Feeds

WoW players learn value of Windows updates

'Vuln left me naked and penniless'

The Essential Guide to IT Transformation

Subscribers playing World of Warcraft on Windows machines continue to find their accounts stolen more than eleven months after hackers first began targeting them using a Trojan attack, according to posts on the game's official website.

The perpetrators are employing sophisticated techniques that involve hundreds of booby-trapped sites that in some cases use the ANI cursor vulnerability that Microsoft patched last week.

According to an advisory by McAfee, some ANI exploits are being carried out by the same malicious hackers who commandeered the Miami Dolphins football stadium just in time for the Superbowl. The Trojan unleashed in that attack sat dormant on compromised machines until users opened the WoW client, at which point a keylogger captured login credentials, according to the BBC.

The booty can bring in good money on the black market. According to Symantec, WoW account logins are worth about $10, more than the going rate of $6 for verification details on credit cards.

WoW attacks work when users visit hacked websites that exploit Windows machines that have not been updated to fix the ANI flaw or other vulnerabilities. The sites, many of which are related to the popular online game, silently install keyloggers. Once an account is hijacked, the attackers collect the user's points and assets and then sell them. Reports of such attacks date back to at least May of 2006.

The account hijackings are causing considerable consternation among WoW users. "I logged in to my account last Wednesday morning to a naked and penniless Grajtik and associated bank alts," a player who goes by that moniker wrote in an online forum. Many victims have learned of the hijackings only after finding that Blizzard, which publishes WoW, had canceled their accounts, presumably because the hackers have violated WoW rules.

While some of the hijackings were carried by exploiting flaws ahead of an official patch, plenty of exploits have been carried out well after Microsoft issued updates, suggesting some players of WoW still haven't learned the most important and basic security measures.

An official Blizzard posting is urging players to promptly apply security updates and to take other measures to ward off attacks. The company also provides a console called Blizzard Launcher, which scans players' computers for malware. ®

Build a business case: developing custom apps

More from The Register

next story
4K video on terrestrial TV? Not if the WRC shares frequencies to mobiles
Have your say with Ofcom now, before Freeview becomes Feeview
YES, iPhones ARE getting slower with each new release of iOS
Old hardware doesn't get any faster with new software
iPad? More like iFAD: We reveal why Apple fell into IBM's arms
But never fear fanbois, you're still lapping up iPhones, Macs
Nice computers don’t need to go to the toilet, says Barclays
Bad computers might ask if you are Sarah Connor
You didn't get the MeMO? Asus Pad 7 Android tab is ... not bad
Really, er, stands out among cheapie 7-inchers
Apple winks at parents: C'mon, get your kid a tweaked Macbook Pro
Cheapest models given new processors, more RAM
VMware builds product executables on 50 Mac Minis
And goes to the Genius Bar for support
Leaked Windows Phone 8.1 Update specs tease details of Nokia's next mobes
New screen sizes, dual SIMs, voice over LTE, and more
Microsoft stands on shore as tablet-laden boat sails away
Brit buyers still not falling for Windows' charms
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Maximize storage efficiency across the enterprise
The HP StoreOnce backup solution offers highly flexible, centrally managed, and highly efficient data protection for any enterprise.