Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

WoW Players Targeted By Windows Flaw Exploit

Posted by Zonk on Thu Apr 05, 2007 08:30 AM
from the keep-your-cursors-peeled dept.
Security Role Playing (Games)
grimwell writes "The BBC is carrying the story that the ANI flaw is being used to target World of Warcraft players, as hackers search for account details. 'Analysis of that malicious software showed that it lay dormant on a victims machine until they ran World of Warcraft (WoW) at which point it captured login data and sent it to the hacking group ... Research by security firm Symantec suggests that the raw value of a WoW account is now higher than a credit card and its associated verification data.'" Doubtless, any compromised accounts would quickly see their equipment sold, and the resulting gold transferred to another account. This gold would then be sold for US currency to Real Money Traders like the company IGE.
+ -
story

Related Stories

[+] Technology: Windows .ANI Problem Surfaced Two Years Ago 110 comments
An anonymous reader writes "There's a new twist to the tale of Windows .ANI exploit, that's been in the news all week (including when a spam campaign used the teaser of nude Britney Spears pictures to lure people to malicious sites). InformationWeek reports the Windows .ANI bug at issue first surfaced — and was patched — two years ago, in early 2005. 'If they had simply looked for other references for the same piece of code when they originally dealt with it a few years ago, they would have found this and patched it in 2005,' says Craig Schmugar of McAfee. 'It would have saved a whole lot of people a lot of time, money and effort.' Microsoft claims this .ANI vulnerability is different from the old, but beyond that they're not talking."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

WoW Players Targeted By Windows Flaw Exploit 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • A cold day in Hell.. (Score:5, Interesting)

    by zyl0x (987342) on Thursday April 05 2007, @08:38AM (#18619571)
    World of Warcraft is considered a better target for theft than a credit card. What kind of nerds are running those crime syndicates these days? Maybe if Blizzard came down on more of these gold-selling, account-selling, and item-selling service providers, this kind of nonsense wouldn't even be an issue.
    • Maybe if Blizzard came down on more of these gold-selling, account-selling, and item-selling service providers, this kind of nonsense wouldn't even be an issue.

      I wasn't aware of these fantastic new police powers granted to Deputy Blizzard.

      And even if they could, on what grounds could you charge any of those places with a crime?

      • Re: (Score:3, Informative)

        by Planesdragon (210349)
        And even if they could, on what grounds could you charge any of those places with a crime?

        Fraud and unlawful computer access, to start. Racketeering too, and possibly money laundering or false advertising.
        • You would have to prove the gold/item trading companies were complicit in any of that. It hasn't worked for online auctions, search engines or ISPs, I don't see why it would work here. They say "we are a medium - it's not our job to investigate every sale for crime. You're the police, you do it."
          • Actually, that got so irritating with pawn shops that many states require pawn shops to record serial number and seller names of any items they take in.

            So yes, playing too dumb can bring the law down on you whether you like it or not.
            • Never heard of such restrictions on pawn shops before, but unless there is a serial number on the item itself (handgun), that sounds like a joke. I'll do the same thing I do for online forms. John Smith. 123 Silly Lane.

              • Re: (Score:3, Insightful)

                by snarlydwarf (532865)
                And I hope you have ID to match that. Again, in many states, ID is required.

                Business Watch International (see BWIPOLICE.COM, for example) maintain database servers for pawn transactions and many municipalities are changing their laws to require pawn shops report their transactions electronically. (Here in the Eugene, Oregon area, for example, that is now the law. Not paper pawn slips for the police to wade through, but databases they have live access to.)

                Of course, it could even be argued that these sort
                • If yes, then why is getting it as a drop not considered taxable income?

                  The correllary would be pretty interesting, suing for access to the drop tables if your loot percentage does not match posted approximations.

      • Re:A cold day in Hell.. (Score:5, Insightful)

        by Aladrin (926209) on Thursday April 05 2007, @08:47AM (#18619711)
        What hole have you been hiding in? Anything that happens on Blizzard's servers is THEIR property. They can do whatever they like with it. By 'come down on' he means 'ban accounts'. If these 'gold-selling, account-selling, and item-selling service providers' lose more money than they make, they'll have to give up. It takes time and effort to amass stuff to sell, and there are companies -paying- people to amass it. If they have no way to do their thing, they'll have to stop.

