www.Tobold.com
Tobold@GMail.com
A blog with my thoughts regarding games I am playing and other stuff in life. Please read my Terms of Service
RSS Feed
Wednesday, May 07, 2008
Account hacked in WoW
Not mine, fortunately, but our guild master's account in World of Warcraft got hacked, and the hacker then proceeded to empty our guild bank of 10K+ of gold and all items. Ouch! The matter is under investigation by Blizzard, but there is a chance that our guild leader will get his character back, but not the content of the guild bank. But what interested me most in this story is the question of how the hacker got our guild master's account name and password.
If you use capital letters, small letters, and numbers, you have a selection of 62 different characters. If your password is lets say 8 characters long, there are 62^5 or 218 trillion different combinations. If somebody had software to test all these combinations one by one, at 1 second per combo, he'd still need 7 million years to test them all. So brute force is probably not a viable way to hack a WoW password.
Things get a lot easier for the hacker if you use a weak password. I once met a guy in Everquest, who told me he had been hacked. After grilling him on how that could be possible, he admitted that his account name, his password, and his main character's name were all the same. Doh! Other weak passwords are "password" and all names. While brute force programs don't work, a program that just tests the 1,000 most popular weak passwords will probably be able to hack into quite a large number of WoW accounts. Hands up everyone who used the name of his girlfriend as password!
One other possible weakness is people using the same password for many different sites. How sure can you be about how safe your username and password is on some random internet forum? And if you use the same username and password for WoW or other important sites, it is the safety of the weakest site that can compromise all other applications.
So on my guild forums there is currently discussion about using software like KeePass, which generates very strong passwords for all of your different applications, and stores them on your hard drive in encrypted form. I'm not a fan. I want to be able to access things like Blogger even from some internet café, so having a password I can't memorize and which is stored at home isn't highly useful to me. And I had enough hard disk crashes in my life to dread the idea I might lose all my passwords in one such crash. I mean, who really does regular backups of his encrypted KeePass database? I prefer well-known techniques to create and memorize strong passwords. And I'm using a completely un-hackable storage system for passwords: pen and paper. I could theoretically be burgled and my password list stolen, but what are the chances of that? Most probably the burglar will take the computer and the stereo, and leave the paper behind.
If you have a strong password, you might still fall victim to a trojan or keylogger. Various WoW-related sites have been infected with those in the recent past. Your best defense against these are the various (and often free for personal use) anti-virus programs available. I'm using Avira AntiVir, which is free, and only nags you about buying a better version every time is updates. Funnily I found that paid-for antivirus software annoys me a lot more often, and is often so over the edge that it prevents you from playing online games in the first place unless you fiddle with complicated controls. Firewalls can also help to some extent. Microsoft having a bad image, people will often advise you to increase your safety by switching from Internet Explorer to another browser, like Firefox. 52% of the visitors of this blog use a Firefox browser, and only 40% some version of IE. So I wouldn't count on Firefox being less targeted by malicious software than IE forever, some people even claim that Firefox has more vulnerabilities. Either use some really exotic browser, or use a well-known browser and update it regularly.
At the end I'd like to discuss one major vulnerability: stupidity. Some people lose their passwords because they fell for some phishing attempt. A popular one for WoW offers you a spot in the Wrath of the Lich King beta, and directs you to a site where you have to enter your username and password to "register" for that beta. Only that the site is a fake, and somebody will soon use the data you so easily gave away to rob your account. In a similar vein a lot of people share their userid and password with friends, family, or guild mates. That isn't safe at all. Sharing passwords with your guild so that somebody else can play your raid healer when you are away is not a good idea. How often do guilds turn sour, and then somebody you pissed off could easily disenchant all your epics and mail all your valuables to his account. Or your spouse could have finally enough of you never having time for her and delete you character. Or your little brother could use your password on a friends computer to show him your epic character, but the friend has a keylogger installed. The more people know your password, the less secure your account is.
Probably the biggest disadvantage of RMT (gold selling) is the secondary effect that it puts a dollar value on your account. Whoever hacked our guild bank got away with hundreds of dollars, and is pretty much completely safe from prosecution. Worst that can happen to him is to get his account banned, at which point he simply opens the next one for a fraction of money he hauled in by robbing us. It is that monetary interest that makes modern hackers so much more dangerous than the just-for-fun kind of earlier ages. Your account might be worth some serious money, and thus you should think of protecting it better. How strong is your password and your protection from trojans and WoW keyloggers?
- posted by Tobold @ 11:55 AM Permanent Link
Comments:
If you have a strong password, you might still fall victim to a trojan or keylogger. Various WoW-related sites have been infected with those in the recent past.
This is the main reason that I won't use any mods. There's no way to verify that they aren't Trojans.
<< Home
Newer› ‹Older
If you have a strong password, you might still fall victim to a trojan or keylogger. Various WoW-related sites have been infected with those in the recent past.
This is the main reason that I won't use any mods. There's no way to verify that they aren't Trojans.
# posted by 
: 7/5/08 14:28
: 7/5/08 14:28
For real security you get firefox with two addons: noscript and adblock plus. Those two addons are the real reason firefox is touted as being safer than internet explorer.
Adblock plus completely blocks banners from all sites. Of course websites hate it because that is their revenue, but when you can't trust banner ads what are you to do?
Noscript analyzes any scripts that will run on a site and any that appear suspect it will simply block. You have to (quite easily) enable scripts on sites that you care about (such as our bank site). It's a bit of a learning curve, but if it means i keep my 10k gold and items it's worth it to me.
I think the majority of the latest hacked accounts fell for that WOTLK beta page. It was done well, and depending on who led you there (maybe a friend sent it to you) you might not even realize it's fake. I tend to err on the side of caution: if it doesn't say worlDofwarcraft.com in the beginning of the URL then i stay far away from it.
