5 ms·

There has to be a way to fix this through changing their process when dropping your authenticator. One solution off the top of my head is to add an additional

by jmatt 17y ago

There has to be a way to fix this through changing their process when dropping your authenticator. One solution off the top of my head is to add an additional special question to admin tasks. Users very rarely if ever go to the blizzard admin page and thus won't be typing a special question in when they are just logging in to the game. Another solution is to confirm such authenticator drops through email or text. Both of these could be quickly implemented. And both could be used to alert blizzard and the user that they are infected. The real problem here are rootkits + trojans that are just trouncing these unpatched old windows boxes. I still haven't figured out how people end up with these trojans. Everyone that I know who plays wow is deathly afraid of getting "infected". Yet they still don't all have authenticators and they still manage to run trojans. Hmm. I blame porn ~ I don't know what else it could be. EDIT: elaboration. paragraph 2 sentence 5 if you must know.

illumin8 17y ago
Good thinking. I think the best way to "fix" this is to remove the authenticator from the account, you are given a 5 minute timeout and must put in another code generated by the token after that period. That way, the original code stolen by the keylogger is no longer valid.
cheald 17y ago
The vast majority of infections are due to Flash-based ads targeting older Flash installs, which are then targeted to be run on gaming sites. The days of opening emails with attached .SCR files are long behind us. Blizzard does require that you provide two consecutive codes when removing an authenticator from an account, so I'm not quite sure how you'd coerce a user into providing two codes back-to-back, unless they just keep spamming tokens into the system. You could get around that by introducing, say, a 15-minute email-based delay that asks for a second auth code: 1) Log into account management (token required), request authenticator be dropped. 2) Request authenticator token. Validate token. 3) Stick request on the queue. 4) In 15 minutes, email the user with a link that includes a URL token validating the request. The link takes them to a page that asks for another token. 5) The authenticator is dropped upon receipt of the second valid token. Most players, no matter how impatient, aren't going to sit at their computers for 15 minutes punching in auth codes. They'll give up after 3 or 4, max. The additional email ownership verification step, with the time delay between code entry should at least buffer you against authenticator-drop attacks.
peterwwillis 17y ago
a second auth step through email would just be added into the trojan to capture. they'd go ahead and run the first token for you and display a fake message that it was successful on your machine. then when you get the e-mail in 2nd stage it'd just mitm that too and finish the auth on its side. text would be more difficult to attack with a trojan, and banks use it; i don't see why WoW couldn't. you get trojans via botnets. very effective covert 0-day kits hidden in vulnerable sites, and not everyone keeps up with all security updates all the time - and all it takes is once.

by jmatt 17y ago

illumin8 17y ago

Good thinking. I think the best way to "fix" this is to remove the authenticator from the account, you are given a 5 minute timeout and must put in another code generated by the token after that period. That way, the original code stolen by the keylogger is no longer valid.

cheald 17y ago

The vast majority of infections are due to Flash-based ads targeting older Flash installs, which are then targeted to be run on gaming sites. The days of opening emails with attached .SCR files are long behind us. Blizzard does require that you provide two consecutive codes when removing an authenticator from an account, so I'm not quite sure how you'd coerce a user into providing two codes back-to-back, unless they just keep spamming tokens into the system. You could get around that by introducing, say, a 15-minute email-based delay that asks for a second auth code: 1) Log into account management (token required), request authenticator be dropped. 2) Request authenticator token. Validate token. 3) Stick request on the queue. 4) In 15 minutes, email the user with a link that includes a URL token validating the request. The link takes them to a page that asks for another token. 5) The authenticator is dropped upon receipt of the second valid token. Most players, no matter how impatient, aren't going to sit at their computers for 15 minutes punching in auth codes. They'll give up after 3 or 4, max. The additional email ownership verification step, with the time delay between code entry should at least buffer you against authenticator-drop attacks.

peterwwillis 17y ago

a second auth step through email would just be added into the trojan to capture. they'd go ahead and run the first token for you and display a fake message that it was successful on your machine. then when you get the e-mail in 2nd stage it'd just mitm that too and finish the auth on its side. text would be more difficult to attack with a trojan, and banks use it; i don't see why WoW couldn't. you get trojans via botnets. very effective covert 0-day kits hidden in vulnerable sites, and not everyone keeps up with all security updates all the time - and all it takes is once.