        Having said that, short of shutting down all the servers, there's no way to stop it. Even having to start from scratch constantly, they'll still make enough money to keep going and hopefully outlast Blizzard's fury. Blizzard can't afford to hire enough people to police this well enough to stop it.
        • Well there's a way to get around this, if Blizzard were so inclined.

          It would involve an added security feature. When an account is created, present the user with a pile of unique graphics (could even be spell/item/etc icons from the game). Make the user pick, say, three out of the pile.

          When the user logs in later, present the user with several of these graphics, with ONE of'em being one of their choices from the get to. User clicks on the right graphic, they log in.

          It's pretty much purely a visual thing - n
          • Err, "get-GO" not "get to". :P

            • Re: (Score:3, Interesting)

              by dknj (441802)
              To: Graff
              From: BlizzardAnnouncement@blizzard.com
              Reply-To: BlizzardSupport@b1izzard.com
              Subject: Blizzard can no longer find your stored password

              Dear World of Warcraft User,

              We are unable to find your stored password. As you know, you should only have to input your username and password once to connect to our WoW servers from your gaming machine. Unfortunately, it would appear that you have done one of the following:

              - Reinstalled Windows or erased a critical part of World of Warcraft
      • Considering that Blizzard explicitly states in their EULA that all items, accounts, and data within is owned exclusively by Blizzard, I would say that they have excellent reason to sue these companies for illegally reselling property that does not belong to them.
        • Wut.

          Blizzard: You illegally resold our property
          Company: How? You owned it the whole time, it was on your server. At what point was the item out of your hands? When was it "sold?"

          • Re: (Score:3, Insightful)

            by Senjutsu (614542)
            By you're logic, it's legal for me to sell someone the Brooklyn bridge. After all, New York still owns it after I'm done, so where's the crime?
      • Their terms of service prohibit the sale of items/gold outside of the game. They can cancel the accounts of people who do this, and order the cancellation of eBay auctions (after all, the 'property' that is sold doesn't belong to the ebayer, it belongs to Blizzard). I'm not sure what steps they could take against non-US sellers, though.
        • If I remember correctly, most companies like IGE don't ask you to pay for the items...they are asking you to pay for their TIME.

          This is why they are able to stay in buisness...they aren't selling you gold, they are selling you time. There is nothing illegal about trading gold from one toon to another in-game, and since real world money is exchanged out of the game for a commodity that they don't own (unless Blizzard is Father Time), there isn't much Blizzard can do.

        • Nothing, or this problem would have been solved long ago. WoW isn't the first game to have to deal with this.

    • Re: (Score:3, Insightful)

      by faloi (738831)
      It probably is a better target, or at least safer. There's nothing illegal (AFAIK) about selling accounts and gold, and I imagine it'd be tough to prove who actually stole the account. The worst thing most people who engage in this behavior have to look forward to is an account suspension, whether you're buying or selling.

    • Re:A cold day in Hell.. (Score:5, Insightful)

      by MyIS (834233) on Thursday April 05 2007, @09:18AM (#18620149) Homepage

      Ah, history is full of examples how making something illegal completely eliminates it. *rolls eyes* More laws make more criminals, and if Blizzard came down on this, they would only drive this arms-race to higher levels. *OR* they could cash in on this (first and foremost), and also improve the game so that IT ISN'T A FRICKEN SECOND JOB!

      See, this is why I quit WoW - the fact that 90% of the time one has to "farm" or wait for a raid to assemble, or dully point their running character along some path across the map. I paid them money to escape the daily grind, and look what happened - I got into an even more boring grind. And, of course, there is no way to escape that grind either, because that's the only way to even get to the "fun" 10% of the game.

      If Blizzard made the game actually *fun* to play almost all the time, then noone would see the incentive to pay someone else to get through the boring stuff! And voila, no gold-farmers, no hacking accounts, no Slashdot story.

