Skip to main content

World of Warcraft account hacked

I'm upset.  My World of Warcraft account was attacked in the early hours of this morning and I'm unable to figure out why.  The two computers that I use to play WoW have active malware scanners..  I change the password occasionally.  I definitely don't fall for scams that try to get you to send your login information to someone for something in return, and yet someone managed to get in.  I'm stumped how they managed to get in, or why they decided to target my user.

They immediately changed the password and recovery information, of course, so I couldn't regain control of the account.  They also stripped bare every character I had on every realm.  I'm assuming this, of course, since I still don't have access to the account, but the evidence is there on WoW Armory: every character I check is missing all sellable gear.  I was notified by one of my guild masters during the day that they had also looted the guild vault, since I had at least one privileged character in that guild.

Blizzard, of course, has not yet responded to my emailed entreaties.  Their billing phone number claims—every single time it's called, even after hours—that they're receiving high enough call volume that they've disabled incoming calls.

I can't imagine why.  Maybe it's a flood of annoyed customers.  Every friend of mine who has played WoW, past or present, has reported having their account hacked at some point.  Many of these people are ones for whom computer security is part of their daily jobs and responsibilities, not just an annoying afterthought to work around.  You don't hear about this scale of computer security breaches from any other sector, why WoW?

Given the rampant in-game spammers—advertising gold that was in many cases stolen from the users they're advertising to, no less—who fill Trade chat with their adverts at all hours, I wonder if Blizzard really has a profit motive to do more to block malicious usage of the game.  Every spammer advertising in-game is a paid user, else they wouldn't get in, whether or not it's been stolen or legitimately paid for.  None of the friends I've spoken with that previously had their gear stolen has stopped playing.  What, then, would motivate Blizzard to actively fix the problem when this occurs?  I can't really think of anything.

Perhaps it's just sour grapes.  I'll let you know if I ever get a hold of a person at Blizzard and get my account back, much less my gear and items.  I'm seriously tempted to punt this game out of the house for good.

Comments

  1. Oops, I failed badly to follow up on this.

    I got ahold of someone at Blizzard shortly after this post and they were able to roll back all the looting (including the guild vault). I also upgraded to using two-factor authentication to prevent this kind of attack.

    Once you get ahold of someone at Blizzard, their support staff are friendly and very helpful.

    ReplyDelete

Post a Comment

Popular posts from this blog

Java command line app with Spring and Gradle

Many Java developers have had to build a command line app for one reason or another over the years, and there are many(!) ways to do it.  There are a bevy of command line libraries, some people roll their own when they get to this point (which is one reason why there are so many command line libraries!), and others just pull in the arguments simply and directly, eschewing a library. However, writing a tool, a developer should just focus on the meat of the problem rather than having to worry about the enabling functionality that allows it to work.  The Spring Framework very much supports this approach to development with its inversion of control (IoC) container and a myriad of other features. To support that approach for command line applications, the spring-cmdline library provides a bridge between the Spring framework and the JOpt Simple command line library. This tutorial will show how to leverage the spring-cmdline library to stand up a very simple command line ap...

manifest classpath + taglib jars + Tomcat = FAIL

I found an interesting side-effect of using manifest classpaths in our application jar files as it applies to taglib jar dependencies and embedded Tomcat 6. ·          Manifest classpaths do not appear to be expanded in the URLClassLoaders that load the jars with the manifests, so only the jar file referenced directly on the classpath are included in its URLs. The taglib search mechanism in Tomcat 6 (haven't checked Tomcat 7 to see if there's a difference) only walks the classpath looking for URLClassLoaders, looking at the underlying JAR URLs. Thus, if the taglib jar is referenced only as a dependency in the manifest of the main jar file and is not specifically on the classpath, it will not be spotted and use of that taglib by the JSP engine will throw an exception. This problem won’t actually show up in tests as IDE environments and builds generally include all the jar files in the classpath, so this one will bite you at runtime. ...