Diablo 3 Account Hacked

Binar said:
1) Use an authenticator if you can. Mobile or Dongle only. Dialup and WoW will not work
2) Move any valuable items you have onto the 2nd page of your stash, and cover the first page in junk. Items you wear and in your inventory will be destroyed when you are hacked and are not safe. You will lose your gold no matter what
3) When logging off after a sesson, log into a smurf character, a level 1 monk for example. This will make him your active character, so he is the one the bot logs onto instead of your valuable one. This will not protect you if you are hacked while online (on your good char)
4) Do not attempt to fight the hackers for control of your account. If they kick you offline, do not try to keep logging in, or they will change your password. Be passive and wait 15 minutes to make sure they are done.
5) File a support ticket as you can on the bottom of this website's page, which may rollback your account. Rollbacks may not save all your progress, because they could be up to a week old and restore you to less gold/items than you had before being hacked. After the first rollback, you cannot use the RMAH until you get an authenticator, and after the second rollback, you cannot use the RMAH permanently
6) Do not join/create public games. The hackers looking for accounts to target by searching public games; you can be targeted for simply being in the same game as one of their bots.
7) Do not be on your friends friends list. Likewise, do not put him on yours. If one account is compromised, they will be able to see a network of accounts on friends lists spanning off from it and target those in turn.
8) Store your liquid assets in other forms than gold. You will lose your gold if you get hacked, so investing in items or materials can be a safer method.

Phishing, keylogging, malware, session hijacking, etc all have nothing to do with this exploit at all, and avoiding user error will not protect you whatsoever. The safe method to avoid being hacked right now is to use a valid authenticator, and there are no guarantees that this same exploit can't be expanded to bypass authenticators too, however I view that as improbable. If you cannot get an authenticator for whatever reason or have to wait to set one up, use the simple methods I have outlined to minimize the damage you will experience.

----not my post just a copy/paste
Click to expand...

Sounds like a same I want to play...
 
lbj. said:
This is nothing, if any of you had played WoW or knew friends that did, you would know this has been happening for the last 8 years or whenever WoW came out.

The Authenticator DOES NOTHING, you still get hacked so it's a waste of money. In the end Blizzard is just crap when it comes to security.
Click to expand...

It does something though. A few times that I have logged on to battle.net, it has asked for my authentication code to login.

It's at least a layer of security.

The problem is, how are these hackers getting in w/o having to login? There hasn't been much solid proof on this, other than speculation of joining public games is prone to attack.

Now I saw a video someone had on youtube of the items disappearing in game. But I'm more interested in seeing how it's actually done. Are they using tools to do this? That's what I want to know.

I know Blizzard won't admit to being hacked ever.
 
Binar said:
1) Use an authenticator if you can. Mobile or Dongle only. Dialup and WoW will not work
2) Move any valuable items you have onto the 2nd page of your stash, and cover the first page in junk. Items you wear and in your inventory will be destroyed when you are hacked and are not safe. You will lose your gold no matter what
3) When logging off after a sesson, log into a smurf character, a level 1 monk for example. This will make him your active character, so he is the one the bot logs onto instead of your valuable one. This will not protect you if you are hacked while online (on your good char)
4) Do not attempt to fight the hackers for control of your account. If they kick you offline, do not try to keep logging in, or they will change your password. Be passive and wait 15 minutes to make sure they are done.
5) File a support ticket as you can on the bottom of this website's page, which may rollback your account. Rollbacks may not save all your progress, because they could be up to a week old and restore you to less gold/items than you had before being hacked. After the first rollback, you cannot use the RMAH until you get an authenticator, and after the second rollback, you cannot use the RMAH permanently
6) Do not join/create public games. The hackers looking for accounts to target by searching public games; you can be targeted for simply being in the same game as one of their bots.
7) Do not be on your friends friends list. Likewise, do not put him on yours. If one account is compromised, they will be able to see a network of accounts on friends lists spanning off from it and target those in turn.
8) Store your liquid assets in other forms than gold. You will lose your gold if you get hacked, so investing in items or materials can be a safer method.

