ZOS integrated spyware RedShell by mistake, deleted from live, still in PTS folder

Chilly-McFreeze

StackonClown wrote: »

Still dont get this - what am I missing here ??

"The ONLY purpose this would be used for is to determine from which origin points our new players come from, so we can better plan where to place advertisements and other web content. Existing accounts will never encounter this, as they are already created."

If this is only for new players that DONT have an account, then they dont have the game either right?
So then how on earth would they install redshell?? Or is that for steam or something?

It seems this has exclusively been installed on EXISTING accounts (by 'mistake' ) but serves no purpose apparently ?!?



Can someone pls explain?

That's what I'm asking myself too. Seems like another excuse.
BTW non-steam users did get redshell too.

anitajoneb17_ESO

StackonClown wrote: »

It seems this has exclusively been installed on EXISTING accounts (by 'mistake' ) but serves no purpose apparently ?!?
Can someone pls explain?

Yes I can.
It's like when in a shop or on a website you buy something for the first time and they ask you "where have you heard from us ?"

It's very relevant for ZOS to know where current NEW players found the incentive to buy and get involved with ESO.
If it's because of trailers on Youtube, then ZOS might invest more into cinematic trailers in order to attract even more new players.
If it's because of conversations on social medias, then ZOS might intensify their community management there.
If it's because of a Superbowl ad, then ZOS might invest more in there. Inversely, if noone chooses to buy and play ESO due to city ads or tv ads or superbowl ads, then ZOS should drop those channels and focus on those which prove more efficient.

Etc.

Not defending the spyware here, just explaining what Matt said its purpose was.

anitajoneb17_ESO

Merlin13KAGL wrote: »

Is Redshell malicious? No.

Define "malicious".

Does it harm my computer ? No.
Is that enough to not be malicious ? In my opinion, no.
ZOS knowing anything and everything I do in ESO ? Okay, why not. But ZOS knowing anything and everything I do, write, research and view, professionally or for fun, outside of ESO is definitely malicious in my view.

anitajoneb17_ESO

lordrichter wrote: »

I, for one, accept the explanation provided by @ZOS_MattFiror

He shows up here very rarely, and this is something Gina and Jessica could have posted. Given that it is still their intent to use it at some point in the future, and how easy it is for unintended stuff to get into their builds, I have no reason to not believe it.

edit... besides, does it matter if that is the reason? What I am more interested in is when they decide they want to use it.

Some figures at ZOS have been intentionally put in the spotlight to gather sympathy from the community (Gina, Jess, Finn, Rich, etc. ). They make us feel like we know them, have a direct link to them and we're "family".

Matt on the other hand impersonates the business side of things and channels hate, if there's any. That's why he steps up for unpleasant announcements or obvious corporate communication stuff, like here now or previously the crown crates.
No way they'd let Gina or Jess or Rich speak up regarding this spyware thing - and they're probably more than happy to not do it.

NewbieOKS

NewbieOKS wrote: »

RinaldoGandolphi wrote: »

Arnorien16 wrote: »

Red Shell is not a spyware, its legit analytics business that works for the likes of Steam in the same way Google analyses behaviors to tailor adds and searches. ZoS using Red Shell is not the mistake, not announcing it properly is the mistake ... which would make sense if it was a unintentional implementation.

Yes it is.

Straight from the mouth of one of the largest internet security companies in the world:

Symantec Security Response

Programs that have the ability to scan systems or monitor activity and relay information to other computers or locations in cyberspace. Among the information that may be actively or passively gathered and disseminated by spyware are passwords, log-in details, account numbers, personal information, individual files, or other personal documents. Spyware may also gather and distribute information related to the user's computer, applications running on the computer, Internet browser usage, or other computing habits.

Spyware frequently attempts to remain unnoticed, either by actively hiding or by simply not making its presence on a system known to the user. These types of programs can be downloaded from Web sites (typically in shareware or freeware), email messages, and instant messengers. Additionally, a user may unknowingly receive and/or trigger spyware by accepting a EULA from a software program linked to the spyware or by visiting a Web site that downloads the spyware with or without a EULA.

