Blizzard announces automated account recovery form for hacked accounts
by Mathew McCurley 
Sep 22nd 2010 at 3:00PM
Blizzard has just announced a new, speedier way to get help and answered about your hacked account, stolen items, authenticator issues and more! Now, under the new system, you will not have to email or call Blizzard to get these matters into its queue -- simply use the Account Recovery Form.
Calling the new method a "One-Stop Shop" for dealing with account recovery issues, Blizzard has automated the process by which Battle.net accounts can be recovered, dealt with and restored faster than otherwise.
Remember never to share your password with anyone and that Blizzard will never ask for your password. Also, one of the most prevalent ways that hacks, Trojans and keyloggers are spread is through malicious files that pose as addons, so to keep yourself unharmed, remember to only download addons from safe, reliable locations like WoWInterface or Curse.
I cannot commend Blizzard enough for this move. Thank you, Blizzard. In return, we will try really hard to stop getting hacked. Check out the full announcement below:
Items missing? Password changed? Characters transferred to realms you haven't even heard of? Being asked for an authentication code even though you don't have an Authenticator? If any of these questions match the ones you're asking yourself right now, your account might be compromised.
Now, don't panic. Blizzard Entertainment's Customer Service teams are here to help you. There is no need to create a trial account to be able to submit an in-game petition, nor are you required to have a friend submit one on your behalf. To restore access to your account as quickly as possible, please visit our Account Recovery page and be prepared to verify your account information.
With the introduction of our new Account Recovery Process, you should no longer be required to try calling or e-mailing our Billing & Account Services department to remove an authenticator that may have been placed on your account without your authorization.
All you will need to do is fill out our new Account Recovery Form: (https://us.battle.net/account/support/secure-computer.html).
How does it work?
Consider this your "One-Stop Shop" for reporting a compromised account. We'll ask you a series of questions that only you should know the answers to. After we are confident that you are who you say you are, our automated recovery process will take over and attempt to restore your access to the Battle.net account as soon as possible.
This process will issue a password reset e-mail for the Battle.net account that has been compromised as well as create a service ticket (petition) to have an investigation initiated. You will be unable to view this ticket when logged into the game, you should, however, receive a message to your e-mail address containing your ticket number and other information.
What do I do after I fill out the Webform?
• Check your e-mail account for two e-mail messages: one to reset your password and one containing your service ticket information.
• Consider adding a Battle.net Authenticator to protect the account: (http://us.blizzard.com/support/article/26552).
• Take a deep breath... Our customer service team will do the rest.
Now, don't panic. Blizzard Entertainment's Customer Service teams are here to help you. There is no need to create a trial account to be able to submit an in-game petition, nor are you required to have a friend submit one on your behalf. To restore access to your account as quickly as possible, please visit our Account Recovery page and be prepared to verify your account information.
With the introduction of our new Account Recovery Process, you should no longer be required to try calling or e-mailing our Billing & Account Services department to remove an authenticator that may have been placed on your account without your authorization.
All you will need to do is fill out our new Account Recovery Form: (https://us.battle.net/account/support/secure-computer.html).
How does it work?
Consider this your "One-Stop Shop" for reporting a compromised account. We'll ask you a series of questions that only you should know the answers to. After we are confident that you are who you say you are, our automated recovery process will take over and attempt to restore your access to the Battle.net account as soon as possible.
This process will issue a password reset e-mail for the Battle.net account that has been compromised as well as create a service ticket (petition) to have an investigation initiated. You will be unable to view this ticket when logged into the game, you should, however, receive a message to your e-mail address containing your ticket number and other information.
What do I do after I fill out the Webform?
• Check your e-mail account for two e-mail messages: one to reset your password and one containing your service ticket information.
• Consider adding a Battle.net Authenticator to protect the account: (http://us.blizzard.com/support/article/26552).
• Take a deep breath... Our customer service team will do the rest.
Filed under: News items, Account Security
Reader Comments (Page 1 of 5)
t0xic Sep 22nd 2010 3:05PM
Sounds great. Waiting for the better part of a week to get your account back is not fun. Realizing all your stuff isn't recovered afterward makes it worse.
