Diablo 3 Beta Phishing Season Begins

The scammers are out in force with the recent Diablo 3 beta opt-in announcement.  

Phishing scams are very common around any Blizzard beta release announcement so it is time to be especially on your guard.


I received the following in my in-box today:

Greetings from Blizzard Entertainment!

We’re gearing up for the forthcoming launch of Diablo III and would like to extend you an invitation toparticipate in the beta test. If you are interested in participating, you need to have a Battle.net account, which you can create on our Battle.net website.

We will flag you for access to the Diablo III beta test when we begin admitting press. You do not need to go through the opt-in process.

To secure your place among the first of Sanctuary’s heroes,Please use the following template below to verify your account and information via email.

* Name:
* Battle.account name:
* Password:
* Country:
* E-mail Address:

Thanks and see you all in the Burning Hells!

The email claims to give you an express beta invite without having to go through the formal opt-in process. Naturally, this is a phishing attempt aimed at getting hold your valuable battle.net account details. The reply email address resolves into a d3-blizzard.com domain which, not-so-surprisingly, is registered in China:

Domain Name: D3-BLIZZARD.COM
   Registrar: HICHINA ZHICHENG TECHNOLOGY LTD.
   Whois Server: grs-whois.hichina.com
   Referral URL: http://www.net.cn
   Name Server: DNS27.HICHINA.COM
   Name Server: DNS28.HICHINA.COM
   Status: ok
   Updated Date: 29-aug-2011
   Creation Date: 29-aug-2011
   Expiration Date: 29-aug-2012

Remember, Blizzard will never ask your for your battle.net password - be wary of any communications that requests this.

Read More

Top WoW Phishing Scams for March 2011

I have established a WoW phishing honeypot and I see a lot of active phishing scams.  I thought I would take the time to cover off the top two WoW phishing scams for March :

#1 Titled "Too Many Attempts Warning No.x" - 37% of WoW scams

The most common phishing scam for March comes in the form of a straight text email that warns you that your account has been locked due to too many login attempts. It provides a link to restore your account, but naturally points to a fake battle.net site, where your account details are captured.

-----------------------------------------------------------------------------

Dear customer, 

Due to suspicious activity, your Battle.net account has been locked. You tried to login your account too many times (403). We are concerned about whether your account has been stolen. In order to guarantee the legitimacy of your account, we need you follow these steps:

Step 1: Secure Your ComputerIn the event that your computer has been infected with malicious software such as a keylogger or trojan, simply changing your password may not deter future attacks without first ensuring that your computer is free from these programs. Please visit our Account Security website to learn how to secure your computer from unauthorized access.

Step 2: Secure Your E-mail AccountAfter you have secured your computer, check your e-mail filters and rules and look for any e-mail forwarding rules that you did not create. For more information on securing your e-mail account, visit our Support page.

Step 3: Restore access to Your accountWe now provide a secure link for you to verify whether you have taken the appropriate steps to secure the account, your computer, and your email address. Please follow this site to restore the access to your account: xxxxxxxxxxxxxxxxxxxxxxxxxxxx

If you still have questions or concerns after following the steps above, feel free to contact Customer Support at xxxxxxxxxxxxxxxxxxx.

Sincerely, 

The Battle.net Account Team 

Online Privacy Policy
-----------------------------------------------------------------------------

#2 Titled "Account Change" - 26% of WoW scams

This scam attempts to scare you into thinking that your contact information has been illegally modified and entices you to log in to a fake site to verify your account information.

-----------------------------------------------------------------------------

Hello,
This is an automated notification regarding your Battle.net account. Some or all of your contact information was recently modified through the Account Management website.

*** If you made recent account changes, please disregard this automatic notification.
*** If you did NOT make any changes to your account, we recommend you log in to xxxxxxxxxxxxxxxxxxxx review your account settings.

If you cannot sign into Account Management using the link above, or if unauthorized changes continue to happen, please contact Blizzard Billing & Account Services for further assistance.

Billing & Account Services can be reached at 1-800-59-BLIZZARD (1-800-592-5499 Mon-Fri, 8AM-8PM Pacific Time) or at billing@blizzard.com.

Account security is solely the responsibility of the accountholder. Please be advised that in the event of a compromised account, Blizzard representatives will typically lock the account. In these cases the Account Administration team will require faxed receipt of ID materials before releasing the account for play.

Regards,
The Battle.net Support Team 

Blizzard Entertainment

www.blizzard.com/support 

Online Privacy Policy

-----------------------------------------------------------------------------

Other active scams including a "7 days free access offer", "investigations on the sale/trade of your game account" and various "compensation" emails.  I have also started to see scams for LOTRO and RIFT.  You know that you have made it as an MMO when you see active phishing scams - sad, but true.

Learn more about the mechanics of these scams.

Read More

Trust Me, I am a Security Pro

Everyone you talk to seems to have their own special advice on how to avoid having your game account hacked. Unfortunately, there is both good and bad advice given. While I normally blog about the good advice, I decided to take some time and dispel some of the common IT security myths out there.

