Did you know that there's a fun way in-game whereby Blizzard could stop, prevent or at least mitigate the effect of account hacking in World of Warcraft? Not only that, but it can be easily implemented and they already have the system in place to do it.

Now, Blizzard has already done a bunch of neat features that reduce the impact of account hacking. I'm not talking about region based account locking or Warden updates - but rather smaller things, like making gear Bind on Pickup and setting their vendor price really low and/or making them immune to disenchanting.

You see, when your account is hacked, they want to clean out your account as quickly as possible. The cleaner will disenchant or sell all of your gear/items and transfer that gold to a laundering account. The most gold they get from you is your on-hand gold and what they can get for vendoring/disenchanting.

Vendoring, for the most part, has been taken care of - you can hardly get anything for vendoring gear, so it's not really worth it.

The big one is protecting your own gold (or your guild's gold).

What if you had the optional ability to deposit your gold into your bank account, and then purchase an in-game Goblin "combination lock" for your bank account?

The Goblin "Gold iLock™" would be a device sitting next to your personal bank (or guild bank if you're the GM) that you interact with it and enter a code to access your personal belongings and gold.

Say that you only have to unlock it once when you login, and it stays unlocked until you log off (e.g. to avoid having to enter the combination every time you try to access your bank.)

The combination lock could be programmed by yourself by using a total of 5 simple movements. For example, UP, DOWN, LEFT, RIGHT, and JUMP. Or it could be made more complicated (eg, spell casts, numbers, etc. to increase the number of permutations.)

The beauty of using standard player movement as a code is that even if you had a keylogger installed on your PC - your account gold and belongings would still be protected. To the keylog file, it would just appear as normal character movements with no special identifying keystrokes. The hacker would not be able to differentiate between normal game play and combination unlocks. So, if your account was hacked, they still couldn't access your gold or valuables. =]

Imagine the Vashj'ir Seahorse training quest where you need to move in different directions. For example, you interact with the Goblin "Gold iLock" system, it asks for you to enter your code, then just press UP UP DOWN DOWN LEFT RIGHT or whatever. Bingo, your personal bank unlocks and you can access your expensive items and gold. (Your player doesn't have to actually move or have character animations during your sequence presses either for additional security.)

This is purely optional too. Some users might find it fun to have it in-game, plus the added security measures are simply invaluable. This could also be applied to Guild Banks.

Now that covers a big part of the issue - your gold, mats, expensive items, etc.

Even though that would make a big difference on it's own, let's take it to the next level. What about gear on your person?

Gear that can't be disenchanted works really well, however that defeats the purpose of enchanting doesn't it? I suppose you could put a timer on it so that it has to be disenchanted on pickup or within a certain time frame. For example, 24 hours to D/E before it's permanent - that would surely revitalize the disenchanting industry for many.

But what if you could have special "enchants" for your gear (for free) that makes the item IMMUNE to disenchanting? =]

This might be very useful for a character that didn't have the enchanting profession, for example, since they probably intend on keeping the equipment for a really long time.

I suppose you could remove this special "enchant" at a later date by using the same lock/unlock code that's shared with your bank account. But even then, this is gear that would typically stay with them for a long time.. and this method would start prioritizing dungeon raids between gear-grinding for profit or for use. (From a Blizzard business perspective, this makes sense since this would actually encourage players to play longer.. which is what they want.)

You put all of these strategies together and you get something simple, fun in-game, and significantly useful. It would essentially kill the account-hacking industry too. What's the point in hacking an account if you can't access their gold and can't D/E their items?

After all, you can't rely on players (who are mostly technically illiterate) to secure and protect their own PCs themselves.. part of their $15 per month bill is paying for insurance, and if Blizzard has the tools and ability, they should be taking these extra steps to protect their customers.

This is a very interesting question. Most players are convinced that Blizzard makes a loss on sales of authenticators, and it's very difficult finding information to the contrary unless you know someone who works in the industry.

There have been plenty of alternatives available, so I was always curious why Blizzard chose authenticators. For example, in-game virtual keyboards (for PIN codes or passwords) are highly successful in other MMORPG's and inexpensive to implement (but, there's no direct profit to be made by doing this). Unfortunately, despite the cost of the device, there's also the chance that you might lose your token, damage it, or have battery issues and until a replacement is shipped, you're locked out of your account.

