Slashdot Mirror
WoW Players Targeted By Windows Flaw Exploit
grimwell writes "The BBC is carrying the story that the ANI flaw is being used to target World of Warcraft players, as hackers search for account details. 'Analysis of that malicious software showed that it lay dormant on a victims machine until they ran World of Warcraft (WoW) at which point it captured login data and sent it to the hacking group ... Research by security firm Symantec suggests that the raw value of a WoW account is now higher than a credit card and its associated verification data.'" Doubtless, any compromised accounts would quickly see their equipment sold, and the resulting gold transferred to another account. This gold would then be sold for US currency to Real Money Traders like the company IGE.
World of Warcraft is considered a better target for theft than a credit card. What kind of nerds are running those crime syndicates these days? Maybe if Blizzard came down on more of these gold-selling, account-selling, and item-selling service providers, this kind of nonsense wouldn't even be an issue.
Blerg.
That would render the wow economy useless... You would only be able to buy from npc's and not from other players.
09 f9 11 02 9d 74 e3 5b d8 41 56 c5 63
Right, so money and goods that are yours permanently and don't give you a way to trade with other people... Yeah, great idea. I don't play WoW, but soulbinding (as you describe it) would only be good for a small handful of your goods that you -KNOW- you will never part with.
And you do realize that money is useless if you can't use it, right?
"If you make people think they're thinking, they'll love you; But if you really make them think, they'll hate you." - DM
While I'm no fan of gold farmers and in-game currency traders, is there any evidence to justify naming IGE in that addendum? What justifies that?
Well, if you could un-soulbind it, then that would probably be a good idea. Also, if you wanted to get rid of some sole binded gold, you could just buy an item, and then sell the item to another character.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Most gear is soulbound upon equipping it, but 99% of the stuff you own can still be sold at a vendor for gold. The amount you get depends on the quality of the stuff you're selling. Gold isn't bound to your character. If it was, you wouldn't be able to spend any of it.
I traded all my mod points for these magic beans.
Soulbinding isn't a choice--it's something that happens to some items (most often quest rewards) that prevents the reward from being transferred/used by other players. Gold cannot be soulbound--as others have pointed out, that would render it somewhat useless. Soulbound items can be sold to NPCs, however they can never be bought back. This does mean that soulbound items would still have value to a hacker who was trying to make real-world money.
Is there some sort of big warning popup in WoW for players as they start the game up? (prior to entering a username/password)? I know that Guild Wars has special "news items" alongside the login form that you can read without having to actually log into your account. It would be cool if Blizzard (heck, and ArenaNet) had a giant warning that came up for the next few days informing people of this issue and of the upcoming fix from MS (or am I confusing my vulnerabilities/fixes here?...). That might help folks out perhaps.
I like basketball!!1!
Well, if you could un-soulbind it, then that would probably be a good idea. Also, if you wanted to get rid of some sole binded gold, you could just buy an item, and then sell the item to another character.
Great, so now only someone who has access to my account can steal my gold and items! That solves everything!
Gold no, but most equipped items are soulbound. So they will only be sellable to NPC vendors. But there's nothing to stop Mr. Hacker from doing that. You can usually buy stuff back from the vendor but not after you've logged out. And Mr. Hacker will have helpfully logged you out. But he'll also have stolen your gold and the NPC's don't accept credit...
I feel so sorry for those poor hackers not being able to get to my account...
not.
34486853790
Connection too slow for X forwarding? Try "ssh -CX user@host"
Almost all equipment in WoW becomes soulbound when equipped. Some items become soulbound when you pick them up. I would imagine that account hackers just sell these items to NPC vendors.
Gold can't be 'soulbound', but a lot of valuable items are. Also, the player can't really control wether it should be soulbound, it happens automatically. For example, some items 'bind' on pick up when you loot it from the corpse of something you just killed (BoP), some do so after equipping them (BoE). Therefore the chances of finding an unbound item on a player that would sell for a lot of gold on the Auction House isn't too big (unless he crafts them with the intent of selling).
All items (including bound ones) can be sold to NPC vendors however which will yield a relatively small amount of gold. I imagine that these people hacking WoW accounts will just 'vendor' everything anyway to get as much gold as possible.