Kapersky
Spyware is generally loosely defined as software that’s designed to gather data from a computer or other device and forward it to a third party without the consent or knowledge of the user. This often includes collecting confidential data such as passwords, PINs and credit card numbers, monitoring keyword strokes, tracking browsing habits and harvesting email addresses.

https://redshell.io/privacy-policy

• Does Redshell gather information about the users computer without their knowledge? Yes
• Does Redshell gather information and relay that information to another computer on the internet without the users knowledge? Yes
• Does Redshell gather information about what programs are on the users computer? Yes
• Does Redshell load or hook into another program without the users knowledge? Yes

Redshell is spyware and there is no grey area about it. Symantec, the worlds largest cyber computer security company with the largest Civilian Threat intelligence network in the entire world with over 174 million endpoints says your wrong. Kasperskyy(regardless of your political thoughts on them) agrees with Symantec.

Its Spyware, plain and simple.

I already had Kaspersky Internet Security running in my PC along with ESO. When a player created this thread, I immediately run a scan test on the targeted files (RedShell.dll) in all the ESO base game folder including the user setting files in My Document. However Kaspersky Internet Security software does not recognise as a threat/mailicious software/spyware.

Edit: typo erorr....thread change to threat

Print Screen of my Kaspersky Total Security on RedShell.dll file and ESO folder

https://imgur.com/a/ypq4awU

anitajoneb17_ESO

NewbieOKS wrote: »

Print Screen of my Kaspersky Total Security on RedShell.dll file and ESO folder

https://imgur.com/a/ypq4awU

Care to summarize ? It's not fun to decipher those.
Anyway, antivirus software is meant to detect threat to our computers - which Redshell isn't - and not threats to our privacy - which Redshell is.

Syncronaut

anitajoneb17_ESO wrote: »

StackonClown wrote: »

It seems this has exclusively been installed on EXISTING accounts (by 'mistake' ) but serves no purpose apparently ?!?
Can someone pls explain?

Yes I can.
It's like when in a shop or on a website you buy something for the first time and they ask you "where have you heard from us ?"

It's very relevant for ZOS to know where current NEW players found the incentive to buy and get involved with ESO.
If it's because of trailers on Youtube, then ZOS might invest more into cinematic trailers in order to attract even more new players.
If it's because of conversations on social medias, then ZOS might intensify their community management there.
If it's because of a Superbowl ad, then ZOS might invest more in there. Inversely, if noone chooses to buy and play ESO due to city ads or tv ads or superbowl ads, then ZOS should drop those channels and focus on those which prove more efficient.

Etc.

Not defending the spyware here, just explaining what Matt said its purpose was.

There are way easier solutions like this. Nintendo for example will send you a poll on their email that you can or not fill.
Its way less anoying that way and also cheaper.

Are you happy with our product 1-5 stars.
Where did you find this game Options
If this feature way a option in future you like it Yes/no

And so on. Survey is the least anoying thing i can think of as its completly optional.

ZephyrWestwind

anitajoneb17_ESO wrote: »

StackonClown wrote: »

It seems this has exclusively been installed on EXISTING accounts (by 'mistake' ) but serves no purpose apparently ?!?
Can someone pls explain?

Yes I can.
It's like when in a shop or on a website you buy something for the first time and they ask you "where have you heard from us ?"

It's very relevant for ZOS to know where current NEW players found the incentive to buy and get involved with ESO.
If it's because of trailers on Youtube, then ZOS might invest more into cinematic trailers in order to attract even more new players.
If it's because of conversations on social medias, then ZOS might intensify their community management there.
If it's because of a Superbowl ad, then ZOS might invest more in there. Inversely, if noone chooses to buy and play ESO due to city ads or tv ads or superbowl ads, then ZOS should drop those channels and focus on those which prove more efficient.

Etc.

Not defending the spyware here, just explaining what Matt said its purpose was.

And what he said made absolutely no sense. They cannot determine where new players came from using this software unless the software was already on their computer when they came into the game. That would not be the case (unless another company installed it on that computer and that installation would/should not be giving information the ZOS). The claim that it was only intended for new users, just doesn't make sense. The software can only be on the computers of existing users for them to get information.

For myself, if I find one lie or inconsistency in a statement, I tend to doubt all of the statement.

anitajoneb17_ESO

Syncronaut wrote: »

There are way easier solutions like this. Nintendo for example will send you a poll on their email that you can or not fill.
Its way less anoying that way and also cheaper.