Adblock plus completely blocks banners from all sites. Of course websites hate it because that is their revenue, but when you can't trust banner ads what are you to do?
Noscript analyzes any scripts that will run on a site and any that appear suspect it will simply block. You have to (quite easily) enable scripts on sites that you care about (such as our bank site). It's a bit of a learning curve, but if it means i keep my 10k gold and items it's worth it to me.
I think the majority of the latest hacked accounts fell for that WOTLK beta page. It was done well, and depending on who led you there (maybe a friend sent it to you) you might not even realize it's fake. I tend to err on the side of caution: if it doesn't say worlDofwarcraft.com in the beginning of the URL then i stay far away from it.
# posted by : 7/5/08 14:29
: 7/5/08 14:29
I was relatively recently hacked. I used firefox, the no script add on, don't download anything dodgy, visit only the most well known WoW sites occasionally, had AV software and virus scanned regularly. I've never bought gold, and I've never disclosed my password. My password is a strong password, and is not the name of my character, nor was it shared amongst multiple sites.
Didn't stop me getting hacked.
I'm actually grateful in a way that the hacker only seemed to be after my WoW account, I would honestly never have found it otherwise. I scanned with multiple scanners, anti-spyware, anti-virus, the works. All found nothing.
Eventually I resorted to the old-school technique of logging all harddrive activity and shutting down absolutely everything unnecessarily. Every 2nd or 3rd WoW login attempt, without fail, coincided with a write to an image file (the one I was using as my account photo), copied and stored in my temp files. It had no reason to be there. If I deleted it, it was recreated every few WoW login attempts.
Basically, I had a super-stealthy keylogger that was capturing my WoW password every few login attempts, storing it in an image file in my internet temporary files, and every once in a while sending it back to home base.
Once I found that I just called it quits, and format C:\ on both my machines.
The moral of the story, you can do everything you are supposed to do, and not do anything untoward, and STILL get hacked.
Didn't stop me getting hacked.
I'm actually grateful in a way that the hacker only seemed to be after my WoW account, I would honestly never have found it otherwise. I scanned with multiple scanners, anti-spyware, anti-virus, the works. All found nothing.
Eventually I resorted to the old-school technique of logging all harddrive activity and shutting down absolutely everything unnecessarily. Every 2nd or 3rd WoW login attempt, without fail, coincided with a write to an image file (the one I was using as my account photo), copied and stored in my temp files. It had no reason to be there. If I deleted it, it was recreated every few WoW login attempts.
Basically, I had a super-stealthy keylogger that was capturing my WoW password every few login attempts, storing it in an image file in my internet temporary files, and every once in a while sending it back to home base.
Once I found that I just called it quits, and format C:\ on both my machines.
The moral of the story, you can do everything you are supposed to do, and not do anything untoward, and STILL get hacked.
"This is the main reason that I won't use any mods. There's no way to verify that they aren't Trojans."
Some xml, toc and lua files in the Addons folder that were unzipped are not going to be Trojans. WoW doesn't load any of those files until after you are already logged in.
The only reason people get trojans when doing mods is they run an executable that is claiming to be a mod. If you simply avoid all executables and only use mods that are zipped you are safe. The only mod i have ever encountered that was an executable was Cosmos, and due to being anal i avoided it just in case.
My addons folder has 92 sub-folders, probably roughly 60 mods, and I haven't had any trojan problems. Plus, as the post indicates, anti-virus software takes care of most trojan problems before they are a problem.
Some xml, toc and lua files in the Addons folder that were unzipped are not going to be Trojans. WoW doesn't load any of those files until after you are already logged in.
The only reason people get trojans when doing mods is they run an executable that is claiming to be a mod. If you simply avoid all executables and only use mods that are zipped you are safe. The only mod i have ever encountered that was an executable was Cosmos, and due to being anal i avoided it just in case.
My addons folder has 92 sub-folders, probably roughly 60 mods, and I haven't had any trojan problems. Plus, as the post indicates, anti-virus software takes care of most trojan problems before they are a problem.
# posted by : 7/5/08 14:33
: 7/5/08 14:33
This is the main reason that I won't use any mods. There's no way to verify that they aren't Trojans.
There are ways.
The most important thing is to know what a WoW addon is. WoW addons are made with a programming language called LUA, which is designed by Blizzard, can only do what Blizzard wants, and can only run in a very strictly regulated sandbox environment inside WoW.
Addons cannot modify files other than their own SavedVariables.lua, and even that is done via WoW at logoff. This means that whatever you put in an addon, at worst it'll soil it's own pants. It cannot run binary code. It cannot infect anything. It cannot install a keylogger. It cannot send spam.
However, there's still one weakness that remains ready to be exploited: You. The addon author can put binary code inside a zip file and tell you to extract and run it. And that code can do whatever you can do. And no matter what additional protections Blizzard adds to WoW, they cannot fix that security "hole".
There are ways.
The most important thing is to know what a WoW addon is. WoW addons are made with a programming language called LUA, which is designed by Blizzard, can only do what Blizzard wants, and can only run in a very strictly regulated sandbox environment inside WoW.
Addons cannot modify files other than their own SavedVariables.lua, and even that is done via WoW at logoff. This means that whatever you put in an addon, at worst it'll soil it's own pants. It cannot run binary code. It cannot infect anything. It cannot install a keylogger. It cannot send spam.
However, there's still one weakness that remains ready to be exploited: You. The addon author can put binary code inside a zip file and tell you to extract and run it. And that code can do whatever you can do. And no matter what additional protections Blizzard adds to WoW, they cannot fix that security "hole".
The best part about Blizzard passwords is that they are case insensitive. Go security!
# posted by : 7/5/08 15:00
: 7/5/08 15:00
LUA was not designed nor created by Blizzard.
http://en.wikipedia.org/wiki/Lua_%28programming_language%29
http://en.wikipedia.org/wiki/Lua_%28programming_language%29
LUA was not designed nor created by Blizzard.
