ESEA turned anti-cheat client into BTC miner

http://play.esea.net/index.php?s=forums&d=topic&id=492102

by dvt • 13 years ago

73 47 13 years ago

play.esea.net

mooism2• 13 years ago

Redirects to welcome page.

dvt2• 13 years ago

I think they use a cookie for the front page splash (the second load usually works afaik).

lucb1e2• 13 years ago

Oh, I thought they took it down! Thanks for saying this, the second try worked.

saurik2• 13 years ago

One of the times that I accessed this page I was given this error, for people who aren't using a browser capable of detecting this kind of thing (although I don't know how serious these detections really are).

Danger: Malware Ahead!

Chromium has blocked access to this page on play.esea.net.

Content from bjskosherbaskets.com, a known malware distributor, has been inserted into this web page. Visiting this page now is very likely to infect your Mac with malware.

ninguem2• 13 years ago

Is this for real? I just went to this page on a mac. Did not get any warning or any other signs. What should I look for? Finally can the mods please remove this link, if this is confirmed?

saurik2• 13 years ago

The second time I accessed it I did not get that; I imagine it is from some kind of rotated-in advertisement provider (although I don't see any ads).

kosei• 13 years ago

I got the same issue. So I decided not to read the article...

chriscampbell• 13 years ago

Got the same Malware warning from Google Chrome

stoic3• 13 years ago

This subscription has been cancelled.

stoic3• 13 years ago

well, looks like word travels fast: http://play.esea.net/index.php?s=forums&d=topic&id=4...

Pyramids• 13 years ago

This is about as bad as you can get for any kind of software developer. I'd rather run an installer that tries to install a toolbar than one that secretly mines Bitcoins. At least those which bundle toolbars generally inform you and provide an opt-out.

Although IANAL, the legality of this is highly questionable, considering the recent (mis?)usage of the Computer Fraud and Abuse act, and the fact that nothing in their EULA/ToS permits this kind of use case.

nyar• 13 years ago

From what I understand the guy who runs ESEA is pretty much saying "Yeah, we were talking about this one day and did it. Now you've caught us, so we'll be removing it and giving everyone a free month. We also made $3000 something dollars by mining with your computers, but we don't want you to be mad at us, so we won't do it again. But we totally had no problem with this earlier."

luke_s2• 13 years ago

Do you have a link to that post on the forum? I don't feel like digging through 4 pages of replies to find it.

UberMouse• 13 years ago

http://play.esea.net/index.php?s=forums&d=topic&id=4...

endianswap• 13 years ago

He's also claiming that all of the money made this way will be put into a tournament prize pool, but still, that doesn't justify the behavior or attitude.

leethax0r2• 13 years ago

He also said that it was an accident and not meant to be pushed to all the users.

Cthulhu_• 13 years ago

For correctness' sake, they didn't make $3000, they made 30 BTC, which could be sold on the market for approximately $3000 at the current rates, minus transaction fees and plus or minus market fluctuations.

shitlord• 13 years ago

This isn't surprising in the least. Anti-cheat clients are the worst, ever scummier than anti-virus clients.

If anyone here has ever played a game that used Inca GameGuard, you know what I'm talking about. If you open a page in your web browser with a title that seems suspicious to GameGuard, it can fucking REBOOT your computer without warning! And that's not the only client with such problems. From my experience, it has been a problem shared by many anti-cheat clients: they're all a bit too trigger-happy, even though they shouldn't be holding that gun in the first place. And if that wasn't bad enough, these clients are also notoriously buggy. They will corrupt the state of your kernel (they will do things like overwrite entries in your SDT/SSDT, making various system calls fail; in fact, it's very common practice for some of these tools to outright disable the use of functions like NtOpenProcess or ZwWriteVirtualMemory, and then not even bother to reallow them after the anti-cheat client exits), they will litter your Windows folder, and wreak havoc however they want.

