So while we wait for the BlizzTechs to stop smashing bugs with rolled-up newspapers, old shoes, and cheap plastic fly swatters, let me tell you a story. A horror story, if you will, and one that’s fresh in my mind.
You see, I found out late last night my account was hacked. But I’m getting a bit ahead of myself; let me set the stage for you.
I sat down to log in and run a few random dailies around 8 PM Pacific Standard, and was surprised to see my login screen ask for an Authenticator code. I’d put off getting one for months at this point, so either Blizz had become psychic and was confusing the future with the present, or someone had added the thing while I wasn’t looking. I’m cynical, and quickly decided it was the latter.
My first task was, of course, to try to get in touch with my guild leaders. Adu was on MSN, so she got the heads up first, and started the process of demotion and checking what was missing. Sadly, I’m Raid Assist for TL, and they had access to everything of worth – all our flasks, fish feasts, enchanting mats, and a goodly number of pre-heroic blues were gone. And we were supposed to raid tonight, the first time in TL, with Kyrem as off-tank. It’s not looking good even now.
While Adu put in the ticket to try to get them back, I shot an email off to Babsy, my Alliance leader. Thankfully all my Alliance toons are much lower on the totem pole – mere Members – so not as much was missing. Oddly enough they didn’t even touch the epic gem tab, though most of my toons likely had access to it at the time. Babsy jumps into Vent with me and we chat while she spams the guild with demotions, puts out a ticket, and attempts to make me feel like it’s not my fault. Vain attempts, to be sure, but at least she tried, right?
At this point I have done everything I personally can; reset my password to a random, face-rolled 16-digit affair that I had to physically write down, put up a forum post, and notified everyone. I start to wonder just *how* in the bloody *hell* someone got my log in information. I don’t really do a ton on my computer. I play WoW and talk on Vent, obviously, watch Youtube videos, read some web comics, check email, and occasionally I even post something here. But that’s it. So I begin the download for Avast! and Webroot to see if either can spot anything, sure it has to be either brute force hacking or some compromise on Blizzard’s end.
Lo and behold, it really is my fault, and I even know how. When I upgraded to Windows 7, I was told to try the Chrome browser because “zomg it’s awesome”. I found it on par with FireFox and, being lazy, never bothered to change over. I had Chrome all set up, after all, and supposedly it’s got all these safety features, right? Well, there’s something FireFox has that Chrome *doesn’t*: NoScript. It’s a tiny addon that simply blocks scripts of any sort from loading, and malware/spyware can only run in scripts. Basic HTML isn’t sophisticated enough to keylog a damn thing, I’m told. So NoScript, something I advocated strongly for my parent’s computer, was the missing link in my casual security, and it proved a fatal flaw.
In the past 24 hours I’ve searched high and low and found quite a few ideas for improving account security. Some are possibly overboard, but until my authenticator arrives in the mail I’m going to follow *all* of them. I don’t feel like going through this again.
Things You Can Do to Not Be A Hacked Slacker:
1) Make your Battle.net email unique. Don’t use your regular email for this, because if your email becomes compromised, so will your Battle.net account. That means *every* game you play that is linked to it, WoW, Diablo, Starcraft… everything. If you use a unique email, though, and don’t sign up for anything other than Battle.net with it, this likelihood decreases, as well as any chance at phishing emails.
2) Use all 16 digits for your password. Sure, it’s a hassle. No, you probably won’t be able to remember it off the top of your head. But it’s much harder to guess 16 numbers and letters in a specific combination than “loludumhakr1337″. (And no, that’s never been a password for me. Nice try though.) Similarily, don’t use leetspeak. I did, for a long time, but have since changed all my passwords to mumbo-jumbo. If it’s decipherable in any sense, it’s not that secure.
3) Get an Authenticator. It’s $6.99 with Washington state tax, so, what… up to $8 if you have a high sales tax? Maybe? If you can scrape together $15 a month, $8 should be nothing. Skip a month if you have to, just get one. No, it’s not foolproof, but it’s probably the closest WoW accounts will ever get to fully secure.
4) Scan your computer for malware, trojans, spyware, and the like every week. I’ve set Webroot up to scan while I’m at work on Saturdays, but you can just as easily have it scan during Tuesday maintenance. Just because I’m a lazy-ass slacker Huntard doesn’t mean you have to be too. In the past I’ve used Avast!, Spybot: Search & Destroy, and AVGFree in tandem and they seemed to catch pretty much everything between them. Best of all, they’re all free. Now I’m using Avast! and Webroot and may add Spybot, though Webroot seems to catch what Spybot covered.
5) Turn on Parental Controls and lock your account when you aren’t playing. This is veering towards paranoid, but think about it. If the hacker can’t simply log into your account, how likely are they to think to check your parental controls? It’s a matter of minutes to turn this feature off and on and one more deterrent never hurt anything.
6) Get FireFox, install the NoScript addon, and be stingy with what scripts you allow to run. It’s fairly easy to tell what scripts aren’t necessary for the website to run perfectly. Currently on this WordPress page I have quantserve.com blocked – a known tracking cookie and one of the ones Webroot found and flagged. I checked a few of my web comics just for luls and found most have up to 3-4 of these scripts currently blocked. The comics and sites probably don’t even know about the potential problem, since these are linked to the flash ads, but that just means you have to defend yourself.
I sincerely hope no one reading this has to go through having their account hacked just to start being smart about security. It sucks having to admit it, but I did this to myself – and in tandem, to both my guilds. TTH might not be affected very badly by it, but TL might not get to raid this week, and that’s my fault. I’d rather post my story, and the things I’ve learned, and look like an idiot than hear of others in the same position.