Skip to Content

WoW Insider has the latest on the Mists of Pandaria!

Posts with tag security

Battle.net authenticator process updated with smarter log-in detection

A substantial updated to the Battle.net authentication system was announced today. Players will soon notice a change to their authenticator log on -- it just might not appear. Blizzard's login servers and authentication system now intelligently track where your account is logging into the game from and, if you're consistently logging in on your home computer, the authentication servers will let you pass, no code needed.

Blizzard wants make the authentication process less intrusive and this is a first step towards that goal. Right now, having to input a code each and every log in is a pain, sure, but it also makes me feel secure. I'm never going to say no to more security, however, and if the system is something that can accurately figure out where I am and let me on, that's great.

This doesn't take into consideration the circumstance where you use an authenticator to prevent access to WoW, even from the home PC. I know some parents who use a simple password that their kids can remember but use the authenticator as the gate to prevent unwanted play. Maybe there will be an opt-out feature of some kind to always ask for the code.

You can check out the Battle.net account security page or check out the Blizzard mobile site for application information. For more information on this specific change to the authenticator system, follow me after the break.

Read more →

Filed under: Blizzard, Account Security

The Lawbringer: Account management and you

Pop law abounds in The Lawbringer, your weekly dose of WoW, the law, video games and the MMO genre. Running parallel to the games we love and enjoy is a world full of rules, regulations, pitfalls and traps. How about you hang out with us as we discuss some of the more esoteric aspects of the games we love to play?

Writing The Lawbringer has taught me a lesson in trends. Over the past few months, specific questions are sent to me in topical batches. Sometimes it is a few emails about selling accounts. Other times, I get four to five emails about account security or compromise. May's email topic of choice was transferring accounts to family members.

Blizzard is very restrictive about what you can and cannot change regarding your account information. On the one hand, it is your account, right? Shouldn't you have ultimate control over the information you provide for the facilitation of a service you pay for? On the other hand, there is a certain degree of problem mitigation that comes with restrictive change. If Blizzard can control certain aspects of what you do with your account and the information it is all filed under, problems can get mitigated before they appear. Today's topic is really all about damage mitigation.

Read more →

Filed under: The Lawbringer

First Core Hound Pup adoption campaign winners announced

Blizzard's Core Hound Pup Adoption Campaign is giving players the chance to win an iPad as well as boost their own account security. In an effort to get more authenticators attached to accounts, Blizzard ponied up some iPads to get the job done. Each month, a screenshot entry is chosen to win one of 12 iPads. Just take a screenshot of you and your security pup companion doing something crazy, out of the ordinary, or just plain awesome, hit up the contest rules page, and you've got a shot at winning. The first four winners have just been announced and their screenshots released.

Read more →

Filed under: Contests, Account Security, Cataclysm

RSA security hack not affecting Blizzard authenticators

Many people were quick to wonder and worry about whether the recent hacking of the RSA (the security branch of EMC) had the potential of harming Blizzard's authenticators or authentication software. Fear not, as the blues have chimed in with a response:

RSA Hack and Blizzard Authenticators
Pokzin,

The Blizzard Authenticators are based off modified Vasco tokens. I'm sorry to hear about RSA's troubles, but it will not affect the Blizzard Authenticator.

It doesn't look like Blizzard will be harmed by this at all. As a reminder, please keep your account safe by not clicking links in emails that don't appear to be from Blizzard, always check your email headers for incoming email addresses, and if you have any questions about whether an email is legitimate, contact Blizzard first. And do please get an authenticator for your account. Check out some of our own security articles here.

Filed under: Blizzard, Account Security

Blizzard posts new account security guide

Make no mistake: it really sucks when your WoW account gets compromised. Even with the speed with which compromises are handled by the support department nowadays, it's still a pain to have to wait to get your stuff back -- and it's even worse to know that someone was in there mucking around with your dudes, you know? Blizzard's been better about helping people with account security problems recently, like giving out free authenticators to some hacked accounts and offering a free phone-in authenticator service, but in the end, a lot of the responsibility falls on you the player to keep your account secure.

To that end, Blizzard has assembled a new account security guide. It's a pretty comprehensive list of the steps you can take to secure your account, from getting an authenticator to learning how to recognize phishing emails to making sure that your computer itself is secured through the use of antivirus software. Learn it, live it, love it. In account security, as in Planeteering, the power is yours.


Filed under: News items, Account Security

Breakfast Topic: What made you decide to get an authenticator?

This Breakfast Topic has been brought to you by Seed, the Aol guest writer program that brings your words to WoW Insider's pages.

Once again, Blizzard is encouraging its players to use authenticators to protect their Battle.net accounts. In addition to the incentive of a lovable Core Hound Pup pet provided to all World of Warcraft characters on an account that has an authenticator attached, there is now a contest going on to win an iPad for your best Core Hound Pup screenshot, and we've even received reports that free authenticators are being offered to owners of accounts that have previously been compromised. Still, incentives alone aren't enough for some players. Sometimes it takes an incident to drive the point home.

