Crestfallen Studios

It has come to my attention (via a few friends on IRC, whose names I have
forgotten), that during any failed Starcraft BATTLE.NET connection
(i.e. you have an invalid CD-Key), some sensitive information is (illegally)
retrieved from your registry and sent up to Blizzard. This only seems to
occur the first time you connect using an invalid key, but not afterwards.
I have personally confirmed this using socket traces.

As of the writing of this document, 6 registry keys in particular are
checked and sent back to Blizzard, who obviously hope to collect names and
e-mail addresses of those who attempt "invalid" connections to BATTLE.NET.
These 6 keys are:

HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User Info\DefName
HKEY_CURRENT_USER\Software\Microsoft\Internet Mail and News\Mail\Sender Name
HKEY_CURRENT_USER\Software\Netscape Navigator\User\User_Name
HKEY_CURRENT_USER\Software\Microsoft\Internet Mail and News\Mail\Sender EMail
HKEY_CURRENT_USER\Software\Netscape\Netscape Navigator\User\User_Addr
HKEY_CURRENT_USER\Software\Kali\Kali95\User Info\email

Blizzard has the ability to change which registry keys are checked at any
time, but currently only these 6 are checked. I would advise doing a "Find"
operation in REGEDIT and removing any traces of your real e-mail and name.

To combat this outright "invasion" of your computer privacy, I have coded
a small program that will make your computer "anonymous" by setting these
6 registry keys to anonymous values. (Setting the names to Ben Dover and
downloading@this.info.is.illegal.com, in particular). Just run BNETANON.EXE
to display your current settings and click YES to "anonymize" them. Any
settings that show up as "<not defined>" have never been created, so you
don't need to worry about them.

Can't believe that Blizzard would do such a thing? Do the socket trace
yourself: go to http://www.win-tech.com, download Socket Spy/32, and
register it using the following codes:

Name=Beowulf
Company=RAZOR 1911
Code=OHJGH3LNLKM3O372 (note that all the O's are the letter O, not zero)

Fire up Socket Spy/32, do "File/Begin Trace" (you may want to also turn on
Capture To Disk to save a .TXT copy of the trace) then launch Starcraft and
attempt a BATTLE.NET connection. After you are denied, exit out of Starcraft
and check out the trace results. If this is the first time you have attempted
to connect to BATTLE.NET using a particular bogus CD-Key, you should see what
I mean. Note that the registry keys are only polled the FIRST time you try
an invalid key, but not afterwards (I THINK). I have included a trace I did
myself as TRACE.TXT.

What does all of this mean? Well, if you plan to do "war-dialing" with
generated keys to find a valid one, you will definately want to make your
information anonymous. If you don't ever use BATTLE.NET for Starcraft,
then this doesn't affect you at all.


- Beowulf [RAZOR 1911]