WOW hacking

[Fnord]

...I will put out one caveat -- Play at your own risk! WoW is highly addictive

I am NOT addicted to WoW!

I can quit any time I want.

 

[tesscaline]

I am NOT addicted to WoW!

I can quit any time I want.

You just don't want to right now!

 

[Fnord]

You just don't want to right now!

Certainly not while I'm trying to set up a group for Scholomance...

 

[tesscaline]

Certainly not while I'm trying to set up a group for Scholomance...

Hey, I got 3 purples last night in Forge of Souls and Pit of Saron. I wouldn't quit right now if someone paid me to!

 

[Blackadder]

I am NOT addicted to WoW!

I can quit any time I want.

I did quit and I don't miss it. Still I am pretty sure I will play again one day, I am a nostalgic person and always returns to old books, old movies, old games. A trip to memory lane in old Azeroth sounds nice. I heard a rumour that flying would be possible one day in the old continent, I'll think I'll check in when that happens. But I don;t mind if it is in 2011 or 12

 

[tesscaline]

I did quit and I don't miss it. Still I am pretty sure I will play again one day, I am a nostalgic person and always returns to old books, old movies, old games. A trip to memory lane in old Azeroth sounds nice. I heard a rumour that flying would be possible one day in the old continent, I'll think I'll check in when that happens. But I don;t mind if it is in 2011 or 12

Flying will be allowed, but it won't be the same old Azeroth. If you want to see Azeroth as you currently know it, you'll want to log in before Cataclysm comes out, and they destroy, then flood, various parts of the original two continents...

 

[Alt+F4]

I did quit and I don't miss it. Still I am pretty sure I will play again one day, I am a nostalgic person and always returns to old books, old movies, old games. A trip to memory lane in old Azeroth sounds nice. I heard a rumour that flying would be possible one day in the old continent, I'll think I'll check in when that happens. But I don;t mind if it is in 2011 or 12

I quit on New Years Eve after 2 years and I don't (well kinda do) miss my lvl 72 mage. Every time I miss it I think how great it is to have all this additional time to do things like go outside and be with other people.

I revisit all my favorite movies and books every summer. It's like catching up with old friends you haven't seen in awhile. As for WoW, as a previous poster mentioned, it's soul-stealing. I regret all the time I wasted waiting around for Lil' Timmy and that stupid white kitten.

 

[JFrankA]

I play WoW, but I'm definately NOT addicted to it.....





......which reminds me, since I played my Horde rogue this morning, I have to do some leveling on my Alliance Shaman tomorrow. Oh....my Alliance rogue has to run FOS to get the dagger and my Pally still has six quests to return.

...and on Monday I'll do some questing for my priest on the European server......

 

[jeremyp]

I have recently received a number of e-mails to my Word of Warcraft e-mail account which are clear phishing scams. Usually they are about "a recent password change" and include a link to a domain which looks at first glance like worldofwarcraft.com, but on closer inspection tuns out to be slightly misspelled e.g. "warcrcft" (genuine example).

Given that all of the WoW accounts recently moved to Battle.Net, the e-mails look sort of legitimate and an unwary person might get caught out. This may be how the person in the OP got shafted.

I'd be interested to know how the phishers got hold of my WoW e-mail, which as far as I know, I only ever gave to Blizzard. Either I'm mistaken (I might have used it on a guild forum) or maybe some disgruntled Blizzard employee sold the mailing list.

 

[tesscaline]

I have recently received a number of e-mails to my Word of Warcraft e-mail account which are clear phishing scams. Usually they are about "a recent password change" and include a link to a domain which looks at first glance like worldofwarcraft.com, but on closer inspection tuns out to be slightly misspelled e.g. "warcrcft" (genuine example).

Given that all of the WoW accounts recently moved to Battle.Net, the e-mails look sort of legitimate and an unwary person might get caught out. This may be how the person in the OP got shafted.

I'd be interested to know how the phishers got hold of my WoW e-mail, which as far as I know, I only ever gave to Blizzard. Either I'm mistaken (I might have used it on a guild forum) or maybe some disgruntled Blizzard employee sold the mailing list.

Like I said in post 39, phishing emails are sent out pretty much at random. Whether they're obtaining mailing lists from popular sources that do sell email lists and are just spamming those addresses, or quite literally going about it at random, with whatever email addresses they can figure out with alphabet attacks, or crawl for, or they're using some other method entirely, no one really knows but them. But whether you get a WoW phishing email or not has no correlation to whether or not you actually play WoW. Blizzard is not selling off their subscriber's emails to hackers. Not even a "disgruntled employee".

People get WoW phishing emails who don't play WoW, have never played WoW, and have never even heard of WoW. Other people, who have played for years, never receive one.

If I were receiving phishing emails, I'd ask myself: Have I used this email address anywhere other than to register WoW? If so, are any of those places possibly selling my email address? If not, could they have had a security issue and the email list compromised?