And here's the kicker: these anti-cheat clients aren't even that effective if you know what you are doing.

leethax0r2• 13 years ago

...did you just imply that anti virus programs are shady?

stoic3• 13 years ago

anti-cheat, like cheating-death or punkbuster

lmm• 13 years ago

Isn't that common knowledge? Many antivirus programs have a worse effect on system stability/performance than the things they're supposed to prevent.

yuhong• 13 years ago

Wonder if this ever caught on: http://games.slashdot.org/comments.pl?sid=3105&cid=14426...

drucken• 13 years ago

Yup, this is the notorious nProtect Gameguard (http://global.nprotect.com/product/gg.php).

It is even worse than most anti-cheat clients which "only" monitor and notify.

Not only will it actively pre-emptively change the state of your programs, some changes irrecoverably, but in addition it cannot be independently uninstalled, i.e. the game publisher who bundles it has to provide an uninstaller for it or it will not be uninstalled if you remove the game.

Gameguard is also believed to contain a keylogger (http://en.wikipedia.org/wiki/NProtect_GameGuard).

It is basically a commercial rootkit that is relatively easily circumvented by cheaters anyway.

username111• 13 years ago

The difference here is that ESEA was the most trusted league in America and the majority of competitive cs players have subscribed to it for 7 dollars a month. (The anti-cheat was only one aspect of the client)

pale_rider• 13 years ago

The thread is closed, which links to an explanation, which is below:

-----------------------------------

[lpkane] - 5.1.13 at 1:46am

lol that got aggressive quickly

back towards the end of march, as btc was skyrocketing, jaguar and i were talking about how cool it would be if we could use massive amounts of gpus logged into the client to mine

we went back and forth about it, considered doing something for april fools, didn't get it done in time, and eventually elected to put some test code in the client and try it on a few admin accounts, ours included

we ran the test for a few days on our accounts, decided it wasn't worth the potential drama, and pulled the plug, or so we thought

fast forward to 48 hours ago, a fuck up in the client server results in a restart which results in a setting getting changed which enables it for all idle users, and here we are

and the results for 48 hours of your combined efforts?

http://www.picsend.net/images/923377coin...

~2 btc, or roughly $280 usd at current exchange rates, not bad!

anyway, our bad, we just released a client update with the btc stuff removed, and your $280 is going into the s14 prize pot -- if you're still feeling sad, feel free to pm me and i'll attempt to buy back your love

but for the record, i told jag he shouldn't be lazy and run the miner in a separate process, rookie move

dvt2• 13 years ago

And then that thread was closed. And this one was opened: http://play.esea.net/index.php?s=forums&d=topic&id=4...

Turns out the ~$280 turned into over $3,500. And the 48 hours turned into 8 days.

makomk2• 13 years ago

Yeah. Only after several people in the first thread figured out that their antivirus software had been detecting the miner for much longer than 48 hours, and one of them contacted the pool used to confirm how much had actually been made, though.

luke_s2• 13 years ago

Actually, there is a follow up to that:

http://play.esea.net/index.php?s=forums&d=topic&id=4...

-----------------------------------

[lpkane] 5.1.13 at 3:17am

first make sure you read part 1 of this developing story:

http://play.esea.net/index.php?s=forums&...

now for the more interesting news:

1. this has been running since april 14th, and definitely explains the virus warning due to the miner being a separate process

2. there were a total of 3 wallets on 3 pools set up for the test with the following addresses:

- 50btc: 1NsEeuxWB4ZvjVrxZcsmeMktDJPG5m4NCn - btc guild: 13X5R8tTGkvZnsvFd12AHqwpF2hp34QKUa - slush pool: 1NLy5djpAeU7uVNQ8meLQ4CweFU1hNfkQP

3. over the 2+ weeks it was apparently running, a total of 29.27627734 btc was mined, way more than 1.9!

4. daily sweeps were set up which converted btc to usd, and transactions totaled $3,602.21 (just sold the remaining btc to get a total)

so first the bad news, this is way more shady than i originally thought, and as the person who is ultimately responsible for everything it's 100% my fault

now the good news, as of the client update released in the last hour, all the btc stuff is out which should solve the gpu and av warnings, and in a blatant attempt to buy back your love (and less likely your trust), i'm going to do the following:

1. 100% of the funds are going into the s14 prize pot, so at the very least your melted gpus contributed to a good cause

