Feeds

WoW players learn value of Windows updates

'Vuln left me naked and penniless'

Gartner critical capabilities for enterprise endpoint backup

Subscribers playing World of Warcraft on Windows machines continue to find their accounts stolen more than eleven months after hackers first began targeting them using a Trojan attack, according to posts on the game's official website.

The perpetrators are employing sophisticated techniques that involve hundreds of booby-trapped sites that in some cases use the ANI cursor vulnerability that Microsoft patched last week.

According to an advisory by McAfee, some ANI exploits are being carried out by the same malicious hackers who commandeered the Miami Dolphins football stadium just in time for the Superbowl. The Trojan unleashed in that attack sat dormant on compromised machines until users opened the WoW client, at which point a keylogger captured login credentials, according to the BBC.

The booty can bring in good money on the black market. According to Symantec, WoW account logins are worth about $10, more than the going rate of $6 for verification details on credit cards.

WoW attacks work when users visit hacked websites that exploit Windows machines that have not been updated to fix the ANI flaw or other vulnerabilities. The sites, many of which are related to the popular online game, silently install keyloggers. Once an account is hijacked, the attackers collect the user's points and assets and then sell them. Reports of such attacks date back to at least May of 2006.

The account hijackings are causing considerable consternation among WoW users. "I logged in to my account last Wednesday morning to a naked and penniless Grajtik and associated bank alts," a player who goes by that moniker wrote in an online forum. Many victims have learned of the hijackings only after finding that Blizzard, which publishes WoW, had canceled their accounts, presumably because the hackers have violated WoW rules.

While some of the hijackings were carried by exploiting flaws ahead of an official patch, plenty of exploits have been carried out well after Microsoft issued updates, suggesting some players of WoW still haven't learned the most important and basic security measures.

An official Blizzard posting is urging players to promptly apply security updates and to take other measures to ward off attacks. The company also provides a console called Blizzard Launcher, which scans players' computers for malware. ®

Boost IT visibility and business value

More from The Register

next story
Kate Bush: Don't make me HAVE CONTACT with your iPHONE
Can't face sea of wobbling fondle implements. What happened to lighters, eh?
Apple takes blade to 13-inch MacBook Pro with Retina display
Shaves price, not screen on mid-2014 model
iPhone 6 flip tip slips in Aussie's clip: Apple's 'reversible USB' leaks
New plug not compatible with official Type-C, according to fresh rumors
FEAST YOUR EYES: Samsung's Galaxy Alpha has an 'entirely new appearance'
Wow, it looks like nothing else on the market, for sure
The agony and ecstasy of SteamOS: WHERE ARE MY GAMES?
And yes it does need a fat HDD (or SSD, it's cool with either)
YES YES YES! Apple patents mousy, pressure-sensing iVibrator
Fanbois prepare to experience the great Cupertin-O
Steve Jobs had BETTER BALLS than Atari, says Apple mouse designer
Xerox? Pff, not even in the same league as His Jobsiness
TV transport tech, part 1: From server to sofa at the touch of a button
You won't believe how much goes into today's telly tech
Apple analyst: fruity firm set to shift 75 million iPhones
We'll have some of whatever he's having please
prev story

Whitepapers

5 things you didn’t know about cloud backup
IT departments are embracing cloud backup, but there’s a lot you need to know before choosing a service provider. Learn all the critical things you need to know.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.