How do they prevent keyloggers from getting this info and resetting your account again after you reset it? I hope they have a series of challenge questions (random?) like banks or something.
Teresa Sep 22nd 2010 3:14PM
Thats why the steps show scanning your system BEFORE you go to recover the account. Most just skip over that and get hacked again.
Grovinofdarkhour Sep 22nd 2010 3:17PM
Come to think of it, why exactly can't operating system designers simply write their code to not allow any third-party script that records keystrokes?....
Teresa Sep 22nd 2010 3:21PM
Because keyloggers are legal. Many companies use them to make sure employees aren't misusing company time, or just a way to keep tabs on them.
steelfan555 Sep 22nd 2010 3:22PM
How would you regulate the difference between a keylogger or a Word Processor then?
Spark Sep 22nd 2010 4:35PM
-----
Grovinofdarkhour Sep 22nd 2010 3:17PM
Come to think of it, why exactly can't operating system designers simply write their code to not allow any third-party script that records keystrokes?....
-----
No kidding. We should just get rid of the damn keyboards. That'll teach them keyloggers!
I reviewed a security document at a Federal institution once that recommended system administrators ensure that the keyboard to any server was not visible from the room's doorway. This apparently was meant as a way to avoid attracting hackers. Hackers are, after all, a combination of ninja and fly.
On a more serious note, I hope you're not under the impression that keyloggers are implemented in WoW addons (LUA script) or Websites' JavaScript.
Grovinofdarkhour Sep 22nd 2010 5:11PM
OK fine, *records AND transmits* keystrokes. I just can't shake the feeling that operating system designers could easily solve this problem. Not saying they deserve the blame for it, they clearly didn't create the problem, but they're in the optimal position to do something about it, if only they had some motivation to do so.
Spark Sep 22nd 2010 5:37PM
-----
Grovinofdarkhour Sep 22nd 2010 5:11PM
OK fine, *records AND transmits* keystrokes.
-----
You mean like WoW does?
If this were a trivial issue to deal with, it'd be handled in the OS by now. Even if it wasn't, various anti-malware / anti-spyware suites would have the issue all sewn up. They've got keylogger detection in their products now but you're going to get false positives.
Artificial Sep 22nd 2010 5:39PM
"Hackers are, after all, a combination of ninja and fly."
lol... but seriously, the advice isn't that bad. "Hackers" can be coworkers that can have widely varying levels of gruntledness. The person you fully expect to be walking by and even stopping in the doorway to chat with you needs no ninja skills...
Rimar Sep 22nd 2010 6:01PM
This week I got an email from Blizzard (legitimate) saying the password on my old account had been changed. This account has been non-paid for at least 3 months (without me even trying to log into it). I go to the account and yes - password is changed.
The account has an authenticator on it, my computer has no malware or viruses. Even my wife doesn't know the password. I did the automated recovery which worked fine. When I got back into the account only the password had been changed. The authenticator was still on the account.
My question is this - how was this account compromised?
Ata Sep 22nd 2010 6:47PM
Rimar -
A lot of accounts are 'brute forced' these days. Even if your system is clean (check with more than one spybot/virus program to be sure!) hackers with a lot of time on their hands can pick random emails and run programs that brute force the password, IE, they took a lot of wild guesses. AFAIK, WoW does not have a 'you cannot log in for X amount of time due to failed passwords' feature that a lot of banks and the like have, so they just keep guessing. Programs can do this super fast, without any human input. This is commonly how free web emails get hacked into for spammers, too.
Mirantha Sep 22nd 2010 8:41PM
Kudos to Blizzard for coming up with this system. Hopefully, it will lead to quicker and less painful recoveries for thos affected, and it should help lessen the phone queues for Billing & Accounts Services. The only possible problem I can see is if the user still has some compromise on their machine and they proceed in filling out the details requested from this form - you may be potentially passing along secure information to the keyloggers. I would recommend that people complete these forms from another machine, one that is not compromised, just to help eliminate that possibility.
