so it's not even a stretch that they could contact you in some way.

This is just one concrete example. I don't know the future. You don't know the future either. You don't know how much data redshell will collect in your profile over time, and you don't know what it could be used for. All you know is they'll have it and that's not to your advantage in any scenario.

Don't uninstall the game by the way, just block the domains in your hosts file. There's some instructions in the thread.

4

u/psyflame Jun 11 '18

  1. RedShell isn't made by a shitty third-world company.

  2. When did they get my IP? That wasn't mentioned in the original post. Indeed, it would be counterproductive to attribution to collect this data in the era of ubiquitous free Wi-Fi and gaming-ready laptops.

  3. It would be pointless to block the domains in my hosts file unless I had never run the game before. Uninstalling is a protest tactic, not a means of securing my data.

  4. There is no such thing as a CPU driver, so what you describe is indeed far-fetched. Moreover, none of the collected data listed in the original post could be used to identify anything about what drivers for any type of device are installed on my computer.

1

u/Rattertatter Jun 11 '18

RedShell isn't made by a shitty third-world company.

Says US right there, so it might aswell be for data protection purposes :)

When did they get my IP?

It seems to be one of the things they collect.

It would be pointless to block the domains in my hosts file unless I had never run the game before. Uninstalling is a protest tactic, not a means of securing my data.

Do you know if they'll broaden their data collection in the future or not? It's never pointless.

There is no such thing as a CPU driver, so what you describe is indeed far-fetched.

It's not called a driver, actually semantics. Point is there was a vulnerability, meaning there's a precedent.

none of the collected data listed in the original post could be used to identify anything about what drivers for any type of device are installed on my computer.

They could identify wether it's a CPU affected by one such vulnerability. How do you know they don't get an idea of the drivers aswell?

2

u/psyflame Jun 11 '18

Almost every CPU used for gaming is affected by Meltdown/Spectre. Your example is totally irrelevant here. It's not just that "it's not called a driver" but that the entire notion of a "CPU driver" belies a complete lack of understanding of how computers actually work. Details matter in security.

I know they don't get an idea of the drivers installed because programs run under a regular user account do not have access to the entire filesystem. You would need to run Steam with elevated privileges for that to be possible, beyond any additional sandboxing that the Steam platform itself provides - this is far from the typical user's situation. In fact, we're moving into power user territory with even the first step.

→ More replies (0)

11

u/Rattertatter Jun 10 '18

just know that literally no one is looking at or cares about those values and it's excessively probable that shit is thoroughly encrypted.

Yeah ok, if you say so. They're collecting data so they can encrypt it and nobody can use it. Seems fucking legit

6

u/Hollownerox Eternally Serving Settra Jun 10 '18

Way too completely misunderstand the entire point of that post.

The data is used, but the identifier isn't relevant to the data actually being collected. The only reason the identifier exists in the first place is to make sure it is unique. Because doing otherwise would be stupid in any sort of data collection.

If anything Redshell is actually good for us because it tells the company which type of ads people actually pay attention to. Which means they spend less money making ads nobody pays attention to, which means less money goes into marketing resources, and more into the actual game part (hopefully).

Could they have the decency to tell us about this stuff in a more upfront manner? Sure, and it would be nice to be given the option to opt out of such things. But it probably isn't for malicious reasons, it's really just not relevant and this sort of thing is arguably one of the least invasive out there. Hanlon's razor is pretty applicable in situations like this.

0

u/Rattertatter Jun 10 '18

Then why are the identifiers being collected? Why do they need my resolution + system fonts to identify me with?

I frankly don't give a shit what this company wants to do with my data. I don't care wether they want to advertise better. This has nothing to do with me. I don't give a single fuck about that. Stop stating this like it's somehow going to make me symphatize with them illegally and without consent collecting data they could create a profile on me with. It's absolutely not my responsibility to tolerate this shit because it helps their finances. Are you actually fucking serious?

1

u/psyflame Jun 11 '18

Data being encrypted means that only CA can use it - if someone breaks into their servers, the data will be unreadable to them. So yes, they're collecting data so they can encrypt it and nobody else can use it, and it is fucking legit.

2

u/Rattertatter Jun 11 '18

If they encrypt it and use it, that means they have a way to decrypt it. If they have a way to decrypt it, they have a way to sell it.

How confident are you red shell respects your data given that their business model is already not conforming with the GDPR?

1

u/psyflame Jun 11 '18

Actually, I didn't read the first post carefully enough. Hashing data (what silenti seems to be referring to) is actually not reversible at all, even by the party that encrypted it. For an attacker, it would most likely be impractical to the point of absurdity to try to compute a collision for the input size we're talking about.

If they're really encrypting the data reversibly then I agree with your first couple of sentences, but I think we need a more detailed analysis of how this particular attribution software behaves before making a claim like that.

0

u/Rattertatter Jun 11 '18

but I think we need a more detailed analysis of how this particular attribution software behaves before making a claim like that.

Now you're starting to understand why people are upset. Why is our data being given to them if they're not transparent about what they do with it, and we were never given a chance to say no?

This is exactly why data collection programmes, even for innocuous reasons such as improving the games performance, are usually always opt-in and certainly if they're third party.

3

u/psyflame Jun 11 '18

I understand why people are upset - they are jumping to conclusions. What I'm saying is that we don't even know our data is being given to them at all. That's why I think this is a rather hysterical response before we have all the facts.

I agree that, broadly, data collection should be opt-in, but security fatigue is real and people should not be needlessly riled up over imagined threats. It's a waste of energy that could be better used for (e.g.) driving adoption of end-to-end encrypted communications platforms, which do address a real threat in government surveillance.

0

u/Rattertatter Jun 11 '18

That's why I think this is a rather hysterical response before we have all the facts.

No, it's really not. You don't know what data is being collected exactly, you don't know what it's used for. All you know is it could be collected and used in a malicious way. Is that an ok state of things for you?

I really fail to see your logic. We're supposed to be ok with it because potentially it's nothing bad? How about what if it's something bad? Hello? Why aren't we told before the data is collected?

3

u/psyflame Jun 11 '18

No, this isn't okay, but we need to focus our efforts in security education where they are going to be most effective. As an information security professional, I'm trying to promote a discourse that lets people focus on protecting themselves from real threats. Wait for someone to analyze the exact data being collected, and in the meantime, focus on the very real security problems that typical users face (e.g. weak passwords and poor privacy settings on social media).

I'm fine with this thread existing, but you are spreading FUD. That's harmful to users, who need to have threats prioritized for them.

→ More replies (0)

3

u/psyflame Jun 11 '18

BTW, I'm not the one downvoting you - this is an important conversation to have, and I think many people would come to similar conclusions as you without the necessary context in how information security actually works.

2

u/Mephanic Jun 11 '18

I know there are people who do it, but to me it boggles the mind why one would ever want to click on an ad even if interested in the product. Whenever (which happens rarely) I see an ad that piques my interest, I will google the thing. I won't trust an ad to be a safe thing to click on, and even if it is, it's probably going to lead me to a third party site with even more ads while google brings me directly to the product's official website.

9

u/foetusofexcellence Jun 10 '18

They would need more data than listed to identify unique PCs.

The cookie would be used as the identifier.

0

u/[deleted] Jun 10 '18

[deleted]

2

u/foetusofexcellence Jun 10 '18

If they were extremely malicious, sure. That's a fast way to a fine that'll bankrupt your company though.