      • Re:A cold day in Hell.. (Score:4, Informative)

        by MBGMorden (803437) on Thursday April 05 2007, @09:58AM (#18620821)

        If Blizzard made the game actually *fun* to play almost all the time, then noone would see the incentive to pay someone else to get through the boring stuff! And voila, no gold-farmers, no hacking accounts, no Slashdot story.
        Yep, and they'd lose a lot of paying customers shortly afterwards. Here's the rub with games like WoW: they're largely a pissing contest where people like to gloat about how much better stats they have, how much better their gear is, how high their tradeskills are, etc. (and this is coming from someone who actually does play the game quite regularly).

        If they took out the grind, the coveted "status" that so many either love to maintain, or love to strive for, vanishes. Everybody is left with just the game for the game's sake, which while arguably the way it "should be" won't work for WoW because the game engine itself isn't the most interesting thing in the world.

        That's mainly why all the gear in TBC was so overpowered compared to the original campaign. People were finally getting to the point where many realized they were NEVER gonna make it into BWL, much less Naxx, and starting to lose interest. They gave them some major gear upgrades so that they can feel like "wow, I'm a badass - this stuff blows away the gear I saw those raiding guys walking around with a few weeks ago". Then they get back on the treadmill to try and reach that status again. Stupid, but if you take away the treadmill a lot of them will see no point.
        • I was really glad to see the "overpoweredness" of the gear that I got in Outland, because (for a little while, at least) it significantly reduced the gap between me and the people that can spend 20 hours a day grinding in the game for uber-gear. It was nice to go into a level 70 battleground and have a realistic chance of winning because nobody had an outrageous gear advantage. Sure, that gap will reappear shortly, but it's nice while it lasts. Hopefully there will be more expansions in the future...

          Anywa
        • They're not mutually exclusive, as you imply. In short: make the "grind" fun. Look at Ultima Online circa 1997-2000 for an example of how to do things differently. Yeah, the WoW system is so simple that the grind is all they have, but it doesn't have to be that way.
      • Wrong. Everyone wants the shotcut. Even if something is fun to one person, it isn't to another and they are willing to pay to get it done so they can concentrate on what they find fun.
        • You get to double your damage? That's pretty cool. How fast do your enemies HP increase?

          Ultimately, it's all about scale. If any MMO allowed you to vastly increase your power compared to the enemies you are expected to fight at that point in your character's development, the games would be mind-numbingly boring. My guess is that CoH enemies HP increases at a faster rate than WoW's, or that there are other ways in which a scale reasonably similar to WoW is maintained.

          A better system might be a system of
  • While I'm no fan of gold farmers and in-game currency traders, is there any evidence to justify naming IGE in that addendum? What justifies that?

    • Re:Awflly big brush you're tarring with... (Score:5, Informative)

      by pslam (97660) on Thursday April 05 2007, @08:49AM (#18619733) Homepage Journal
      While I'm no fan of gold farmers and in-game currency traders, is there any evidence to justify naming IGE in that addendum? What justifies that?

      Why, you could click on their web page [ige.com] and note the tagline "IGE, Buy WOW Gold, World of Warcraft Gold, FFXI Gil, Final Fantasy XI Gil, Lineage 2 Adena". These guys are assholes and proud of it. They don't deserve apologists.

      Maybe I should also dig up the evidence that in the past they were involved in authoring trojans...

  • Warning for players upon startup (Score:3, Interesting)

    by Sciros (986030) on Thursday April 05 2007, @08:46AM (#18619685) Journal
    Is there some sort of big warning popup in WoW for players as they start the game up? (prior to entering a username/password)? I know that Guild Wars has special "news items" alongside the login form that you can read without having to actually log into your account. It would be cool if Blizzard (heck, and ArenaNet) had a giant warning that came up for the next few days informing people of this issue and of the upcoming fix from MS (or am I confusing my vulnerabilities/fixes here?...). That might help folks out perhaps.
    • No, they are exploiting ANI. However a patch for this exploit has been released by Microsoft and is available via Windows Update.