I stand corrected. However, my original point still stands. Blizzard controls the sandbox. An addon can only do what Blizzard allows it to do.
I stand corrected. However, my original point still stands. Blizzard controls the sandbox. An addon can only do what Blizzard allows it to do.
I use Keepass Portable. I keep it on my thumb drive. Which is on my keychain, so it is always with me.
Considering the vast numbers of forums, online games, online shopping, online banking, paypal, work accounts, photobuckets, etc, I feel it's a requirement for me.
I'd thought about using the 'easily memorizable hard passwords' method, but again, with so many that i'd need, I didn't want to deal with the hassle. PortableApps makes it easy to backup the content of my thumb drive to my work and home systems, so a forgotten drive doesn't strand me with no password file.
Considering the vast numbers of forums, online games, online shopping, online banking, paypal, work accounts, photobuckets, etc, I feel it's a requirement for me.
I'd thought about using the 'easily memorizable hard passwords' method, but again, with so many that i'd need, I didn't want to deal with the hassle. PortableApps makes it easy to backup the content of my thumb drive to my work and home systems, so a forgotten drive doesn't strand me with no password file.
This is probably a great post for gamers. Those of us who've been in corporate It have known for years that the weakest link is always the person. In fact I read an article a year or so ago that said organized crime didn't even try to hack bank systems anymore. That is was easier and more profitable to get people on the inside or blackmail current employees to do the theft.
But It's a problem. You need hard passwords that are difficult to figure out. But you have to remember them. On top of that you really should change them periodically. But even if everyone does that. It's been shown over and over again that most people get compromised by friends, or family, or by downloading software from some site. You'd think the software downloads would be the biggest culprit but It's the friends and family that do an incredible amount of identity theft. Not surprising really. They are the ones that have the access.
But It's a problem. You need hard passwords that are difficult to figure out. But you have to remember them. On top of that you really should change them periodically. But even if everyone does that. It's been shown over and over again that most people get compromised by friends, or family, or by downloading software from some site. You'd think the software downloads would be the biggest culprit but It's the friends and family that do an incredible amount of identity theft. Not surprising really. They are the ones that have the access.
One of the most common ways accounts are "hacked" is because the person simply gives out his password to a close friend, girlfriend or guild member. Sometimes they need to finish a raid and you have to log, or your girlfriend wants to try your class.
Once the password has been given to one person, it is gone and you will never know how many people have it. I can't list the number of times I've heard that someone breaks up with his girlfriend only to find his account stripped. Guild accounts are even more vulnerable since there are many reasons you would want to give the password to someone else, just for convenience.
I wouldn't be surprised if it turns out more than one person knew the password for your guild leader's account.
Sammy
Once the password has been given to one person, it is gone and you will never know how many people have it. I can't list the number of times I've heard that someone breaks up with his girlfriend only to find his account stripped. Guild accounts are even more vulnerable since there are many reasons you would want to give the password to someone else, just for convenience.
I wouldn't be surprised if it turns out more than one person knew the password for your guild leader's account.
Sammy
# posted by : 7/5/08 16:06
: 7/5/08 16:06
A couple notes:
NoScript addon for Firefox is great, but for the average user, they will just be enabling scripts on every webpage they visit anyways, so it becomes almost useless. When websites like WoWHead get hit, NoScript is not going to save you, because chances are the website's scripts are not blocked.
Good news though, if you are a bit tech savvy and don't mind managing NoScript's filters, you can be relatively safe. It just takes some time to figure out the good sites from the bad.
There is actually a simple defense against the most common WoW keyloggers. Dual boot your machine with Linux and WINE. WoW is the rare gem of a game that is played from its files, not an install. You can boot to Linux and play WoW from its folder on your Windows drive. Obviously, this isn't for everyone, but if you have the Linux know-how, PLAY WOW FROM A LINUX DUAL BOOT with SELinux (Cent OS, Red Hat) in ENFORCING.
AddOns, from most major UI sites, are scanned upon upload and download. Also, several installers and updaters from bigger sites (Ace2, Curse) scan a third time upon install. Plus, you can scan these files yourself before un-compressing them. Just be smart enough to only download from legit sites that take the time to scan what they distribute. Don't ever be afraid to report to Blizzard any questionable websites.
The truth of the matter is that the majority of keyloggers come from drive-by websites and stupid downloads, onto computers that are not setup properly to defend against operator error. I've found, in years of helping people with computers, that it is almost 100% of the time, questionable surfing habits and stupid downloads (porn and torrents for example).
On that note: The Pirate Bay is not a trustworthy site, no matter how much BS they spout about removing virus infected uploads.
NoScript addon for Firefox is great, but for the average user, they will just be enabling scripts on every webpage they visit anyways, so it becomes almost useless. When websites like WoWHead get hit, NoScript is not going to save you, because chances are the website's scripts are not blocked.
Good news though, if you are a bit tech savvy and don't mind managing NoScript's filters, you can be relatively safe. It just takes some time to figure out the good sites from the bad.
There is actually a simple defense against the most common WoW keyloggers. Dual boot your machine with Linux and WINE. WoW is the rare gem of a game that is played from its files, not an install. You can boot to Linux and play WoW from its folder on your Windows drive. Obviously, this isn't for everyone, but if you have the Linux know-how, PLAY WOW FROM A LINUX DUAL BOOT with SELinux (Cent OS, Red Hat) in ENFORCING.
AddOns, from most major UI sites, are scanned upon upload and download. Also, several installers and updaters from bigger sites (Ace2, Curse) scan a third time upon install. Plus, you can scan these files yourself before un-compressing them. Just be smart enough to only download from legit sites that take the time to scan what they distribute. Don't ever be afraid to report to Blizzard any questionable websites.