Are you happy with our product 1-5 stars.
Where did you find this game Options
If this feature way a option in future you like it Yes/no

And so on. Survey is the least anoying thing i can think of as its completly optional.

Those surveys report what players say they do.
Spyware reports what players actually do.

There's usually a significant discrepancy between the two.

Spyware is also much more precise. A form is not able to ask you if you've also played Skyrim, Witcher, Pokemon, etc... and for how long, over a thousand games.

And finally, spyware answers the questions. Humans usually don't.

Question : "Where have you heard from us" ?

• Answer by Spyware ===> user saw 142 ads on Youtube and 253 on Twitch before buying this game.
• Answer by user ====> I think it's an amazing game !!!
  

anitajoneb17_ESO

ZephyrWestwind wrote: »

They cannot determine where new players came from using this software unless the software was already on their computer when they came into the game.

Of course they can. Browser history, Google+ data, Twitch/Youtube/FaceBook history, hard drive, already installed games, mobile phone data, etc.
Even if you wipe your hard drive and do a fresh install with only Windows, a browser and ESO, they'd know more or less everything about you the second you sign in into any social media.

NewbieOKS

anitajoneb17_ESO wrote: »

NewbieOKS wrote: »

Print Screen of my Kaspersky Total Security on RedShell.dll file and ESO folder

https://imgur.com/a/ypq4awU

Care to summarize ? It's not fun to decipher those.
Anyway, antivirus software is meant to detect threat to our computers - which Redshell isn't - and not threats to our privacy - which Redshell is.

I am not a tech savy person, but Kaspersky software that I am using is not only able to detect virus but also malware/spyware/other vulnerabilities ... what I am trying to say that RedShell is not a spyware as the title of this thread but the real topic is the integration of the Redshell.dll file to ESO game client without transparency and acknowledge of its players/users....but again I remembered in the ZOS Privacy Policy that I agreed that there is one paragraph saying like this

Link https://account.elderscrollsonline.com/privacy-policy

Analytics Tools. We may use internal and third-party analytics tools (see our Cookie Policy at http://www.zenimax.com/cookie_us for a list of third parties) to collect and aggregate activity data and other data across multiple channels.

Vulnerability Test
https://imgur.com/a/ypq4awU



Print Screen no 5 & 6 on the vulnerability test

Link on the Kaspersky Total Security functionality p.s I am not promoting Kaspersky but as a internet user, I personally feel need to install a simple firewall software for home use

https://kaspersky.com/total-security

Link on Kaspersky Lab Research and Report - it includes not only virus but also other threats (malware, spyware, etc) - for reference purposes
https://securelist.com/

Link on a IT user forum inspection on the RedShell.dll capabilities
https://forums.elderscrollsonline.com/en/discussion/comment/5184809/#Comment_5184809

Edited due to correcting typo error, better arrangement on the links and insert the print screens

anitajoneb17_ESO

NewbieOKS wrote: »

Link on Kaspersky Lab Research and Report - it includes not only virus but also other threats (malware, spyware, etc)
https://securelist.com/

"Hello ? Kaspersky ? RedShell speaking here. this is just to let you know that our software isn't a spyware, but a marketing tool. The gathered information is only meant to help companies target their audience better and expand. that's good for everyone. So please do not include it in your spyware detection list, because it ain't spyware at all. If you have doubt, I can invite you and all your staff on a month holidays in Paradise Island so we can explain it all to you. And we can make your retirement days more comfortable, too."

(This example is purely fictional - Any resemblance with real life current or past events is coincidental).

MarbleQuiche

anitajoneb17_ESO wrote: »

NewbieOKS wrote: »

Link on Kaspersky Lab Research and Report - it includes not only virus but also other threats (malware, spyware, etc)
https://securelist.com/

"Hello ? Kaspersky ? RedShell speaking here. this is just to let you know that our software isn't a spyware, but a marketing tool. The gathered information is only meant to help companies target their audience better and expand. that's good for everyone. So please do not include it in your spyware detection list, because it ain't spyware at all. If you have doubt, I can invite you and all your staff on a month holidays in Paradise Island so we can explain it all to you. And we can make your retirement days more comfortable, too."

(This example is purely fictional - Any resemblance with real life current or past events is coincidental).

Oh, I've got one too! Imagine a world where your AV software was mining your computer itself!

