Authenticator finally bypassed because someone failed to keep their machine secure

[erish]

Saw this on the ffxi section awhile ago but blizzard finally confirmed they can be bypassed.


From MMO


Trojan succesfully hacks Authenticator Protected Accounts
A new virus spawned on the internet a few days ago and seems to be the first trojan capable of hacking a WoW account protected by an Authenticator. It was confirmed by Blizzard a few hours ago.
Quote from: Kropacius (Source)
After looking into this, it has been escalated, but it is a Man in the Middle attack.

http://en.wikipedia.org/wiki/Man-in-the-middle_attack

This is still perpetrated by key loggers, and no method is always 100% secure.

Basically, what the virus does is fairly simple after you're infected :

* The next time you log in World of Warcraft, the game asks for your Authenticator code.
* The virus intercepts it, send it to another server, and sends a wrong one to Blizzard = You get an error.
* The people behind the virus now have a few seconds/minutes to use the "real" code while it's valid to change your password / empty your account / guild bank.


How to check if you're infected
Just search for a file named "emcor.dll" on your computer, it is most likely located in "C:\Users\(Your user name)\AppData\Temp" but I suggest that you check everything just to be sure. If you do find the file, delete it and make sure you update your anti-virus to prevent any further problem.

To be honest, if you found this file your account is probably already compromised.

What does it mean exactly?

* Yes, you can get hacked even if you have an authenticator, the chances are MUCH lower but you're not invulnerable.
* It definitely isn't an excuse to not have an authenticator. We're talking about a single virus here and the authenticator will save your ass 99% of the time.
* Get a decent anti-virus, buy an authenticator, you'll be safe.

[Gulkeeva]

Think the old "get your e-mail info, contacting blizzard through your e-mail and telling them you lost your authenticator, disable it and login" method still works

[Boyiee]

People are calling this an "authenticator hack" when the authenticator isn't really getting hacked as much as you are just being keylogged on your login screen.

[Pikarya]

People are calling this an "authenticator hack" when the authenticator isn't really getting hacked as much as you are just being keylogged on your login screen.

This is correct. The authenticator isn't failing, its the user.

[Siniroth]

Same thing happened to ffxi lol

[Ohaigaiz]

i'm still confused as to how people get keylogged in the first place

[Onorgul]

Part of it is a learning process. When you first jumped onto the internet, I'm sure you ended up infecting your computer a time or three before figuring out how to exercise appropriate caution and skepticism. Some people never learn, of course, and will click on any link that promises hot milfs (OMG click me), but it's really not that hard to imagine someone going to the wrong site using the wrong browser because they've never learned any better.

[Thunderblaze]

Majority of computer problems are caused by people using Internet Explorer. 99.9% of the time when I am asked to fix a computer, IE usage was the cause.

Firefox + Noscript + Common Sense = 0% chance of getting a virus.

[Siniroth]

.00001% chance maybe, you aren't going to hit 0% chance of getting a virus unless you have a computer completely cut off from any form of network

[Kaylia]

.00001% chance maybe, you aren't going to hit 0% chance of getting a virus unless you have a computer completely cut off from any form of network

I got a virus from a 5¼ floppy disk before I even knew about the internet, you're not safe even without the net!

[Thunderblaze]

I got a virus from a 5¼ floppy disk before I even knew about the internet, you're not safe even without the net!

That reminds me of when I sent a kid a file named porn, he opened it, and it destroyed his computer. Had to spend a few hours telling him how to undo everything, didn't think he'd be stupid enough to open it :\

[Kaylia]

Why the fuck would you send that to anyone? If someone I know would send me a file named porn, I would probably open it, thinking it's a joke file.

[Boyiee]

I get video text messages to my phone weekly named "porn" or something related, only to open it and see giant balls or some gaping asshole.

[finamenon]

Majority of computer problems are caused by people using Internet Explorer. 99.9% of the time when I am asked to fix a computer, IE usage was the cause.

Firefox + Noscript + Common Sense = 0% chance of getting a virus.

I use all of the above(yes common sense included) plus anti-virus. WoW account was still hacked. I gave no one my password, not even my girlfriend. Firefox + Noscript does fuck all. If someone wants to hack you, they will.

[Tonko]

Or, if you're stupid enough to fall for a phishing scam, you'll get hacked.