Authenticator Accounts Hacked, ICC Quests, Crimson Deathcharger

[Doktor Faustus]

Jaina and Sylvanas aren't at the entrance either.

They probably show up when the buff exists.

Isn't he also at the Crusader camp on the edge of Icecrown/Crystalsong?

[Pokchop]

I think it's hilarious that people will go to such extreme lengths to get past the authenticator with this method just to get into a WoW account... when banks use the same authenticator tech to protect vaults.

Doing that to a bank can land you in prison for a long time.

Hacking into a WoW account won't. However thanks to people who buy gold, WoW accounts have some monetary value so it's "safe."

Of course, that doesn't mean banks don't get hacked. Though I'm sure banks have much tighter security.

[TobiasX]

Three words...

Buy a Mac.

:]

7 words: You Are Not More Safe On A Mac.

The only reason people try to hack them less is because the majority of home users (the targets of hacks) are on PCs.

[Nezoia]

Any word out on how people managed to get the trojan installed yet?

I suspect a flash vunability.

[Tir]

Any word out on how people managed to get the trojan installed yet?

I suspect a flash vunability.

Someone already posted this, but here: http://www.worldofraids.com/topic/15...atrix-website/

Basically a fake WoWMatrix that google recommends (!), as well as a fake Curse and other specific addon sites. So I believe you still have to download something from these bogus sites to get it. What I don't like is that the first victim's NOD32 and anti spyware didn't pick up on it at all.

Moral of the story is use your bookmarks and hope the legit sites never get hacked, and if you have to google one then triple check the url, and don't trust the sponsored links.

[Nnug]

Extremely simple solution, when the password is submitted, lock the authenticator code to that IP address.

[Tir]

Extremely simple solution, when the password is submitted, lock the authenticator code to that IP address.

If it can intercept a code before submitting a wrong one to blizzard then it can just submit the password from their end as well. It probably already does.

[blupp]

Buy a Mac.

Ouch. Do you think when the majority buys a Mac "hackers" will focus on Mac? Take IE for example its not just because Microsoft tends to slack at security its also because a lot of people are using it as it is the standard windows brower.

At least Blizzard is being honest. Most of the time they dont say a word about things like that and surely none of their tools can fail. "i got hacked" "well, delete WTF folder and addons"

Ofc nothing is 100% safe, that must be understand. But i didnt think anyone would bother doing so much for a WoW account. Well i dont know its real worth but i thought the prices dumped because gear is so easy to get and people are richer than ever before.

[DrRight]

PANIC

Repent all ye sins! The end of days has arrived.

[LeperHerring]

I can write a man in the middle attack for WoW on OSX as well, if you like. (Or any other OS for that sake).
You just have to download it in the first place, likewise on Windows. Get the picture?

Making the authenticator secure against man in the middle attacks is trivial. Blizzard hasn't released details of the attack, but it's unlikely to be a real man in the middle attack (given that the authenticator is a 3rd party product designed by people who should know what they're doing - unlike Blizzard). Instead, the attack likely relies on the attacker being able to modify the client endpoint rather than only being able to observe and modify bits on the wire. There is nothing that can be done to stop such an attack on any OS.

[Deviltry]

Why i can't get that trojan to open? :/ I get this error:

[Shoganitic]

i getting an error i think 2 months ago , when i use the authenticator code its says that is not correct...
but anti-malware cant find anything.

[Atallicus]

I'm super new to mac's, is there something I should be looking for here? I know I won't find a .dll so does that mean I'm safe? Sorry for a newbie question

[Yoe]

Question, if you waited for the last say 10-15 seconds off your authenticator code then entered it before it changed wouldnt you still be perfectly safe? As by the time they get the code and use what ever bot to get into your account a new code will be needed?

[Ryoushii]

Btw, it's fine for people to refer to it as a 'virus', although it doesn't have the characteristics of one, people have been using the word in this context so much that it's just become generally acceptable for any type of malware, at least outside of professional areas.

I'm super new to mac's, is there something I should be looking for here? I know I won't find a .dll so does that mean I'm safe? Sorry for a newbie question

DLL's are for Windows operating systems, so you are indeed fine for this trojan.

Question, if you waited for the last say 10-15 seconds off your authenticator code then entered it before it changed wouldnt you still be perfectly safe? As by the time they get the code and use what ever bot to get into your account a new code will be needed?

Yes, that's fine.

[IKT]

7 words: You Are Not More Safe On A Mac.

The only reason people try to hack them less is because the majority of home users (the targets of hacks) are on PCs.

Bit of a contradiction there,

If the only reason people try to hack them less is because the majority of home users are on pc's (you mean windows), then macs ARE safer because they're being targeted less, however the whole popularity contest is a flawed and dumb reason that only idiots use.

Btw, it's fine for people to refer to it as a 'virus', although it doesn't have the characteristics of one, people have been using the word in this context so much that it's just become generally acceptable for any type of malware, at least outside of professional areas.

No it's NOT, excusing people for being fucking dumb is not a valid reason to keep using the incorrect term, half of this shit happens because of dumb fucking people who can't put 1+1 together.

http://en.wikipedia.org/wiki/Malware...uses_and_worms

[Atallicus]

Btw, it's fine for people to refer to it as a 'virus', although it doesn't have the characteristics of one, people have been using the word in this context so much that it's just become generally acceptable for any type of malware, at least outside of professional areas.


DLL's are for Windows operating systems, so you are indeed fine for this trojan.

Yes, that's fine.

Thankyou much!

[Puntar]

Hmm, wouldn't tying MAC address of you Ethernet card to the Authenticator make it very hard on the hackers?

Another way would be to input 2nd Authenticator number just after log in (in that log-in Auth phase player still cannot interact with anything).

[Deviltry]

Hmm, wouldn't tying MAC address of you Ethernet card to the Authenticator make it very hard on the hackers?

Another way would be to input 2nd Authenticator number just after log in (in that log-in Auth phase player still cannot interact with anything).

Changing MAC address takes like 10 seconds. And reading it when you have a trojan installed on your victim's computer is piss easy.

[TobiasX]

Bit of a contradiction there,

If the only reason people try to hack them less is because the majority of home users are on pc's (you mean windows), then macs ARE safer because they're being targeted less

The majority of viruses target a computer; they don't care whether it's a mac or a windows pc.
There are a number of viruses that specifically target windows pcs. This is a very small number relative to the total number of viruses that exist.