Phishing, keylogging, malware, session hijacking, etc all have nothing to do with this exploit at all, and avoiding user error will not protect you whatsoever. The safe method to avoid being hacked right now is to use a valid authenticator, and there are no guarantees that this same exploit can't be expanded to bypass authenticators too, however I view that as improbable. If you cannot get an authenticator for whatever reason or have to wait to set one up, use the simple methods I have outlined to minimize the damage you will experience.

----not my post just a copy/paste
Click to expand...



While I see your point -- following even HALF of what you said means to play D3 "safer" I would have to take an extra 5 or so minutes to jump through all these little hoops. Of gearing up and down after each session. Not to mention having "fake" characters to cover your tracks.

Not being able to play with friends? Not being able to join any or all games? At that point you need to turn off the computer and force a refund on the game.

I'm still debating whether to request a refund, I have about what? 1 or 2 more weeks for that 30 day period? I know blizzard would say "no" but hooray for credit card charge back. As I said, still debating.
 
Was thinking about this last night. Pretty sure the RMAH is going to kill itself.

Imagine a couple scenarios:

6 months from now, you're all setup with an authenticator to protect you're high level character loaded up with some good end game gear (that has value on the RMAH), but want to make an extra buck. So you let your account sit for a couple days (so the restore point has all your current gear), call up a friend who lives some distance away and give them your credentials (including your authenticator #). Have them 'hack' you. Request roll-back. Sell second set of gear from a new account. Could even have them 'hack you' while you're online playing, giving some credence to the 'session spoofing' theory.

Now imagine a criminal organization, they could run this same scam, but more effectively. First they absolutely load up a powerleveled level 60 character with across the board best available gear from the RMAH (hard to say what the cost of that would be, might be $200, might be $2500). Have it 'hacked' by another member, request rollback. Now they've got two sets of that awesome gear. Move items over to other characters/accounts, repeat the process. Now they've got four sets and so on. Release it back onto the RMAH from various accounts once they have more gear than they can realistically cycle this way. 12 items on the character, plus full inventory and full stash. Could be 100's of items duplicated each time.

The only solution is have unique item ID's and to actually flag 'hacked' items, and 'rollback' items and shutdown the users who are trading in them exclusively. But then they'll just move them about in the gold auction house or in game trading to effectively launder the source of the items.

Will probably only really stop once the flood of 'rollback' cloned items depresses the value of max stat items on the RMAH below the point that running a rollback scam makes money.
 
^^ good thoughts.

So it appears that Blizzard trying to stop duping results in Blizzard becoming the duper.
 
DarkSaturn said:
Was thinking about this last night. Pretty sure the RMAH is going to kill itself.

Imagine a couple scenarios:

6 months from now, you're all setup with an authenticator to protect you're high level character loaded up with some good end game gear (that has value on the RMAH), but want to make an extra buck. So you let your account sit for a couple days (so the restore point has all your current gear), call up a friend who lives some distance away and give them your credentials (including your authenticator #). Have them 'hack' you. Request roll-back. Sell second set of gear from a new account. Could even have them 'hack you' while you're online playing, giving some credence to the 'session spoofing' theory.

Now imagine a criminal organization, they could run this same scam, but more effectively. First they absolutely load up a powerleveled level 60 character with across the board best available gear from the RMAH (hard to say what the cost of that would be, might be $200, might be $2500). Have it 'hacked' by another member, request rollback. Now they've got two sets of that awesome gear. Move items over to other characters/accounts, repeat the process. Now they've got four sets and so on. Release it back onto the RMAH from various accounts once they have more gear than they can realistically cycle this way. 12 items on the character, plus full inventory and full stash. Could be 100's of items duplicated each time.

