BattleEye Does it safe ? (Read this post maybe your idea may change)

[Bender]

Hello folks, first this is not my review about the the BE a.k.a (BattleEye) anticheat.
I just want to show people what is going on and what is it!

THIS PART FORM REDDIT USER CALLED Douggem

Orginal reddit post Link of this post

====(Douggem post and Article)====

Battleye sends files back to the master server from your hard drive if it is
suspicious of you. It sends the whole file path and your IP address.
These are logged on the master server and kept indefinitely.

I've done a lot of reverse engineering work on Battleye.
I've been working on it since 1.204 (it's at 1.215 now for A2OA and DayZ).
If you Google my name and "Battleye decomp", you will find some of my previous decompilations and reverse engineerings of the Battleye module, as well as explanations of how certain scans work and how Battleye is able to detect common hacking techniques.
I also made a post in this subreddit maybe a month ago talking about Battleye's scans and false positives.

When Bohemia's servers were compromised and the source for DayZ standalone was stolen, Battleye's master server was compromised as well. The people that broke into it contacted me to share information on what Battleye had been doing, and sent me screenshots as proof. They found thousands of .log files with IP addresses and dates attached, that appeared to be dumps of processes and modules:

Alot of HEX CODE (advanced you dont need to see this)

Image #1[i.imgur.com]
Image #2[i.imgur.com]
Image #3[i.imgur.com]

You can see INT3/CC padding between functions and make out portions of the header,
as well as obviously see the full file path to the modules and executable.
Battleye has always sent back information to the master server, but usually only a few bytes. For example, in its module scan, it sends back the address of the memory page the detection occurred on if a detection happens:

Image #4[i.imgur.com]

If your client runs a detected piece of Arma script, it sends back the entire script expression to the master server:

Image #5[i.imgur.com]

But it's never done anything like sending back entire modules or executables until it became virtualized. And it doesn't dump the modules from memory - it reads them from disk. And while I SUSPECT that it only sends back modules that detections occur on, since I didn't have access to the logs, only screenshots, I don't know.
Last night I posted this information to a hacking forum, explaining that he was sending back files from users' disks. This morning I received a message from Bastian Suter, which is the

Conversation with BattleEye DEV. named Bastian Suter

Battleye developer response

Dear Mr XXXXXXX(if that's your real name), seeing that you tried to add me on Skype before and that you just crossed a line, I decided to directly send you a warning.

I would advise you not to associate with the individuals known as "XXXXXX" and "XXXXXXX" in any way as they are being criminally prosecuted for breaking into and stealing information/data from servers owned by Bohemia Interactive.

Should you or anyone else not refrain from sharing or posting leaked information online these persons will be included in the prosecution.

Image #6[i.imgur.com]

He's never spoken to me before this. His threat just made me want to tell people about this dumping more, though, so nice job.

Why it could be a big deal:

Battleye is actively sending back dumps of entire files,
linked with your IP address, to the master server where they are stored indefinitely. It can send any file that it has access to, and if you run Arma as administrator, that means basically everything. It does so silently and with subterfuge: he did not add this functionality until he started obfuscating the BEClient module.

Why it's probably not:

While Battleye clearly is going over the line by sending files from your hard drives back to the master server and storing them there, in actuality he's probably not stealing your nudes or your bank statements. My hypothesis is that he is only sending back modules and processes in which detections occur, which should limit the scope of what he receives. Assuming he never wants to abuse this (his anti-cheat allows the server to send arbitrary code for execution on the client, and he can send this to specific clients. He can, on the fly, execute whatever code on your computer he wants, and would easily be able to dump any files from a targeted user, or every user using this mechanism) it won't cause much harm. It's still creepy as hell, but he's probably not pilfering through your hard drive.

But it's still something I think everyone should know about, because it's pretty shady behavior overall. We all know it scans every byte of every running process, but I don't think we assumed it would be sending files back from our hard drives.

EDIT: Bastian's response on Skype:
Link of this post - my "threat" (which is actually a warning) still stands, what you and those other individuals are doing is illegal (seeing that you are a not a child you should realize that)

[4:32:51 PM] Doug: Bastian, the people that brok>e into your server broke the law. I am not breaking the law by reporting on what you are doing

[4:33:40 PM] Doug: What might be against the law is sending files from clients' computers to your master server. I'm not sure about that though it might not be.

[4:33:57 PM] Bastian: regarding the actual information, I could care less about anything you stated. This is standard anti-cheat procedure - if VAC does it it's called "advanced" (same as dynamic code execution), if BE does it it's evil.

[4:34:13 PM] Bastian: wrong, it's illegal to release leaked info, which is what you are doing
He's from Germany so take into account there may be a language barrier before you infer anything from his tone or verbiage.

Image #7[i.imgur.com]

READ THIS PART CAREFULLY

EDIT2:

Battleye's Terms of Service:
BattlEye will never report any of Licensee's private data (documents, passwords, etc.) to other connected computers or to Licensor. BattlEye will not violate Licensee's privacy.
To be fair, it also says:

BattlEye may scan the entire memory, and any game-related and system-related files and folders on harddisk and report results to the connected game server for the sole purpose of detecting cheats.

Image #8[pastebin.com]

EDIT3:

Battleye made an official response confirming what I have said:

Battle eye response on reddit
Battle Eye website[www.battleye.com]

====(My thoughts)====

Okey this is REALLY long documentation. But if you Google the BattleEye or just go a game community that game has The BattleEye, if there is any person that he/she know computers very well he/she comment will be bad becuase of "BE".