Small time forums, and other websites that want you to create an account, often do not have the proper security enabled, and they can easily be hacked and the user information stolen. A lot of very small operations also collect the emails and sell them off to larger distributors of such information. A lot of larger operations do it too.

Just saying, there's a LOT of ways for someone to get ahold of your email address other than a "disgruntled employee". Some of them legitimate ways, some of them not so legitimate. But the phishing emails have nothing to do with Blizzard.

 

[Fnord]

I've not received any "Buy Gold" phishing/spam messages on my WoW/Battlenet account. They only get sent to me as a 'Whisper' while I am playing WoW, and those I report immediately and then set the sender to 'Ignore.'

 

[tesscaline]

I've not received any "Buy Gold" phishing/spam messages on my WoW/Battlenet account. They only get sent to me as a 'Whisper' while I am playing WoW, and those I report immediately and then set the sender to 'Ignore.'

If you use the right click, report spam option in game, it automatically ignores that person for the duration of your WoW session. No need to add them to your ignore list, as those in-game spammers don't usually last long, the accounts having their chat ability removed within an hour or two, and being suspended or banned within a day or two.

 

[jeremyp]

Blizzard is not selling off their subscriber's emails to hackers. Not even a "disgruntled employee".

How can you possibly know that?

I'll grant that Blizzard are not selling e-mail addresses, but there's no way you can guarantee that all of their employees (or ex-employees) have not done it. A disgruntled employee is not going to advertise the fact that he or she has sold e-mail addresses.

I'll repeat what I said before. My phishing e-mails are coming in on the account I used specifically to sign up to WoW and which I do not use for any other purpose. Having said that, it is possible I used it on a guild forum back in the early days.

Just saying, there's a LOT of ways for someone to get ahold of your email address other than a "disgruntled employee". Some of them legitimate ways, some of them not so legitimate. But the phishing emails have nothing to do with Blizzard.

I'm just saying that you have a naive trust in every past or present employee of Blizzard if you are dismissing the possibility that the source of the list with my e-mail address came from one of them.

 

[tesscaline]

How can you possibly know that?

I'll grant that Blizzard are not selling e-mail addresses, but there's no way you can guarantee that all of their employees (or ex-employees) have not done it. A disgruntled employee is not going to advertise the fact that he or she has sold e-mail addresses.

I'll repeat what I said before. My phishing e-mails are coming in on the account I used specifically to sign up to WoW and which I do not use for any other purpose. Having said that, it is possible I used it on a guild forum back in the early days.


I'm just saying that you have a naive trust in every past or present employee of Blizzard if you are dismissing the possibility that the source of the list with my e-mail address came from one of them.

Naive trust? HAHAHA. No. I distrust employees of Blizzard on an individual level. I've been burned by one in particular in the past. The thing is, if someone at Blizzard were selling email addresses, then why are the phishing emails being sent to people who have never played the game, and don't even know what it is? Why are people who have played for years (I've been playing for 4 years, my SO for 4.5, and neither of us have ever gotten one) not receiving them?

And then there's the legal requirements in place about user information. If a company has it's customer's information compromised, they are required by law to report it. Blizzard has submitted no such reports. Or are you expecting me to believe that some pissed off call center employee is skilled enough to steal large amounts of customer information and not get caught?

And why would a hacker (you know, those jerks that send the phishing emails) buy email addresses when they can get them for free by hacking vulnerable systems?

I'm sorry, but logical reasoning + personal experience + information from Blizzard itself != naive trust of random individuals.

I'd also like to point out the bolded part of your quote. You'd rather think up some sort of fantasy situation in which some employee at Blizzard stole your email address and sold it to a hacker than go with the much more logical and reasonable explanations of a) you used it somewhere and didn't remember and that place got hacked, or b) your email got hit through an alphabet attack on your email provider's service. Seriously? You want me to go with the most far fetched, most CT version of events when there are far simpler and more reasonable explanations available?

 

[jeremyp]

The thing is, if someone at Blizzard were selling email addresses, then why are the phishing emails being sent to people who have never played the game, and don't even know what it is?

You seem to be assuming that all WoW phishing e-mails come from the same source.

Why are people who have played for years (I've been playing for 4 years, my SO for 4.5, and neither of us have ever gotten one) not receiving them?

I've been playing for at least three years. Why did I suddenly receive four or five phishes in the space of a few days on an e-mail address that I haven't used except for WoW for at least two years?

And then there's the legal requirements in place about user information. If a company has it's customer's information compromised, they are required by law to report it. Blizzard has submitted no such reports.

You are assuming that they know about the issue.

Or are you expecting me to believe that some pissed off call center employee is skilled enough to steal large amounts of customer information and not get caught?

Who says it has to be a call centre employee? What about a server admin? a marketing person? the CEO?