The only solution is have unique item ID's and to actually flag 'hacked' items, and 'rollback' items and shutdown the users who are trading in them exclusively. But then they'll just move them about in the gold auction house or in game trading to effectively launder the source of the items.

Will probably only really stop once the flood of 'rollback' cloned items depresses the value of max stat items on the RMAH below the point that running a rollback scam makes money.
Click to expand...

OH CMON THAT'S REALLY STRETCHING IT, As MUCH AS I INSULT BLIZZARD, SURELY SURELY SURELY THEY CANNOT HAVE BEEN THAT INCOMPETENT TO NOT HAVE PLANNED FOR THIS TYPE OF SCENARIO.

But then again, who's to say that Blizzard could not be behind this type of scheme and flooding the RMAH with high level high priced items to sell which they've artificially created and sold on Blizzard owned accounts for profits... :eek:

/puts tinfoil had on and head asplodes.
 
TheMadHatterXxX said:
OH CMON THAT'S REALLY STRETCHING IT, As MUCH AS I INSULT BLIZZARD, SURELY SURELY SURELY THEY CANNOT HAVE BEEN THAT INCOMPETENT TO NOT HAVE PLANNED FOR THIS TYPE OF SCENARIO.

But then again, who's to say that Blizzard could not be behind this type of scheme and flooding the RMAH with high level high priced items to sell which they've artificially created and sold on Blizzard owned accounts for profits... :eek:

/puts tinfoil had on and head asplodes.
Click to expand...

Now imagine how they could do this effectively. They would have to hide the 'user' who is selling any particular item, could always spoof a fake user but someone might try and contact them. Oh wait, they've done that.

In order to make it really work, what they could do is say a max + to vitality an item can have is +250, so they set the formulas to allow for a small percentage of blue items and yellow items with fewer than 4 properties or less than max sockets to drop with +250 Vitality. But rare(yellow) items with 6 properties and full sockets can only ever drop with +220 Vitality or less. Then trickle a tiny amount of said impossible items onto the RMAH. The b.net forums will be full of Blizzard white knights to claim they are legit, afterall they have themselves found blue or crappy yellows with + Vitality above 220 so they are possible to find :O
 
Well I finally got a reply to my ticket, and for some reason you have to reply to the blizzard reply "clearly saying you want to use one of your two rollbacks" before they do anything ... sigh .... I guess I have to wait some more.
 
DarkSaturn said:
Was thinking about this last night. Pretty sure the RMAH is going to kill itself.

Imagine a couple scenarios:

6 months from now, you're all setup with an authenticator to protect you're high level character loaded up with some good end game gear (that has value on the RMAH), but want to make an extra buck. So you let your account sit for a couple days (so the restore point has all your current gear), call up a friend who lives some distance away and give them your credentials (including your authenticator #). Have them 'hack' you. Request roll-back. Sell second set of gear from a new account. Could even have them 'hack you' while you're online playing, giving some credence to the 'session spoofing' theory.

Now imagine a criminal organization, they could run this same scam, but more effectively. First they absolutely load up a powerleveled level 60 character with across the board best available gear from the RMAH (hard to say what the cost of that would be, might be $200, might be $2500). Have it 'hacked' by another member, request rollback. Now they've got two sets of that awesome gear. Move items over to other characters/accounts, repeat the process. Now they've got four sets and so on. Release it back onto the RMAH from various accounts once they have more gear than they can realistically cycle this way. 12 items on the character, plus full inventory and full stash. Could be 100's of items duplicated each time.

The only solution is have unique item ID's and to actually flag 'hacked' items, and 'rollback' items and shutdown the users who are trading in them exclusively. But then they'll just move them about in the gold auction house or in game trading to effectively launder the source of the items.

Will probably only really stop once the flood of 'rollback' cloned items depresses the value of max stat items on the RMAH below the point that running a rollback scam makes money.
Click to expand...

I can see them requiring every account to have an authenticator very soon.
 
alienate said:
I can see them requiring every account to have an authenticator very soon.
Click to expand...

