PSA: Blizzard Authenticators now Vulnerable to Keylogging
- Thread starter John Funk
- Start date
I think blizzard need to add something else and i no exaclty what, when u go to log in u type in ur user name and pass word, ur authenticator is u have one. But then a numpad appears on screen with the numbers 1-9 on in a random order, u then using mouse only click in your 4 digit code with the order of the numbers changing every time u press one, in order to log in.
U would recieve this number as an email a few days b4 the system comes out.
anyone who has played Runescape members should no what im talking about. the runescape bank pin.
U would recieve this number as an email a few days b4 the system comes out.
anyone who has played Runescape members should no what im talking about. the runescape bank pin.
Sadly, the only way to be safe from having your WoW account attacked.Mornelithe said:
Frankly, I saw this coming a couple years back when I first heard about the Authenticator. Not that I don't applaud the effort, the authenticator is an awesome idea (though I don't want a lot of companies to start using the idea, lest I be running around with 20+ authenticators), but I knew it would only be a matter of time before the gold farmers found a way around it.
But again, as the MMO Champion article says, it isn't any reason to not have an authenticator... at least for the time being. Those gold farmers are tenacious little fucks, so we can (uneasily) rest assured that this is only the scouting party, with the army just beyond the horizon.
There is no such thing as a 100% secure system. Enough time and money (and ingenuity) can break any system. A system is also only as strong as it's weakest part. In the case of WoW authenticator, the weakest link is arguably the Windows OS. They have done a lot to make it a non-trivial issue to crack someone's WoW account, but there's plenty of ways to get into a person's computer to see what they are doing or take control, so for any way they try to make it more complex to log in to WoW on your PC, there will be ways to break the system for people who want to badly enough.Khell_Sennet said:
By the way, your bank account is secure partially because you don't insert your debit card into your PC. If you used online banking (which is currently very popular and has much more at risk then a WoW account...at least for people with what most would consider normal priorities in life) then it would not be much more difficult for someone with a key-logger on your system to get your account ID and PIN for your bank account. If you are not careful with your system, bad things can happen no matter what anyone else does to try and guard their software against it.
For the most part (I'm sure there are exceptions), you have to do something stupid to get your account hacked. And by "stupid", I mean that you have to fall for one of those links they like to spam around the WoW Forums that are usually pretty obvious once you've seen more than a few of them and know how they look. Admittedly they do get tricky about it. Last I checked (which was about a year ago), they were actually using multiple accounts to post mock conversations. The first one would be a guy making the topic with the link that would put a key logger on your system, then they actually put the effort into having about 5 or 6 follow-up accounts all post replies to what's supposedly inside the link. They actually noticed how people will read a topic before going to a link, and learned from it. Granted it was still a lot of broken english and the link still looked like a key-logger link, so it was still easy to spot if you were looking for it, but it really goes to show you how much they'll adapt to try and attack people's accounts.Mornelithe said:You know what's wierd, I've never actually had any account hacked, wow, email, anything. The only reason I got my authenticator for WoW, was because I was a high officer with full access to the guild bank, and several officers had their accounts hacked, the GM included. Even after I became guild master, still never got hacked, but the authenticator was more for the 7.5K gold I'm walking around with
Anywho, that tangent aside, unless you go to a site that sneaks the logger into your system, there's really no way they can attack your account. This is why sharing your account is considered a bad idea: You don't know if the other person (or people) is going to get a key logger on his system. Like this one guildy of mine; smart guy when it came to avoiding key loggers, except that he shared his account with a couple friends. So despite his own ability to identify and avoid key logger sites, he still ended-up having his account attacked because one of his friends must have done something stupid.
they actually have 15 seconds to hack your account. authenticators rotate their 6 digit number after that amount of time.
My Wow Account has been hacked into twice. the first time made me stop playing and I lost 90% of my original interest in the game. but after the second time...I was like..ok..that's enough. i bought the authenticator. it is a little annoying having to type in extra stuff to get in my account. but given what ive been through. all my stuff sharded twice. i feel safer with this thing than without it. and I have 2 REALLY good anti-viral softwares running. so while i will be more conscientious with this new key logger. I feel pretty secure.
I'm praying that this new found failer of Blizzard's is due to being with Activision, which hopeful will go down the shit pipe soon if IW gets their way, and even if they don't, thats still alot of bad press.Khell_Sennet said:
That's pretty ingenious.
Seriously though, it seems like all of these damn malicious files are .dll extensions, I wish there was some way I could get my computer to ask permission every time a .dll file is going to be added, since they aren't common file extensions to be added to your computer regularly, it'd really cut down on infections.
Seriously though, it seems like all of these damn malicious files are .dll extensions, I wish there was some way I could get my computer to ask permission every time a .dll file is going to be added, since they aren't common file extensions to be added to your computer regularly, it'd really cut down on infections.