For me, it was a hacking scare involving my girlfriend's account. We had just resubbed to WoW in preparation for Cataclysm and were having a blast when she got a notification from Blizzard that her account had been locked due to an unauthorized break-in. Nothing was gone, no items destroyed, no gibberish-named level 1s created, but she did have to change her password and verify to Blizzard that she was still herself. She was playing on a Mac, used Adblock and had disabled Flash on her browser, and she only visited a handful of websites on a daily basis, all very innocuous places like Gmail and WoW Insider. We figured it was an isolated incident, but just to make sure, she wiped her hard drive and reinstalled WoW. Then, a week later, it happened again. I couldn't believe it, and I still don't know how or why she was targeted, but I ordered our authenticators the very next day. We haven't had a problem since.

What convinced you to get an authenticator? Was it a contest, a promotion by Blizzard, or a hacking scare? If you don't have an authenticator yet, what's holding you back?

Adobe announces new Flash security vulnerability

On Sept. 13, Adobe Systems released a security advisory detailing a vulnerability in its Flash Player 10.1.82.76 for earlier versions of Windows, Mac, Linux and Solaris, and Adobe Flash Player 10.1.92.10 for Android. The vulnerability also affects Adobe Reader 9.3.4 for Windows, Macintosh and Unix and Adobe Acrobat 9.3.4 for earlier versions of Windows and Macintosh. The vulnerability allows remote attackers to cause a denial of service crash and execute a code to take control of your system by delivering this malicious code through a specially crafted PDF or Flash file.

For WoW players, this can mean infection by keyloggers that could potentially steal your login information and compromise your account.

Adobe Systems is working on a patch to stop this type of attack from being possible and plans to make it available the week of Sept. 27, with plans to update Adobe Reader 9.3.4 and Adobe Acrobat 9.3.4 the week of Oct. 4.

Read more →

Filed under: News items, Account Security

Email confirmation added to authenticator setup to foil hackers

For a while now, account thieves have been putting authenticators on their stolen accounts to buy more time for their scumbaggery. Blizzard has recently made that more difficult by requiring email confirmation when an authenticator is added to a Battle.net account. Rather than just logging in and putting in the appropriate information, you now have to follow the steps in a confirmation email sent to the address registered in your Battle.net account.

Note: Changing the email address on the account requires not only your password (which the account thieves already have at this point) but also the answer to your security question. So make sure the answer to your security question is not guessable or obtainable by any phishing information. As I have suggested before, if you use a password for your security answer rather than an actual answer, you are adding a very thick level of security. Make it a separate password you use just for security questions, like p45sw0rd (don't use that one).

We don't know how long ago Blizzard added email confirmation The email confirmation has been active since July 27 and we believe it will reduce the workload of Blizzard's customer service. More importantly, this will make getting your account back less painful.

Of course, the best way to prevent someone from stealing your account and then adding an authenticator to it is to put an authenticator on it yourself. There are keyfob and mobile versions available.

[Thanks for the tip, Joel!]

Filed under: Blizzard, News items, Account Security

Ventrilo vs. Mumble

"What's your Vent info?" is as ubiquitous as "What's your GearScore?" Voice chat programs are a fact of WoW life, and by all means Ventrilo dominates the market. After five years of using Ventrilo, I say it's time to change to something better.

One of the most common questions I get from the show Big Crits is "what's the mod that shows who's talking in Vent?" It's actually not a mod, and in fact it's not even Ventrilo. Big Crits uses Mumble, a low latency VOIP program for gaming. It's mostly unknown in WoW, as Ventrilo clearly dominates voice chat in our world. Mumble is perhaps better known in FPS circles, where the low latency really gives it a competitive advantage.

I started this article with every intention of making a pros-and-cons comparison between the two programs, but in truth, I had a hard time coming up with pros for Ventrilo. I'll run through features, but don't be surprised if you come out of this with a new perspective on voice chat options and a strong desire to switch to Mumble.

Read more →

Filed under: Analysis / Opinion

New scam tries to give you a free Celestial Steed

One of the sadder parts of this job is reporting on the numerous scams that sweep across the World of Warcraft landscape. It's no secret that your WoW account is valuable to thieves -- the entire gold-selling industry is built on a foundation of hacked accounts and stolen items.

Their latest scam vehicle? Our inherent desire for sparkle ponies. Let's get two things straight off the bat:
  1. You did not just win a free Celestial Steed mount. That in-game tell is an attempt to steal your account.
  2. No one just bought you a Celestial Steed mount. That email you got is an attempt to steal your account
If it sneaks by your spam filter, the latest scam email can be quite convincing. The message, which appears to be from sales@mail.blizzard.com, masquerades as a receipt for the purchase of the $25 Celestial Steed mount. Of course, the email is not actually from Blizzard (the "from" email is spoofed), and the links to Battle.net and Worldofwarcraft.com inside send you to a phishing website designed to steal your password or infect your computer with a keylogger.

