Rae & Darq's accounts have been hacked ~

Unfortunately, not many people come here, so I am glad I changed the guild note yesterday.

By now, many of you know Rae's account was hacked - password changed, and then they cleared out all her characters gear, money, banks. Used Cham to gut the guild bank of items, and withdrew all the money between Rae/Rockin & Cham.

Then, they put Raessa in for a transfer to another server.

Well, basically, Blizz reviewed the account logs, and say a specialist on monday will begin the character & guild vault restorations, as much as is possible. They know she was hacked, and will fix it as best as they can.

Today, I spent day trying to clean Rae's computer (I'm pretty good with that stuff).

While I was doing that, someone hacked my account, too. And basically did the same to me.

1/2 of darq's equip gear is gone. Rod & Rather are completley gutted - still there, but naked. Gatlin - the enchanter - is GONE from the game - probably put in for transfer, or deleted.

Taeraah seems to have been left alone; I haven't checked horde toon yet, but all under lvl 40. (& Rae's hordeside seem to have been left alone).

So, Blizz & the GMs got reports in from me & other gamers when it was happening. We can't risk logging in with Rae to file the complaints in game, but we are ok here.

So, this is end of Part 1. In the next part, I will tell you all how we think it was done, from what we research/GMs have told us -

Good Luck, if you need us to contact GMs and tell them what we saw let us know. Also We have started to hoard money and items in case they cannot restore everything for you we can help you get back on your feet.
/HUGEST Guild Hug to you both

I will start to save money for you and Rae. Dont argue you are me friends till the end of days, and you WILL take it to. I wanted to choke out the little bastard when I saw him with gatlin doin that. Talk to you later.

Dasz

ok, I can't say too much, because they are still trying to figure out the source, but here is what I do know:

It was a keylogger, and they use it ONLY to steal WoW accounts. There is a very regular pattern, but it seems to involve WoW-related websites, and addon-download sites.

And of course, there is lots of stuff for people who buy gold, powerlevel service (not like the fast-level guide we use/posted up here, which is legit).

What happens is people using IE or a not-too secure Firefox go to a site like Allakazam, or to d/l an addon from a semi-secure site, like Curse gaming. When you mouse over a ad window, or go to close a popup, or choose the wrong mirror, or enter login info for a forum, it happens.

The keylogger installs, and then waits for you to enter your info for either the game or WoW forums, or similar sites (LIKE FORUMS!!!! IF YOUR WOW LOGIN INFO IS SAME AS HERE, CHANGE WOW PW NOW!!!). It takes pictures, and sends it to the hacker.

then, here is what will probably happen:

a filter bot compares the info to Armory or other model/character sites (like wowhead). If it is a high-level or guild-leading type, an alert pops up - because the hacker gets THOUSANDS of hits every day; they have to choose the 'best' people to try to hack.

The hacker will log in - weekend is better, because less Blizz customer support - or at really offpeak time. First, they change password aAND your secret question, to buy time.

Now, they look for highest level enchanter, and start there.

All items will be DE-ed or vendored that can. gold raided. many things deleted just to be mean. An enchantre is chosen, hopefully one with guild bank access. If not, the person may drop a profession, and powerlevel enchanting and/or alchemy - so they can DE guild vault , bank and inventory items, or make stacks of potions to move out.

Then, it gets bad.

If 60+, they go to Shadow Lab or Slave pen, and use a speed/teleport hack to get to a chest. They try to open them & loot before dying, and reset. This is all probably done with botting programs. They want the blue items, and this is fastest way - again, for DEing. GMs catch them a lot at this point, at whcich time you will be banned for 'game mechanics exploitation.'

They may join high-level PUGs for the same purpose - to ninja & hearth.

Or they may just run around naked, cursing, harrassing. Or trying to spam gold buying/selling/powerleveling services. If you get banned, it just buys them more time while you have to figureout how to file a complaint through e-mail.

