NETGEAR TECH SUPPORT SETUP SCAM!! WOW $60.00 TO SETUP CONFIGURATION PROBLEMS.

BEWARE OF NETGEAR SCAM. I PURCHASE A NETGEAR ROUTER ONE YEAR AGO AND TECH SUPPORT WON'T FIX THEIR CONFIGURATION.!!!!!BEWARE  WE SHOULD NOT HAVE TO PAY FOR TECH SUPPORT $60.00 IF IT IS A PROBLEM WITH THEIR WIZARD OR CONFIGURATION PROBLEM. THIS IS AN INTERNAL MATTER OF THE COMPANY.

I JUST MOVED TO NEW LOCATION AND HAD PROBLEM WITH NETGEAR CONFIGURATION, BECAUSE WIZARD COULD NOT FIX THE PROBLEM NOR THE CD PROVIDED. CONTACT NETGEAR TO HELP WITH THIS PROBLEM BEING THAT IT IS A PRODUCT SERVICE THAT CAN ONLY BE FIX BY ONE OF THEIR TECH. NO TECH WOULD HELP WITH THE PROBLEM UNLESS THE CLIENT PAY 60 DOLLAR FOR THEM TO FIX AN INTERNAL CONFIGURATION. AFTER SPEAKING TO OVER 10 DIFFERENT TECH AND SENDING E MAIL TO TECH TO FIX THE PROBLEM THEY HAVE NOT RESOLVE THE ISSUE AND DEMAND THAT YOU PAY FOR TECH SUPPORT TO FIX IT. TO ME THIS IS A SCAM AND CLIENT SHOULD BE ADVISED THAT IF THEY HAVE PROBLEM IN THE FUTURE THAT THERE IS NO TECH SUPPORT TO FIX THE PROBLEM WITHOUT RENEWING YOUR WARRANTY FOR THE PRODUCT. WHICH HAS NOTHING TO DO WITH THEIR CONFIGURATION OR WIZARD PROBLEM.
I ADVISE USER TO BEWARE THIS SCAM AND SELECT A MORE RELIABLE SERVICE AS LYNKSYS ROUTER. BIRKLIN IS SLOW AND HAS ISSUE TOO YET THEY PROVIDE SERVICE IF YOU HAVE SETUP PROBLEM.

Read More

Blizzard Adds Dial-in Authenticator

Blizzard has announced a new security service for US players called the Dial-In Authenticator.

"Similar to the Battle.net Authenticator and Mobile Authenticator application, the Battle.net Dial-in Authenticator is an optional tool that provides an additional layer of security against unauthorized account access. The Battle.net Dial-in Authenticator is not a physical token or application run on a mobile device, however. Instead, it is a free opt-in service that will actively monitor an account and request additional authorization from the user when a potentially unauthorized login attempt occurs."

The service asks you to nominate a phone and a PIN.  When your account is accessed from a different IP address it will ask you to authenticate by dialling a US toll-free number from your nominated phone and entering your PIN and a single-use security code.  The service is optional and best of all, it is free.

This is a good addition to the security arsenal, especially for those users that move around a lot and don't have a hardware authenticator. Remember that good security is made up of several layers of protection, and this offers yet another layer.

More information can be found at the official Battle.net Dial-in Authenticator FAQ.

Read More

Guild Ranks To Include Authenticators

Image courtesy of WoW Insider

The latest news from the Cataclysm beta program, via WoW Insider, is that guild masters have the option tp set guild ranks to require the player to have an authenticator on their account.

The obvious use for this is to have the guild master set this on any guild rank that has guild bank access. This will help reduce the chance of the guild bank being stripped in the event of an account compromise.

However, guild masters can go further by mandating that all of their raiders, and even all of their members, have an authenticator.  Too often we see raiding disrupted when key players have had their accounts hacked.  Just imagine the inconvenience when a progression raid gets cancelled because the main tank is waiting for his/her account to be restored after a hack.

This is a great initiative by Blizzard and will surely give people one less excuse for players to adopt this technology.

Some of the more common excuses for people not having an authenticator include:

1. "I don't have a credit card" or "They don't deliver to my country" - download the free authenticator app for your mobile phone or ask a guild mate to purchase one for you and mail it to you
2. "I am too smart/cautious to get hacked" or "I have never been hacked" - Vulnerabilities in your operating system and applications can very easily result in you downloading a keylogger by simply visiting a legitimate web site that may have been compromised.  For well-written exploits, no user interaction is required to become infected - you just need to visit a compromised web site.  Your game login and password is then shipped off to the bad guys.  See the recent Adobe example. Additionally, common passwords can be attacked by automated processes - you don't even need a keylogger on your system to fall victim.
3. "I own a Mac" - Yes, you are less likely to pick up a keylogger since most are written for Windows however, owning a Mac won't stop you falling for phishing attacks.
4. "I pay for this service, authenticators should be free" - I doubt that Blizzard are making any real revenue on a product that sells for $6.50 - they are just aiming to recover costs.  Think of the amount of money you have paid for your subscription to date, and then ask yourself if it is worth the extra $6.50 to reduce the chance of all your hard work being compromised.
5. "It is inconvenient to type in the code" - the extra ten seconds required to login is a small price to pay for the extra security that it provides.
6. "Authenticators have been hacked" - well, it was not the authenticator that was hacked, it was more that a keylogger picked up the authenticator code and, in real time, shipped it off to the bad guys.  This was a fairly sophisticated attack and required people power to do the real time processing.  Keep in mind that security is never 100% and that the authenticator is just making it more difficult for the bad guys to get into your account.  An authenticator is still a very effective tool in your security arsenal.
7. "I don't care, Blizzard can restore my account after a few days" - if you are in a raiding guild then the delay in reporting and restoring your account may mean you miss out on raiding, potentially impacting your entire raid group.  This may even put your guild membership at risk if this happens regularly.

