Authenticator increased security idea.

[Deleted]

Muahrøømz theyll just block your attempt completely, or reroute your connection to their own server. Either way theyll just keep you from sending your info at all to the server and then log in.

As for you arrogant scrubs who thinks your invounerable, your not. Ive personally always been carefull not to enter dodgy sites, open emails i dont know, always had antivirus/firewall installed, and yet after 5 years of no problems i got hacked as well.

I really dont se a solution to this problem tbh. If you get that file on your comp, your screwed.

Sure that's a possibility for them to hack us, but it would be really complicated, just for a random ammount of gold in a virtual game. Besides, such a complex reroute is probably very hard to get past decent firewall/anti-stuff/etc.
I mean seriously if i would have the skills to do that, i'd probably shoot for something bigger :-\

[Vasti]

NEVER will there be a 100% secure option. Backdoors will always exist.

But as far as security is concerned couldnt they make like an authenticator usb stick?
Stick it in the computer and it sends a signal to Blizz which includes your IP-adres. Then limit WoW to only be played from that IP-adress? If u want to change computers then stick ur authenticator-usb in the other computer and then that computer is able to log into your WoW account.

Im sure even this idea will have flaws...such as sending a wrongsignal to blizz from ur comp, while copying the code and sending it to another comp who then sends it to blizz so they get WoW acces, but then atleast, by sticking ur usb in a virus-free computer, the hackern will be blocked aswell since now the virus-free comp will have the priveledge to log in to wow?

[viau]

NEVER will there be a 100% secure option. Backdoors will always exist.

But as far as security is concerned couldnt they make like an authenticator usb stick?
Stick it in the computer and it sends a signal to Blizz which includes your IP-adres. Then limit WoW to only be played from that IP-adress? If u want to change computers then stick ur authenticator-usb in the other computer and then that computer is able to log into your WoW account.

Im sure even this idea will have flaws...such as sending a wrongsignal to blizz from ur comp, while copying the code and sending it to another comp who then sends it to blizz so they get WoW acces, but then atleast, by sticking ur usb in a virus-free computer, the hackern will be blocked aswell since now the virus-free comp will have the priveledge to log in to wow?

that is what I wrote (or just about) and I think this could be the safest way. Plus, plugging your stick in another computer should trigger a series of secret questions that you must answer correctly

[Herecius]

Wouldn't the simplest solution for blizzard be to set it so that if someone sends the wrong information while logging in, to make it so that account can't be logged in to for the next 20 seconds? this won't solve the problem of having the trojan, but will stop the account from being logged in to by the bots until the code expires. i'm sure i'll get trashed for this by someone, but it seems like a reasonable idea

I actually like this. It would make the code entry good ONCE, and only once. If you screw up your entry, you have to wait, and by the time you're done waiting, you'll have a new code. Sure having the trojan on your computer would keep you from logging in, but it would also keep the hacker from logging in.

[Unholyground]

The current Authenticator MITM attack is:

Input Email/Pass/Code => Trojan => Faked Input => WoW Client (yes.. CLIENT) <=> WoW Auth server
              |
              v
           Hacker's server => Battle.net Authentication (for remove current auth)

and nothing to do with:

WoW Client (I repeat "CLIENT") <=> Trojan <=> WoW Auth server

G3 or SSH/tunelling have nothing to do with the attack.. Authenticator works as intended under MacOSX and Linux+Wine.

I was referring to making an authenticator that needs to physically transmit a private encoded signal directly to a server wirelessly, not using the internet. GO GO BLIZZARD SATELLITE!

[Deleted]

I was referring to making an authenticator that needs to physically transmit a private encoded signal directly to a server wirelessly, not using the internet. GO GO BLIZZARD SATELLITE!

Which is protected by FBI frequency changing towers around the world and interceptor sattelites ? Hmmmmm

[Deleted]

you need to start from a basic code.

passwords can be stolen.
computer-specific data can be forged.
anything you type in, copy-paste from the web or see can be recorded.
everything can be counterfeit given enough time and a clear image of the starting point.
every security system has flaws, some big, some small.
people can be bribed.
ANYTHING GOES IN CRIME!

you need to remember these rules if you want to develop a safety measurement. and even then, the tiniest messup can mean grave things. remember that the PSP GO was known before the official announcement? remember that all data about cataclysm lore was known before blizzcon? that can and will happen again. as long as there is a human factor, mistakes will be made.

only when the input device is made from scratch by a computer-made computer and the same for the receiving device, then we can't speak of human factor except from a long shot.

[Herecius]

Nope, because the information you enter would be hack blocked from reaching Blizzards server and go straight to the hackers computer instead.

Blizzards server would only see the hackers log in attempt, which would be the first attempt made.