Equipment, yes.
Gold, no.
Trade skill items, no.
I dont RTFA but im assuming u have to go to one of those "power lvl" sites for this to happen (or any other site). That means that people that buy gold and items (ilegal according to blizz) with real cash have big chances of getting hacked. If all this is true why should blizzard care? this is theire anti-power lvl system. RandomGM : WORKING AS INTENDED.
I just hope no one ever figures out a way to do this with Slashdot accounts. If WoW accounts are more valuable than credit cards, then Slashdot accounts must be more valuable than, I guess, say Dilithium Crystals or Ewok slaves. I think I have finally going to have to upgrade to Windows98 from Windows95. It probably is mature enough at this point.
----- There are two kinds of people in this world, my friend; those with loaded guns, and those who dig.
Blizzard recommends using their news launcher tool to start World of Warcraft, as it's supposed to be able to thwart any kind of attack.
What Microsoft should have done, instead of investing significant amounts of its own resources into the security patch, was tether a huge, yellow exclamation point over the Redmond campus. Wayward WoW players would be inexorably drawn to it where they would find a Non-payroll Personnel Coordinator (NPC) who would relate to them the details of the bug and why it needs to be fixed. Harvesting the collective zeal of the WoW community in such a fashion, the solution to the issue would have been presented to Microsoft promptly and at little expense. Patch notes could even be copied and pasted directly from the resulting Wowwiki page.
Incidentally, I plan to use a similar process to reduce the amount of manual labor around the home.
Dewey, you fool! Your decimal system has played right into my hands!
Some items can be soulbound, either when they are first obtained ("Bind on Pickup") or when they are first worn / wielded ("Bind on Equip"). However, even soulbound items can be sold to NPC merchants. Also, there is no way to soulbind gold, or any item not already marked as bindable.
This signature carefully hand-crafted from recycled electrons.
There's been a recent surge in the number of gold farming and leveling service spammers in the game lately, too. Your only recourse with those is to disable the whisper channel, which you can do from the chat menu. Unfortunately then you can't get whispers. I'm pretty sure all these spams are coming from trial accounts. It'd be nice if Blizzard could include an option to ignore trial accounts. I suppose it'd also be possible to write a plugin to ignore whispers from people not on your friends list, but that's still a pain in the ass.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
Soulbinding is for items only, which can still be (rare cases, not withstanding) sold to the vendor for gold. Gold cannot be soulbound. Which is why, on hacked accounts, the person is left naked and pennyless. Everything in liquidated into gold and the gold is transferred to another.
However, that is really a interesting idea. How would a game economy handle the idea of no inter -player trade? I would find that an interesting concept to test out. The game would have to be designed where 'all players are equal' in a sort. Everyone could craft any item (or require that you can only get crafted items from NPC vendors). Killing a monster and looting would give full value of money and items to everyone. (A monster drops 10 gold and all 5 players who killed it get 10 gold each. as well as a copy of the weapon or armour it dropped). Heck, a monster would no longer even NEED to drop items. They can just drop money and (as WoW is turning too) special tokens which can be exchanged for items at the high-end.
It would remove an 'economy', for whatever a virtual economy is worth (as technically, everything is limitless). Though I know a lot of people like the idea of 'trade' (I'm one of them), the real question is, does a 'game' really need it? I guess this is close to how Guild Wars works when you only play with NPCs. All items dropped are given to you and gold is reduced by the number of NPC party members. While some items can be dropped from monsters that you use, often find that armour is crafted for you by NPCs who require crafting materials you salvage from item drops and some gold. In essence, it's kind of like only getting gold from monsters.
Do so, does take something away from the 'feel' of the game, but it also can add to the 'work' of the game and I often find this adds to my own 'burning out'. Tough choice, but I like the idea and would like to see how people reacted to a game once they've played it fully.
Cheers,
Fozzy
"The past was erased, the erasure was forgotten, the lie became truth." ~1984 George Orwell
Soulbinding is for the purpose of keeping used items from degrading the economy -- when you loot a valuable item, you can either use it yourself, or sell it to other players, but not both. You can, of course, sell a used one to a merchant, who doesn't actually re-sell it, but you can imagine they do if it makes you feel better.