*shudder*

What a dystopian world that would be!

ZephyrWestwind

anitajoneb17_ESO wrote: »

ZephyrWestwind wrote: »

They cannot determine where new players came from using this software unless the software was already on their computer when they came into the game.

Of course they can. Browser history, Google+ data, Twitch/Youtube/FaceBook history, hard drive, already installed games, mobile phone data, etc.
Even if you wipe your hard drive and do a fresh install with only Windows, a browser and ESO, they'd know more or less everything about you the second you sign in into any social media.

I said "They cannot determine where new players came from using this software". Your reply does not address this issue.

Matt said " My apologies for the confusion over the integration of Red Shell into ESO. Here’s what happened: we have been experimenting with a better way to link which advertisements and web content new players see to the eventual account that is created in the game. The ONLY purpose this would be used for is to determine from which origin points our new players come from, so we can better plan where to place advertisements and other web content. Existing accounts will never encounter this, as they are already created."

Matt's claim that Redshell was only going to be used to find out where new players were coming from is simply not possible.
Unless redshell is already on the computer, redshell cannot tell them where the new players came from. It can only be used after the game is installed and at that point, they have already come from whatever origin point there was making it useless for the purpose Matt stated.

Yes, other methods like you listed can be used to get that information, but this thread is about Redshell and ZOS's use of it. At least part of the explanation given, quoted above, is complete and utter nonsense.

anitajoneb17_ESO

ZephyrWestwind wrote: »

I said "They cannot determine where new players came from using this software". Your reply does not address this issue.
.../...
Yes, other methods like you listed can be used to get that information, but this thread is about Redshell and ZOS's use of it. At least part of the explanation given, quoted above, is complete and utter nonsense.

It does address this issue, because of course RedShell can read and send info from all the things I listed - and more. And that way, it can read stuff and know things from before it was installed.
Also, please remain polite.

Reverb

For the last few years, I wondered what would finally turn me away from eso, and I knew it would be Zeni’s business practices and not the game itself that I turned away from. The giant login ad bring shoved down my throat 12 times a day had me near the tipping point, and this move has crossed the final line. I’m out, good luck all.

Esha76

I am more tech savvy than the average person, but not by much. I had no idea what Red Shell is, or what this thing does, until I saw this thread. And the more I read of it, the more terrified I am. And I go digging into the ESO folders, and sure enough, I find the horrid little thing living in there.

I don't care if it was a mistake. Something like this should never have been considered in the first place. Even if ZOS's intentions are purely to determine the best way for them to spend their adverting budget, I certainly don't trust the likes of Red Shell. What the hell else is that thing doing in there?

To be honest, and at the risk of sounding rather dramatic: I am feeling rather betrayed, and exploited, at this point. And even if it was an "honest mistake", ZOS still plans on using it in the future! Really, you want to put this monitoring program on my machine??? Sorry... You DID put this monitoring program on my machine!!!

We are paying for our conveniences, and entertainment, with a lot more than just currency these days.

anitajoneb17_ESO

Esha76 wrote: »

We are paying for our conveniences, and entertainment, with a lot more than just currency these days.

Very true.
That's also part of the reason why our conveniences and entertainment - at least the ones available online - are so incredibly cheap.
And since everyone has a "profile" to "sell" (knowingly or not), while not everyone has spare cash to spend, the result is that the model "free or cheap + data collection" will be the dominant model and the "paid+privacy" will be the luxury model.

xeNNNNN

Honestly - I think at this point its more that they didn't even tell us than the fact its there because that kind of "movement" leans towards the idea they only said anything because they got caught... which is actually kind of sad. But thats an assumption as much as I love to make assumptions lets not go full tinfoil hat, its not healthy for the community.

Lets just make sure we let them know we're watching them. Just like they want to "watch" us. We're customers and we can hold them to account. Even the little guy can stand up to a "corporation". So if they make any poorly thought out decisions then we can hold it over them. Especially something like this which if used without consent will break European law (not sure what the american law is).

Im just saying, we know about it now and so we can do something about it.

Odnoc

Radinyn wrote: »

I love how people here are crying because ESO added this thing, if you are here on the internet you were really spied in every possible way xD. There's nothing to fear, noone is going to come to your house and rob you because of it. Cheers.

