WoW account security?

[Rofl-Mic-Lofl]

My friend had his account stolen (was from a bad addon) and he let it go about 2 weeks before calling Blizzard and getting it recovered. His main had an extra 5,000 gold on it and maxed professions.

 

[darkpaw]

I think the "trusted" site could be the biggest problem. I had my account compromised sometime in March and I still strongly believe that I was infected by a flash ad on wowhead. It's a tough to say that such a large and prominent database site can't be trusted, but I guess I can't trust them after all. Now I gotta take extra precautions (ad blocks etc.) even when browsing websites that aren't exactly shady. It's annoying to deal with this, but necessary. Only sites I trust is [H] and the online banking/CC sites I use.

There is no such thing as a "trusted" site, just slighty better rep than others. Even the big name everyday sites have gotten hit by infected ads and the people that say you can get by without av are deluding themselves. AV is a warning system and just part of a good defense. I've seen it catch inbound flash attacks on tier 1 sites and also miss attacks quite often. Good security involves using all available tools together.

Any site that targets wow users is going to be a huge target for malcious activity and some things are going to get through. Personally, I have no flash plug-in installed in FF and use no-script as well. If I have to use a flash only website, I'll use IE for that particular page.

 

[Yoshiyuki Blade]

My friend had his account stolen (was from a bad addon) and he let it go about 2 weeks before calling Blizzard and getting it recovered. His main had an extra 5,000 gold on it and maxed professions.

If I'm not mistaken, add-ons generally aren't the source of the infection, but rather the executables used to install them. I always just downloaded the zip file and extracted them into the appropriate folder. Add-ons themselves don't contain any executables.

There is no such thing as a "trusted" site, just slighty better rep than others. Even the big name everyday sites have gotten hit by infected ads and the people that say you can get by without av are deluding themselves. AV is a warning system and just part of a good defense. I've seen it catch inbound flash attacks on tier 1 sites and also miss attacks quite often. Good security involves using all available tools together.

Any site that targets wow users is going to be a huge target for malcious activity and some things are going to get through. Personally, I have no flash plug-in installed in FF and use no-script as well. If I have to use a flash only website, I'll use IE for that particular page.

Yea I guess the golden rule will always be "trust no one," but I tend to trust reputable sites that aren't shady and visited often. Perhaps I was at the wrong place at the wrong time and was one of the first people affected by an exploit.

 

[Ragenrok]

If I'm not mistaken, add-ons generally aren't the source of the infection, but rather the executables used to install them. I always just downloaded the zip file and extracted them into the appropriate folder. Add-ons themselves don't contain any executables.

I'm pretty sure his is correct, I've had my account tooken over 3 times, 1st time was a bad site. Next 2 both happened within 3 days of installing the curse client and having it download and update my addons. There was about a 8 month gap between the first install and he second, I even reformated and installed windows again between the two so I'm 99% sure it was the curse client.
Posted via [H] Mobile Device

 

[darkpaw]

Yup, add-ons by themselves are just script files. You can look into every one and see what it is doing. Don't trust anything executable at all though. It isn't that hard to update your files by unzipping an archive.

Add-ons could still be a potential vulnerability, but that would only be if someone discovers a vulnerability in WoWs script parsing engine. Possible, but not easy. I'd love to do research in that area if I actually had more free time.

 

[PornoSatan]

If I'm not mistaken, add-ons generally aren't the source of the infection, but rather the executables used to install them. I always just downloaded the zip file and extracted them into the appropriate folder. Add-ons themselves don't contain any executables.

That's correct, addons themselves can't contain trojans. That's why any of you who are using the curse client shouldn't be. Take the extra 5 seconds to manually extract and update them, it's not hard and saves you future problems by removing another potential entry to your computer.

 

[Nasty_Savage]

I had mine haxed the other day. Binding the account to an email address was dumb on Blizzard's part, now they spam the shit out of me with phony messages from Blizzard. That didn't happen until the battlenet integration. I never answered any of them, and both my machines are clean so I can't figure out how they did it unless they brute forced the password. I never log into anyone else's machine, and even so, why would it happen out of the blue after months of inactivity? Really getting sick and tired of having my email address spewed all over for logging into shit. Having a hidden account name at least took you off the radar IMO. I have an authenticator now, but that's complete bullshit. Just because the forum mods cried about their jobs...they exposed the account names/email addresses and took away one half of the security which was anonyimity...