account-security
Latest
Blizzard's zombie survival guide
digg_url = 'http://wow.joystiq.com/2010/05/12/blizz-zombie-survival-guide/'; If you are the leader of a guild that has a large number of people who have account security issues, you regularly get emails from Blizzard that say the following: Recently one of the members of your guild was the victim of an account compromise, and during the course of our investigation it was discovered that items were removed from the guild bank while the account was out of the control of your guild member. The items have been returned to you as attachments to an in-game mail. We sincerely apologize for any inconvenience this has caused. The email lists what items were restored and that they are attached to an in-game email sent to your account. (You then probably insist the hacked guildie get an authenticator.) Recently, The Spousal Unit received a bit more from the GM helping him with a security incident: a zombie survival guide. The full text of the guide is after the break.
The Queue: Quelling subversion
Welcome back to The Queue, WoW.com's daily Q&A column where the WoW.com team answers your questions about the World of Warcraft. Alex Ziebart will be your host today. You may or may not remember my poll from the other day. You know, Taco Bell vs. KFC? I was impressed with how many people yelled at me to learn how to cook so I don't need to eat fast food. Come on, guys. Give me some credit here! I know how to cook. I cook all the time. Sometimes you just want some fast food! Seriously, I can cook. I promise. Tell you what, if any of you magically fall down my chimney one day, I'll whip up a nice spinach quiche for dinner. Unless you'd prefer a pot of chili or some shrimp scampi? Maybe even potato pancakes if you're that kind of guy or gal. We can have a piece of old-fashioned slab apple cake for dessert. Family recipe! Zulix asked ... "Just rolled a BE, and In Silvermoon City by the entrance, there is a 'harassed citizen' surrounded by guards, and you talk to the guards they say it doesn't concern you. What's the lore behind that?"
GDC10: En Masse's Patrick Wyatt talks MMO security
Security concerns in MMOs are nothing new. We all know the drill -- Don't share your account, avoid suspicious emails and sites, change your password regularly and so on. We go through all of that to keep our personal accounts safe, but what about the bigger picture? Patrick Wyatt from En Masse looked over this very thing at GDC this year, explaining how issues like gold farming, account theft and even plain old griefing affects the MMO community at large. He began looking at the other side of the equation: the people causing these problems in the first place and what motivates them. Money is the main motivator, of course, but there is no shortage of attackers who are just doing it for kicks. So as long as you protect your own account, it doesn't affect you, right? Wyatt addressed that false assumption as well, outlining the affect of each type of attack on the general gaming community and the game in question itself. Any event that affects the game and the community at large will of course affect every member of the community. So what's to be done? Game developers never stop working to stay ahead of "the enemy", and Wyatt illustrates quite a few possible solutions. This slideshow certainly isn't only for those in the industry. It's very informative for any MMO player, so head over to playnoevil.com and take a look at the slideshow for yourself!
EVE Online devblog discusses account security
Every MMO suffers the horrors of gold spammers and EVE Online is no different. The RMT (Real Money Trading) industry is massive and EVE's developers CCP have waged a constant war against it in recent years. The PLEX initiative gave players a way to safely buy ISK for cash while at the same time helping players who couldn't afford their subscriptions pay with ISK. The result was a dramatic hit to the RMT market, who had to drop their prices to compete with a legitimate service replacing their own. As part of Operation Unholy Rage in August of last year, EVE GMs also banned over 6200 accounts belonging to farmers known to be supplying the RMT industry. The effect on the market was instant, with the population in farmed mission systems like Ingunn disappearing overnight. Almost immediately, the farmers reacted with a spate of account hackings to claw back some ISK.
Why Blizzard can't (and won't) sell gold
In any discussion concerning botting, farming, hacking, or gold-buying, someone inevitably makes the argument that Blizzard should cut out the middlemen and sell gold to players themselves. I wanted to use this article to explain why this would not necessarily be a good idea. We don't need to get into the legal situation, or examine why assigning a real-world price to in-game currency edges us closer to a world where in-game property can be taxed. All I have to do is tell you a story from the not-too-distant past that involves: Prices that would make Zimbabwe look like a model of inflationary restraint, and: What happens when money -- in this case, gold -- loses meaning.
