The Most Helpless Feeling in the World...

[Carlinda]

... is watching (while in a raid) your boyfriend's account get hacked and all of his amazing EleShammie gear get vendored. This, of course, is while he's sitting next to you at his computer with a look of absolute horror on his face. All the awful explicit tells you can send can't do a thing and posting a ticket as it's happening doesn't work fast enough. Then the keylogger logs off his T5 Shaman and logs on his Level 70 Warrior and proceeds to vendor all of that toon's epics. Your entire guild is ferociously posting tickets, taking screenshots, etc., doing whatever they can to help.

You see, he got this keylogger (we're almost positive) from the WoW forums. When he thought he might have one, he did all his virus scans (Ad-Aware, Spybot, and Avast!) and when he was confident his computer (and account) was safe, he changed his Blizzard password. This was yesterday... and he literally got hacked an hour ago. We also think that my boyfriend's new ban from the WoW forums is because this keylogger used his information to post more keyloggers on the forums.

We're confident that he'll get most of his gear back (yay! screenshots!) and we have a great guild that will help fill in the gaps if needed... but this is mostly a warning to those of you that do go to the WoW forums... don't click on links you don't know and run your scans religiously. Or simply, since the WoW forums are crap anyway, just don't go to them. Please be careful and game safely!

[Akasha]

Oh my, I couldn't even imagine that.

[Pernicious]

Ouch, Sorry to hear that.

Long ago I remember witnessing a persons account get Hacked, we were about to go to ZF and finally found ourselves a pally healer. Well just as we were about to get started, he vanished... then resurfaced i watched him strip down to nothing next to a vendor with the exception of shoulders (which i guess couldn't be sold). He then ran to a mail box and logged... a few minutes later he logged back in.

Apparently the hacker jumped in sold everthing mailed the gold and then let the guy regain his account because when he came back, it was the original account holder and he was very upset.

I gotta give it to the guy though, he insisted we still do the ZF run while he waited for his ticket to get through to Blizzard. The good news is, he ended up with a lot of loot... We had to give him all the greens we found to make him somewhat less killable and useful.

He eventually did get his gear back, but I don't think he got all the items that were in his bags.

[Mekca]

this truely gives me the creeps. This way of steeling accounts and make it possible to hack accounts and sent gold to other chars, it is a big problem. And im so sorry to hear that it happend to you're boyfriend.

I truely hope he wil get the stuff back and blizzard will do something about this. Maybe a code before you can sell you're stuff?

[thorlock]

You can thank the people that buy gold.

[Theleb]

Its a truly horrible situation to be in.

Our old Guild Leader had his account hacked after taking many of the same precautions you did and not only did they clear out his T6 mage, T5 Enhancement Shaman and some alts, they also raided the GUild Bank.

Yes, the gear was returned, yes the bank was reinstated but the fact that these things can happen even after taking a lot of precautionary measures just plain sucks and he has my most heartfelt commiserations.

[BloodElfArmy]

I'd like to commiserate with the OP..

And, this should not be taken as any sort of evangelism, please consider the operating system you are using, everybody.

The reason keyloggers and hacking is so prevalent in the Windows world, is that it's so easy to do a kid can do it.. in fact, I'd guess about 70% of ALL viruses, keyloggers and trojans are written by under 20-year olds. Thats not base don any verifyable fact, just observation.

My job is programming windows, just to state where I'm coming from.
Whether I'm a good programmer or not is irrelevant, but I do know how easy it is to get inside Windows and, basically, do what you like.

I see people get a new computer with Vista on it.. the first hour is all about the new shiny. Then they turn all that off, disable the User Access controls because it's SO DAMN ANNOYING, and then they're left with what is effectively Windows XP.

They might leave the firewall enabled, but it's not really a very good firewall. It's not what is known as Statefull-Packet-Inspection, which means it doesn't examine the insides of the actual TCP packets coming in over the wire.

At home, I run Apple Macs. My wife just got a new Macbook pro because her Windows laptop was just getting on a bit and falling to bits.