The truth of the matter is that the majority of keyloggers come from drive-by websites and stupid downloads, onto computers that are not setup properly to defend against operator error. I've found, in years of helping people with computers, that it is almost 100% of the time, questionable surfing habits and stupid downloads (porn and torrents for example).
On that note: The Pirate Bay is not a trustworthy site, no matter how much BS they spout about removing virus infected uploads.
NoScript isn't limited to Firefox, you can set Internet Explorer to not execute scripts. I'm doing that in spite of getting a warning every time I use the Blogger script to create a hyperlink.
Oh, and I failed to mention that giving your password to a powerleveling company isn't very clever either. If you really wanted a character to be powerleveled (which I find pretty pointless), you should do that on an extra account, and then move the character to your main account as soon as you got him back.
Oh, and I failed to mention that giving your password to a powerleveling company isn't very clever either. If you really wanted a character to be powerleveled (which I find pretty pointless), you should do that on an extra account, and then move the character to your main account as soon as you got him back.
Dictionary attacks seem highly improbable, because (presumably) the servers will only allow n failed login attempts for an account per period of time. Furthermore, account names aren't published anywhere (that I know of).
It's certainly possible for a dictionary attack to succeed, but the odds are against it unless you have a common (or commonly known) login name and a weak password. Choose something better than "gandalf/password" and you're reasonably safe.
Keyloggers are also unlikely. They certainly do exist, but if somebody has a keylogger on your system, is your WoW login really what they're looking for? Compared to free reign on your credit cards or taking out a loan using your social security number, a few hundred dollars worth of WoW lewt is small potatoes.
Again, I don't mean to imply that this never happens, but I doubt many script kiddies are specifically looking for WoW account info, and if you have a keylogger on your box you've got bigger concerns anyway.
As you might have guessed, I feel like a vast majority of stolen account stories are the result of social engineering. As Sammy mentioned above, the second you hand out your login information - it doesn't matter to whom - it's in the wild, and you no longer control it.
I also imagine that a non-trivial number of "hacks" are actually scams, perpetuated by the person claiming to have been hacked. Have a friend across the country log in to your account from his neighbor's wifi, sell off everything, claim that you're hacked. It's virtually untraceable, and an easy way to make a buck.
It's certainly possible for a dictionary attack to succeed, but the odds are against it unless you have a common (or commonly known) login name and a weak password. Choose something better than "gandalf/password" and you're reasonably safe.
Keyloggers are also unlikely. They certainly do exist, but if somebody has a keylogger on your system, is your WoW login really what they're looking for? Compared to free reign on your credit cards or taking out a loan using your social security number, a few hundred dollars worth of WoW lewt is small potatoes.
Again, I don't mean to imply that this never happens, but I doubt many script kiddies are specifically looking for WoW account info, and if you have a keylogger on your box you've got bigger concerns anyway.
As you might have guessed, I feel like a vast majority of stolen account stories are the result of social engineering. As Sammy mentioned above, the second you hand out your login information - it doesn't matter to whom - it's in the wild, and you no longer control it.
I also imagine that a non-trivial number of "hacks" are actually scams, perpetuated by the person claiming to have been hacked. Have a friend across the country log in to your account from his neighbor's wifi, sell off everything, claim that you're hacked. It's virtually untraceable, and an easy way to make a buck.
capital letters, small letters - they don't matter. You can set the password "RoXXor" and type in "roxxor" - it will be accepted.
# posted by : 7/5/08 16:52
: 7/5/08 16:52
One pet peeve of mine is that people keep talking about passwords. Most of the software out there (including WoW) accept long passphrases. There's no technical need to limit your passwords to 8 characters of gibberish you're never going to remember anyway.
I find it hard to believe that people are brute forcing WoW accounts, but I guess if you leave your account name out on the Internet somewhere, you might as well assume that given enough time you will be hacked.
If you never share your account name, browse wisely, and take good care of your machine, you should be safe. A strong password is nice, but obviously won't help you if you get keylogged. I would focus more on keeping software off of your machine and not being foolish.
If you never share your account name, browse wisely, and take good care of your machine, you should be safe. A strong password is nice, but obviously won't help you if you get keylogged. I would focus more on keeping software off of your machine and not being foolish.
# posted by : 7/5/08 17:02
: 7/5/08 17:02
WoW accounts aren't "hacked" in the common sense. Passwords are not guessed, nor are they brute-forced.
99.9% of people with "hacked" WoW accounts did one of these two things:
1) Gave his password to someone, whether it's a trusted person or a scam of some kind. Once someone else has the password, anything goes, such as the trusted person repeating this step or #2...
2) Picked up a keylogger, whether browsing himself or from some other person using the computer and being careless with installing things.
That's it. The first one is very easy to prevent, the second one is slightly easier, but can be difficult in a household with a shared computer.
People who get victimized will always disavow both because, hey, it looks stupid. But it's almost always the truth.
Password strength does not enter into it.
99.9% of people with "hacked" WoW accounts did one of these two things:
1) Gave his password to someone, whether it's a trusted person or a scam of some kind. Once someone else has the password, anything goes, such as the trusted person repeating this step or #2...
2) Picked up a keylogger, whether browsing himself or from some other person using the computer and being careless with installing things.
That's it. The first one is very easy to prevent, the second one is slightly easier, but can be difficult in a household with a shared computer.
People who get victimized will always disavow both because, hey, it looks stupid. But it's almost always the truth.
Password strength does not enter into it.
# posted by : 7/5/08 17:11
: 7/5/08 17:11
If your GM's account was compromised, there is a reasonable chance you will get your guildbank. he will have to petition about it as a followup to his character being restored.
That is what I was told by multiple GMs when an officer stole my guild's bank recently. (Sadly for us, he wasn't hacked, just a jerk).
That is what I was told by multiple GMs when an officer stole my guild's bank recently. (Sadly for us, he wasn't hacked, just a jerk).