Update: Keylogger source identified
Just a quick update from from our friends at World of Raids about the current situation regarding circumvented authenticators. It appears there are multiple websites being used for this malware. Be careful of which sites you go to in order to update your addons from; fake website addresses are being used to trick users. For example, one of the fake sources appears as a "Sponsored Link" right at the top of a Google search. Don't actually visit that site and be sure to warn players asking about addons where to go. What happens is the fake site will allow you to download a fake copy (did you see fake?) of the WowMatrix AddOn Manager which installs the emcor.dll. This Trojan (Malware.NSPack) can currently be detected by Malware Bytes. Thanks Kody!
Man in the middle attacks circumventing authenticators
It has been brought to our attention that Blizzard's technical support department is currently handling a security exploit that is, in a limited capacity, circumventing authenticators. Before we get into the details, please do not panic. This does not make authenticators worthless, and it is not yet a widespread problem. Do not remove your authenticator because of this, and do not base your decision on whether or not to buy an authenticator off of this. They are still very useful, and your account is much safer with an authenticator than it is without one. This is not the only report of this that we've seen, but it is the first time that a Blizzard representative has openly acknowledged that there is something afoot. For a full account of what happened, check the thread on the EU Technical Support forums. To sum up: There is a piece of malware (emcor.dll is what is being reported at the moment) that is being used as a hijacking tool to facilitate Man-in-the-Middle attacks on users. Kropaclus After looking into this, it has been escalated, but it is a Man in the Middle attack. http://en.wikipedia.org/wiki/Man-in-the-middle_attack This is still perpetrated by key loggers, and no method is always 100% secure. source To explain in the simplest way possible, instead of data being broadcast directly to Blizzard when trying to log in to your account, that data is being broadcast to a third party via this malware. This includes your authenticator code. Rather than you logging into your account, the hacker on the other end does so. They log into your account, clear out your characters, and move around virtual funds to fulfill orders from players buying gold. This method of circumvention has been theorized since the release of the key fobs, but it has only now started to actually happen.
The Daily Grind: Locked out
You don't really know the value of account security until it fails you. Or, more accurately, you don't think at all about entering your password until that day when you type it in... and it doesn't work. You double-check it, and it still doesn't work. You don't know if you somehow forgot it, or if you've gotten hacked, or what the issue is... but suddenly playing the game becomes impossible. And suddenly, something as trivial as going in and doing your obnoxious dailies seems like it's an urgent matter. In the best-case scenario, you just forgot the correct password and it can be fixed fairly easily. In the worst-case scenario, you look and find that the recovery e-mail is an address you haven't used in years that no longer functions, and all of your contact information is completely wrong. Because who needs all of that, right? Except that you do now, and you're left kicking yourself for not thinking it through at the time. Have you ever found yourself on the wrong end of getting locked out of an account? What happened? Were you angry, upset, or just ambivalent? Tell us your story, because for better or worse, we've all had to wrestle with security at some point.
Mobile Authenticator available for Android
Blizzard appears to be trying to make it easier for everyone to have an Authenticator and to that end, there is now a Mobile Authenticator for Android. The Android version works just like the iPhone/iTouch app and is available at the Android App store (you can view it via a third party site). Once you get it on your phone, you then link it to your account at the official World of Warcraft Account Management page. We have reports of the app working for people. Though we were unable to find this app from Blizzard directly, we believe it to be legitimate. However, we have contacted Blizzard for confirmation. We'll let you know what they have to say when we hear back from them. Update: Here is the link to the official Blizzard support page for the Android app. Looks like it's legit. Update 2: Here is the official announcement. If you don't have an Authenticator yet, we can't recommend it enough. The added protection an authenticator provides to your account is much greater than the slight inconvenience of needing access to your phone whenever you login. This is particularly the case if you game at internet cafes. %Gallery-49197%
Debunking another hacked authenticator story
One of our readers, Bill, sent us a tip about a WoW account issue on The Consumerist. It seems that the ownership of Anonymous's friend's account is under dispute and Blizzard won't let him use it in the meantime. The ownership became disputed after the account was allegedly hacked, even though there was allegedly a mobile authenticator on the account. His friend has given up on the account, complete with Val'anyr, and has created a new one. We can't confirm any of the facts in this case. I am willing to believe that Anonymous is truly upset and believes the story he tells to be true, even though he is posting anonymously. There are some serious red flags, however, that seem to point to Anonymous not having all of the facts:
Blizzard shines the spotlight on account security
At least judging by the number of emails we've been getting about them, WoW scams have never been more popular than they are now. So I'm very happy to see that Blizzard has launched a new Account Security section on their Battle.net site, featuring tips on how to keep your Battle.net account safe. A lot of it is common sense - things like using an authenticator (which also gets you a nifty Corehound pet), not giving your account name/password to anyone (even if they say they're a Blizzard employee), and keeping up-to-date browser software and anti-virus on your computer. It never hurts to reiterate these things, though; many accounts get compromised every day through not observing these rules.