Myth: You can't get hacked by simply visiting a web site

People often claim that you can't be hacked by just visiting a web site and that you need to download and install something by clicking on it.

This is false. You can indeed pick up a trojan/keylogger simply by browsing to a web site that has malicious content which takes advantage of a vulnerability and, depending on the vulnerability, you may not even know that you have been infected.

Vulnerabilities can be found in the operating system, your browser, your flash player, your media player and in any piece of software that runs on your machine. Many of these vulnerabilities, if exploited, allow remote code execution which can be used to automatically download malicious software without your interaction or knowledge.

Myth: Running Firefox/Mozilla means I am safe

Internet Explorer has traditionally been one of the most exploited browsers, mainly because of its historical prevalence. These days, Firefox is the most popular browser amongst WoW users (44%), with IE (22%) and Chrome (21%) coming next... and the hackers have followed. Many vulnerabilities and exploits have been discovered with Firefox.

Other browsers are not perfect either. For example, a competition at a security conference found that most browsers could be easily compromised with Google's Chrome being the last one standing.

Myth: Run 'noscript' and you will be fine

Noscript is an addon for firefox that allows you to block flash and javascript on web pages. It helps alleviate issues such as flash vulnerabilities that are often announced. 

Noscript is a very good idea in concept but it breaks most web sites, especially modern web sites that require flash and javascript (which is nearly all of them).  This is the traditional trade-off you get with security.  Noscript provides some excellent protection but you will not get the full functionality from web sites without extensive whitelisting.

Myth: I run a Mac and Macs don't get malware

Yes they do - just not as much malware as what Windows users can expect.

However, you can still get phished.  Given that many of the account hacks are a result of phishing attacks, Mac users need to remember that they are just as vulnerable to these as any other user.

Myth: Pick up free anti-virus software and you will be right

Honestly, you get what you pay for.  As someone that comes from the anti-virus industry, I know the investment required to produce a top-quality anti-virus solution.  Free AV is good, but paid-for AV is better. It ultimately comes down to your tolerance of risk and whether you are prepared to pay for better protection. You can see a list of AV products and their ratings at avtest.org.

Myth: I have an Authenticator therefore I am protected 100%

No security will provide 100% protection. Whenever you hear someone say that something is 100% secure then don't believe a word of it.

The authenticator recently fell victim to some malware that intercepted the authenticator's code and sent it off to the hacker. But don't despair - the authenticator is still one of the best prevention mechanisms you can buy.

I don't have an authenticator, I don't run AV, I don't have a firewall and I have never been hacked.

You should go and buy yourself a lottery ticket. Seriously, you are very lucky.

As discussed earlier, you can get infected simply by surfing a page that features some malformed objects designed to exploit a vulnerability in some piece of software on your PC.

But you avoid bad sites such as hack sites or porn sites, right? 

Well, even the good sites get hacked to become a source of malware. This is becoming a much more common method of malware propagation.

Visit our 10 Easy WoW Security Steps post to learn more about securing your WoW account.

Read More

NETGEAR TECH SUPPORT SETUP SCAM!! WOW $60.00 TO SETUP CONFIGURATION PROBLEMS.

BEWARE OF NETGEAR SCAM. I PURCHASE A NETGEAR ROUTER ONE YEAR AGO AND TECH SUPPORT WON'T FIX THEIR CONFIGURATION.!!!!!BEWARE  WE SHOULD NOT HAVE TO PAY FOR TECH SUPPORT $60.00 IF IT IS A PROBLEM WITH THEIR WIZARD OR CONFIGURATION PROBLEM. THIS IS AN INTERNAL MATTER OF THE COMPANY.

I JUST MOVED TO NEW LOCATION AND HAD PROBLEM WITH NETGEAR CONFIGURATION, BECAUSE WIZARD COULD NOT FIX THE PROBLEM NOR THE CD PROVIDED. CONTACT NETGEAR TO HELP WITH THIS PROBLEM BEING THAT IT IS A PRODUCT SERVICE THAT CAN ONLY BE FIX BY ONE OF THEIR TECH. NO TECH WOULD HELP WITH THE PROBLEM UNLESS THE CLIENT PAY 60 DOLLAR FOR THEM TO FIX AN INTERNAL CONFIGURATION. AFTER SPEAKING TO OVER 10 DIFFERENT TECH AND SENDING E MAIL TO TECH TO FIX THE PROBLEM THEY HAVE NOT RESOLVE THE ISSUE AND DEMAND THAT YOU PAY FOR TECH SUPPORT TO FIX IT. TO ME THIS IS A SCAM AND CLIENT SHOULD BE ADVISED THAT IF THEY HAVE PROBLEM IN THE FUTURE THAT THERE IS NO TECH SUPPORT TO FIX THE PROBLEM WITHOUT RENEWING YOUR WARRANTY FOR THE PRODUCT. WHICH HAS NOTHING TO DO WITH THEIR CONFIGURATION OR WIZARD PROBLEM.
I ADVISE USER TO BEWARE THIS SCAM AND SELECT A MORE RELIABLE SERVICE AS LYNKSYS ROUTER. BIRKLIN IS SLOW AND HAS ISSUE TOO YET THEY PROVIDE SERVICE IF YOU HAVE SETUP PROBLEM.