Two-factor authentication can also be made available through other sources (besides specific mobile devices) for free. For example, a soft token through a webpage or a second PC.

Anyways..

The Blizzard authenticator is in fact a Vasco Digipass Go 6, a cheaper model of token. There's a wowwiki entry on the authenticator as well.

(Just a quick note by the way. Hardware tokens are really just small LCD clocks with a factory-encoded key. Software tokens are the same - a very basic timer application that generates a code at specific intervals based on a uniquely assigned key/seed. They don't communicate back to any centralized servers or anything like that.. yes, some people actually believe that. They're just small standalone clock algorithm and a decoder. They're not hard to create either.. a basic soft-token apps literally take 1-2 hours to program and there's even plenty of open source examples online.)

There are certain plans where you can get the Mobile Authenticator for "free", but generally the Blizzard software tokens for mobile phones cost $0.99 (you also pay for download charges.) That's $1 to Blizzard for a simple 500 kb software app. Not bad.

Hardware authenticators cost $6.50 in the US, where free shipping is available. I'll use that as a base, even though they're more expensive in other countries (£4.80 or 6 Euros plus shipping can cost upwards to £10.00 or more.)

Online retailers sell the hardware token for $10 individually, but you can purchase these yourself from resellers in bulk for about $5.

I wanted to know how much manufacturers paid for something like this though, so I contacted a source in the manufacturing industry. His response: "Bill of materials? In volume, pennies."

Apparently, the components needed for this type of token shouldn't be more than $0.90 (including the casing). So, let's say the cost of manufacturing (well, assembling) is $1 per unit at the most, and Blizzard aesthetics (i.e. "a sticker") costs $1.. even though you know that these cost a fraction of a cent. At the very most these tokens cost $3 in total to manufacture, but in reality though, they're far less. Since they ship in bulk, individual transportation costs would also be in pennies. (Note: I was also told that "tokens are cheaper to make than crappy dollar-store calculators" if that helps put things into perspective.)

So yeah.. I think it's safe to say that both Blizzard and Vasco are definitely making a significant profit on authenticator sales. I'd be really interested in seeing their contract, but I'm assuming that Blizzard takes in the larger half of their split.

I think the reason why people think Blizzard is taking a loss is because they don't understand the technology and imagine the authenticator being a very expensive piece of new technology (with a satellite uplink that decodes passwords directly from Blizzard). After all, the Blizzard sticker makes it look very cool and shiny. Or maybe, they just don't know how much it truly costs to manufacture and ship goods. Or they see online retailers selling the model for $15-30 each, and assume retail prices are just slightly above manufacturing costs.

Or maybe they just forgot the saying "there's no such thing as a free lunch". This reminds me of Blizzcon actually.. it's said that the 2009 Blizzcon was a "substantial loss" for the company.. but I wonder what they mean by that? Sure, it cost a lot up front.. but how much did they reap in longterm revenue and marketing potential?

Anyways, I just want to correct a common misgiving that Blizzard is taking a loss on authenticator purchases. It's almost as ridiculous as those claims that Blizzard has "never had a security breach" because "they're required by law to announce data breaches, which they never have so logically there's never been a breach." =]

* UPDATE (03/15/2011):

Found this project online, it's a more expensive and complicated type of token/authenticator (active proximity, not passive) for unlocking SmartPhones.

This token can be built in volume for about $0.75 USD each. It's definitely more complicated than the Vasco Digipass (which is just a fancy clock with an algorithm), but it gives you a really good idea of component costs before assembly. A really good example nonetheless for those unbelievers. =]

Talk to an electrical engineer, and they'll tell you how much things really cost.

To help put things into perspective, do you have technical support experience? How long does it take you to install a new harddrive, memory, an operating system, or scanning for viruses? Staples charges $50 for a HD, $40 for memory, $100 for an O/S install, and $200 for a scan/removal. PC users with no experience believe that these prices are reasonable.. but you know better don't you? =]

* ANOTHER UPDATE:

And here's official proof directly from Vasco, the manufacturers, themselves.

This is a 2006 document detailing the Digipass line. In 2004, the cost per token was ~$3.50. In 2005, it was ~$3.00 each. And in 2006, it cost ~$2.00 each per token. They have probably made improvements in manufacturing technology since then, and bulk sales have definitely increased quite substantially so you could assume that their DigiPass Go 6 tokens cost $2 at the very most to manufacture (parts, construction, etc.)

