WoW players learn value of Windows updates
'Vuln left me naked and penniless'
Subscribers playing World of Warcraft on Windows machines continue to find their accounts stolen more than eleven months after hackers first began targeting them using a Trojan attack, according to posts on the game's official website.
The perpetrators are employing sophisticated techniques that involve hundreds of booby-trapped sites that in some cases use the ANI cursor vulnerability that Microsoft patched last week.
According to an advisory by McAfee, some ANI exploits are being carried out by the same malicious hackers who commandeered the Miami Dolphins football stadium just in time for the Superbowl. The Trojan unleashed in that attack sat dormant on compromised machines until users opened the WoW client, at which point a keylogger captured login credentials, according to the BBC.
The booty can bring in good money on the black market. According to Symantec, WoW account logins are worth about $10, more than the going rate of $6 for verification details on credit cards.
WoW attacks work when users visit hacked websites that exploit Windows machines that have not been updated to fix the ANI flaw or other vulnerabilities. The sites, many of which are related to the popular online game, silently install keyloggers. Once an account is hijacked, the attackers collect the user's points and assets and then sell them. Reports of such attacks date back to at least May of 2006.
The account hijackings are causing considerable consternation among WoW users. "I logged in to my account last Wednesday morning to a naked and penniless Grajtik and associated bank alts," a player who goes by that moniker wrote in an online forum. Many victims have learned of the hijackings only after finding that Blizzard, which publishes WoW, had canceled their accounts, presumably because the hackers have violated WoW rules.
While some of the hijackings were carried by exploiting flaws ahead of an official patch, plenty of exploits have been carried out well after Microsoft issued updates, suggesting some players of WoW still haven't learned the most important and basic security measures.
An official Blizzard posting is urging players to promptly apply security updates and to take other measures to ward off attacks. The company also provides a console called Blizzard Launcher, which scans players' computers for malware. ®
COMMENTS
Proc Run?
Ash, even if you were running linux and are foolish enough to run something in your home directory it'd have a chance at hacking into WoW; the fact is that WoW uses normal widgets which don't encode passwords as their typed and they don't use protected process inputs to stop key logging (although I have no idea if windows api in general offers this feature).
the point is that Blizzard are doing the bare minimum to secure their users through technical means, and it's not helped by the rather lax security offered by the standard windows xp operating system.
I'm playing ATITD on Linux, so there.
Keeping WoW (and other) Credentials Safe
To any WoW player who reads El Reg (Not that anybody who knows about this site won't know this anyway...);
1. Create a Limited (user) account on your PC for each person you want to use it. If you don't know how, search Microsoft.com
2. Do not use any account but a user account to play games, visit websites, check email, watch movies etc.
3. ONLY use the non-limited (Administrator) account to perform updates. WoW updates will load when required, Windows Updates should be set to Notify Before Download or Notify Before Install
I'm willing to bet this ANI vulnerability requires you to be logged on as Admin...
Thick bastards
Come on I mean appart from the odd legitimate sites that have been hacked which must have caught about 3 people. The real reason they get havked isn't trogan, spyware or hackers. The real reason is stupid users that don't know how to use a computer let alone protect it.
I use M$ Windows XP SP1 Semi patched for performance no Antivirus, no anti spyware and no firewall program I am however behind a linux firewall, just blocking ports. I have never had a virus, only the common spyware that comes with windows and tracking cookies and never had my WoW account hacked. WHY i'll tell you
I dont download illegal music from bareshare or limewire i use reviewed Bittorrent sites and binary newsgroups.
I dont open every last peice of crap i get on e-mail only stuff im expecting
I dont surf porn in internet explorer actually i dont use internet explorer i use firefox full stop if a website wont work in forefox it isnt worth looking at. Firefox handles my porn viewing and ever ANI exploiting sites.
These people really should not get there items back at all and call it a good hard lesson of use your brain and learn
Silently installs trojans ?
"...hacked websites that ... silently install keyloggers"
By "silently" I suppose Mr. Goodin is referring to the wonderful IE functionality that allows a web site to "force" a download without user consent.
I discovered that "functionality" by chance because I was surfing with Mozilla at the time and a popup displayed telling me that the site was trying to force a download and did I want it ? Of course, I said no, then it occurred to me to ask myself what IE would have done in such a case. So I did a bit of research on that site and the file it wanted to download.
After having determined that the file was not dangerous enough to worry about if I deleted it straight away (it targeted Outlook, which I do not use), I went for the gold and started IE, typed in the same URL and waited. No warning, no popup and no download window either, but sure enough, when I checked the file was right where it was supposed to be.
Shame on Microsoft for inventing such a fundamentally flawed "functionality", and kudos to just about every other web browser I have ever tried for not allowing such nonsense to continue unchecked.
Visibly, WoW users use IE. It's called a bad practice, and you pay for it sooner or later.
Pascal.
What good will a scanner be?
The scanner will only pick up known malware...
Antivirus packages already detect known malware, and known malware gets patched.
All this scanner will do, is give people a false sense of security as they're being attacked by new, unknown malware. If it's as profitable as it seems to sell stolen accounts, there will be plenty of people churning out new malware all the time.