Keyloggers and Trojans and viruses are almost impossible on a Mac. Why?
Well, it would be just as easy to actually write a virus that worked on a Mac. Or a program to capture keystrokes for instance. But actually getting them on to a users machine is a lot more difficult.

Microsoft are heading the right way with the User Access Controls, but, as usual, the implementation is awful. It's annoying, so people turn it off.
The point is, you should never ever be logged in to a computer as GOD.
Never.
Not Ever.
Not even to do system admin things.
On my Mac, and on every Unix or Linux machine I've ever had, the root account is disabled. Not only that, it has a very long password. I think my record is 128 characters of mixed upper and lower case letters and numbers generated randomly.
The point is, you give an ordinary user admin rights to *certain things* - like installing software, and so on, but you require them to enter their password when they want to do something like that.

The idea is, that if you get a "Enter your password" prompt you should know what is asking for it, why it's asking, and what it's going to do when you enter the password.
If you don't know these three things, you don't enter the password.
Unix, Linux and Mac users who never used anything else, know this instinctively. it's always been that way.

Windows users have always been System Admin by default, and thus never got asked for passwords. In fact, home users never even knew they were systems admins.

Want to install a bit of software? Sure, go right ahead. No Questions Asked.

Vista attempts to address this by asking "Something wants to do something, let it ?", "Are you sure", and then, possibly, it asks for authentication. I've seen it just go ahead after the second prompt.

This is wrong. and annoying, which is why people turn it off.
On any other operating system, you get a single prompt. "This Application wants to do something. enter your password"

If you don't know what asked this, you click cancel and nothing dangerous can happen.

The firewall deployed with Linux and Mac is a Statefull-Packet-Inspection robust, industry standard firewall. Although Apple, for some ghod only knows what reason, ships it turned off by default.
That's not too important though, since very little hacking these days is done through physical intrusion via the internet.
These days it's script-kiddies writing trojans distributed through websites like facebook in adverts for a screensaver, or smilie emoticons for a chat program.

When you download a file from the internet on Windows, it ends up on your disk. The double-click it to run it and that's it.

On my Mac, if I download a program the first time I run it, I get told "This file was downloaded from the Internet" it also tells where it was downloaded from. I can then choose to let it run or not.

The whole point of this rant.. is that there are alternatives to Windows.

If you absolutely must run Windows, you can install it on the new Macs as well as Mac OS X.

People says Macs are expensive. Not True.
I have a G4 PowerBook bought in 2003 for £2000 expensive at the time eh?..old kit now. But it stills runs as well as it did when new, still looks good. 5 years old. Show me a 5-year old HP, Dell or Acer laptop that has never been reinstalled and stills runs and looks like new.

My Dual G5 PowerMac cost.. £2500 in 2005. Still runs as good etc..

I'll probably get one of the new Intel Macs at some point. It'll cost me, oh, say £2500 or so..judging by todays prices.


So, please think about this next time you're looking for a new PC.

Bazz

[Theleb]

Good Post Bazz

[forketta]

To the opener:
i can't imagine how orrible it could have been!!!
I can add my useless "awful explicit tells" for the keylogger, hoping all he gains from stealing goes into powerful drugs against <<< insert preferred illness here >>>.

To the MAC user: i used to be a PC user, and still run WoW (amongst other things) on a WinXP always on PC. I still own the original 2 floppy of Windows 1.0. But, the more i see Window$ and his future trend, the more i get tempted from Mac.

[snackereen]

Oh my... I'd so freak out seeing my characters being stripped *live*. What a mental torture... I hope you will get (most of) your items and gear back.

And Fullquote.... 2 of them. The first is Thorlock and 2nd is BloodElfArmy. We had those (totally annoying) break-in attempts almost everyday over here, and guess on which machines only? Unfortunately we HAVE to use the OS for testing purposes and some programs which won't run under linux/MacOS.
Outcome: We changed every possible machine to linux. You can't imagine how scared people get when you tell them to use another OS from the one they know..wait... "know" was wrong.. "thought they were able to operate" fits better

So if you can: make the switch. Seriously.
If not: take every measure you can to protect yourself (I know you do already, do it again). Usually there are much more critical/personal/valuable things on your machine than your online-game-character!!!