Doing this would do nothing more than letting the hacker being able to log in, and you as the legitimate owner being locked out.

Tie the attempt to a separate packet then, one that isn't intercepted. The idea here is to counter this particular attack, not future ones of a modified trojan. If you manage to get a whole NEW one, that's your own fault for sucking at interweb security.

Which is protected by FBI frequency changing towers around the world and interceptor sattelites ? Hmmmmm

Damn hackers, launching spaceships so they can get our WoWgold.

[kailtas]

There still has to be some way to do it and make it impenetrable.

No there is not, technicaly computers are retarded.

Neither your computer or blizzard's server got any inteligent communication betwen them. However a computer does not make an error. And if u make an error with your computer then someone else can manipulate your computer to do something else than originaly told.

The reason you update your antivirus is because hackers continiusly find different ways to bypass your retarded computer. This is done by ''cloaking'' viruses to make your computer alow them entry. When a hacker is inside he either plants viruses or have fun.

By clicking certain sites programed internet sites u may automaticly download cloaked files that instals itself on your computer. This virus is pre-programed to send a random code to blizzard the split second you click loggin wich is the wrong code. While it sends the correct code to another computer, this computer is pre-programed to automaticly type in the code and auto log in ingame and on the wow web page in order to change password.

Then the hacker is logged onto your Wow account while u do not got the account password and your authenticator wont help u fast enough to prevent theft.

Then the hacker logs off and wait for a new auto loggin from the couple thousand infected computers.

This is basicly how it's done, and the only error involved is the person sitting at the screen who tought updating anti virus or clicking that video with the name ''OMFG LOOLOLLOL FUNNY!'' did not harm his computer.

[vesseblah]

G3 or SSH/tunelling have nothing to do with the attack.. Authenticator works as intended under MacOSX and Linux+Wine.

The hack works by sniffing and intercepting the traffic between WoW client and server on player's own computer, and it can be just as easily ported in Linux or OSX. Problem is that the weak encryption Blizzard uses to protect the game data as well as client-server communication was broken years ago and never fixed. Public key encryption is the best-known and most widely used solution for the man-in-the-middle attacks, and would be really easy to implement into the game client instead of the current crap.

[Teli]

Not sure if this would work, but maybe they could make it so that the client first asks for an authenticator code for loging in, and then another one for the first char you login to. Unless they manage to get 2x codes from you at the same time, this would be safer.

Edit: typo

[Herecius]

Which puts us back to square one with a security system that can easily be breached and the blame going to people who can't protect their PC's.

That is exactly the situation we have now, the changes mentioned that you thought was a good idea does precisely nothing to change what we currently have.


I will say it 3 times now -

Only a dynamicly passworded system that changes with every log in attempt can break the keylog and man in the middle attacks.

The solution to the problem is simple in these terms and it is this - Any information sent to the keylog or man in the middle has to be invalid when he recieves it, but valid when you use it.

The way to implement this is to provide a long series of codes in a table that is provided with your copy of the game that is stored in paper format only and nowhere on the cd or in any data stored file system.

Every time a log in attempt is made the server will ask a unique question such as - "What is the code in squares A4, G3, D5, F2, H7".

You as the user and Blizzards databse system is the only 2 parties that have all the combinations of answers.


Thus, when you try and log in the password will work for you, but if the keylogger tries to log in, Blizzards server will ask him - "What is the code in squares B2, D2, F3, G5, H2?".


The keylogger has all the information you just typed, but wherase it would of worked for your log in attempt, itwould not work for him.


>>>>>Dynamically Unique Passwords<<<<<

How would this protect digital downloads, then?

[Doddilus]

Not sure if this would work, but maybe they could make it so that the client first asks for an authenticator code for loging in, and then another one for the first char you login to. Unless they manage to get 2x codes from you at the same time, this would be safer.

Edit: typo

nah, the hacker can wait till you try to log in again and get a second code

the only truly secure way is like the poster above me said, the system never asks for the same password twice

[vesseblah]

the only truly secure way is like the poster above me said, the system never asks for the same password twice

That is exactly what the authenticator does. Every time you log in, there is different password. Except that the system is vulnerable to MitM if the login is not encrypted.

