So I'm convinced Blizzard has security issues

[Nisch]

Keep in mind I haven't played WoW for months now.

Ok, so I get an email recently saying my account has been suspended, followed by one that says it is terminated due to "use of automation software". It's one of my accounts.........and I try to login to my Battle.net account to see what's going on. I can't.......it says there is an authenticator attached to it.............which I never did. My other 4 accounts don't have it, but this particular one does.

Now I know you might be thinking I was hacked on my end. But here are some points:

• Since I quit WoW, I have a new computer that doesn't even have WoW installed on it.
• I used different passwords for my battle.net account than anything else
• My payment was terminated months ago....how did they login?
• The account that was hacked was NOT used for anything other than that WoW account (I'm a hardware boxer), and has not been ON since I quit WoW.

Considering my password was not easy in the slightest, how do you figure this happened? Should I even call Blizzard to get the account back or is it a waste of time? I was going to try out Cataclysm, but now I'm left with 4.

What do you all think?

[Svpernova09]

there was a report not long ago that a huge list of game accounts was uncovered. that was collected over time. Probably had your info in it. I'd scrub all your WoW comps to be safe.





















scrub them FROM ORBIT!

[Tonuss]

scrub them FROM ORBIT!

It's the only way to be sure.

I've seen numerous people who were very cautious about computer security (and WOW security in particular) get hacked and not have a clue how it was done. It's one of the reasons that I got an authenticator. I'm pretty cautious and pro-active about my computer's security, but I no longer take for granted that I know enough to be safe.

Still, there could be other ways that these guys are getting this info. I can't imagine that it's due to Blizzard's own security, if these guys had access to that kind of information, I doubt that they'd be careful enough not to tip Blizzard off about it. If it *is* an inside job in any way, that could be catastrophic for Blizzard as a company.

In the end, who knows? The people who work to steal accounts have become ridiculously aggressive and seem to be using everything from the most basic social engineering to more sophisticated ploys. I get the feeling that if we ever understood the scope of what these guys are doing, we'd hang ourselves in distress.

[Nisch]

Those computers haven't even been turned on since March. I sent an email about it disputing the account closure.

Do you have any details on the accounts uncovered? Any link with info?

[jinkobi]

Since this last patch I've been having crashes randomly with a DEP message. Data Execution Prevention... I've scanned and there's no virus or malware so I've been at a loss. Only thing new since this started was the patch and updating some addons off Curse. Never use their client- always manually install.

[Sajuuk]

Keep in mind I haven't played WoW for months now.

Ok, so I get an email recently saying my account has been suspended, followed by one that says it is terminated due to "use of automation software". It's one of my accounts.........and I try to login to my Battle.net account to see what's going on. I can't.......it says there is an authenticator attached to it.............which I never did. My other 4 accounts don't have it, but this particular one does.

Every multiboxer should have an authenticator. Beside the wait time for logging in, there's little excuse.

Since this last patch I've been having crashes randomly with a DEP message. Data Execution Prevention... I've scanned and there's no virus or malware so I've been at a loss. Only thing new since this started was the patch and updating some addons off Curse. Never use their client- always manually install.

I have never ever had a problem with data execution prevention that I can remember.

[Nisch]

Every multiboxer should have an authenticator. Beside the wait time for logging in, there's little excuse.

I have never ever had a problem with data execution prevention that I can remember.

Every time I tried to order one, they were out of stock. While I said I played in March, that was again after a long hiatus prior to that, before the authenticators were available.

[Ughmahedhurtz]

It MUST be an inside job. RITE?

On a less tongue-in-cheek note, hackers do not immediately use account information when they keylog/hack it. It sometimes sits for months before someone tries to take advantage of it. Rest assured that one of the PCs you used to logon to that account was trojaned, you "loaned" your account to a "friend" or you have a really, really weak password.

[Nisch]

It MUST be an inside job. RITE?

On a less tongue-in-cheek note, hackers do not immediately use account information when they keylog/hack it. It sometimes sits for months before someone tries to take advantage of it. Rest assured that one of the PCs you used to logon to that account was trojaned, you "loaned" your account to a "friend" or you have a really, really weak password.

Again, the computer that the account was used was not used for ANYTHING other than that WoW account.........I never visited a single website, ran a single program, or anything of the like. I don't use software like Keyclone that talk home.

I have turned that computer on, and run packet monitoring software, as well as a scan for files (even hidden, archived, or the like) that were created AFTER the computer was originally created. Nothing other than WoW updates.

I know it's easy for people to say that it was my computers, but being a network security specialist for 10 years, I feel I have the ability to check for these things.

Let's say that for some reason, my main computer has been compromised. Why would an account that was never even logged into that computer be hacked? Also, why would it not be the account hacked that was on the computer I use for something other than WoW?

My password consisted of uppercase, lowercase, non alpha-numeric characters over 10 characters in length. It was not guessed.

I have never had anyone log into my accounts, friends used my computers, not even my wife.

Now, I have worked for companies where an exploit was used. When an exploit is successful, I have never seen people "wait" to use it. It's the same as in the study that was released this year stating that changing your passwords on a regular basis is a futile point. If someone gets your password, they are going to use it then and use it as much as they can before the security breach is found.

I even have a hardware appliance in place that sends me reports of daily web traffic, it reports TCP and even UDP traffic for any website, any port, any protocol used for communication through the box. No where does it state any communication out of the ordinary. No IRC communications, no CuteFTP exploits, no telnet communications, nothing.

I would be arrogant to say that it isn't 'my fault, but I'm not some kid that can't use a computer. I have several safeguards in place that can notify me if something is unusual. If it was my main account, then I would highly consider it to be my computer at fault. But companies do make mistakes, just as I could make mistakes. A good example is how Mythic was overcharging on accounts that were closed for years causing thousands of people getting overdraft fees.

[Ughmahedhurtz]

I know it's easy for people to say that it was my computers, but being a network security specialist for 10 years, I feel I have the ability to check for these things.

I can see how that might lead you to believe you're not the one in error here but if there's one thing I've learned over the years, it's that hackers are an ingenious lot. I know it's hard to believe but the alternative theory goes beyond the pale. I just cannot fathom that Blizzard has some security hole where accounts get hacked regularly for 5 years and NOBODY has found out about it yet. It would not be a normal hack, either, because they're not entering your logon/password for any trojan to sniff. /shrug