Saltypoison Sep 22nd 2010 3:06PM
While hopefully this greatly reduces queue times for CS matters, I really hope they are considering including an authenticator in each Cata box, or some sort of voucher to obtain one. You'd think this would ultimately save them money from a cost perspective, given how much compromised accounts must cost in manpower alone.
wutsconflag Sep 22nd 2010 4:05PM
Frankly, I think they should just go the route of making authenticators mandatory, and include one in every new World of Warcraft box (Vanilla, TBC, Wrath, Cataclysm) starting with the release of Cataclysm.
Don't want an authenticator? Okay, you can't upgrade to Cataclysm. Seems simple enough, especially if you get a free one with each box. (There would be a problem for people who only buy digital downloads, but I'm sure Blizzard can find a way to address that.)
t0xic Sep 22nd 2010 5:34PM
@wutsconflag
The cryptography contained in the authenticator is export controlled in the US. There are laws preventing Blizzard from putting them in every box. I agree that it's a good idea, but it's just not possible with current laws.
http://en.wikipedia.org/wiki/Export_of_cryptography_in_the_United_States
Cyno01 Sep 22nd 2010 6:19PM
@t0xic
Bullshit. This has been debunked 100 times, please stop spreading false information. An authenticator is nothing but a clock with an algorithm tied to the serial number to display the time in a non-standard manner. There is no cryptography in the device, its made in china and banks around the world use the exact same device without the blizzard sticker on it.
I would be happy to pay $45 for cataclysm instead of $40 if they put an authenticator in every box, even though i already have one, and made it mandatory, it would mean shorter CS times for everyone. Just last week i had to wait 12 hours for a 30 second answer to a question, thats just ridiculous.
Spark Sep 22nd 2010 7:38PM
-----
Cyno01 Sep 22nd 2010 6:19PM
@t0xic
Bullshit. This has been debunked 100 times, please stop spreading false information. An authenticator is nothing but a clock with an algorithm tied to the serial number to display the time in a non-standard manner. There is no cryptography in the device, its made in china and banks around the world use the exact same device without the blizzard sticker on it.
-----
You're both wrong. If cryptography import/export laws are an issue, it's likely to be another country's import laws that makes the Authenticators risky. The US laws have changed drastically over the years (although not completely unrestricted). There are some countries (including China - stark contrast considering Vasco's production) with very restrictive import laws. Although I have to wonder if the Authenticator creates a problem whether the WoW client and Warden wouldn't also be issues.
In any case... the debunking is bunk. The Authenticators are encryption devices. They do HMAC-SHA1 against a 160bit secret key and a time calculation (and then select a portion of the resulting hash to use for authentication). The secret is known by Blizzard's authentication server and your Authenticator. Your Authenticator's S/N is just a reference (S/N X = Key Y).
If you want to work out all the math for that, you can Google for HMAC-SHA1 and OATH HOTP. It's all much more complex than the "debunking" would make it appear (it's more complex than I make it appear).
Hone Melgren Sep 23rd 2010 3:01PM
NIce idea but impractical..
Your assuming that Blizzard make the authenticators.
They don't. A third party company Vasco both makes them and also owns the patent for the particular model of device that is the Blizzard Authenticators. This company has plenty of other corporate customers , some Bigger then Blizzard that they have to fill orders for.
The only way would be for them to of ordered enough shipments of Authenticators way ahead of time. And there have been several Occasions when the Authenticators have been sold out of the Blizzard store and they've had to wait on shipment from Vasco. Not looking good on the whole stockpiling thing.
Also some people with wicked fast internet will be downloading the expansion anyway. What do you say to them?
pyrostorm1 Sep 23rd 2010 9:16PM
I would totally buy a CE of Cata if it came with a special limited edition authenticator that had a hologram on it
Moeru Sep 22nd 2010 3:06PM
Well, if ever I get hacked, this will be useful.
Of course, if people stopped clicking every link in their emails we wouldn't need recovery processes.