# posted by : 7/5/08 17:11
: 7/5/08 17:11
I let my 7-year old son play WoW on my account. The UserName is saved to automatically appear so he just has to type in the password.
Not too long ago we visited my in-laws and when we knocked on the door the FIL called out, "What's the password?"
You can imagine my shock when my son yelled back my WoW login password, at which point the FIL opened the door for us.
I have a new password now, and if my son wants to play WoW either my wife or I type the password in for him.
I also run Firefox with AdBlock and NoScript, and only temporarily allow scripts to be run on all but a select few sites. Of course that won't help me if I visit WoWHead or Thotbott or Allakhazam and allow scripts on the day they've been hacked.
Not too long ago we visited my in-laws and when we knocked on the door the FIL called out, "What's the password?"
You can imagine my shock when my son yelled back my WoW login password, at which point the FIL opened the door for us.
I have a new password now, and if my son wants to play WoW either my wife or I type the password in for him.
I also run Firefox with AdBlock and NoScript, and only temporarily allow scripts to be run on all but a select few sites. Of course that won't help me if I visit WoWHead or Thotbott or Allakhazam and allow scripts on the day they've been hacked.
Yes, you get your guildbank back if the account was compromised. It happened to us and we got everything back.
We got hacked by a link posted in our public section of the forums, it exploited a hole in internet explorer and within minutes some peoples accounts were being stripped of everything.
Everything was returned eventually by blizzard.
Another guild on the server didn't get anything back, it turned out their gm had just ripped everything for himself and staged the whole thing.
We got hacked by a link posted in our public section of the forums, it exploited a hole in internet explorer and within minutes some peoples accounts were being stripped of everything.
Everything was returned eventually by blizzard.
Another guild on the server didn't get anything back, it turned out their gm had just ripped everything for himself and staged the whole thing.
# posted by : 7/5/08 17:23
: 7/5/08 17:23
I am a big fan of Keypass, if only because it saves me the hassle of remembering all those passwords. Mind you I carry a copy around with me on a memory stick which admittedly is a security risk. I use one uber password to get into keypass but if ever anyone stole my memory stick and cracked that uber password they would literally own me.
it turned out their gm had just ripped everything for himself and staged the whole thing.
The cynical side of me does wonder just how many cases of guild masters or officers getting hacked and having the guild bank drained are legit, or are a case of someone being a complete asshat. Finally realizing (maybe from GM confirmation or whatever) that the guild got good and screwed must be one of those moments where you want to stick a pencil through both eyes and scream bloody murder.
The cynical side of me does wonder just how many cases of guild masters or officers getting hacked and having the guild bank drained are legit, or are a case of someone being a complete asshat. Finally realizing (maybe from GM confirmation or whatever) that the guild got good and screwed must be one of those moments where you want to stick a pencil through both eyes and scream bloody murder.
# posted by : 7/5/08 18:18
: 7/5/08 18:18
Take a look at any of the AV vendors "new threat" lists. A large percentage of new trojans are specifically designed to keylog mmo game accounts.
It is a super easy and most importantly, low risk way of turning your hacking activities into real dollars through RMT. It's a volume business, liquidating many accounts to make a modest profit.
Going after bank accounts is too risky as they don't tend to take that sort of thing lightly... law enforcement gets involved. Blizzard just shrugs their shoulders, bans a couple of accounts, and recreates the victims characters, items, and even gold in most cases. It's practically a victimless crime in the perpetrators eyes.
It is a super easy and most importantly, low risk way of turning your hacking activities into real dollars through RMT. It's a volume business, liquidating many accounts to make a modest profit.
Going after bank accounts is too risky as they don't tend to take that sort of thing lightly... law enforcement gets involved. Blizzard just shrugs their shoulders, bans a couple of accounts, and recreates the victims characters, items, and even gold in most cases. It's practically a victimless crime in the perpetrators eyes.
# posted by : 7/5/08 18:31
: 7/5/08 18:31
Well I got hacked and my main toon was deleted. Gone. Poof. Blizz was very good about restoring the toon minus the enchants. The biggest thing that sucked is that this was way back when you can have only one in enchanting and disenchant everything, so I lost all my tradeskills for my toons for one enchanting. Which I thought blizz should of restored but it didn't. Luckily I had a very supportive guild that helped as well. I was really glad to get my main toon back too.
From then on I used letters, numbers. I limit my mods to only essential for raiding. I avoid questionable links like the plague.
As for the guild bank, blizz should restore that as well. Which is a shame.
You could verify if the GM stole your crap, look at the armory and see if he's still there, what kind of gear he has on.
Well my heart goes out to your GM, I been there.
From then on I used letters, numbers. I limit my mods to only essential for raiding. I avoid questionable links like the plague.
As for the guild bank, blizz should restore that as well. Which is a shame.
You could verify if the GM stole your crap, look at the armory and see if he's still there, what kind of gear he has on.
Well my heart goes out to your GM, I been there.
# posted by : 7/5/08 18:32
: 7/5/08 18:32
keypass and other similar programs are best used if you carry around a little USB drive, and backup the password file at home. I know a couple people that carry drives like that, and use "portable apps" (portableapps.com is one site) as well (running apps off the flash drive) so no matter where they are they have not only data they need but a small suite of apps, not Office of course.
"Keyloggers are also unlikely. They certainly do exist, but if somebody has a keylogger on your system, is your WoW login really what they're looking for?"
Sorry to burst your bubble, but a recent report showed that 20% of trojans are aimed at WoW, only beaten by 40% aimed at Lineage 2. ( http://www.mmoglory.com/trojans-a-threat-to-online-gaming-22.html )
A WoW account is worth thousands of dollars if it has good characters and access to tons of gold/supplies. And that is just counting the items, gold, etc. that the hacker guts from the account. Tack on the money they will make through using the account as a spam bot and gold filtering service and its evident that your WoW account is pure money.
