Macintosh Malware questions

[Burnsy]

Hi tech section!

I've been using a MacBook Pro for the last 5 months or so to play WoW until yesterday when I discovered that my account had been compromised by a third party. (yes I know, another I got hacked thread, but my questions are more specific)

My specific question is this:

Blizzard suggests virus detection for Windows users, and even suggests Norton (lol) for Mac users. Does anyone know of a different application I can use on this mac to check for Keyloggers or other mal/spyware?

I know Macs are generally not targeted, and after running a full scan with a trial version of MacScan, I have found nothing of note, but if anyone knows of any other free software along the lines of Malwarebytes for a Mac OS 10.5.8 system I'd love to try them.

For the record: Never logged into my account with another machine, or shared my password, never fell for phishing messages or emails, Never visited any site on the possibly infected machine other than:

www.femaledwarf.com - Hunter DPS calculator
wowhead.com
wowwiki.com
official blizzard Armory


All add-ons were downloaded through he newest version of CurseClient.

Any and all suggestions (other than buying an authenticator, it's getting bought as soon as my account is restored) will be greatly appreciated, please remember Mac OS X only, I don't even have windows installed thru boot camp or anything.

[Linliel]

Is your password a dictionary word?

[Cephius]

Keyloggers can be installed rather easily on Macs, the difference is the user has to approve them (a box similiar to "Are you sure you want to install this?" will pop up) for them get in there and work.

I'd make sure you don't use the same password for your wow account that you do for other services.. other than that it's impossible to say where it came from without a lot more data about your browsing habits.

Anyway, MacScan was probably your best bet. If it didn't pick up anything, you likely got hacked by other means.

[Burnsy]

Question 1: Password for both the mac administrator account I use and WoW account are different, and no, they are not dictionary words, they are an alpha numeric version of old character names from ffxi, no one knows the character names or how I make them work with letters and numbers. The only scary thing is I was using the same password for my gmail and wow accounts.... Both have been changed as of yesterday morning.

I did notice a few "How to hack wow accounts" videos on youtube from 2008, using a file found in any WoW client, and a character and realm name, forcing a password retrieval email to a different specified email address, is this still a possibility?

For the record, this is a work owned computer that I have administrative rights to, so my browsing is limited to legit WoW sites (listed above) reddit, here, and other technology related sites (I'm a entry level computer support aide, basically IT guy without certs or "proper" training) Google News - the links there may be iffy, but I usually stick to the big names, NY times etc.

I did have emails in my gmail account (that is the primary contact for the battle.net account) stating my password had been reset, then changed, then the account suspended email from the attacker apparently spamming chat channels with advertisment links...

Guess using Blizzard's authenticator is a must, sad that the RMT have to do this kinda shit to a noob to make money.

Thank you.

[Mayareira]

Its quite difficult to get a keylogger running on a UNIX based OS, like Cephius said it'll literally ask you everytime you attempt to launch something..however if you happen to approve it by mistake then you've got a problem.

You were probably using a weak password, hackers out there are notorious and have developed a fuckton of methods to retrieve stuff (alphanumerical doesn't necessarily mean strong...it has to be long, changed periodically ,etc.).

If you are serious about WoW, yeah autenticator is the way to go. Also, you might've attempted to log onto your account from an unsafe (like public) computer in the past.

[Burnsy]

Also, you might've attempted to log onto your account from an unsafe (like public) computer in the past.

I can 100% refute this line. This machine I am typing on now is the only machine I have ever logged into my account with.

I've never allowed a application I didn't know I was installing be installed, the only thing that possibly concerns me are add-ons downloaded thru Curse, I might be expunging them all before I try to log in again.

Thank you for the information, and sadly I guess I have to start changing retarded long passwords every few days once my account is unlocked, and buying a security token.

Edit: My senior Macintosh tech at work gave me this link, and I ran the application just now, nothing showed here either, I think they either bullrushed my password, or spoofed a reset message. Here's the app I just used for anyone else that uses mac that might want to try something other than Norton:

http://www.versiontracker.com/dyn/moreinfo/macosx/30622

[Korietsu]

I can 100% refute this line. This machine I am typing on now is the only machine I have ever logged into my account with.

I've never allowed a application I didn't know I was installing be installed, the only thing that possibly concerns me are add-ons downloaded thru Curse, I might be expunging them all before I try to log in again.

Thank you for the information, and sadly I guess I have to start changing retarded long passwords every few days once my account is unlocked, and buying a security token.

If you logged into your battle.net account elsewhere to post on the forums, then you could have been compromised that way.

[Burnsy]

If you logged into your battle.net account elsewhere to post on the forums, then you could have been compromised that way.

This may be a possibility, but I'm almost positive that I only use this machine for anything WoW related (years of fear on a pc with my ffxi account has me usually pretty smart about these things, but I might have been high/drunk at some point in the last 5 months)

[Cephius]

Stupid question but you said it was a work computer.. do other people log into it? Probably not, but yeah...

I would guess that your gmail account was hacked, and that's how they got into WoW. Since you're pretty sure it couldn't have been anything else, that would be my guess. But again it's really hard to track these things down without me having been looking over your shoulder for the past month.

[Burnsy]

Stupid question but you said it was a work computer.. do other people log into it? Probably not, but yeah...

I would guess that your gmail account was hacked, and that's how they got into WoW. Since you're pretty sure it couldn't have been anything else, that would be my guess. But again it's really hard to track these things down without me having been looking over your shoulder for the past month.

No one else uses this machine, clears one possibility out.

The gmailhack/password guessing theroies are most probable imho, and as I was not using my PC for anything but "bad" browsing, (using firefox/noscript/flashblock) since quitting ffxi, it is possible that my gmail was hacked... fucking scary shit tho man, you think you're being safe....


Thank you all so very much for your time and comments, they make this process and situation much easier to deal with. I had been pulling out various body hair regions trying to nail down where my security leak was.

[Linliel]

No one else uses this machine, clears one possibility out.

The gmailhack/password guessing theroies are most probable imho, and as I was not using my PC for anything but "bad" browsing, (using firefox/noscript/flashblock) since quitting ffxi, it is possible that my gmail was hacked... fucking scary shit tho man, you think you're being safe....

One thing I've always done with gmail is to make sure that I use the secure version of the site. I think they made it the default now, but with anything that you use passwords that you use for other things, if there's a https version of the site, use it. Or use a different password from everything else (at the very least).

[Burnsy]

One thing I've always done with gmail is to make sure that I use the secure version of the site. I think they made it the default now, but with anything that you use passwords that you use for other things, if there's a https version of the site, use it. Or use a different password from everything else (at the very least).

All very true. I have been using the secure site for some time now, as long as it's been the default anyway.

Seriously it's my own laziness in my personal life that has lead to this... I never used the same passwords for things until WoW/gmail, which were linked, so in an effort to stop the FFFFFUUUUUUUUUUUUUUU everytime I had to actually remember a password, I cheaped out and used the same one.


Back to a small notebook of passwords that I keep in my desk!