Trojan succesfully hacks Authenticator Protected Accounts

[shadowsx]

so it seems that there is a virus spreading around that can Hack accounts with an Authenticator attached to it. i read this on MC, and a link provided to the wow forums where it was originally posted.

A new virus spawned on the internet a few days ago and seems to be the first trojan capable of hacking a WoW account protected by an Authenticator. It was confirmed by Blizzard a few hours ago.

Basically, what the virus does is fairly simple after you're infected :
- The next time you log in World of Warcraft, the game asks for your Authenticator code.
- The virus intercepts it, send it to another server, and sends a wrong one to Blizzard = You get an error.
- The people behind the virus now have a few seconds/minutes to use the "real" code while it's valid to change your password / empty your account / guild bank.

How to check if you're infected
Just search for a file named "emcor.dll" on your computer, it is most likely located in "C:\Users\(Your user name)\AppData\Temp" but I suggest that you check everything just to be sure. If you do find the file, delete it and make sure you update your anti-virus to prevent any further problem.

To be honest, if you found this file your account is probably already compromised.

What does it mean exactly?
- Yes, you can get hacked even if you have an authenticator, the chances are MUCH lower but you're not invulnerable.
- It definitely isn't an excuse to not have an authenticator. We're talking about a single virus here and the authenticator will save your ass 99% of the time.
- Get a decent anti-virus, buy an authenticator, you'll be safe.

World of Warcraft (en) Forums -> Hacked with authenticator

so it seems that people really care about account stealing

[2dgreengiant]

The hacker has to be online in the 30 seconds before it changes?

[shadowsx]

The hacker has to be online in the 30 seconds before it changes?

not much is known atm but to my understanding its probably automated


the Trojan works as a Man-in-the-middle attack

- more here Man-in-the-middle attack - Wikipedia, the free encyclopedia

[2dgreengiant]

Ah well easy way around this, don't use the authenticator :P

[XTZGZoReX]

- Get a decent anti-virus, buy an authenticator, you'll be safe.

More like, use common sense when browsing the Internet. I haven't used an AV for about 4 years, and have yet to be infected/compromised.

Ah well easy way around this, don't use the authenticator :P

As stated, you're just even more vulnerable then.

[shadowsx]

i personally do not use an authenticator because its to much hassal for something i don't need cause im not mentally retarded

[Classified]

This is madness!

[Ballwinkle]

Lock it to a certain ip if you enter a wrong code whilst the code is valid:

Enter wrong code -> blizz makes account only accessable to that IP whilst the real code is valid....so if anone else tries to use it the code will be useless

[shadowsx]

Lock it to a certain ip if you enter a wrong code whilst the code is valid:

Enter wrong code -> blizz makes account only accessable to that IP whilst the real code is valid....so if anone else tries to use it the code will be useless

there is most likely a work around to this (ie; spoof the IP ext, ext.)

[aamlord]

Only moron would let that trojan get in the first place to let his account get stolen.

Good AV program running full time + spyware checks + not using IE + not running anything that gets downloaded + not running email attachment from unknown sources = you're mostly safe. Authenticator is still the best tool against account theft because if anyone gets your user ID and password w/o authenticator, they got all day to steal your account. Authenticator limits the window to about 30 seconds and makes brute force attack next to impossible to achieve.

[EcHoEs]

The emcor.dll comes from site wowmatrixf.com, if you google wowmatrix it's a sponsored link. Watch out

[WhiteShizzle]

Yeah only complete morons or "Older" people should get Trojans/Viruses/Anything not wanted.

I've never used any sort of AV/Firewall/Other programs that give a false sense of security. Just don't be retarded and download random shit to see if it "works".

[---TreMolitE---]

This happend to a buddy of mine. They SPAM the wrong authenticator # to the point yours gets banned and you can't get on. Whatever empties your account is somewhat primitive, they leave some things that are worth quite a bit, and take some stuff that's garbage. He had all his gear, but they took most of his inventory & gold. The also clear out any gbank so if you have access to yours or a bank guild it'l get emptied. The hack part is VERY fast in this case, he got a wow error and by 15~ or so seconds later his authenticator was locked and he had to go to the website.

[Castseven]

There's nothing new about this, this could have been done on day one. The only thing that's happened recently is that MMO champion posted a sensationalized, overblown "story" on this. A blue poster simply said "That's called a Man in the Middle attack", and the next day the headlines read "AUTHENTICATOR HACKED!!".

It's possible but very very difficult for someone to pull off. You're still a thousand times better off with an authenticator than without one.

Ah well easy way around this, don't use the authenticator :P

That is one of the dumbest things I have ever heard. That's akin to saying "Seatbelts don't protect you if a stray bullet flies through your window. An easy way around this is to not wear a seatbelt."

[I Hypnotoad I]

I'm having a hard time believing that THIS


Could hack into an account.