Read More

Blizzard Adds Dial-in Authenticator

Blizzard has announced a new security service for US players called the Dial-In Authenticator.

"Similar to the Battle.net Authenticator and Mobile Authenticator application, the Battle.net Dial-in Authenticator is an optional tool that provides an additional layer of security against unauthorized account access. The Battle.net Dial-in Authenticator is not a physical token or application run on a mobile device, however. Instead, it is a free opt-in service that will actively monitor an account and request additional authorization from the user when a potentially unauthorized login attempt occurs."

The service asks you to nominate a phone and a PIN.  When your account is accessed from a different IP address it will ask you to authenticate by dialling a US toll-free number from your nominated phone and entering your PIN and a single-use security code.  The service is optional and best of all, it is free.

This is a good addition to the security arsenal, especially for those users that move around a lot and don't have a hardware authenticator. Remember that good security is made up of several layers of protection, and this offers yet another layer.

More information can be found at the official Battle.net Dial-in Authenticator FAQ.

Read More

Guild Ranks To Include Authenticators

Image courtesy of WoW Insider

The latest news from the Cataclysm beta program, via WoW Insider, is that guild masters have the option tp set guild ranks to require the player to have an authenticator on their account.

The obvious use for this is to have the guild master set this on any guild rank that has guild bank access. This will help reduce the chance of the guild bank being stripped in the event of an account compromise.

However, guild masters can go further by mandating that all of their raiders, and even all of their members, have an authenticator.  Too often we see raiding disrupted when key players have had their accounts hacked.  Just imagine the inconvenience when a progression raid gets cancelled because the main tank is waiting for his/her account to be restored after a hack.

This is a great initiative by Blizzard and will surely give people one less excuse for players to adopt this technology.

Some of the more common excuses for people not having an authenticator include:

1. "I don't have a credit card" or "They don't deliver to my country" - download the free authenticator app for your mobile phone or ask a guild mate to purchase one for you and mail it to you
2. "I am too smart/cautious to get hacked" or "I have never been hacked" - Vulnerabilities in your operating system and applications can very easily result in you downloading a keylogger by simply visiting a legitimate web site that may have been compromised.  For well-written exploits, no user interaction is required to become infected - you just need to visit a compromised web site.  Your game login and password is then shipped off to the bad guys.  See the recent Adobe example. Additionally, common passwords can be attacked by automated processes - you don't even need a keylogger on your system to fall victim.
3. "I own a Mac" - Yes, you are less likely to pick up a keylogger since most are written for Windows however, owning a Mac won't stop you falling for phishing attacks.
4. "I pay for this service, authenticators should be free" - I doubt that Blizzard are making any real revenue on a product that sells for $6.50 - they are just aiming to recover costs.  Think of the amount of money you have paid for your subscription to date, and then ask yourself if it is worth the extra $6.50 to reduce the chance of all your hard work being compromised.
5. "It is inconvenient to type in the code" - the extra ten seconds required to login is a small price to pay for the extra security that it provides.
6. "Authenticators have been hacked" - well, it was not the authenticator that was hacked, it was more that a keylogger picked up the authenticator code and, in real time, shipped it off to the bad guys.  This was a fairly sophisticated attack and required people power to do the real time processing.  Keep in mind that security is never 100% and that the authenticator is just making it more difficult for the bad guys to get into your account.  An authenticator is still a very effective tool in your security arsenal.
7. "I don't care, Blizzard can restore my account after a few days" - if you are in a raiding guild then the delay in reporting and restoring your account may mean you miss out on raiding, potentially impacting your entire raid group.  This may even put your guild membership at risk if this happens regularly.

Check out Ten Easy Steps to Securing WoW for more security tips.

Read More

Adobe Announces New Flash Vulnerability

Adobe Systems has recently disclosed a vulnerability in their Flash Player 10.1.82.76 for Windows, Mac, Linux and Solaris. The vulnerability allows the execution of code from a specially crafted PDF or Flash file. Adobe mention that they have seen this being actively exploited.

Put simply, this type of vulnerability could see you become infected with a keylogger simply by browsing a web site that has been compromised. We have seen WoW keyloggers installed via this type of Adobe vulnerability before in June and February.

Adobe has not released a patch for this as yet, but plan to have something available during the week of September 27.

You can reduce the chance of becoming subject to this attack by patching your flash player as soon as a patch is released and by running a PDF/flash blocker such as noscript in the meantime.

You can find more information on this at the Adobe Security Advisory site.

Read More