AionSource.com compromised, e-mails possibly leaked to hackers
Yesterday we reported that a wide number of e-mail password phishing scams were being sent out to Aion users. Today, AionSource.com has sent out an e-mail announcement to all of their users that this new wave of scams may have been due to a hacking attack on their website. Knite Shadowbane, administrator of AionSource, has posted that AionSource.com had been under hacker attack five days ago on the 24th of January. The staff has since cleared the attack and has proceeded to beef up their security, but today's e-mail to all AionSource members warns that their database could have been used for these phishing scams. So, if you are a member of AionSource, keep an eye out for any unusual e-mails coming your way. Even if you aren't a member, always remember to check the source of any e-mails coming to you that request for you to "access your account" or "confirm your password" or require you to log into an unverified source. Knite has also posted a handy guide to securing your account, such as changing your password and installing anti-virus software.
Aion players: Watch your e-mails for scams
Keeping your password for your favorite game safe is always a top priority. No one wants to have their accounts hacked or have their passwords lost to someone who's willing to sell all of their items for gold, kinah, or what have you. So today, as a friendly public service announcement, we here at Massively would like to remind you to make sure you double and triple check any correspondence that looks like it comes from NCsoft or your favorite game company. Today we've received an e-mail telling us that our Aion account password had been changed, and if it wasn't us that we needed to go to the NCsoft master account site and change it back. We can guarantee you that the link provided was not for NCsoft's account management, but a phishing scam. While the scam letter was pretty obvious, always be wary of e-mails you don't anticipate. If you think there's something wrong, don't click any links in the e-mail -- instead go to your account management website directly to check on your account.
Aion's community address for January
Approaching the end of the month means it's time for another Aion community address. It's reliable enough to set your watch by, assuming your watch runs in one-month increments of time. This address promises an increased number of double experience weekends, with one currently running to help players accelerate their leveling. It also promises that character re-customization and gender changing services are on the horizon for players who would like said services, and briefly discusses the need for ongoing improvement in the website. There's a scarcity of hard facts, however, beyond a promise that some of these features should be available in early February. If you were guessing that the community seems a bit... unhappy about this, you'd be guessing right. The comments for this particular entry already stretch into the triple digits, with several players calling for server merges and additional content. It also has no mention about the recent security issues that NCsoft has been contending with, a somewhat sore point for several players. Coupled with the January Eye On Community, the natives seem to be getting a tad restless, especially with no news on the many features previewed in the Visions trailer. We're sure that Aion's team is hard at work, but the fan community seems a bit less docile than before.
Help! My account has been hacked!
There are so many scams going around like the Catclysm Alpha invite and the WoW Armory phishing site, that people's accounts are getting stolen more than ever. With all of the work that Blizzard has to do to keep up with the problem, it's no wonder they are offering the fast solution of care packages. We've talked about how to avoid scams as well as how to protect yourself. Here is a guide as to what to do if your account gets stolen. Important note: The following guide assumes that you have not put an Authenticator on your account. There are no confirmed cases of accounts being stolen if they are protected by an Authenticator.