Attempt to collect your sparkle pony, and within a few short hours, your entire account will be under someone else's control. If you haven't put an authenticator on your account, the scammers will do it for you, locking you out of your own account and severely hampering your ability to get it back.

More information on the latest scam, what you can do to protect yourself and what to do if you're a victim, all after the break.

Read more →

Filed under: News items, Account Security

Drama Mamas: Hacking a friend's account


Drama Mamas Lisa Poisso and Robin Torres are experienced gamers and real-life mamas -- and just as we don't want our precious babies to be the ones kicking and wailing on the floor of checkout lane next to the candy, neither do we want you to become known as That Guy on your server.

It was really hard to choose from the many dramalicious emails we got this week. So much drama, so little time. I'm happy we have so many topics to choose from, but sad that so many of you have to go through so many dramafied situations. This one really did stick out as pretty dramarific, however. Dramarily! Drama-lama ding dong! Dramastified. OK, I'm drama-done. Turn the page for all the dramaness.

Read more →

Filed under: Analysis / Opinion, Drama Mamas

New issues with Adobe Flash, Google search links could compromise your account

We have news of two new tricks hackers are currently using to steal WoW accounts. First, from Curse, comes news of a Google sponsored link that claims to lead to the popular addon manager Curse Client, but instead leads to a malware download. To be absolutely safe, you should always only download the client from http://www.curse.com/client.

In addition, Blizzard is warning that Adobe Flash version 10.0.45.2 contains a critical vulnerability that could be used to install a keylogger on your computer in order to steal your WoW account info. You can avoid this issue by installing Adobe Flash version 10.1 Release Candidate 7, which does not appear to have the same vulnerabilities.

Filed under: Bugs, News items

Real ID security concerns

Ever since the Real ID friend system was announced, players have voiced concerns about hackers and phishers exploiting this system. They're worried that hackers will move through a group of Real ID friends like a wildfire during a drought. While it is always good to have concerns about account security, sometimes paranoia is a bit too much.

Yes, you do need your friend's email address to add them as a Real ID friend. However, that is the last time you'll ever see that email address in your game client -- once you hit the "Send Request" button, that's it. There is no way to look up that person's email address from the interface again. The only personal information in the client after that is your friend's name.

Just remember that this system is meant for your real-life friends and family and not for some guy who was a good healer in your ICC PUG last week. If you don't know where to go to knock on the person's door if something happens to your account, then don't share your email address.

Filed under: Account Security

Security Warning: Phishing emails on the rise

Recently, Polar over at Securing WoW wrote about the latest phishing email being sent out by scammers. Account thieves are using the 2010 Arena Tournament as a way to lure you to their site to steal your login info. (Registration for the tournament ended on the 27th continues until June 7.) This is typical behavior by these crooks. Every time a Blizzard event is announced or even rumored, from the Cataclysm alpha to the StarCraft II beta, scammers take advantage it with legitimate looking emails. With the Cataclysm beta almost upon us, the expansion related phishing is going to get even worse.

But there are also the tried and true emails that are being sent out daily, regardless of upcoming events. They spoof their email so that it looks like it is coming from Blizzard and fill the email with legitimate links, making their info-stealing site link look real. Also, the links have misspellings which are hard to catch at a quick glance, (like "starcratf2" or "worldotwarcraft") and lead to sites that look very much like the official ones.

Blizzard has an excellent resource for protecting yourself from phishing attacks. In general, if you get an email that looks legitimate, type battle.net in your browser's address bar (spell it correctly). This will take you to the correct site for your region and there you can see the status of your account yourself. Some examples of phishing emails are after the break.

Read more →

Filed under: Account Security

New scam targets the WoW Launcher

A post in the official forums today, later confirmed by a blue, points to hackers attempting to take advantage of a new avenue to attack the user -- the World of Warcraft Launcher.

As you can see from the screenshot above (large version here) the real launcher apparently is replaced with a fake launcher that sends the user to a web site that pretends to be official, asking for subscription information (including answers to secret questions and the original CD-Key) in what is meant to appear as the means to restore a supposedly suspended account. One of the telltale signs that this isn't legit, besides the very invasive information requested, is the version number in the upper left corner of the screen. We're way past patch 3.1.1 -- however not everyone might know this.

Ancilorn posts confirming that this is not genuine (reiterating that they will never ask for your password in such a manner, and also requesting that such things be sent directly to Blizzard if they happen to you). Goes to show that as security is increased, those looking to breach it become more desperate.

Filed under: News items, Account Security

WoW Insider Show 

Subscribe via  iTunes for our latest show.

Hot Topics


 

Upcoming Events


Around Azeroth

Around Azeroth

Featured Galleries

It came from the Blog: Pandamonium
The gaming artwork of Jessica Dinh
Mists of Pandaria Raid DPS Analysis
Mists of Pandaria Collector's Edition
Death Knight plague epidemic
Mega Bloks: Goblin Zeppelin Ambush
Mists of Pandaria Beta: Ruins beneath Scarlet Halls
Mists of Pandaria: New warlock pets
Female Pandaren Customization

 

Categories