Sometimes, a high-level character will be put in for realm transfers - they are hoping to either sell it off, or to use it to commit more wow crime on another realm. If your credit card info is with wow, then the hacker can just do a 'paid realm transfer.' They did that with Rae (but she is on her way back to CC now), and they either deleted Gatlin, or tried to tranfer him (we are waiting to find out).

Or, they may just delete the character.

There are 2 known gangs doing this - 1 in China (college students) and 1 organize crime ring in Russia.

As of now, these hackers ONLY want wow stuffs - because it is a very low-ranked cybercrime; almost impossible to trace/prosecute internationally, and not as harsh punishment as stealing credit card info, driver ID, govt. ID, etc.

There are a few things you can do to help/reduce the chance, but not many - this is a VERY sophisticate attack plan!!!

End of Part 2 >.<

If I set up the parental controls will it help? Can accoutn info be changed without putting in the parental control password?

BTW, I have changed my password Since in the past couple weeks I have visited Allakhazam and have downloaded addons

Wow, that really sucks, I actually used to change my P-word for Wow every couple of weeks, just in case, one of the major ways they do it is the Keyloggers. there will be a link on a forum post that will pop up with a page that says you need to re log back into the forum, The page looks IDENTICAL to the normal "Need to log back in" site, but actually just records your login and P-word.

I just wrote 4 pages up on security stuffs, over in General, and made it sticky thread.

Parental controls help - it adds another password layer. But a keylogger is a keylogger - the BEST thing to do, right away, is to 1) do an online scan in Safe Mode with Network Support (F8 key when booting to get there), and 2) d/l and install Keyscrambler 2 free edition, for win IE/firefox. 3) after those 2 are done, start changing your passowds for wow-relate sites

We will be back in game soon - have to fax off our ID copies to blizz to prove it is us. We should be back after maintenance. We still are hoping to get gatlin & raessa back intact, but Blizz is working on it

Darq, when they restore your accounts will they restore the guildbank too?

Also when will you be restored and we get to see you again?

Yes, they will restore guildbank, too. We are still waiting on Rae, and Gatlin is back, but still has no gear. They are actually doing stuff quite fast; this is becoming a widespread problem!

We should be back in a few more days

here is something else you can do, for safety -

put WoW into windows mode, and use the on-screen keyboard to enter passwrds/login info - either with your mouse, or touchscreen (if you have touchscreen monitor).

The O-S KB is in start~>all programs~>accessories~>accessibility~>on-screen keyboard.

Start the keyboard, then wow

Use the keyboard to enter login and/or password

Blizz just threw up a warning about adobe flash. UPGRADE IT PEOPLE!!!

It seems the characters have been restored the best Blizz can. Now, we are just waiting to reset secret question & new passowrd & give them new credcard info.

hopefully, this weekend

As far as I can tell, the combination of really, really good computer cleaning, changing browser to FF or Opera, using SnoopFree + Keyscrambler, and the Onscreen Keyboard when you are finally ready to reset your passwords is the best/safest we can do for now.

I hope it happens to no one else.

Another note - maybe important! We found out, while searching, that IGE (the biggest gold-selling company) has bought up Thottbot, WoWHead, AND Allakazam.

The fact that these were 3 of the sites most responsible for the advertising exploit/hackings??? Hmmmmm . . . I would NOT be surprised.

So, I suggest using TenTonHammer's pages for wow stuff. Use this bookmark - someone has already set up a fake TTH site - just click & save it.

http://www.tentonhammer.com/wow

I hope that this situation gets better. We love wow, but it is a game, and we would hate to see wow die out because of this kind of thing.

Sweet!!!!

I will be gone this weekend, not sure if I will have access to comp or not but i'll be in game for sure Sunday nite

Well, it is Monday afternoon here now, and we are still waiting.

However, some good news for guild - a GM contacted me, and said that they can/will do a full (as possible) guild vault restoration -

Rae just needed to send her 'account case specialist' an e-mail asking him/her to do so - and she just did.

So hopefully, the 4/5 tabs will be back up soon.