Second part of my thoughts:
Im not saying the "BE" is spyware (if you dont know what is spyware you can check form this link)Spyware wiki page[en.wikipedia.org] but the "BE" kind of spyware. Im not saying the "BE" is leaking you personal info, bank statements or other stuff but im not convenient about the "BE" has permission to acces you hardware info even your NUDES (sense of humour dont care serious). And the BattleEye "CAN" collect this info and sent to Master Server. And if im saying if cause thats will be REALLY BIG PROBLEM if the BattleEye get hacked by some one or just a kid, that will be problem for every single person that used the "BE".

Third and last of my thoughts:
Yes i will stop using the BattleEye cause like i said i am not convenient about this spyware crap, i done LOTS OF researchs about "BE" and i found critical infos about this spyware crap.

If you dont want to get leak of personal data stop using "BE" i know popular games using this anti-cheat but every time there is an altranative way to avoid form danger!

====(/My thoughts)====

[[LZ]Icy]

i dont think ark runs on BE servers without it though :( Maybe this is also the source of the ram leak?

[SireDragonChester]

Very interesting read.. Not that fully understand it all, but I don't run BE with my Ark server and have never trusted BE myself.. Not sure how other un-official Ark admins feel.

I use to run The Isle server and had to have BE enabled to able kick/ban bad players. but it always didn't work well and would often crash the server. . I turned off BE and would run hours with no issues.Though that was almost 1+ yr ago,. But true The Isla is Beta game too.. and BE seem very grey area..

personally. I don't like or Trust BE.
-Sire

[TheRightHand]

Just to chime in with things I've said before, too.

1) I would look at what Gabe Newell has said about this topic, because VAC does similar things to what BattlEye does, and everyone is generally cool with VAC:

https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_and_trust/?st=izbyugqi&sh=1ef9a55c

2) The things that BattlEye does are literally (and I mean literally, not figuratively) exactly the same as what a common anti-virus program does. The EULA/User agreement is incredibly similar to that of an anti-virus program, and anti-virus programs CAN AND WILL SEND BACK DATA TO THEIR MASTER SERVERS THAT INCLUDE INFORMATION SUCH AS THE PATHS OF INFECTED OR POTENTIALLY INFECTED MODULES, IP ADDRESS, AND INFORMATION ABOUT THE COMPUTER/LICENSE THAT OWNS THE PROGRAM.

This is necessary for anti-virus companies to identify and capture variants on infections, and to improve their own heuristics about potential threats.

3) Huge companies MUCH BIGGER than Wildcard and supported by multi-hundreds of millions of dollars have had the ability to review, use, implement, and work with BattlEye. As far as I am aware, there has never been a case of BattlEye being used to do anything malicious on a user's computer in any provable way. There is a lot of speculation that it could happen, but as far as I am aware (and I did a lot of research on this), there has never been an incident where BE has been used to compromise any system, steal any personal data, etc.

As it has always been, so it shal continue to be that people don't have to use it if they don't want to, or don't trust it, etc, but the truth is that much like EasyAnticheat, every anti-cheat before it, every anti-cheat that will ever exist after it, and every anti-virus in the world that's worth anything, the program has to be invasive, or the people making the cheats can simply hide them in the places that the anti-cheat "wont go", and the cheat is impossible to fight back against. Same with viruses. That's why anti-viruses have to have pretty much full control over your whole computer. You take them on faith that they wont do anything bad, and such far, the good ones, have not.

- The Right Hand

[Navjotski]

They should work on other algorithm for BE lol. This one seems pretty invasive... BE getting hacked will result in massive cyber thefts. Rip bank accounts, emails, nude pics, privacy stuffs.

[gamertaboo]

I literally don't understand what the problem is.

They are trying to find cheaters. If you do something that trips their software you deserve for them to snoop into what you're doing.

You know you can place as much blame on things like VAC and BE as you want, but the entire reason we are where we are at this point is due to the cheaters.

Blizzard has to region lock the world like children. BE and VAC have to actively keep an eye on everyone's computer's looking for cheat programs.... it sucks but this is our reality. Because some people think cheating is somehow fun or cool or whatever. I'll never understand it.

Either way I'm not going to worry about it for a second of my life. If someone really wants to get into my PC and see what I'm doing they don't need VAC or BE to do it.

[Aisteach]

The BE team has a really impolite way of answering a perfectly honest concern about the way their program works. I am now concerned about it especially because of the way they answered. I will write to Steam to ask them to look into an alternative solution since those developers don't respect their users.

[Paladari]

Play on Mac, dumbasss

[skyguard]

Ummmm, mac and cheese.

[Malakai]

Originally posted by Yanoee:

I am a little heated so this my be somewhat of a rant.

I read license agreements when they pop up for everything, and I read no such line where Battle Eye is allowed to search all my hard drives. I have cheat engine, I use it on things like Stranded deep, Skyrim, Fallout and such just to be able to build or reenact cyber life to my hearts content, so when I try to run Ghost Recon Breakpoint, I Do not appreciate the assumption that since they scanned my secondary hard drive where cheat engine is that I am going to use it and will not allow me to play the game until I remove it...
BULL**** I paid for this game, I don't play the multiplayer, achievements don't get me paid real money, I bought and upgraded this computer, get the hell out of my personal space and, if you must, scan the game for any ATTACHED processes WHILE it is running otherwise I am HELLFIRE!
I don't care if they own the game or at least the rights to it you don't own my Personal Computer, this is not Communist Russia!!

[skyguard]

They don't care what you do in Single Player game, they care if you cheat in a multiplayer game. So you have nothing to worry about in SP.
Nice necro.