That has nothing to do with it. I'm not worried about someone coming to rob me, I am paying to play ESO, I don't like being double dipped. It really is as simple as that.

Kuwhar

Odnoc wrote: »

Radinyn wrote: »

I love how people here are crying because ESO added this thing, if you are here on the internet you were really spied in every possible way xD. There's nothing to fear, noone is going to come to your house and rob you because of it. Cheers.

That has nothing to do with it. I'm not worried about someone coming to rob me, I am paying to play ESO, I don't like being double dipped. It really is as simple as that.

But, you weren't being double dipped.

First: it was never active
Second: The idea isn't to profit off of you more, it's to gauge the return on their marketing investments.

StackonClown

ZephyrWestwind wrote: »

anitajoneb17_ESO wrote: »

StackonClown wrote: »

It seems this has exclusively been installed on EXISTING accounts (by 'mistake' ) but serves no purpose apparently ?!?
Can someone pls explain?

Yes I can.
It's like when in a shop or on a website you buy something for the first time and they ask you "where have you heard from us ?"

It's very relevant for ZOS to know where current NEW players found the incentive to buy and get involved with ESO.
If it's because of trailers on Youtube, then ZOS might invest more into cinematic trailers in order to attract even more new players.
If it's because of conversations on social medias, then ZOS might intensify their community management there.
If it's because of a Superbowl ad, then ZOS might invest more in there. Inversely, if noone chooses to buy and play ESO due to city ads or tv ads or superbowl ads, then ZOS should drop those channels and focus on those which prove more efficient.

Etc.

Not defending the spyware here, just explaining what Matt said its purpose was.

And what he said made absolutely no sense. They cannot determine where new players came from using this software unless the software was already on their computer when they came into the game. That would not be the case (unless another company installed it on that computer and that installation would/should not be giving information the ZOS). The claim that it was only intended for new users, just doesn't make sense. The software can only be on the computers of existing users for them to get information.

For myself, if I find one lie or inconsistency in a statement, I tend to doubt all of the statement.

^^^^ Exactly!!!!!!!

Elsonso

DoctorESO wrote: »

Why did PLAYERS have to self-discover this and call you out on it before you admitted to having the program and agreeing to delete it? It shouldn't be like this.

They were not actively collecting data. It was there, but not being used. My guess is that the server has to tell the client to collect the data, and that was not happening. So, even if they knew it was being shipped, they might have figured it was not a problem. Until, that is, the players found it. Then, it was a problem.

Personally, I doubt they knew it was still in there. They probably had some ticket/issue/task/intention to remove it. That never happened or was not done properly, and no one bothered to check.

Elsonso

Octopuss wrote: »

ZOS_MattFiror wrote: »

The ONLY purpose this would be used for is to determine from which origin points our new players come from, so we can better plan where to place advertisements and other web content.

Someone translate this into human speech for me please.
What advertisements, what web content WHERE? There are no ads on the ESO website.

Red Shell is a tool that tracks visits to ad venues outside of the game, not in the game. This is nothing to do with launcher ads and crown store ads. This is Bethesda and ZOS trying to draw a line between an ad venue and playing ESO so that they can place ads in places where people likely to buy, download, and play ESO hang out. This basically is the automated way to answer the survey question about how you found out about ESO.

Sounds to me like ZOS is not convinced this is the right tool. Yet.

Esha76 wrote: »

To be honest, and at the risk of sounding rather dramatic: I am feeling rather betrayed, and exploited, at this point. And even if it was an "honest mistake", ZOS still plans on using it in the future! Really, you want to put this monitoring program on my machine??? Sorry... You DID put this monitoring program on my machine!!!

My feeling is that companies need to disclose when they are using monitoring software, for whatever reason, at the time of installation. I can't prevent them from doing it, and not telling me, but I block quite a few of these little gems, and Red Shell is one of them.

Red Shell is not malware, even if it is spying on us.

Chicharron

StackonClown wrote: »

Maybe some of the community ambassadors or class representatives can comment on this also, given they roles the have representing players ??

Represent who? they are not my voice and never will be, no matter what ZOS says.

Their opinion should be as valid as any other.