The ASP (Average Selling Price) is also quite interesting. Apparently, wholesale distributors sell these things for 5-20x what they cost to manufacture.

Here's a video that more people need to watch, especially game publishers and developers.

It's a conversation with Jared Psigoda, a leader in the RMT industry. He's also the individual who informed Markeedragon about the new PayPal & Blizzard relationship that's still making the rounds on the net.



He says that Blizzard has certain trends in their ban-waves. Typically, they occur before an expansion pack launches (as a clean sweep) or when they experience poor quarterly financials. He confirms that Blizzard gets a "huge revenue influx" when a ban-wave occurs, due to the sheer number of accounts requiring reactivation (Note: Monthly fees also double-up meaning twice as many "Active Subscriptions"). These accounts make up a huge portion of revenue for Blizzard as there are hundreds of thousands working in the industry.

Does any of this sound familiar? =]

It's certainly nice to have this officially confirmed by another industry professional.

He also talks about a couple other interesting topics, like which games they avoid (since there's no profit to be made) and how most "hackers" gain access to your online gaming account.

Consider first, though, the amount of money developers spend on managing the aftermath of Gold Sellers and Hacked Accounts:

- Investigation teams need training, benefits, and salaries.
- The amount of time spent investigating accounts and confirming that they are gold buyers/sellers. Or confirming cheating, hacking, etc.
- Money spent on hiring and training large quantities of Customer Support personnel (high turn-over environment)
- More Customer Support staff needed for the amount of farming, cheating, hacking, recovery, etc.
- Blizzard even had to change their own Recovery Process, which goes to show how difficult and unmanageable the situation was becoming.
- The more staff you employ, the higher the risk and/or costs of mistakes (e.g. disgruntled employees, injury liability, employee theft.)
- Stolen and hacked accounts lead to massive customer service issues. Not only is it taxing on the customer service departments, but it is also taxing on their customer retention rates.
- You also have to pay the salaries of the managers who manage these teams, and financial services (HR, Facilities, IT, etc) who serve these managers and employees.

A massive money-eating monster has been created that just addresses "clean-up operations" or the chain-reaction and consequences of something that could have been prevented in the first place. There's a word for that: negligence.

All of those issues can be fixed with very simple solutions.

How To Stop Gold Farmers

- RMT (aka secondary sales) thrives on subscription based games, not games that are heavily micro-transaction based.
- RMT is almost exclusively World of Warcraft. Gold farmers and hacked accounts would suffer greatly if WoW were to change it's model.
- If the game is Free to Play or the developer sells items/gold themselves, RMT companies cannot compete with these developers who can print their own money.
- If people stop buying gold, there's nothing for farmers to sell. So, make gold worthless like how it was done in Diablo 2. (Or find a balance.)
- The more easily you can obtain gold in-game, the more it loses it's value and drives down the profit margin of gold farmers. Eventually there's a point where the value isn't "worth enough" to farm.
- Or leave gold very valuable in-game, but simply make it "soulbound". It can't be traded, but it can be used to purchase expensive services or crafts (that take a long time to develop and collect soulbound materials for) from other players. Prices for these services/goods would be fixed as well. Or the gold can be used to buy valuable items/gear, but from NPCs instead of real players.
- Make all items Bind On Pickup, so that epic items cannot be traded.

The best solution, however, is just for developers to sell the gold themselves. It's a quick way to shutdown the virtual trading industry.

This probably won't happen with World of Warcraft, considering the verbal commitments already made to their customers - but it's a viable solution for their next-generation MMO (considering the gameplay approach and plans on increasing "real world" interaction).

How To Stop Power-Leveling Services

One of the problems that RMT has been facing (for power-leveling services and hackers alike) is IP-based account locking. When an IP suddenly changes, the account is locked, and the owner of the account needs to call Blizzard to unlock it.

Unfortunately, Blizzard has also taken it upon themselves to take additional proactive (provocative?) measures, like cancelling credit cards of innocent players overseas and screwing them over.

Nevertheless, IP based account locking is a very effective process. It's geography based at the moment, but what if they made it for location specific? For example, limiting it to a specific ISP (in case the user has a dynamic IP address) but allowing them a maximum of 2-3 different IP address "registrations" in the same geography. The other option is MAC Address locking, but maybe allow a maximum or 2 PCs and additional ones require online approval and an "identity check".