And why would a hacker (you know, those jerks that send the phishing emails) buy email addresses when they can get them for free by hacking vulnerable systems?

Hackers and phishers are not necessarily the same people. There is a market among spammers for lists of e-mail addresses. A list of actual guaranteed WoW account e-mail addresses would be pretty valuable.

I'd also like to point out the bolded part of your quote. You'd rather think up some sort of fantasy situation in which some employee at Blizzard stole your email address and sold it to a hacker than go with the much more logical and reasonable explanations of a) you used it somewhere and didn't remember and that place got hacked, or b) your email got hit through an alphabet attack on your email provider's service. Seriously? You want me to go with the most far fetched, most CT version of events when there are far simpler and more reasonable explanations available?

I'm afraid that is a total misrepresentation of what I have been saying. I'll try to explain again, in case my communication skills aren't as good as I think they are.

I actually said that I was getting phishing e-mails on my WoW account e-mail address. This much is fact. The main point of my post was to suggest that the OP on this thread was caught out by a similar phishing attempt.

I then (more as an aside than anything) speculated as to how my e-mail address got into the hands of the phishers. I advanced two hypotheses

a) a Blizzard employee or ex employee leaked my e-mail address

b) I used the e-mail address at some point in the past on a guild forum and have now forgotten I did it.

You have also advanced

c) alphabet attack

I think I can rule out option c, since I own the domain the e-mail address is in and e-mails to anybody @ the domain end up in my inbox (or spam folder). Option c would have resulted in me being flooded with WoW phishing e-mails on multiple addresses.

Option b is probably the correct hypothesis, but I can't rule out option a, since computer crime against a company by its own employees does happen. In the early days of the internet, it was said that almost all computer fraud originated internally.

 

[tesscaline]

You seem to be assuming that all WoW phishing e-mails come from the same source.

No. I'm not. And I'm not sure why you would even think that I was.

I've been playing for at least three years. Why did I suddenly receive four or five phishes in the space of a few days on an e-mail address that I haven't used except for WoW for at least two years?

Because phishing emails are sent pretty much at random?

See, it's that one year gap there... In the one year between when you registered your WoW account and when you stopped using the email address for anything else, what did you use it for?

You are assuming that they know about the issue.

You don't think Blizzard knows that it's customers receive phishing emails, and hasn't taken every measure possible to ensure that those emails are not being leaked by their own employees? Really? This situation with phishing emails has been going on for years. Blizzard has gone to great pains to combat them. They have an entire department dedicated to seeking out and neutralizing (when possible) the people responsible for these sorts of illegal activities (the hacks division). On top of that, you're not exactly the first person to have put forth the "disgruntled employee" hypothesis.

Who says it has to be a call centre employee? What about a server admin? a marketing person? the CEO?

Alright, now you're REALLY starting to sound like a conspiracy theorist. The CEO of Blizzard sold your email address to someone who sends out phishing emails used to hack WoW accounts. Uh huh. Okay. Right.

Hackers and phishers are not necessarily the same people. There is a market among spammers for lists of e-mail addresses. A list of actual guaranteed WoW account e-mail addresses would be pretty valuable.

Do you understand the connection between phishing emails and WoW account compromises (aka "hackings")? You don't think that the people sending phishing emails are in any way associated with the people who hack accounts with the information gained from the phishing emails? Sure, they could be private contractors who do nothing but send emails all day... But that would mean they're working for someone. Who would that someone be? Oh right. Those responsible for hacking accounts, stripping them, and selling off all the gold acquired from them.

I'm afraid that is a total misrepresentation of what I have been saying. I'll try to explain again, in case my communication skills aren't as good as I think they are.

I really don't see it that way. Unless you intended the "or a disgruntled Blizzard employee sold my email" as some sort of a joke to highlight that the real reason was that you did, actually, use your email address somewhere that it was compromised... But if that were the case, why would you be defending the idea so vehemently?

<snip>

Option b is probably the correct hypothesis,

Yes...

but I can't rule out option a, since computer crime against a company by its own employees does happen.

And I can't rule out the existence of invisible pink unicorns that are responsible for taking my cell phone off my desk and hiding it around my apartment, even though a simpler explanation is that I just misplaced it myself. But is the invisible pink unicorn a plausible explanation?

There is no evidence to support your hypothesis that a "disgruntled Blizzard employee" is selling email addresses. It's not even a plausible explanation when compared to the other explanations that are out there, and have actually been demonstrated conclusively to have happened.

In the early days of the internet, it was said that almost all computer fraud originated internally.

This bolded part of your quote... How exactly does what "was said" 30 years ago (or longer, depending on how you define "the internet" and "early days") relate here? In the early days of medicine, it was said that almost all illnesses were the result of "bad humors" and could be cured by blood letting. So I should ditch my immunologist and start cutting myself to treat my allergies?