  • OMFG! What about my Slashdot Account? (Score:4, Funny)

    by Culture (575650) on Thursday April 05 2007, @09:05AM (#18619961)
    I just hope no one ever figures out a way to do this with Slashdot accounts. If WoW accounts are more valuable than credit cards, then Slashdot accounts must be more valuable than, I guess, say Dilithium Crystals or Ewok slaves. I think I have finally going to have to upgrade to Windows98 from Windows95. It probably is mature enough at this point.

  • Preferred MS patch procedure (Score:3, Funny)

    by RealErmine (621439) <commerce&wordhole,net> on Thursday April 05 2007, @09:15AM (#18620089)

    What Microsoft should have done, instead of investing significant amounts of its own resources into the security patch, was tether a huge, yellow exclamation point over the Redmond campus. Wayward WoW players would be inexorably drawn to it where they would find a Non-payroll Personnel Coordinator (NPC) who would relate to them the details of the bug and why it needs to be fixed. Harvesting the collective zeal of the WoW community in such a fashion, the solution to the issue would have been presented to Microsoft promptly and at little expense. Patch notes could even be copied and pasted directly from the resulting Wowwiki page.

    Incidentally, I plan to use a similar process to reduce the amount of manual labor around the home.

  • Must suck having to worry about Windows exploits when you play WoW. One of my arena team members was complaining the other day that she needed another gigabyte of RAM to play WoW in Vista, too. I don't know if this is an issue in OSX since all my Apple machines came with 2gb.

    There's been a recent surge in the number of gold farming and leveling service spammers in the game lately, too. Your only recourse with those is to disable the whisper channel, which you can do from the chat menu. Unfortunately then

    • Do what I do. Simple verbal harrasment complaint:

      Player XXXXXXXX is whisper spamming website xxx.xxx.xxxx for gold and powerleveling services in area (STV|Barrens|wherever)

      EVERY GM I've talked to thus far has said they don't mind getting these reports and that this is currently the prefered method.

      The only time it's a pain is when I'm in the middle of a mob.

      The way that would make it easier is to put functionality into the problem report to select a name from recent whispers. I know who foo and bar and baz

    • Re:Soulbind Gold? (Score:4, Insightful)

      by FredDC (1048502) on Thursday April 05 2007, @08:39AM (#18619573)
      That would render the wow economy useless... You would only be able to buy from npc's and not from other players.

      • Re: (Score:2, Informative)

        by pslam (97660)
        There are ways around this. A common trick used to exchange gold cross-faction (not involving gold sellers at all) is to stick a "plain letter" (a very cheap item) on the cross-faction auction house for the amount of gold you want. The player on the other faction then buys it.

        Same applies to same-faction trading. In order to really stop gold changing hands, you would need to remove the auction houses. It would also render a lot of the profession system useless because you couldn't do enchants/crafting and

    • Right, so money and goods that are yours permanently and don't give you a way to trade with other people... Yeah, great idea. I don't play WoW, but soulbinding (as you describe it) would only be good for a small handful of your goods that you -KNOW- you will never part with.

      And you do realize that money is useless if you can't use it, right?

        • Re:Soulbind Gold? (Score:4, Funny)

          by kalirion (728907) on Thursday April 05 2007, @08:47AM (#18619707)
          Well, if you could un-soulbind it, then that would probably be a good idea. Also, if you wanted to get rid of some sole binded gold, you could just buy an item, and then sell the item to another character.

          Great, so now only someone who has access to my account can steal my gold and items! That solves everything!

            • Re: (Score:3, Insightful)

              by jchenx (267053)

              It amazes me the "infield fly rules" these games create just to prevent them from being like reality. It's bad enough a guy with no fighting training and no armor can stand there waving his hands while a huge guy with a sword beats on him unopposed. But this is "balance", i.e. melee wimps, casters much tougher than they actually are (not damage they do, but that they take. You can't avoid flinching when someone waves a hand in your face, much less a sword, much less hits you with a sword -- yet you can't we

    • Soulbinding isn't a choice--it's something that happens to some items (most often quest rewards) that prevents the reward from being transferred/used by other players. Gold cannot be soulbound--as others have pointed out, that would render it somewhat useless. Soulbound items can be sold to NPCs, however they can never be bought back. This does mean that soulbound items would still have value to a hacker who was trying to make real-world money.
    • Almost all equipment in WoW becomes soulbound when equipped. Some items become soulbound when you pick them up. I would imagine that account hackers just sell these items to NPC vendors.