It's one option that shouldn't be a nuisance for most players anyways. =]

How To Stop Gaming Account Hackers

This might surprise many of you. According to Jared, account hacking due to key-loggers isn't as significant as account hacking due to your gaming websites.

The problem is, most players use the same email address from World of Warcraft and they register it on other websites, forums, or gaming communities. They typically use the same password as well. That's how most WoW (and other) accounts are hacked.

Chinese hackers primarily target gaming websites and forums and steal user database information. Some of the gaming news sites (forums, communities, etc) are aware of the breach, however they don't tell their customers. Others might not be aware of the breach, and Chinese hackers may frequently revisit the database due to it's ease of access.

I don't own an Authenticator, but I have multiple WoW accounts. The reason I've never been hacked in 7 years is because I use a unique email address for each WoW account, and I have never re-used the same email account for anything else online. I have over a dozen different email addresses that I use for different purposes, and about 40 other "online identities" that have no interconnectivity. Passwords are never the same either.

If you want to substantially increase the protection of your WoW account right now, register a new GMAIL address right away, create a unique password, and change your WoW email address/login ID to the new GMAIL account. Your WoW account password should also be changed to something unique. And, of course, make sure to scan your PC for key-loggers before starting all of this. 20 minutes of work now will save you days of potential aggravation in the future.

Since most players don't know this, Blizzard needs to force a change in their customer behavior in order to reduce account hacking. After all, it will benefit their customers as well as themselves (in a huge way.)

Here is Jared's solution that can prevent 90% of hacked accounts (from a developer perspective): FORCE PLAYERS TO CHANGE THEIR PASSWORD EVERY MONTH.

Alternatively, Blizzard could "educate" players at the login screen to change their password. Or make it very easy at the login screen to change their password, but gently remind players to change it every 60 days for example. If they were to force players to change all of their passwords right now, they would see a HUGE and immediate impact to the number of hacked accounts.

More people need to get this knowledge across to Blizzard. If there are enough people demanding the change, the more positive impact it will have for at-risk players (and only serves to help Blizzard.) Unless, of course, there's more revenue to be made from simply selling authenticators.

Here we go again..

Nintendo has made the bold statement that the new 3DS is unhackable, foolproof, and that piracy is now a thing of the past.

Where have we heard this before?

Microsoft made the same claim about the original XBOX, however it was broken within a week. Microsoft also said that NTFS and Windows 2000 were uncrackable. Regarding their XBOX 360, they simply said that it would be "as difficult as possible to hack." Smart choice of words.

Infineon's chip was proclaimed to be "unhackable". The Laserlock STAR DRM was also claimed to have been "uncrackable" by the manufacturer.

Did you know that Blizzard once made that "unhackable" claim too? On May 30th, 2000 when speaking about Diablo 2, Blizzard stated that "The game can basically be considered unhackable." =]

The PS3 and PSP have been (historically) described as "unhackable" only by users, and I haven't been able to find any evidence of Sony making the claim themselves. A very wise decision.

In an older post, I stressed that Blizzard was not required by any law to notify users of internal data breaches. Many misinformed players, Blizzard employees and fans used this false information as the logical reasoning and proof as to why Blizzard's internal databases "have never been broken into" or account information stolen.

To be clear: Blizzard (nor any other gaming company) is not required by law to notify anyone of anything.

Here's a little excerpt I wrote at the time:

Now, if something very bad were to happen, then yes - a large announcement would be made.

Well, it just happened with Runes of Magic. =]

Here's a link to the news article.

Basically, a hacker obtained login/personal data from their account database and is now holding the information "hostage" until Frogster/RoM Team changes the "forum communication practices and technical aspects of Runes of Magic operation".

The only reason that the company is releasing this information NOW is because it's been made public and they're being "held hostage." The data breach actually occurred back in 2007 by the way. They sat on this data breach information for 4 years before telling anyone and probably would have continued to do so until the hostage situation was made public.

Still think this hasn't happened anywhere else? It's actually more common then you think, and I'm not just talking video games.