NCsoft's Game Survelliance Unit speaks out on account security
The extra attention to security measures at NCsoft continues, with the latest being a message on the Aion site from Scott Jennings (GM Luminary) of NCsoft's Game Surveillance Unit. The point of the message is to make sure the players understand what a large, aggressive business the RMT market is. There is a huge amount of money on the line, and those involved are working very hard to make sure the profits keep rolling in. Jennings explained what NCsoft views as their job in this fight and what they've been doing on their end, even detailing a few specific examples of security testing. The message continued with a much longer list: what players can do on their end to protect themselves. While much of it may seem obvious to veteran players, with account security attacks becoming ever more frequent and aggressive, it's a pretty good idea for everyone to read through what Jennings has to say, and be sure you're protecting yourself as much as you can.
Confessions of a gold scammer and identity thief
digg_url = 'http://massively.joystiq.com/2010/01/19/confessions-of-a-gold-scammer-and-identity-thief/'; "We have met the enemy and he is us." The player identified as "Patrick" is not the malevolent monstrosity we'd like to see. Nor is he a victim of circumstance, at that. He acts for all the world like a perfectly normal gamer, and if you didn't know he'd scammed between $10,000 and $20,000 in a year of reprehensible behavior, you certainly wouldn't be able to guess. That's what makes a video interview with him, mirrored and annotated at PlayNoEvil and originally recorded by Marcus Eikenberry, so odd on many levels. The full interview lasts thiry-eight minutes, which makes it a bit long for casual viewing. The article which mirrors the video notes some of the highlights, including when he almost breathlessly exhorts the moment he realized that there was nothing in PayPal's EULA that prevented him from not transferring his EVE Online account to a purchaser on Craigslist. His rationalizing of the actions include the loss of his job and financial instability, even as he begins the interview explaining how he would scam players in both EVE Online and World of Warcraft for fun. His words are unsettling, but what makes them all the more eerie is the fact that without the foreknowledge... there's no way to tell his voice from any of ours. When you have the time, the whole interview is well worth looking at if you're at all interested in account security and the culture of scammers.
CEO of SecurePlay discusses account security
Anyone even slightly in touch with the MMO community is aware that account security has been an even bigger concern than usual for the past few months. While it's more in the forefront of everyone's mind these days, it's important to remember that this isn't a brand new problem. It's very important for people on both sides of a game -- both the player side and the development side -- to work to make player accounts as safe as possible. Steven Davis, CEO of SecurePlay and the mind behind PlayNoEvil, has been watching the events with interest and spent some time recently talking to us about his take on the situation as well as overall account security. Follow along after the jump and see what he had to say.
Breakfast Topic: What are you doing to protect your account?
While it is certainly nothing new, it seems that you can't spit without hitting someone who has, or has had, a compromised account. These WoW account predators are getting more clever by the day, with using everything from keyloggers, sham contests, betas and security checks, to even grabbing an account and immediately attaching an authenticator to it. Now, any moderately-savvy internet user would just scoff, and say that they take all necessary precautions -- what's there to worry about? Fair enough, but what about those who, well, don't? Blizzard has said time and time again about safe-guarding your account information, yet people still jump onto those fake Cataclysm betas and fancy new mount prizes. Make something idiot-proof, and they'll build a better idiot, eh? That being said, what are you doing to protect your prized polygons? Do you have a good anti-virus installed? A malware scanner? If you don't have an authenticator, how come? It's only about the price of a grande Starbucks drink, and will provide a longer-lasting effect of happiness and joy to your life. Discuss amongst yourselves!
In defense of care packages and mandatory authenticators
If you read WoW.com with any regularity, you probably saw and read our pieces on Friday discussing some rather curious policies Blizzard has recently instituted. There are two in particular that I'd like to discuss further: The care package for hacked accounts and the possibility of mandatory authenticators. First, how many of you have had your accounts stolen, or know someone that had theirs stolen? Chances are good every single person that reads this post will raise their hand to that question. The problem is not a small one. I'm in a rather large guild, and every few weeks someone has their account stolen and the little bits of our guild bank they have access to go with them. My large guild is also just one guild in a larger guild alliance which suffers the same problems. Every two weeks or so, someone I see online on a regular basis gets their account stolen.