[removed bashing comment]

Azarai

This has honestly been one of the most overblown and embarrassing things I have seen on this forum yet. Yes, it is very easy to accidentally throw some code into the build and have it go Live for many, many reasons. Changing business decisions, testing it out, even just seeing if it works. No, this is not Spyware, this is Marketing Analytics. It is used by the vast majority of companies that utilize advertising, because they have to know HOW their money is being spent. No, Red Shell is not collecting your personal information, it does not matter to them. Honestly, you can see what they do, they list it on their website. What this awful 'Spyware' does is measure where players would click when coming from ads and throws it in a graph/CSV. This is nothing new in the slightest.

Rohamad_Ali

ZephyrWestwind

anitajoneb17_ESO wrote: »

ZephyrWestwind wrote: »

I said "They cannot determine where new players came from using this software". Your reply does not address this issue.
.../...
Yes, other methods like you listed can be used to get that information, but this thread is about Redshell and ZOS's use of it. At least part of the explanation given, quoted above, is complete and utter nonsense.

It does address this issue, because of course RedShell can read and send info from all the things I listed - and more. And that way, it can read stuff and know things from before it was installed.
Also, please remain polite.

Hmmm, not sure what you considered impolite.

I don't know if you read the link in the OP or how thoroughly. Redshell does not claim to use any of the methods you listed. It lists a very specifc method of gathering fingerprints and matching those to the game and there is quite a bit of information to dig through. The most important bit is that it is designed to measure a marketing plan success rate, not tracking where users come from. It measures traffic from very specific locations/links. This means the company using it needs to incorporate Redshell into their ad sites/links.

This quote from the redshell site

"Red Shell provides Steam attribution by collecting a fingerprint when a user clicks on a tracking link then collecting the same fingerprint when the user plays your game. On the backend we match this data and when we find a match we show a conversion in our dashboard. "

I believe this next line is the key!

"This means that we require code to execute when the game launches so we can collect a fingerprint of the user's computer. To make the collection of this information as easy as possible we provide multiple SDKs as well as a REST API. "

They need the fingerprint of the user's computer (Redshell installed) to be able to match the fingerprint when it occurs elsewhere in the ads.

This can be used to tell where current users are coming from before a game session if they came from a supported ad, but as described it does not retroactively gather data or pre-gather data about an unknown fingerprint and so would not tell where new players came from.

Now, there is a way to get that information, but it would make the "it was installed by accident explanation" suspect. If ZOS has already placed the web bugs/tracking info into their own ads reporting to Redshell, then Redshell could be already collecting fingerprints to match at a later date to see where new users came from. Either way, their explanation for this situation is suspect and that practice would not be covered by the EULA at this time.

BTW, reading the RedShell site one will also discover that Xbone, PS4 and Switch alpha testing is planned. Probably why they said it wasn't planned for console. They wouldn't be able to plan it until later.

Elsonso

ZephyrWestwind wrote: »

This can be used to tell where current users are coming from before a game session if they came from a supported ad, but as described it does not retroactively gather data or pre-gather data about an unknown fingerprint and so would not tell where new players came from.

Maybe not every player, but perhaps any player that has run any game or application that includes Red Shell. I doubt that the signature that they collect is game specific, so once you are profiled by Red Shell for one game, it will apply to any subsequent game. In that respect, it can retroactively tell stuff about a player before the player started playing ESO.

Seems to me there are gaps. If this were a slam dunk product, ZOS would not be evaluating it, they would be using it.

billp_ESO

This thread is confusing, and it's hard to figure out what RedShell really does.

1) Does it only activate when you click a RedShell-enabled ad? For example, ESO runs an ad on a website, and you click it. By clicking the ad, you trigger the collection of your data. Then, if you buy ESO and play it, they match the game to the ad, and know that ad worked. If you never click on an ESO ad, nothing happens. If this is the case, I see little problem.

2) Does it activate when you click ANY ad? For example, I click an ad on cats, and RedShell tracks that and sends it to ESO. Now I start seeing cat ads in game, when they pitch the cat pets in the store. That wouldn't be good.

3) Does it activate when you click on ANYTHING? For example, I click on a news story about cats, not an ad. RedShell still knows that, and matches that up with the game so that I start seeing ads for cats in game. Not good at all.

4) RedShell monitors all your activities, and sends that data along with your computer specs, location, etc, to anyone who wants to buy the data.

Does anyone know definitely which one of these it is?