Hacked account hunting info

#0 - Sept. 21, 2010, 2:18 p.m.

I have been actively hunting hacked accounts in WG for some time now. The use of blackened warg steak tracking humanoids etc.. While the count percentage of the ones I catch and report are from dormant accounts, there are a few from non-dormant accounts. Th ratio is about 9-1 dormant over hacked active account which may be created or new accounts. Now What I am getting at is this.....For a company to have access to dormant account inforamtion points to a sever security breach within Blizzard. It appears as though Battlenet or some blizzard employees are selling this information. The problem is global to all servers and accounts, not just a few targeted servers. The Database that would be required to scan all online users and happenchance to dedect dormancy is like looking for a drop in the water that fell in the ocean. However, The Ability to replace a banned hacker with a new one from dormant account information passed out from an employee is More obviously the actions needed to sustain the game hackers. I have also noticed that hacked accounts are now able to go through authenticators from conversations on the subject. This describes the ability to apply a new authenticator to account of a dormant toon. We can complain and report the little fires but the problem is global and security based. While we spend the time to report the hackers and blizzard has employees to take these reports and act on them a global fix is required. For instance:
1. Bring back a in game GM toon on each server. They can police hackers expediantly, and police any other ingame problems such as harassments exploits etc...
2. Blizzard may be spending so much time putting out little fires that the cost of employees hired to be in game GM toons may be more appropriate.
3. Security is by far failing at a faster rate than before authenticators, and battlenet. too much information is being spread out across to much population outside of the game.
4. One real problem is the free trade aspect of the game, leaving too much opportunity to exploit. As the global economy has been opened up from expansion of the ability to transfer goods and funds through world server and faction swapping goods leaves more secuity holes to exploit.

Now realizing that the fire is out of control, and the economies are being destroyed and multimillion dollar companies farm this game through ways of exploiting gold selling..gear selling..etc.. People have found ways to creat actual real life incomes off of this game. The demand for real life money outweighs the security of this game. This demonstrates a global failure of Blizzard. Apologies dont cut it anymore.
If a company stands to make thousands per day exploiting this game then it wont take much to slip some employee some severe life changing income to breach security of accounts.
With any organization global problems start at the top. You must fix this by looking in that direction not the matchsticks thrown into a wildfire. With cata being released soon all eyes are upon these things and I wonder...will this growing intolerance of the people whom funded blizzard with our money be the end of WOW? many new games are being released soon and the migration from wow may be innevitable.
Blizzard..... it's time you stepped up to the plate peeps.....

Harlsoco

#6 - Sept. 21, 2010, 2:57 p.m.

WTB less wall of text. :/

Ã€mÃŸÃ ssÃ dÃ³r –

I can assure you are servers have not been compromised. As a publicly traded company it would be our responsibility to announce something of this nature to our player base. To this day we have not made an announcement of the sort. We implement the highest level of security to ensure our player’s information is safe. Not to mention if our databases were compromised, millions of players would be affected and our in game queue times would dramatically increase.

Security of the accounts and the computers on which they access the game are the responsibility of the account holders themselves. We cannot police websites people visit or who they give their information to. We can only provide our players ways to protect themselves. It is what they do with that information that is key.

Q u o t e:
How do you explain the accounts hacked using authenticators?

While this thread is from March of this year, the information is still relevant on how accounts with authenticators can be compromised:

Q u o t e:
http://forums.worldofwarcraft.com/thread.html?topicId=23425467207&sid=1

As a part of our ongoing security awareness efforts, we wanted to share some information about a trojan we've found to be involved in a small number of recent account compromise cases. Computers infected with this type of trojan allow a third party to view account credentials as they're entered into the game during login. Due to how this particular trojan functions, both those with and without Battle.net Authenticators are vulnerable to possible compromise.

How It Works:
This type of trojan is often referred to as “Man-in-the-Middle,” and it circumvents security measures on the user’s machine by intercepting information (including account name, password, and temporary Authenticator passcode) in between the player's input and the World of Warcraft client. Once the information is intercepted, the compromised account is accessed, and often the password is changed to prevent the account owner from quickly reclaiming it. This process can take place in the short window before the temporary Authenticator passcode expires.