It's sad to see the constant scrambling to fight crackers and improve copy protection measures. The battle has been going on for decades and yet businesses have yet to learn that you can't stop illegal copying. With next-generation copy protection measures come next-generation cracking tools. It's a useless cycle and they're just wasting money trying to find "the next big thing." *cough* StarForce *cough*

Copy protection methods have always used the some old approaches: memory checksums, data/hardware checks, decrypting data after activation, dongles, obfuscated code, activation codes (serial/registration), etc.

But the problem with those approaches is that they're too obvious and right out in the open. Simply put, it's like hitting a brick wall - it's right in front of you, crackers know where it is, and they can start to work away at it. When debugging code, programmers need to know when a process occurs so that they can trace it. They're not going to trace the entire gaming code, it would simply take too much time.

But what if they (or the user) didn't know that there was any copy protection in place? Or when copy protection algorithms were "activated"?

I've always been interested in the more entertaining and creative forms of copy protection out there.

One of my favorites was MOTHER 2 / EarthBound. It had some standard stuff (e.g. data checksums, piracy warnings) of course, but the "pirated ROM" would allow players to play for several hours without the user ever knowing that copy protection schemes were actually still in place. =]

There were so many ROMs out there too, it was hard to tell if you had the "real" cracked version or not. The only way to tell is to play through the game and look for certain signs (if you knew what to look for) or wait for special events to occur during the game (at critical points, generic crash/freezes are caused and all saved games are deleted.)

That's just awesome. =]

This approach is a good example of what you want to take advantage of, but without the piracy warnings (as they stick out) and other obvious "signs" that exist during the beginning of the game. You don't want the cracker or player to know that there's copy protection in place, or what version they're even using.

Recently, Ubisoft incorporated an "amazing new copy protection approach" into the NDS version of "Michael Jackson: The Experience". Illegal copies would show no notes played, the game would freeze when paused, and vuvuzela's would be blasting over the music.

This is actually an old copy protection method, in fact, and it's just another "brick wall" that prevents you from playing right away, and thus making it easier for crackers to detect, trace and disable the copy protection measures.

In that same Wired article about Ubisoft's novel approach, there's a quote by Nintendo President Satoru Iwata: Battling pirates “has been like a game of cat-and-mouse"

If you want to seriously fix this problem, stop being the predictable mouse and stop trying to be the cat.

What you should be is a fucking ninja/pirate hybrid and engage in subtlety, confusion, obscurity, dirty tricks, and deception. Is this really a battle, or just a game?

So, here's my recommendation for developers/publishers (using a RPG as an example):

Part 1

- Announce that the game will not have an annoying DRM, no activation will be required, that it doesn't need to be online all the time to play, etc. There's no need to make a big deal about this either.
- Alteratively, you could put standard copy protection in place, announce that there's copy protection but ensure that you don't pay too much for it as it's really just a red herring so that crackers bypass it and release their pirated version. Going the copy protection route will come in handy later actually however, but this will make more sense in Part 3.
- You want players to be on your side, not supporting pirates.
- Realize that there's no point in DRM - it will just be broken on the first day. Instead, focus on making a great game since that's where the majority of your revenue will come from.
- Keep the retail cost of the game low.
- Talk to people who do pirate your game, work with them to make your game better, get them involved in your game and future games. If they're involved in the project, they'll support you and probably buy all of your future games. Especially if they know you personally.

Part 2

- Over half the battle is controlling information and perception.
- Release several different versions of the "pirated version" on torrent websites (and P2P/FTP/etc) under various real, independent or anonymous group names. Use a private VPN, get randomized source IPs going.
- Those pirated versions should be crippled out right, or simply stop functioning early in the game (freezing/crashes). These would be special pre-fabricated versions of the game (ie, not the full game.)
- Spread false information on forums/websites that you've heard reports of these pirated versions containing a new type of virus, can damage your PC, have keyloggers that target MMORPG's, etc. (Game publishers already send out these types of warnings for pirated games in general already anyways.)
- Keep in mind that most players who pirate aren't technically savvy, and they'll just download the first game/MP3 they see (or download multiple copies if they're not sure.) Help them waste their bandwidth, would be nice too if they're capped on a monthly basis.
- Fill up torrents and forum posts with so much misinformation (even good old "it's being tracked by the FBI"), that you'll discourage users from downloading the game or they'll want to wait.
- If the game is amazing and highly sought after, many will just go out and buy the game rather than taking the risk of downloading the "dangerous pirated copy" or wasting more bandwidth.
- Since you'll have a lot of time to prepare, your outsourced employees (ie, plants) can build up a trusted name for themselves on various forums or release websites.

