Hacking theories

#0 - Aug. 12, 2010, 2:59 a.m.
Blizzard Post
Well it finally happened. My account was "hacked" late last night. They made off with every item all of my toons had, and all of my gold. The worse part is, they also wiped out our guild vault of gold and any of the more valuable items.

I have thought about the theory of hacking a WOW account before, and now that it happened to me I have a small amount of experience. The first thing is, how do they do it? There are a limited number of ways to get access to someone's account.

-Friends sharing info. Its common for teenagers to share info, including access to each other's accounts. Then your friend's friend's friend Sarah gets ticked and logs onto your account and wipes it out.

-Being gullible. This is anything from buying gold from one of those bogus companies, to going to one of the spammed whispers in-game, or even a bogus Blizzard e-mail

-Keyloggers: Someone actually goes through the effort to record your keystrokes and gets your info when you log on. This requires software to be installed on your PC, so having a good firewall and good anti-spyware and anti-virus software should keep this from happening.

-Shared PC. Have a PC in the livingroom, with a house full of people? kids always coming and going?

-Shady add-ons? 3rd party add-ons can be a real problem, mainly all of the lesser known ones.

Then there is the "paper trail". There is NO way I can think of for someone to get away with a theft from an account. O.K., they jack the account. Next they sell anything they can to get quick gold. They take that gold, and mail it to their other toon. Instand paper trail, and Blizzard would nail them almost instantly. Or they could try to "launder" it, and mail it through several accounts. It still leaves a trail, and wherever that gold stops is the thief's account.

I feel my account is about as secure as it can get. My password wasn't the same as what I used anywhere else. Absolutely NOBODY knows my password but me. No friends, no family. The only people who come through my home are adults- my wife, her parents, etc. Very few people ever come here, and NOBODY who even knows what WOW is, let alone plays it. My PC has a good firewall. I also have a good antivirus software that runs a scan every night. After I got hacked I ran scans using AVG, Ad-Aware, and Malwarebytes. NOTHING. I'm not gullible- I don't respond to spam, I don't click on any Blizzard e-mails, I don't buy gold. I only access WOW from ONE PC, and nobody has access to it but me. I only use one add-on, and its probably the most popular one in WOW, from a very large name source. Yet somehow I still got hacked.

I want to find the source of the security breach, so it won't happen again. But so far I can't find a possible source.
#6 - Aug. 12, 2010, 7:38 a.m.
Blizzard Post
Email accounts can also become compromised.

No one can protect against a zero-day vulnerability 100%, that's why they are zero-day vulnerabilities :)

Good security habits it sounds like you have. Vigilance, sounds like you have that as well.

I'd recommend adding an authenticator as an added layer of protection.

Naturally, you'll want to report this just as soon as possible so we can look into a restoration investigation for you and your guild.

Blizzard Store
http://us.blizzard.com/store/browse.xml?f=c:6

Mobile Authenticator
http://us.blizzard.com/support/article.xml?locale=en_US&articleId=26109

Now that you know this can happen even with the most care and best intentions, please also talk to your guildmembers about the need to be both careful - and protected.

I hope Dante has reserved a special circle for these guys, no one should ever have to suffer this kind of violation. We'll certainly do our very best to try to help.