That's my big frustration. It's inevitable that will be the outcome, but right now they are essentially blaming the users for poor security, which may or may not be the case.

What we do know however, is that Blizzard isn't exactly going out of the way to prevent this on their end, or if they are they aren't communicating it.

Case sensitive passwords: nope

Options to shutdown account until email confirmation if connection from a new IP detected: nope

Banning IP's of users that are repeatedly connecting to account after account, accounts registered all over the place: ie: hackers: Certainly doesn't look like they are doing this.

Shutdown of accounts after a # of failed password attempts: nope

Authenticator shouldn't be the only option here. Maybe I'm just bitter since I use a non-supported phone OS, and am unimpressed that they want $14 to ship a tiny plastic authenticator because I live all the way in Alberta.
 
I dont know a single person who has been hacked with an authenticator on their account.

Generally a "hacked" account isnt a personal attack - someone/something is going through hudreds of accounts to pilfer everything from them all, it's not going to put effort into getting in any single account.

Moral of the story? Get an auth. It's free on mobile phones, not even the stupid $1 fee it used to be.

If you managed to piss the wrong person off enough, your account is fucked, auth or not. But you'll lower the chance of getting your shit taken by probably 98% (I would say 100, but anything is possible). If you dont have an auth, nobody feels bad for you. Learn your lesson, and get an auth so it doesnt happen again.

I'd also call shens on only two rollbacks. Raise enough of a shit fit and you can probably get more lol
 
Pack of guest passes printed on cardstock to ensnare your friends: in the box

Random diablo themed notepad to plan skill tre... er for something: in the box

Authenticator, for which if you play without you're more than like going to be hacked: not in the box

While on the subject:

DVD style case to keep your copy in nice shape like pretty much every other major PC release in years: not in the box

Cardboard sleeve like you expect from a Hobosoft release: IN THE BOX

(yes I'm aware that digital distribution exists... just object to paying the same and getting less).
 
Regular editions of the game only got a cardboard sleeve case for the dvd? Collectors ed. got a proper dvd case :eek:
 
just submitted a ticket to start the refund process on my account - I explained in a detailed professional manner why I require my money back. And that if the request can't be handled smoothly I would have to escalate the issue with my bank.

Maybe in 6 months or a year they will have these issues fixed, nobody really knows for the time being I refuse to pay money for something this broken. It's like buying a sports car that's fun but you can't enjoy it because everyone has a set of keys to it.

I explained to them that when trying to call their support line, a 2 hour wait is unacceptable and that I refuse to blow $20 worth of my minutes on the small chance a person might answer the phone after 2 hours and "maybe" help me.
 
If the problem truly is on the user's side, then someone explain to me why we hear about cases of account hacking (WoW, in this case) where a dormant account that hasn't been used in months ends up getting hacked?

At the very best, there are some serious security deficiencies in the way Blizzard handles log-ins (see DarkSaturn's post above.) Blizzard should implement something like RIFT's system - detect unfamiliar IP address, and you get coin-locked - can't do anything related to sending money/items/auction house stuff until you've verified your account through your email address.
 
Daggah said:
If the problem truly is on the user's side, then someone explain to me why we hear about cases of account hacking (WoW, in this case) where a dormant account that hasn't been used in months ends up getting hacked?
Click to expand...

It's simple, just because an account was hacked today doesn't mean they got the info yesterday, or last week, or last month. The user could also be using the same info at different places. Happened to an old guildie of mine, his account was offline for around 6 months. He got kind of lucky because he was used as a bot, wasn't stripped. He only knew because he got emailed when they changed his password and got to come back free of charge, the hacker added time, to bags full of ore/gems, not to mention a shit ton more gold than what he quit with.

Anyone still out there without an autheticator for whatever reason can check this out https://code.google.com/p/winauth/. I came across it the other night. It isn't endorsed or supported by Blizz but seems like it should/could be a decent stop gap until you can get yourself the real thing, so I guess use it at your own risk.
 
