When playing online it does. It could send it to the host robot, which could be spoofing the name of a reliable host robot source.
Is it deleted from memory? Normal memory allocation does not zero out deallocated memory to save time, after all it is correct programming practice to initialize all memory upon allocation anyway. Since the deallocated memory might still be mixed with in use pages it is possible that it still can be read by the application without causing a memory access exception. Once read it could be relayed to a host robot for being stored and stolen.
With C++ when dealing with passwords or other sensitive information you are meant to zero the buffers out upon deallocation to make sure they leave no footprint in the memory for people to read. Java and languages with similar memory model should not suffer from such a problem as arbitrary memory reading is not permitted by the language and is considered a critical security exploit so patched ASAP.
I see why your name is "Dr. Super Good". You really like to be the politically correct guy.
Well, I can't say that your arguments are wrong. If something like the Java VM, that is used by millions of applications worldwide, had a vulnerability that allowed memory reading, it would surely be a critical issue that would have to be patched immediately.
But this is not the Java VM. This is fucking Warcraft III. A 15-year old game, played by "almost nobody", if you compare it with other popular games, and even with itself in the past. A game with a very old and limited engine, and when someone finds a way to remove a small bit of those limitations, we even have to hear people complaining about safety.
Man, seriously, DO YOU REALLY THINK SOMEONE WILL TAKE THE JOB TO MAKE A MAP JUST TO STEAL CD KEYS? IN 2K17? First, it may probably not be possible at all. I'm not gonna take my time to research about this, and I'm pretty sure no one will. Second, it will certainly not be trivial, it may possibly be in a dynamically allocated memory area instead of a fixed address, and that would require scanning the memory for patterns in order to find it, which will probably crash the game before finding valid data, since Jass VM has no exception handling.
And third, if we ignore all these obstacles, WHO IS GONNA TAKE THIS JOB JUST TO STEAL USER'S CD KEYS? Warcraft III is so fucking cheap, and we even have random CD Key generator in the web, of course those keys don't work in bnet, but there are plenty of other places to play WC3 online.
The amount of security in an application is proportional to its size, a game like WC3 doesn't need as much security as something big like Java, especially when these "security measures" will take away useful features from the game, something WE REALLY DON'T NEED considering how limited the engine is already.
When the original Memory hack was released (the full version with write access), the community has been split in two. Those that wanted to use that power for map development, and those that saw it as a critical issue that should be patched. After it got patched by 1.27b, the community has been split once again: those that are happy with read-only access, and those who still think we should go back to the no-returnbug era.
So now there are basically 3 groups in the WC3 community around the world:
- The group that wants to stay on older patches, because they don't fucking care about new patches that bring more harm than good. Most of this group uses 3rd party addons for WC3, like W3Arena, iccup, and the chinese dota that uses Lua engine, so they don't need Blizzard to do their shit for them. This group also includes the new generation of maps that use the full Memhack, like DracoL1ch's Dota.
- The group that wants to stay on the latest patches and play a safe game, but also want some new cool features that Blizzard has never given us, and probably never will. The read-only memhack is targeted at this group
- The "Dr Super Good" group.
I don't need to say that splitting the player base brings no good for the life of WC3. Blizzard has just forgotten about WC3 for years, and people didn't want to wait for them so they made 3rd party addons. Now these new patches are fucking with these addons, and they are giving nothing in exchange.
If read-only memhack is removed there will be again a community split, as the mapmakers that are using it and their playerbase will simply stop updating. They might even migrate back to 1.26 since it's quite stable and gives the full power of memhack.
There's no logical reason to take this decision. Fixing the write exploit was a necessity because it allowed arbitrary code execution. But the read-only mode allows to do what? Stealing CD Keys? Really, removing the ability to read memory, without giving anything in exchange (and what could possibly replace this power?), is nothing but bad for everyone.
Btw, I just had a glimpse: why not implement a "safe-mode" of memory hack? I mean, an option where the player could explicitly give permission for a map to access the memory? We could have something like a "Trusted" folder inside the maps folder, and only maps manually placed on this folder by the player will have special privileges. This way a player could download their favorite map from a trusted source and play with the full power of memhack without worrying about security. Maps downloaded via bnet will never go into this folder of course. And if you want more safety they could even display a message to the user before running a map from the "trusted" folder.