    • Re:Soulbind Gold? (Score:4, Interesting)

      by Fozzyuw (950608) on Thursday April 05 2007, @09:32AM (#18620387)

      Don't WoW players have the option of "soulbinding" their gold and other items, so that only their own character can use them? This would seem to be the easiest fix for the problem of account hacking.

      Soulbinding is for items only, which can still be (rare cases, not withstanding) sold to the vendor for gold. Gold cannot be soulbound. Which is why, on hacked accounts, the person is left naked and pennyless. Everything in liquidated into gold and the gold is transferred to another.

      However, that is really a interesting idea. How would a game economy handle the idea of no inter -player trade? I would find that an interesting concept to test out. The game would have to be designed where 'all players are equal' in a sort. Everyone could craft any item (or require that you can only get crafted items from NPC vendors). Killing a monster and looting would give full value of money and items to everyone. (A monster drops 10 gold and all 5 players who killed it get 10 gold each. as well as a copy of the weapon or armour it dropped). Heck, a monster would no longer even NEED to drop items. They can just drop money and (as WoW is turning too) special tokens which can be exchanged for items at the high-end.

      It would remove an 'economy', for whatever a virtual economy is worth (as technically, everything is limitless). Though I know a lot of people like the idea of 'trade' (I'm one of them), the real question is, does a 'game' really need it? I guess this is close to how Guild Wars works when you only play with NPCs. All items dropped are given to you and gold is reduced by the number of NPC party members. While some items can be dropped from monsters that you use, often find that armour is crafted for you by NPCs who require crafting materials you salvage from item drops and some gold. In essence, it's kind of like only getting gold from monsters.

      Do so, does take something away from the 'feel' of the game, but it also can add to the 'work' of the game and I often find this adds to my own 'burning out'. Tough choice, but I like the idea and would like to see how people reacted to a game once they've played it fully.

      Cheers,
      Fozzy

      • Sure...

        Many games I play in WINE lack the bugs they have in windows.

        Ex: Due to DirectX errors, Master of Orion 3 is virtually unplayable in Windows, where as it's flawless in WINE.

        Also, WINE isn't involved in my web browsing or email.
        • Master of Orion 3 is unplayable period, and not because of any "unplayable windows bugs" but because the game design is grade A crap.
      • WINE causes alot of bugs in the user including garbled command input, general lag/delay and a 5 point hit to decision-making. I'd steer clear of it when playing online games, otherwise you might find out one morning you just donated all your possessions to the "Microwave Pirates" guild in a confused stupor.
        • Hmmm, I think you are thinking of a differint type of WINE.

          This is not the WINE you find next to the BEER and VODKA, one aisle over from the SODA POP, but rather a software application you find in the PORTS TREE in BSD, or various SOFTWARE REPOSITORIES in Linux.
        • I agree. I play using Cedega and have never had any problems that weren't my own causing. The ONLY bug I've had that was even remotely annoying was occasionally losing the ability to type anything. I could still use all my macros and move with the keyboard just couldn't type in guild or whisper. Get to a safe place, log out and log in and it's resolved.
    • I'm not sure I'd call it "simple." It could kill the game by making it impossible to enjoy - the guys that can spend 16 hours a day grinding for gear would now also be able to safely spend real money (that they don't have to spend on rent because they're living in mom's basement) to buy even better gear and make things like battlegrounds even less fun for casual gamers.

      Then again, maybe they're already doing that via the gold/item/level farmers. Maybe a legitimate exchange system for real-world money woul
        • It would be nice if there was some equivalent to the "rested XP" bonus once you've reached max level; some benefit that casual gamers would receive for not being online all the time. I'm sure the hard-core people would whine about it, but I doubt many of them would quit over it (as long as it wasn't some outrageous benefit).

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.