Check out Ten Easy Steps to Securing WoW for more security tips.

Read More

Adobe Announces New Flash Vulnerability

Adobe Systems has recently disclosed a vulnerability in their Flash Player 10.1.82.76 for Windows, Mac, Linux and Solaris. The vulnerability allows the execution of code from a specially crafted PDF or Flash file. Adobe mention that they have seen this being actively exploited.

Put simply, this type of vulnerability could see you become infected with a keylogger simply by browsing a web site that has been compromised. We have seen WoW keyloggers installed via this type of Adobe vulnerability before in June and February.

Adobe has not released a patch for this as yet, but plan to have something available during the week of September 27.

You can reduce the chance of becoming subject to this attack by patching your flash player as soon as a patch is released and by running a PDF/flash blocker such as noscript in the meantime.

You can find more information on this at the Adobe Security Advisory site.

Read More

Blizzard steps up password education

Blizzard has stepped up its security education program, with a big emphasis on password security. Via both a game login message and a recent blue post, Blizzard stresses the importance of having a different password for your World Of Warcraft game account and making sure that your password is a strong one.

BORNAKK: We have been helping players deal with account theft for years now, and unfortunately, roughly a third of players make a very basic security mistake: using the same password for all of their security needs.

If you are serious about protecting your account and your personal security, your Battle.net password should be different from your email account password -- or other personal passwords for that matter!

No one wants account thieves rooting around in their personal email, address book, and contact lists. Too often we see thieves breaking in to this information because their target has used the same password across multiple types of accounts. Not only can this give thieves access to your account, it can lead to compromises far outside of Battle.net as well.

It’s immensely important that everyone use separate passwords for separate applications, including games. Secure passwords have both numeric and alphabetical values, and are usually at least 10 characters in length. 

Now this is very sound advice and is something that I have been highlighting for quite some time.  One third of hacks being a result of using the same password across multiple sites and applications, such as email and fan sites, is a fairly alarming statistic.  This suggests that there are a lot of 3rd party systems out there that are being hacked to farm WoW user accounts and passwords.

Also note that WoW does not impose restrictions on password attempts so dictionary attacks are also a real possibility on your account.  This is a great reason for selecting a strong, complex password.

Oddly enough, Bornakk does not mention the use of an authenticator. The Blizzard authenticator is a great security mechanism and something that every WoW gamer should possess.

You can read more on choosing secure passwords and dictionary attacks on your WoW account here.

Read More

ESRB mistakenly releases player email addresses

Many people have asked me how the bad guys get hold of our battle.net login id's - the same bad guys that inundate us with WoW phishing emails and do dictionary attacks on our battle.net logins.

The team at wow.com have published an article on how the Entertainment Software Rating Board (ESRB) managed to mistakenly release almost 1000 email addresses of wow players that wrote to them to complain about Blizzard's plan to use real names on the official wow forums.

This email list is a gold mine to the bad guys, especially where these email addresses match up with battle.net ID's.  There is little doubt that these 1000 email addresses will end up on WoW phishing lists and that they may also be targets for WoW dictionary attacks.

If you recently wrote to ESRB and you used the same email address as your battle.net ID then please consider changing your battle.net ID to a new, unique email address.

You can read more about the mess-up at Wow.com

Read More

Patch Your Flash!

Blizzard has released an advisory warning all players to update their Adobe Flash Player.  Adobe Flash Player 10.0.45.2 has a vulnerability that may allow an attacker to take control of your machine.

LUCYTR: A critical vulnerability has been discovered in Adobe Flash Player 10.0.45.2 and Adobe Reader/Acrobat 9.x, and could potentially be used to target World of Warcraft players and accounts. The newest available version of Adobe Flash 10.1, Release Candidate 7 (available at http://labs.adobe.com/technologies/flashplayer10/), does not appear to contain this vulnerability, and we recommend that everyone upgrade their Flash player as soon as possible. Earlier versions of Adobe Reader and Acrobat, specifically version 8.x, do not appear to contain this vulnerability, either. 

Adobe reports that it has seen evidence of this vulnerability already being exploited.

Although the technical details are still sketchy, it is likely to require a specially crafted flash or PDF file to trigger the vulnerability.  We have seen this type of attack on Adobe flash before - where you can be infected by a keylogger/trojan by simply visiting a legitimate web page that renders this malicious code or redirects to a malicious site containing the code.

Unfortunately, Adobe don't seem to have this fix on their auto-update system so be sure to visit Adobe's Security Page and patch your machine with v10.1 today.

Read More