To compare, your social security number is worth maybe a hundred bucks on line. Your credit card number? Lucky to get fifty bucks out of it.
On another note; a lot of guild leaders getting hacked these days are coming from their own guild websites and forums running on horribly maintained forum software. Can't find the link, but a report not long ago showed how WoW account thieves were directly targeting known vulnerabilities in forum software that guild websites use.
Sorry to burst your bubble, but a recent report showed that 20% of trojans are aimed at WoW, only beaten by 40% aimed at Lineage 2. ( http://www.mmoglory.com/trojans-a-threat-to-online-gaming-22.html )
A WoW account is worth thousands of dollars if it has good characters and access to tons of gold/supplies. And that is just counting the items, gold, etc. that the hacker guts from the account. Tack on the money they will make through using the account as a spam bot and gold filtering service and its evident that your WoW account is pure money.
To compare, your social security number is worth maybe a hundred bucks on line. Your credit card number? Lucky to get fifty bucks out of it.
On another note; a lot of guild leaders getting hacked these days are coming from their own guild websites and forums running on horribly maintained forum software. Can't find the link, but a report not long ago showed how WoW account thieves were directly targeting known vulnerabilities in forum software that guild websites use.
For all those thinking that hard core criminals would rather go after banks than you.
You are wrong. A hard core criminal can make a lot of money on WOW accounts, credit card numbers etc. 150 dollars for 50 wow accounts is 4500 dollars. a 10 cent surcharge on 10,000 credit cards is 1,000 dollars. The smart criminals make lots of money on microtransactions and stay below the radar of the FBI and secret service. Good money and less risk.
You are wrong. A hard core criminal can make a lot of money on WOW accounts, credit card numbers etc. 150 dollars for 50 wow accounts is 4500 dollars. a 10 cent surcharge on 10,000 credit cards is 1,000 dollars. The smart criminals make lots of money on microtransactions and stay below the radar of the FBI and secret service. Good money and less risk.
Sorry to burst your bubble, but a recent report showed that 20% of trojans are aimed at WoW, only beaten by 40% aimed at Lineage 2. ( http://www.mmoglory.com/trojans-a-threat-to-online-gaming-22.html )
I thought that looked bogus, so I decided to read the source article. That "20%" number for WoW there is of game-specific malware variants. It does nothing to tell you how prevalent game-specific malware is relative to malware as a whole, only that of all video game malware WoW has 20% of the market. And, even then, it only tells you that 20% of game-related variants are targeted at WoW, not how many accounts are actually compromised or how many instances of the malware are actually installed. It's basically meaningless.
The point that there's less risk involved in stealing game accounts is definitely valid, but the rewards are minuscule relative to traditional identity theft as well. Accounts worth "thousands of dollars" are the exception, not the norm. I just can't believe that there's much of a business model here.
Again, that's not to say that I think this never happens - but I do think being compromised in this manner is rare relative to account theft due to social engineering. Not installing trojans and keyloggers is generally a good idea, whether you play WoW or not.
I thought that looked bogus, so I decided to read the source article. That "20%" number for WoW there is of game-specific malware variants. It does nothing to tell you how prevalent game-specific malware is relative to malware as a whole, only that of all video game malware WoW has 20% of the market. And, even then, it only tells you that 20% of game-related variants are targeted at WoW, not how many accounts are actually compromised or how many instances of the malware are actually installed. It's basically meaningless.
The point that there's less risk involved in stealing game accounts is definitely valid, but the rewards are minuscule relative to traditional identity theft as well. Accounts worth "thousands of dollars" are the exception, not the norm. I just can't believe that there's much of a business model here.
Again, that's not to say that I think this never happens - but I do think being compromised in this manner is rare relative to account theft due to social engineering. Not installing trojans and keyloggers is generally a good idea, whether you play WoW or not.
Jeremy, those 50 dollar social security numbers someone mentioned. The thieves get about 5dollars for em. Drivers licenses, credit card numbers its the same. The people that steal them get just a small amount of money for them. So even if a wow account is only worth 50 or 100 dollars its worth more than a social security card or a credit card to that thief if he or she is willing to sell it online themselves.
As I said earlier. The smart long term profitable thieves go for small amounts per transaction because law enforcement isn't going after the thief of a wow account. Or someone that stole 10 cents from your credit card. They'll file a report and then go bust the guy that robbed the 7-11 for 1000 dollars
As I said earlier. The smart long term profitable thieves go for small amounts per transaction because law enforcement isn't going after the thief of a wow account. Or someone that stole 10 cents from your credit card. They'll file a report and then go bust the guy that robbed the 7-11 for 1000 dollars
LUA was not designed nor created by Blizzard.
Hmm. I’m fairly certain the WoW version of LUA is Blizzard’s creation and they simply use the LUA syntax as the basis for their UI scripting extension. At the very least, it’s a heavily modified version as a significant amount (25%) of the standard LUA API has been completely removed. Shalkis’ point (which is valid) is that the LUA included in WoW operates under limitations that Blizzard imposes to prevent it from being abused. A LUA addon is quite safe if the only files included are .xml, .toc and .lua files.
On topic… I myself have been keylogged (WoW and Bank account) and I am well above the technology curve and I use several forms of protection. Not to sound elitist, but if I can be compromised than anyone can. These criminals are very smart, clever and persistent. They also have the advantage of surprise.
Hmm. I’m fairly certain the WoW version of LUA is Blizzard’s creation and they simply use the LUA syntax as the basis for their UI scripting extension. At the very least, it’s a heavily modified version as a significant amount (25%) of the standard LUA API has been completely removed. Shalkis’ point (which is valid) is that the LUA included in WoW operates under limitations that Blizzard imposes to prevent it from being abused. A LUA addon is quite safe if the only files included are .xml, .toc and .lua files.
