Authenticator Accounts Hacked, ICC Quests, Crimson Deathcharger

[Tang]

If there's one virus that does it, there will be more.

Hope blizzard's login application will get smarter soon, to prevent viruses from snatching stuff like this.

Blizzard can be vigilant with updating their encryption, but there's not a whole lot they can do when you let a virus onto your system and that virus reads information from your memory and redirects traffic however it likes.

It's more like players need to understand that an authenticator is only a part of the solution. People who think 'I have an authenticator, I am invincible" are about as stupid as the people who say "I never go to suspicious sites, I am invincible" or "I have anti virus software, I am invincible."

The only way to be safe is to take multiple precautions. Have a firewall, have an updated anti virus, have an authenticator, and pay attention to what you click and where you browse. If you think that only one or two of those things will be enough, well, eventually you'll be wrong.

[Tang]

If they steal one of your authenticator codes, they can logon to account management and change ur pw. Doesnt help them nothing, seeing as they dont have any more codes to logon the game itself. Or, they can logon the game and try to take stuff, and get immideatly dc'd by the user trying to logon again, because user still have his password. They will need the user to enter a new auth code every 30sec to even stay online. Sounds like the hacker needs to be online and communicate with ur computer within seconds, to even successfully logon to any character. I dont see this being a commonly used method amongst hackers. Curious to see what Bizzards action will be, regarding this.

The hacker does need to be "online" when you try to log in in order to use the authenticator code, but that part can be automated, and for such a sophisticated attack, that's trivial to do. You could even run a sweat shop like most of these gold seller/hackers already do. Joe Chinaman or Joe Russki is sitting at a terminal waiting for the trojan to pass him an account, and when it does, he's logged in automatically, and all he has to do is to quickly get the loot off the account onto a friendly mule. The guy robbing the account doesn't need to even know the account name or password.

There is no chance of the actual user kicking the hacker off, because the actual user's correct information is never going to get to the Blizzard servers. The user doesn't even know that he's being hacked, per se, only that he can't log on. The server only knows that the user successfully logged on (actually the hacker, but the server doesn't know that).

[Mystoman]

If they steal one of your authenticator codes, they can logon to account management and change ur pw. Doesnt help them nothing, seeing as they dont have any more codes to logon the game itself. Or, they can logon the game and try to take stuff, and get immideatly dc'd by the user trying to logon again, because user still have his password. They will need the user to enter a new auth code every 30sec to even stay online. Sounds like the hacker needs to be online and communicate with ur computer within seconds, to even successfully logon to any character. I dont see this being a commonly used method amongst hackers. Curious to see what Bizzards action will be, regarding this.

Indeed, even if they hack someone with authenticator, you can just try to log in again, no need to go through authenticator code step, just your normal password and that will result in dc + 24h ban on account, plenty of time to sort things out.

[Tang]

Indeed, even if they hack someone with authenticator, you can just try to log in again, no need to go through authenticator code step, just your normal password and that will result in dc + 24h ban on account, plenty of time to sort things out.

Only if you log in from a different PC. If you log in from the infected PC, you never connected to the Blizzard server the first time, and you won't on the second or third try either.

As far as the server knows, you tried to log in one time, and you succeeded.

[CaptainArlong]

No one is safe!

Everyone can be safe. Since the game launched my account has never been hacked. I never bought an Authenticator, and I never will. Wanna know why? Because I can play without a ton of mods. I don't visit porn sites and other websites that are filled with viruses.

[boneschaman]

where does it come from?

I guess the usual free wow mount here and update your patch with our superfast dl...

[Metaz]

What is more worrying is not that this virus can hack WoW accounts but that these authenticators are industry standard for a lot of online banking authenticators also. That is much more of an issue that a WoW account as far as I am concerned. This is as far as I know, correct me if I am wrong though.

[Aswed]

Everyone can be safe. Since the game launched my account has never been hacked. I never bought an Authenticator, and I never will. Wanna know why? Because I can play without a ton of mods. I don't visit porn sites and other websites that are filled with viruses.

Not all porn sites have viruses...

[DaGhostDS]

the tabard its missing his thumb because of the symetry.. :
and
lol at authentificator

[Collected]

So is it wise to hit send on your authenticator code right before the code changes, to give any hacker the least amount of time possible to hack your account?

[Throrion]

I am wildly offended by the use of "ass" in this announcement. Please keep in mind that this is a game for ages 12 and up. WHY WON'T ANYONE THINK OF THE CHILDREN?!

[Tang]

Everyone can be safe. Since the game launched my account has never been hacked. I never bought an Authenticator, and I never will. Wanna know why? Because I can play without a ton of mods. I don't visit porn sites and other websites that are filled with viruses.

*sigh* this is ignorance at its finest.