In any case, being able to un-soulbind something defeats the purpose of soulbinding. When you read "soulbound", read "rendered useless for trade to prevent valuable items from becoming too common".
It amazes me the "infield fly rules" these games create just to prevent them from being like reality. It's bad enough a guy with no fighting training and no armor can stand there waving his hands while a huge guy with a sword beats on him unopposed. But this is "balance", i.e. melee wimps, casters much tougher than they actually are (not damage they do, but that they take. You can't avoid flinching when someone waves a hand in your face, much less a sword, much less hits you with a sword -- yet you can't wear armor because it interferes with these "delicate hand movements". Sheesh.)
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
There is a simple solution to this. Instead of banning accounts and ignoring the fact that no matter what they do, people are going to pay hard cash for in game items, Blizzard should follow Sony's lead.
If they would control the whole secondary market process, it would help them track stolen property and give them a lucrative second source of income. Instead, they would rather take a hard stance and deny this is even happening.
RTFG - Read The F#$%ing Google!
Same applies to same-faction trading. In order to really stop gold changing hands, you would need to remove the auction houses. It would also render a lot of the profession system useless because you couldn't do enchants/crafting and get a fee.
Have you played WoW?
In City of Heroes/City of Villains there is effectively no economy. There is no cash, but defeating mobs gets you "influence" (as a heroe, and its equivalent as a villain), that can be used to buy Enhancements that can augment your powers. The thing is those enhancements are also available from NPC vendors in shops, and are individually not worth much. As well when you get to higher levels, you are buried in influence and it becomes a non-factor really.
All in all the game is greatly improved by not having an economy and not having any "loot". Its refreshing I find...
"The first time I got drunk, I got married. The second time I bought a chimpanzee, after that I stayed sober" Arian Seid
Gold farmers and their black-hat exploit friends make the game more palatable for the players who don't have time for the constant grinding required to keep up with their unemployed guildmates.
This is why Blizzard has not taken the one action that actually would stop the black hats and the farmers: banning anyone who buys from them.
The game already records all the transactions that occur. This information could be data-mined to identify gold farmers, middlemen, and their clients. The clients are the source of the money. The clients are the people who should be kicked from the game. The transaction logs lead to the clients.
Blizzard has to officially disapprove of gold farmers, but their failure to take action against their clients demonstrates that they are actually in favour of them. All they need to do is appear to be working to stop gold farmers by banning a token subset of them every month.
The solution is obvious!! Sell your WoW account and start playing archaic games like Ultima Online. NOBODY in their right mind would want to steal your UO account/items/gold. It's kind of like driving a 1982 Dodge Aries...you could leave your keys in the ignition in Detroit!
:-)
But I play UO all the time. I never get bored of it. Account hacking is unheard of. Players do gank other players and get their items because the victims were dumb enough not to insure their items and went to a PvP area or joined a guild. I'm a player killer myself. I join guilds and kill tamers or mages and take their stuff
tends to use Mac Minis to play WoW on.
My female gnome mage giggles at the Windows ANI exploit!
-- Tigger warning: This post may contain tiggers! --
If you're truly looking for something closer to reality, then perhaps you should check out LARPing
-- jchenx
When will people realise this is basically the whole POINT of an MMO? You grind to gain better items. That is the underlying principle of an MMORPG.
Want a game where you can jump into the action on an equal playing field? FPS's are out there, as are RTS, etc.
If everyone started at 70 on WoW the game would become incredibly boring. PvP? Why? No rewards except pride.
Blizzard should implement the possiblity to unlock/lock items for disenchanting and selling.
Locking an item would be instant. Unlocking would take two or three days. They could also add a notice that one or more items have been marked to be unlocked when you login. This will alert you of anyone trying to get to your gear.
This would not solve the problem but it will make sure you dont lose your gear when your account is hacked.
Unfortunately no. "Soulbound" items, aka BoP (Bind on Pick-up), can be sold to NPC vendors, but can't be traded to other players or put up for in-game auctions. As I'm finally starting to get to a decent level, some of those items can hit hundreds of gold. If someone were to hack a lvl 70, between the gold on them and the items, we're talking a good chunk of change. But there's no way to make an item or currency bound to a single player.
"The only constant in the universe is change." - Unknown author