On topic… I myself have been keylogged (WoW and Bank account) and I am well above the technology curve and I use several forms of protection. Not to sound elitist, but if I can be compromised than anyone can. These criminals are very smart, clever and persistent. They also have the advantage of surprise.
I once decided to raid our guildbank, because of some serious issues with the gm, some members and the way I was treated.
But what the gm didn't knew was that I knew his logon/password, because I was our forum admin and could read private messages in which he gave is account data to another member.
Bad idea. :D
So, I made two new toons, stuffed them with bags and around 4AM I started the raid.
I logged in with gm account and my account, invited my bank toon #1 in guild, gave him all rights, emptied guild bank and sent all stuff to bank toon #2. Deleted bank toon #1.
(I did not delete any chars of the gm. I was only after the guild bank contents.)
I logged off.
Some days later I got mail from Blizzard. ;)
I got my last warning, and my account was suspended for 72 hours.
The text from the blizzard mail:
(in german, no time to translate it)
Art des Vergehens: Unautorisierter Zugriff
Hergang: Dem Account wurde ein Fremdzugriff sowie die Schädigung eines fremden Accounts nachgewiesen
Maßnahme: Accountsperrung für drei Tage (72h), letzte Warnung, Gold & Gegenstände gelöscht
The guild bank was fully restored,
except one stack mark of illidari which were left on my bank toon.
Blizzard must have forgotten to restore/delete them.
PS:
The guild still doesn't know it was me. They all think the gm was hacked by some leet hackerz. ;)
PPS:
Yes, sometimes I'm a bitch.
But what the gm didn't knew was that I knew his logon/password, because I was our forum admin and could read private messages in which he gave is account data to another member.
Bad idea. :D
So, I made two new toons, stuffed them with bags and around 4AM I started the raid.
I logged in with gm account and my account, invited my bank toon #1 in guild, gave him all rights, emptied guild bank and sent all stuff to bank toon #2. Deleted bank toon #1.
(I did not delete any chars of the gm. I was only after the guild bank contents.)
I logged off.
Some days later I got mail from Blizzard. ;)
I got my last warning, and my account was suspended for 72 hours.
The text from the blizzard mail:
(in german, no time to translate it)
Art des Vergehens: Unautorisierter Zugriff
Hergang: Dem Account wurde ein Fremdzugriff sowie die Schädigung eines fremden Accounts nachgewiesen
Maßnahme: Accountsperrung für drei Tage (72h), letzte Warnung, Gold & Gegenstände gelöscht
The guild bank was fully restored,
except one stack mark of illidari which were left on my bank toon.
Blizzard must have forgotten to restore/delete them.
PS:
The guild still doesn't know it was me. They all think the gm was hacked by some leet hackerz. ;)
PPS:
Yes, sometimes I'm a bitch.
# posted by : 7/5/08 22:42
: 7/5/08 22:42
The way I keep my passwords safe is to vary them according to the site. For example, my WoW password could be xxxTF123 (where TF stands for Tigole Furor). :-) And then my American Express password would be xxxCC123 (CC for credit card). It's easy for me to remember the code letters, but difficult for a human thief, and almost impossible for an automated program that simply copies my login/password from guild web forums to try WoW access.
Tobold, that Firefox link is Microsoft propaganda. The author, Jeff Jones, is a Microsoft Director of Security Strategy. Hardly impartial, and his statement are *highly* misleading. Read:
http://shaver.off.net/diary/2007/11/30/counting-still-easy-critical-thinking-still-surprisingly-hard/
And read some of the comments on the original page...
http://shaver.off.net/diary/2007/11/30/counting-still-easy-critical-thinking-still-surprisingly-hard/
And read some of the comments on the original page...
# posted by : 8/5/08 04:59
: 8/5/08 04:59
I was hacked early in 2005. I used the same username and password for wow as I did for some wow related site
Never made that mistake again.
I regularly change my passwords. If I need to let someone else log onto my account, I change the password as soon as they have logged off.
I use a combination of numbers and letters, by making shapes/pictures on the keyboard, and just retyping the shape later (Like a W on the keyboard: 1qazse4rfvgy7)
Never made that mistake again.
I regularly change my passwords. If I need to let someone else log onto my account, I change the password as soon as they have logged off.
I use a combination of numbers and letters, by making shapes/pictures on the keyboard, and just retyping the shape later (Like a W on the keyboard: 1qazse4rfvgy7)
# posted by : 8/5/08 08:21
: 8/5/08 08:21
aul.cadenI am the GM that Tobold is referring to that got hacked and it was a wake up call to me...
I play on a Mac and have never ever given my account details to anyone, nor have I entered said details into any other web site or link apart from the official Blizzard account management site. The actual last time I was on the account management site was over two years, apart from recent necessary activity ofc, as I pay by subscription and never need to go on the site!
Anyway, today my account got restored and I found out that the hacker was actually using my character to run instances! He/she sold off a lot of spare items I carry round for specific tasks and even sold/destroyed my Frostwolf Howler mount for some bizarre reason. None of my main items were touched and I am now waiting for a GM to restore the guild vault contents (fingers crossed!).
Lesson learned! Never be complacent... Even on a Mac...
I play on a Mac and have never ever given my account details to anyone, nor have I entered said details into any other web site or link apart from the official Blizzard account management site. The actual last time I was on the account management site was over two years, apart from recent necessary activity ofc, as I pay by subscription and never need to go on the site!
Anyway, today my account got restored and I found out that the hacker was actually using my character to run instances! He/she sold off a lot of spare items I carry round for specific tasks and even sold/destroyed my Frostwolf Howler mount for some bizarre reason. None of my main items were touched and I am now waiting for a GM to restore the guild vault contents (fingers crossed!).
Lesson learned! Never be complacent... Even on a Mac...
# posted by : 13/5/08 21:48
: 13/5/08 21:48
The people talking about the .LUA scripts running in a sandbox and all that only after wow has logged in forget that it is possible to exploit memory overwrite errors in shoddy code.