I played for 3 years, never got hacked. Know why? I don't visit suspicious sites, have anti virus software, don't give out my information yada yada yada.

Then one day I got hacked. Know why? Because I visited a Blizzard fan site, which was linked to by a blue post, from the official blizzard forums. I read a totally legitimate article about the upcoming Wrath of the Lich King expansion, and while I did that, my browser was being exploited by a flash vulnerability through an advertisement embedded in the page. All of my software was fully updated, but they got me during a window where a vulnerability was discovered and not yet corrected.

Saying "I've never been hacked, so I am safe" is like saying "I've never had cancer, so I'll never get it." No one gets cancer until they get cancer. No one gets hacked until they get hacked. I hope you won't get hacked, but with your ignorant attitude, you probably will hacked some day.

[Mystoman]

So is it wise to hit send on your authenticator code right before the code changes, to give any hacker the least amount of time possible to hack your account?

After all im affraid that all is going in a matter of seconds , automaticly. Well at least login on b.net account and changing pass, dunno what about WoW itself coz it will dc after beign afk too long anyway ? But yeh, prolly im going to wait with sending code till last seconds.

[Peta]

Is nothing unique in this game anymore? Why does everyone need to be able to ride a deathcharger. This game has fallen pray the commercialization band wagon since they joined with activision.

[Guinss]

Only if you log in from a different PC. If you log in from the infected PC, you never connected to the Blizzard server the first time, and you won't on the second or third try either.

As far as the server knows, you tried to log in one time, and you succeeded.

What you dont understand is that you are indeed connected to Blizzard. The hack just send your code to them and switches it with a fake code which goes to Blizzard. Therefore the fail on login.

You can pretty much just spam login and they wont be able to do nothing. Even if the same auth code is still valid. Unless, ofcourse wont work if they change your password. Something that is a risk for them seeing as they then use one of the recieved codes and its no longer useable.

[gregg37]

Just curious - Im about to start playing WoW again, well was thinking about it - but my account isnt attached to an authenticator and im extrememly tight on money etc - even a WoW subscription is pushing it. Taking into account all of hte following, should I really buy an authenticator and be short on money, or just wait till next payday?

The internet I use is extremely secure.
The computer I will be using has just been rebuilt and uses AVG.
Nothing gets downloaded onto the computer in terms of torrents etc.

I have 4 years playing experience and have only been hacked once, and that was when I logged into my account at a friends house.

So what im asking is, is the authenticator that important if you are a sensible, knowledgable computer user?

Physical authenticator is like 6 bucks. Skip Mcdonalds one day and get one.
Mobile authenticator is free.

[Zero44556]

*sigh* this is ignorance at its finest.

I played for 3 years, never got hacked. Know why? I don't visit suspicious sites, have anti virus software, don't give out my information yada yada yada.

Then one day I got hacked. Know why? Because I visited a Blizzard fan site, which was linked to by a blue post, from the official blizzard forums. I read a totally legitimate article about the upcoming Wrath of the Lich King expansion, and while I did that, my browser was being exploited by a flash vulnerability through an advertisement embedded in the page. All of my software was fully updated, but they got me during a window where a vulnerability was discovered and not yet corrected.

Saying "I've never been hacked, so I am safe" is like saying "I've never had cancer, so I'll never get it." No one gets cancer until they get cancer. No one gets hacked until they get hacked. I hope you won't get hacked, but with your ignorant attitude, you probably will hacked some day.

This is too true, wendsday I was hacked, lost everything, never did anything reckless or went to any unsafe sites, don't be an ass just because it hasn't happened to you, because kharma has a way of taking you down a notch

[Jasco]

The Blizz authenticator is pointless, the REAL authenticator should be two factor. Its based on something you have (Authenticator) and something you know (a pin). I will never own the Blizz kind, as its been proven not effective.

[pinkduck]

Gee. I recall members calling me down as retarded and not understanding things at all for describing this exact method of hacking your account some months ago. mmo=champion forums ftw.


http://www.mmo-champion.com/general-discussions-22/if-you-do-not-have-a-authenticator-read-this!/msg1875413/#msg1875413

[Demog]

People who get STDs are idiots.

People who need a "condom" to not get STDs are idiots.

That's all, have a nice day.

Yes, if I go bang a random chick without any protection and find out later that it has brought me an STD - then I know very well that I'm an idiot.

That's a very good analogy, but you got the second part a bit wrong.

You're obviously not an idiot if you use a condom to not get STDs (which btw ain't completely sure either). The alternative is to get a recent medical report verifying that's she's clean, signed by her doctor (and your lawyer, to add an extra dimension of security :P).
But deciding that all that is too much work and just use a condom instead, doesn't make you an idiot in my book.