9 replies to this topic

[Luci]

A few days ago I read some news all around the World of Warcraft websites about a virus which managed to hack Authenticator Protected Accounts. I wasn't too amazed because there is no 100% secure method to protect your account but if you know what to do your chances of losing your account are extremely low. I'll try to guide you by giving you some tips on how you can protect your account details. Remember, this is not necessarily only for a World of Warcraft account. Since Battle.net accounts deal with more than World of Warcraft, if someone compromise your account this can also affect games like Diablo III and Starcraft II.

Here are a few ways to prevent account theft:

1. Keep your WoW account email and password private

Do not post your email and/or password that your are using for your WoW account on forums or blogs or something like that. Do not email them or use them in chats with your friends. IF you want to tell someone you trust your account details use the phone. (Remember that transferring the account details is not safe either!)
If you register to forums or websites (especially the WoW related websites) do NOT use the same password and/or email that you are using for your WoW account.

2. Do not randomly click on strange adds and/or links

Especially on the WoW related websites avoid clicking on random links or adds that fly around everywhere these days. You can never know if you can trust any of those links. Read below and use a better internet browser and an anti-virus software.

3. Use a strong and unique password for your account

Keep your password unique. Use it ONLY for your WoW account. Like I said above, do not use the same password you are using for your WoW account anywhere else BUT for your account.
Also do not use simple passwords like "pass" or "warrior" or anything simple like that. Be more creative. You can use up to 16 case sensitive characters for your password. Use something like "ILoveW0WJuJu123#" (that was just an example, do NOT use that!).
A strong password should have: case sensitive letters, numbers and special characters.

4. Use anti-virus software and a firewall

All PC users should have something like this installed on their computers. The best anti-virus and/or firewall programs are the paid ones. You'll never find a free one at the same level of performance with a paid one. But still, a free anti-virus is better than nothing and it can increase your PC security by a lot.

Here are a few free anti-virus products you can use:

• AVG Antivirus Free Edition
• Avira Personal Free Antivirus
• BitDefender Free Edition

Here are some free firewalls:

• ZoneAlarm Free Firewall
• Comodo
• Ashampoo FireWall FREE

These programs are only a few examples added there in no specific order. You can search yourself for the product that suits you best but remember, always download it form the official website.
Also, do not forget to UPDATE your anti-virus and firewall. An old anti-virus is pretty much useless.

5. Use a Malware / Trojan / Keylogger scanner

It is always good, beside your anti-virus, to run some additional scans. The good thing is that most of the products for this job are free (or they have a free version most of the time).
Use Spybot Search & Destroy. It is totally free. Install it, update it, run the Immunizer and after that scan your PC.
Use Malwarebytes. It has a free version too... Install it and perform a full scan.

Use these scans from time to time and your PC will be a bit more secure.

6. Download only from trusted websites

Whenever you download a new addon or your vent client after a reinstall or if you download an addon updater client use the trusted website only.
For the addons use the curse.com, wowinterface.com OR the addon author official website. Even so, if you are not sure about the source do not download and ask for your friends or guild mates help to tell you where they downloaded that addon from.
For ventrilo us the official website: http://www.ventrilo.com/
For addons updater clients use their official websites also: curse.com or wowmatrix.

Basically for anything you are downloading check the address bar of your browser. Read the name of the website carefully and be sure it is the CORRECT one.

7. Watch out for site phishing

Even if a website looks EXACTLY like the official Blizzard website it is not necessarily the right one. Read the URL of the website you are in carefully BEFORE submitting your account details to it.
Also, using a secure browser helps a lot with this. Try using Firefox or Opera. Usually on Firefox your address bar will look something like this when you are on an official Blizzard website.

Note the blue battle.net background. It means the website is verified, secure and authentic.

8. Wise WoW Account management

There are two important things you have to remember when you create your account.
Always keep your WoW CD Key safe and always remember where you left your CDs after install.
Always remember your account Secret Question.
If your account is hacked these are the only "tools" to recover your account.