For instance, if QuestHelper ran in the latest wow 2.4.1 or something and actually caused the game to exit with a memory error, does that not also imply that they could break through the sandbox somehow? In my security experience it is quite likely.
So don't be too sure about how safe you are... trojans can slip in anywhere...
For instance, if QuestHelper ran in the latest wow 2.4.1 or something and actually caused the game to exit with a memory error, does that not also imply that they could break through the sandbox somehow? In my security experience it is quite likely.
So don't be too sure about how safe you are... trojans can slip in anywhere...
# posted by : 16/5/08 09:10
: 16/5/08 09:10
The people talking about the .LUA scripts running in a sandbox and all that only after wow has logged in forget that it is possible to exploit memory overwrite errors in shoddy code.
We're not forgetting that. It's just a risk that you can't really defend against. Aside from turning on NX support (it's on by default in all major operating systems released in the last 4 years or so), there's not much you can do. Any program can contain a buffer overflow vulnerability, and thus any data could be used as an attack vector. If you find buffer overflows to be an unacceptable risk, I suggest that you disconnect your computer from the Internet now.
Security is always a tradeoff. If you want perfect security, you'll end up with a system that can't be used by anyone.
So don't be too sure about how safe you are... trojans can slip in anywhere...
Yes, including this comment. Who knows, maybe your browser has a buffer overflow vulnerability that I'm exploiting right now.
But how much would it inconvenience you to guard against this (imagined) threat? Probably more than you're willing to tolerate. Conversely, not downloading any LUA would inconvenience players a lot when compared to the slight increase in security they would gain.
We're not forgetting that. It's just a risk that you can't really defend against. Aside from turning on NX support (it's on by default in all major operating systems released in the last 4 years or so), there's not much you can do. Any program can contain a buffer overflow vulnerability, and thus any data could be used as an attack vector. If you find buffer overflows to be an unacceptable risk, I suggest that you disconnect your computer from the Internet now.
Security is always a tradeoff. If you want perfect security, you'll end up with a system that can't be used by anyone.
So don't be too sure about how safe you are... trojans can slip in anywhere...
Yes, including this comment. Who knows, maybe your browser has a buffer overflow vulnerability that I'm exploiting right now.
But how much would it inconvenience you to guard against this (imagined) threat? Probably more than you're willing to tolerate. Conversely, not downloading any LUA would inconvenience players a lot when compared to the slight increase in security they would gain.
If you dont want to get your account hacked just pick the remember account name option that blizz gives you. If you don't type your account name a keylogger can't pick it up. Doesn't matter if it has your password if it doesn't have the account name to go with it.
# posted by : 17/7/08 19:44
: 17/7/08 19:44
5 Days ago i got hacked, disenchanted my whole gear etc, contacted GM, the day after i got all items and gold back trough mail. The next day, i got hacked again, i had just bought epic flying mount for 5k g (thank god) so the hacker only got around 400g+disenchanted my gear again. I assume he got pissed since he switched all my keybinds and messed up with my actionsbars+ did PvP in lv 70 gear for some odd reason?
Btw i was full Naxx 10/25 Man epiced, so it kind of hurts :p Contacted GM again, got perm ban, now i had tp reinstall windows and run like 10 virusprograms then email Blizzard, to get my account back. They also told me, if i do get hacked for a 3rd time, they will probably close my account forever. Weird rules, I have never been hacked before, But i heard there was a hole/leak in Internet Explorer that went for Game account last week. I use Mozilla Firefox now, but sometimes Microsoft forces you to use Internet Explorer which sucks.
Btw i was full Naxx 10/25 Man epiced, so it kind of hurts :p Contacted GM again, got perm ban, now i had tp reinstall windows and run like 10 virusprograms then email Blizzard, to get my account back. They also told me, if i do get hacked for a 3rd time, they will probably close my account forever. Weird rules, I have never been hacked before, But i heard there was a hole/leak in Internet Explorer that went for Game account last week. I use Mozilla Firefox now, but sometimes Microsoft forces you to use Internet Explorer which sucks.
# posted by : 22/12/08 04:52
: 22/12/08 04:52
My account was hacked via my Email account. Someone got access to my email username/password. they requested a new password in my gmail account and then changed it, logged in, changed the email account. IE is easily accesible and stores username/passwords. Use email accounts like Hush mail to prevent them from being able to access that information.
# posted by : 24/12/08 19:23
: 24/12/08 19:23
I was recently hacked. but not by any of all of these talk of people selling items to make a quick buck. In all honesty if it wasnt for it being summer and me playing late into the night i might have never found out. I noticed around 3am one night that i was disconnecting every like 10 seconds. On a random chance it was a friend i shared my info with awhile back i went and changed my pass and went back to playing. No other problems. But to be on the safe side i called another friend and had him change my pass for me from his computer. I had made some foolish downloads while trying to play on a private server and i assumed i got hit by a wow specific keylogger. When i returned i ran some virus scans. removed all the programs i suspected of the problem, and returned to playing. 2 days later i was on and got a dissconnection late at night, due to being tired i just called it a night. Next day i remembered that issue i was having and i checked my toons. All 10 of my toons were fine and my main still had all his gold and epics. But i checked my realm list. and i had 1 toon on ever realm. and all with names such as asdfjk. I had been hacked by a spam bot. I changed my pass again, and i was playing forawhile today before deciding on how i was gonna fix this. And i got disconnected, upon trying to get back on i learned Blizz temporarily locked my account on the grounds of my password being changed. Idk how long i have to wait to be unlocked, but i have downloaded spyboat and hijack this on top of windowsdefender and macafee and i'm running multiple scans and comming up with nothing else. I'm at a loss as to what to do short of reinstalling my OS
Post a Comment
# posted by : 13/7/09 23:56
: 13/7/09 23:56<< Home