Part 3

Okay, this is where things get interesting.

- The real game will be investigated/cracked by various groups, they will test play it (not a FULL play through mind you), and then release it quickly (they might be in competition with other cracking groups, sometimes the programmers are lazy, they believe that it was cracked successfully, etc.)
- You don't want your hidden DRM measures to take effect early in the game. Instead, wait until the player is nice and comfortable first before you hit them with it. When it happens, it won't be obvious either. (Much like EarthBound, players didn't even know that they were using the "bait" pirated ROM until it was too late.)
- After an hour or two of playing (or longer/keep it random), reward the player with an epic item drop for example, and then "crash" the game shortly afterwords. Save games should get corrupted in the process too.
- You don't want the player to be angry at your game or the developer, you want to instead redirect their rage to someone else. The game should be rewarding the player, but when things go wrong - blame the pirated copy.
- When the game crashes, it should be a standard Windows error page casting blame on "RZR1911.DLL" or "CRACK.DLL". That's an excellent way to convince players that the crack was responsible for the crash and their loss of time.. it wasn't poor coding in the game.
- Also incorporate other random crashes with unique error codes, so that when they (Google) search the message they're brought to a forum that explains that only pirated versions cause those crashes and that they don't occur with retail versions. Also explain the dangers to their PC from using this specific pirated game.
- You want to start causing doubt in the user's mind and these pirated copies should be scaring players.. "is this really safe to run on my PC?" Random exception faults, fake freezes, BSOD's, driver failures, corrupted save files, reinstalls required - this is all because by the cracking groups.. it can't possibly be something that's built into the software as a form of copy protection. =]
- Of course, cracking groups will start releasing "updates" to fix the issue. But you should be doing the same. Also, since they don't know where the copy protection begins and ends, they will be releasing crack-fix upon crack-fix upon crack-fix once they are discovered.
- There's going to be so much misinformation out there, players won't be able to tell whether they have the real version or not. The anticipation alone of having to play for 3 hours, then having a random crash (and lost saved games) is not worth the amount of stress. You want players to mistrust the pirate community, not the game developer. (Yes - I understand the irony of it all. But this is war, irony be damned.)
- These groups might also start making news announcements about this type of copy protection - but the damage will have been already done. Most of the downloaders rarely read these news items on their official pages anyways. As the game developer you can simply state that their "band aid solutions" and "poor skills" are responsible for the current state of the game and that it's ruining the experience for players (and hence should buy the real game and avoid the inferior or possible infected pirated versions). =]
- At later stages of the game (ie, points where it's been patched by cracking groups), you could start taking different approaches - like checks, changes to difficulty, invisible changes to player stats, random boss cheats (e.g sudden smack down), etc.

Basically, stop making it easy for crackers - make them seriously work for it using means that they're not used to. They've been spoiled for far too long.

While they're hard at work creating countermeasures, you'll be gathering more "converts".

And instead of trying to find the next "best" form of DRM, just start using a little conditioned response, some psychology, control of information, red herrings and confusion (keep the crackers busy), and putting your DRM out in the open. No one should even know if there's any copy protection in place. Let players get into the game after a couple hours first (consider it a demo) as that's where it will hurt them the most. But, make sure they blame someone else and not the game.

Just a thought.

* UPDATE (02/15/2011):

So, someone on Reddit just discovered those clever copy protection methods in EarthBound, which brought up a little conversation on other games doing the same.

I didn't even know about these, but they were pretty cool to read and confirmed just how effective this kind of DRM is.

Here's an interesting article on Spyro the Dragon 3. Get this: it took 2 months to crack fully. =]

The Spyro copy protection methods took place after playing for long periods of time, and the crackers kept assuming that they removed the DRM each time. However, the glitches and piracy warnings were made obvious to the user - so the crackers knew WHEN (well.. where) to remove the DRM. Imagine if they never knew when/where to remove the DRM though? (Like what I've been talking about.) =]

The trick is to make random and undetectable copy protection, and play with their heads a little bit.

Another cool (more recent) one is Batman: Arkham Asylum. When the main copy protection was removed, there was still a small tweak made - pirated copies would not allow Batman to fly/glide, making the game impossible to progress.

I'm surprised developers don't do this more often.