[Deleted]

now that we are trying to develop over the top methods, how is this?

you get a code from blizzard when you start up the game. you need to enter this code in your authenticator, then you get a second code from your authenticator. this is your password.

then you press the logon button, the second code is processed, and you need to type in a captcha, which is generated at the wow account side and at the blizzard side with the same code, which is dependant on the time of the second code's entry and the current time AND the time the first code was sent. you enter this code.

and then you get a 3rd code, that you need to enter in your authenticator. you get a reply code that consists of 26 alphanumeric numbers. you need to enter any 8 of these in the same sequence, but they may not lie next to each other. then you enter an extra 8 and then the remaining 10.

after this, you need to lay your finger on a specially designed pad on the authenticator. a randomly selected random amount of coordinates is sent to blizzard, that compares it with a fingerprint stored in their database tht you entered when you registered the authenticator.

finally, one random question out of 10 questions you needed to answer when you made your account needs to be answered. you need to give the same answer as you did when you created your account.

every datafile is sent to to a different server. they all need to agree on the validity of the registration. the files are sent via a double proxy and 3 independant firewalls (proxy 1, proxy 2 and the server) that checks if the IP adresses match for each packet at the proxies and the server checks if the ip adresses matches the one from the original packet that opened the connection with the server (but did not contain any data).

if anyone manages to hack through such a system IN PRACTICE from a remote computer without any data about my authenticator, i will let myself be violated for 3 days straight by a rabid dog.

[Shinja]

The hack works by sniffing and intercepting the traffic between WoW client and server on player's own computer, and it can be just as easily ported in Linux or OSX. Problem is that the weak encryption Blizzard uses to protect the game data as well as client-server communication was broken years ago and never fixed. Public key encryption is the best-known and most widely used solution for the man-in-the-middle attacks, and would be really easy to implement into the game client instead of the current crap.

Please stop... Traffic is the SAME whatever client OS.

Read My post, the Trojan hook keyboard (OS related weakness), read memory, inject false information to WoW client (THE GAME).. If the good code is sent to Blizzard Auth server, it'll no MORE WORK (it's the Anty-replay protection) so sniffing is useless.

Stop talking about computer / network security when you have any clue how attack works please.

[Demonicdave]

1) Get real virus scanning software (Norton works fine).

norton antivirus is basically having a virus its self it affects system preformance I.E. boot times and time it takes to launch programmes AVG/macafee will do a much better task

[vesseblah]

Please stop... Traffic is the SAME whatever client OS.

Read My post, the Trojan hook keyboard (OS related weakness), read memory, inject false information to WoW client (THE GAME).. If the good code is sent to Blizzard Auth server, it'll no MORE WORK (it's the Anty-replay protection) so sniffing is useless.

Stop talking about computer / network security when you have any clue how attack works please.

Way too complicated. Since the protocol of WoW login is very well known and documented, it's extremely easy to intercept and fake the tcp traffic. Reading and most of all writing into WoW's memory space is 100x harder due to Warden and the memory protection mechanisms of modern CPUs. I recommend you listen to your own advice btw.

edit: The reason this exploit does not exist for linux/osx yet is because infecting those systems with trojans is harder

[Micalas]

I don't even have an authenticator and I've never had a problem. Suck less. It's the perfect solution.

[Tarjon]

Sorry to break it to you guys, but the vast majority of solutions that have been suggested come from people who either have none or not enough knowledge when it comes to security and/or encryption. No offense, but it's not as easy as you seem to imagine it. If we discard the possibility of a clean (not infected) computer system being used to log on, then malicious software running on that computer can:
* log everything you type
* take screenshots of everything you enter via an on-screen-keyboard or the like
* log the entire communication between your computer and (in this case) Blizzard's servers
* and: as long as this communication is not encrypted or at least cryptograhically signed, forge/manipulate it

Seeing how it is absolutely necessary for you to enter your password and, if you have one, your authenticator code, the only way to stop man-in-the-middle attacks is to secure the communication between your client and the wow server. Asymmetric (sometimes referred to as public/private key) encryption could solve this problem, but would still leave any malicious software that's running on the victim's computer capable of logging the credentials you TYPE when you log in. Even if you used the suggested 10x10 chart, it would only be a matter of time until a sufficient amount of these codes have been logged, enabling the bad guys to complete a login.
Same goes for the suggested USB stick. The information stored on that would have to be in a format that your computer can read. If that's the case, then malicious software can read it as well.

Almost completely unrelated: The login process has to be somewhat comfortable. Entering three codes, looking up the weather in Sydney and adding up two captchas is nothing anyone would be willing to perform every time they login.

It all boils down to this: You can create the perfect and "most secure" login process, but: It will fail the moment you can no longer trust the machine it's running on. In a perfect world, gamers would have a machine dedicated to playing games only, and would never ever install any software or connect to any website/network share that is not absolutely necessary for their game to run. Common sense does not hurt either, but as the past has shown, even reputable websites have been manipulated, thus serving zero-day-exploits to the masses.

tl;dr: A perfect login process fails the moment the system it's running on can no longer be trusted. You've surfed the web? Opened an email? Consider your system potentially untrustworthy.