9. Avoid using other computers but your own

Whenever you log WoW or access your account management is better to do it from your PC. You never know if that PC is infected or not.
Public computers like net cafes should be avoided mostly. Most of the public computers are infected with different kinds of trojans and keyloggers that can "steal" your account details and compromise its security.

10. Use an Authenticator

Last but not least: The Authenticator! Yeah, some virus managed to "hack" this method, but that doesn't mean it is not a VERY good method to protect your account. If you follow this guide to the letter and you add an Authenticator to your account as well it will be a BIG plus to your account security. (and you get a great in-game pet too! ^.^)

Basically, if you follow all tips of this topic you should have your World of Warcraft account pretty safe. Noting is 100% secure these days but at least you know you did everything you could to protect yourself. Remember to always scan your PC at least once a week. Update all the software products that you are using and also do not forget to update your Operating System.

Do you have any other tips to help others protecting their WoW accounts? Tell us about it...

[SombrioFe]

I would actually stay away from AVG...  One of my friends had it, and he ended up with keyloggers that the AVG missed.  I (and most of my guild, now) use Avast.  It is free, only requires a registration.  The registration gives a free license for up to 5 computers.  I have not had problems with it at all.  I highly recommend it!

[Deprave]

Malwarebytes is good, Comodo is my firewall. I've been thinking about giving Avast a go though.

[tellos0]

Have used Avast and AVG on different ocasions and did not have a problem with any of them.

[Arcania0311]

I'd have read the article if I had not been distracted by the corehound pup. It's adorable! O_O

*edit* To give this post some additional value; great guide! Easy to follow and to the point.

[cadal]

Not: Authenticator has a middle man attack problem right now, so people with it please note you are never blatantly safe (you should always be careful and never think that you are!). Expecting patch to issue in 3.3.3.

[Neirin]

I wouldn't expect blizzard to fix this in the next patch, because it's not their problem. Just as they can't patch the game to prevent keyloggers from getting your password, they probably can't patch the game to prevent keyloggers from getting your authenticator code.

If it was an issue of security in their program, then absolutely, it would be patched... But this is an issue of the security of the users computer, which is not really something Blizzard can fix, other than continued emphasis on good security practices.

[Deprave]

As if to reinforce the point that authenticators are basically a must-have anymore, five of my friends have been hacked over the last month. These were people who had great passwords, used virus scanners, and had firewalls.

At least I get to tell them 'I told you so', in response to their 'I'll never need it' statements they made.

[Neirin]

I've finally convinced my current guild to go to an Authenticator-required policy for guild bank withdrawls. After the guild bank was lost for the third time because of the SAME account being hacked (plus multiple other hacks of other guild members), I described the concept to the guild leadership and they agreed it was a good idea.

For anyone who isn't sure about it, it works like this: Your guild ranks are split up and paired off, with one rank for authenticators, one for without. Let's say your ranks look like this:

Guild Leader
Officer
Raider
Member
Recruit

Obviously, your Guild Leader have Authenticators, in order to hold that position, because their gbank access cannot be restricted. Officers requiring them is also pretty common in guilds with these policies.

Then, you split Raider to Raider-Auth and Raider-NonAuth. Both are on same standing for all guild permissions except bank withdrawals. Raider-Auth has their full withdrawal, Raider-NonAuth is incredibly restrictive, or no withdrawls at all. Same for Member, split it to Member-Auth and Member-NonAuth and the ones with authenticators get usual Member privileges (Probably full withdrawal from non-raid-material tabs) and NonAuth gets nothing.

Guild Leader (Auth Required)
Officer (Auth Required - All Tabs)
Raider-Auth (Auth Required - Raid and General Tabs)
Raider-NonAuth (No gbank privileges)
Member-Auth (Auth Required - General Tabs)
Member-NonAuth (No gbank privileges)
Recruit (No gbank privileges)

It makes your guild bank mostly* hack-proof, then you only need to be worried about guild thieves. I've also found that in a decent size guild, authenticators are common enough now that people without them can easily get a guildmate to withdraw materials they need. NonAuth isn't about not letting them get stuff from the gbank, but not letting their less secure account be able to loot it dry. If they need something, an Auth rank member just takes the stuff out for them