Fahim said:
I turned on the Authenticator to check every time I log in and put in a stronger password.
Click to expand...

Blizzard says you are a liar.

Every single time someone has said they were compromised despite having any authenticator, their research always came up showing the authenticator was added AFTER being compromised, combined with the majority of systems being so full of malware it would make Anonymous cry.
 
Mokkat said:
The authenticators came into existance as a 10€ extra layer of protection to keep people's WoW accounts with hundreds of € and real life days racked up, safe - not to add an mandatory 10€ onto my 60€ game so I can play without worrying for my items disappearing.
Click to expand...

Mobile Authenticator is FREE.

Next excuse?
 
boredreflux said:
Anyone still out there without an autheticator for whatever reason can check this out https://code.google.com/p/winauth/. I came across it the other night. It isn't endorsed or supported by Blizz but seems like it should/could be a decent stop gap until you can get yourself the real thing, so I guess use it at your own risk.
Click to expand...

I've bolded the part that makes this stupid to use.

There's no way to verify the security of a non-official authenticator, and you'll probably be hosed if the authenticator stops working/syncing for some reason and you're left unable to get into your account.
 
damn, i think ill get a authenticator now
 
I have heard even accounts with authenticators are not safe at all from being hacked.
 
Has anyone identified the piece of malware that is jacking D3 accounts but leaving other game accounts, bank accounts, mail accounts, etc alone yet? With so many people getting hacked, I'm curious what the culprit is considering it is so widespread and obviously pretty specific in target.
 
Well, I got hacked this morning. The asshole took all my gold and equipment and jewels. I guess it is mine own fault for not changing my password regularly and not setting up the authenticator. Authenticator was set up this morning and password changed to a rediculously long password this am.

How long does it generally take them to restore your account?
 
MrGoodKat44 said:
Well, I got hacked this morning. The asshole took all my gold and equipment and jewels. I guess it is mine own fault for not changing my password regularly and not setting up the authenticator. Authenticator was set up this morning and password changed to a rediculously long password this am.

How long does it generally take them to restore your account?
Click to expand...

Run Malwarebytes and figure out what got your password.
 
orijin said:
I have heard even accounts with authenticators are not safe at all from being hacked.
Click to expand...

I think we have all heard that, but have yet to see anyone prove it otherwise.

Is it possible? Hell yes

Have we seen it? Nope... Not to my knowledge.

I had the authenticator after a week of playing this game and hearing about the rampant hacking.
 
SilverSliver said:
Has anyone identified the piece of malware that is jacking D3 accounts but leaving other game accounts, bank accounts, mail accounts, etc alone yet? With so many people getting hacked, I'm curious what the culprit is considering it is so widespread and obviously pretty specific in target.
Click to expand...

It probably isn't malware. Here's a youtube link from a person (born in the US) who runs a virtual currency broker service and is being interviewed. The person interviewing is markeedragon, an owner of a website that allows you to buy accounts and other virtual goods:

http://www.youtube.com/watch?v=PWvHcoqru7I&t=25m28s

Here he describes "account cleaning" and eventually, around (32:02: http://www.youtube.com/watch?v=PWvHcoqru7I&t=32m4s) he comments on where the "account cleaners" get their user id and passwords.

This would explain why people's bank accounts haven't been messed with, as the user id's they are mining aren't bank information at all. It's simply hackers logging into popular communities sites, breaching the databases, and mining the information.

Edit: i just remembered the second reply in this thread:

MisterSkills said:
Is it possible you've created an account on a message board or any online services with the same email and password you use on battle.net ?

That's how i got compromised myself on wow ...
Click to expand...
 