2. every user who was premium this month will get a free one month premium code which they can use whenever and for whomever they like, and you'll find the code under manage accounts -> premium codes

once again, our bad, thanks for keeping us honest

-----------------------------------

So, it turns out, it wasn't $280 worth of BTC that was mined, it was $3,602.21 . How you can 'accidentally' mine more than $3000 of BTC is beyond me!

nnash• 13 years ago

>anyway, our bad, we just released a client update with the btc stuff removed, and your $280 is going into the s14 prize pot

To be honest I thought that this was what the story was originally going to be about. They should add it in as an opt-in setting so people can support ESEA's tournaments.

bradleyland• 13 years ago

> fast forward to 48 hours ago, a fuck up in the client server results in a restart which results in a setting getting changed which enables it for all idle users, and here we are

This is some of the most hand-wavy bullshit I've seen in my 15 years of IT experience.

pcieee• 13 years ago

Mirror: http://www.webcitation.org/6GHYnetpc and http://www.webcitation.org/6GHYhQL72

makomk2• 13 years ago

Failed both times, only mirrored the splash page and not the forums.

tantalor• 13 years ago

I'll bite. Why not sell a service to a mining pool? Many services are free anyway. I'd fork over an hour of GPU per day to see fewer the ads.

krichman• 13 years ago

An hour of GPU is not much. I think a single GPU can do a few Megahashes per second. To hit one BTC/day you would need about 20 Gigahashes per second all day.

I think they'd make a bunch more by showing you the ads.

http://www.bitcoinx.com/profit/

lucb1e2• 13 years ago

But 1btc/day is >$100/day. They don't make that much on a single client showing ads. More like $0.10 at most, or 0.001btc (which takes much less mining power).

seanp2k2• 13 years ago

BTC mining on GPUs uses a ton of power, like quadruple-the-monthly-power-bill-in-your-apartment kind of power. If you're willing to pay the energy company and bring more harm to the environment for something, I don't feel like you're really thinking about the true cost. I'd rather just pay up-front on simple terms.

thaumasiotes2• 13 years ago

The monthly power bill in my apartment is consistently $7 / month. If it went up by a factor of 5, I'd never notice; a while ago I got fed up and paid several months in advance because it seemed so ridiculous to have a $7 bill every month.

What's a typical power bill like, and what's going on with mine?

(my power uses - lights, fridge, and one to two old computers in a 400 sq. ft. apartment in downtown SF)

DigitalSea• 13 years ago

It was only a matter of time before someone tried this, if I were in their position I would contemplate it too given the rise of the cost of a Bitcoin and they won't be the last to try something like this. I the day a widely used software application like uTorrent decides to remove the malware and banner ads and instead bundles in a Bitcoin miner that runs when your machine is mostly idle (like download a torrent over night).

johnyzee• 13 years ago

New business model for games: Free-to-play with embedded Bitcoin miner!

lifeformed• 13 years ago

Let me provide some background on ESEA:

It's a paid service ($7/month) that lets you set up competitive matches of Counter-strike (and TF2 and LoL) with other ESEA players. It has it's own ranking system, it's own league/ladder, and anti-cheat system. It has over 20,000 subscribers. It's the most popular of such services for Counter-strike, and has been around for many years.

This incident is really serious. People have reported damaged hardware from this. Mining bitcoins can run quite hot if your system is not built for it. ESEA has been known for being scummy in the past - this is a huge breach of trust and security that I can't believe so many players are overlooking it.

The worst part is their response to all of this. They're playing it off like a joke and think it's no big deal. The $3600 they made came at the expense of far more than $3600 in electricity costs from the community. They lied about the whole thing, and keep changing their story as people figure out more of it. There's more discussion on this on the csgo subreddit: http://www.reddit.com/r/GlobalOffensive/comments/1dgad2/esea...

jacobquick• 13 years ago

Should change this link to an actual news item, currently it goes to their front page which of course provides no information. I know reddit's crappy but this post is actually doing a good job aggregating info as it becomes available: http://www.reddit.com/r/Games/comments/1dglil/popular_compet...

This should probably be a really big story covered and analyzed by all the serious video game journalists... just kidding those don't exist. If we're lucky maybe Forbes will cover it or something.

ESEA turned anti-cheat client into BTC miner

Related Stories