Last edited:
timtheenchantor said:
It probably isn't malware. Here's a youtube link from a person (born in the US) who runs a virtual currency broker service and is being interviewed. The person interviewing is markeedragon, an owner of a website that allows you to buy accounts and other virtual goods:

http://www.youtube.com/watch?v=PWvHcoqru7I&t=25m28s

Here he describes "account cleaning" and eventually, around (32:02: http://www.youtube.com/watch?v=PWvHcoqru7I&t=32m4s) he comments on where the "account cleaners" get their user id and passwords.

This would explain why people's bank accounts haven't been messed with, as the user id's they are mining aren't bank information at all. It's simply hackers logging into popular communities sites, breaching the databases, and mining the information.

Edit: i just remembered the second reply in this thread:
Click to expand...

Thanks for the video.
 
timtheenchantor said:
It probably isn't malware. Here's a youtube link from a person (born in the US) who runs a virtual currency broker service and is being interviewed. The person interviewing is markeedragon, an owner of a website that allows you to buy accounts and other virtual goods:

http://www.youtube.com/watch?v=PWvHcoqru7I&t=25m28s

Here he describes "account cleaning" and eventually, around (32:02: http://www.youtube.com/watch?v=PWvHcoqru7I&t=32m4s) he comments on where the "account cleaners" get their user id and passwords.

This would explain why people's bank accounts haven't been messed with, as the user id's they are mining aren't bank information at all. It's simply hackers logging into popular communities sites, breaching the databases, and mining the information.

Edit: i just remembered the second reply in this thread:
Click to expand...



Great video, definitely explains probably why my WoW account got hacked. I used my spam/forum email account to setup my WoW account and so I bet those credentials got mined from a site. Now it uses its own unique password as well as the email account it connects to has its own password as well.
 
Not only will they only restore your account twice, but they will ban you from the AH if you get compromised twice...
 
So basically what to take away from this is make sure your Diablo 3 username and at least password are totally unique to that service.

... but the "account cleaners" do not explain getting around authenticators do they? Or can they just add another authenticator to their own device, use it once, then remove it from the account?
 
Fahim said:
They need to make authenticator mandatory. Thats it.
Click to expand...

Before the last expansion came out, there was some speculation the authenticator would be included in retail box copies and mailed to people buying digital downloads. Unfortunately that turned out to not happen, and hacking was still rampant.

The problem got really bad in the guild I was helping to run. And every single time people would get hacked, it was the same story "Omgosh I don't use that password anywhere, I don't log into shady sites, Blizzard servers got hacked, it DEFINITELY isn't my fault" blah blah blah... After this was affecting guild activities so much we had trouble doing raids (people were waiting for restores or getting hacked during raid encounters), we finally made it a required item. Pissed off some people, but they got over it. Then the problems with people being hacked magically went away, and everyone was like "Huh, oh I see these actually DO work" :rolleyes:

For all the people blaming Blizzard for some huge security problem, there are hundreds of thousands of authenticator-using people happily playing battle.net games without a problem. The hack rate for people using authenticators appears to be pretty damn close to 0, while there is a very vocal group of people that get their shit hacked because they have bad security practices then choose to point fingers.
 
Last edited:
Just have your account text message you when something weird happens, such as login from a foreign location or maybe they should do it how steam does it. They require you to enter a code when the location is questionable from the normal locations you log in from.
 
Fahim said:
They need to make authenticator mandatory. Thats it.
Click to expand...

People need to get sense of what they are doing. Hell, the Chinese farmers themselves call those people out in the video. Those who risk it, are not too keen on security and don't care. IMO, those people have no one to blame but themselves if they use the same information across services. Basic security here folks and I find it hard to take someone who has been compromised in this fashion seriously when they deny it, and troll the community like what is happening ("it just has to be a breach it can be no other way!" *sigh*)

In my opinion, Blizzard does what they can as a business. They shouldn't be acting as peoples Internet security advisor or monitoring accounts for authenticators. It's the users responsibility and it should stay that way.

In terms of using location and authenticators, they use a method like that. If I log on somewhere that is not my home, it requires an authenticator.
 
Last edited:
You must log in or register to reply here.
Back
Top