Diablo 3 Accounts Being Hacked

[IBNobody]

UPDATE 2:

Blizzard

From Bashiok:

We've been taking the situation extremely seriously from the start, and have done everything possible to verify how and in what circumstances these compromises are occurring. Despite the claims and theories being made, we have yet to find any situations in which a person's account was not compromised through traditional means of someone else logging into their account through the use of their password. While the authenticator isn't a 100% guarantee of account security, we have yet to investigate a compromise report in which an authenticator was attached beforehand.

If your account has been hacked, please view the previous post for information on contacting our support department.

http://us.battle.net/d3/en/forum/topic/5149619846?page=29#571

----------------------------------

Apparently, there is a wave of account hacks going around for Diablo 3. Thieves are taking control of characters, looting all equipment, and stealing all their gold. Account stealing is old news with WoW, but it appears that there is more going on than just stolen passwords. Some are saying that it may be a session ID hack or a server-side hack.

Hacked users log in to find their items looted and mysterious entries on their recently played list.

Spoiler

Here are a few examples of game reporters getting hacked.

http://www.eurogamer...nd-items-stolen
http://www.examiner....diablo-3-hacked

This reporter, after having her own account with authenticator hacked, firmly believes this is a serious security breach on Blizzard’s side, though they either do not want to admit it, or are still unaware of the problem. Many who have had their account on Diablo 3 hacked were logged in at the time of the hack and support staff tells them there was no evidence of their account being hacked. That indicates there is an exploit in the system being taken advantage of.

Here's a link to a massive thread on Blizzard's website:
http://us.battle.net...49008518?page=1

People are reporting that they've been hacked even though they have an authenticator and a secure password.
People are reporting that they were hacked even though they only played single-player.

Here's some theorycraft on Session ID Theft.

http://us.battle.net...8518?page=8#156

You make a credential handshake once in the entire session. This happens at the time of login and this is what gets logged (IPs, account IDs, etc.).

At this point only session identifiers get transferred back and forth for each transaction. A transaction is whenever the state on your account changes. This could be anything from making an AH purchase to picking up some uber sword, or completing a quest, etc..

If I steal your session identifier and send that instead of mine, then I now have access to your account and I completely bypassed the need to login. This could happen in real time. It's possible Blizzard made the system spaz out when it detects multiple detections from the same account ID, so it keeps the most recent one logged in and kicks the old one.

The tools to do this might have also allowed the malicious user to change credentials on the fly. The game client assumes it's not hacked and the session is legit, so it makes the changes live.

NOTE: I'm not a security expert. I have not had my account hacked.

 

[Rydian]

I don't understand how this is funny. While the current goals seem to be chinese gold farming and not actual money, it's still account security for something people paid for (and is going into the gold farming business).

EDIT: Grammar fix.

 

[purplesludge]

All the stolen stuff doesn't even need to be sold by a third party. Why didn't Blizzard anticipate this when they decided to have the real money auction house?

 

[Rasas]

It isn't that funny but with all the stuff they did to Starcraft 2 and Diablo 3 they had it coming.
They shouldn't charge for a authenticator that offers little to no defense but Blizzard has been going on a downward spiral every since merging with Activision. The DRM preventing single player was a bad idea decreasing sales. We all know hackers will hack it eventually so why hinder your own sales. Also blaming the consumer when you send a ticket when your WoW and Diablo 3 account gets hacked when it probably is a problem with their security is complete BS. Ya, some computers aren't fairly secure but just like MS and Sony they pretty much shift all the blame to you when it might be a security hole on their side when your computer is secure.

All the stolen stuff doesn't even need to be sold by a third party. Why didn't Blizzard anticipate this when they decided to have the real money auction house?

They probably didn't think the numbers would be to high. I'm pretty sure every online service company takes in to mind some accounts being hacked.

 

[ferofax]

but then again there is such a thing as "acceptable losses". chances are, these players will just have to start over and forget about all those hacked items. i mean, really, relying on session IDs alone?

even I who's not well versed on hacking have a faint idea on how to go about doing it, and I might even succeed with the attempt. I didn't expect things to be this lousy, just because it's a DRM.

 

[IBNobody]

All the stolen stuff doesn't even need to be sold by a third party. Why didn't Blizzard anticipate this when they decided to have the real money auction house?

They did... But in a poor way.

Note: After the first compromise restoration occurs on a Battle.net account, that account's access to the Diablo III Real Money Auction House will be restricted until an authenticator is attached. If the account is compromised a second time, access to the Diablo III Real Money Auction House will be permanently revoked.

Basically, if you get hacked, you get punished.

 

[Sora de Eclaune]

This is why I'm going to wait until there's an exploit to make it possible to play the game offline. I didn't play the first two online, and I didn't have to be constantly connected to the internet to play, so why does this game have to be the odd one out?

 

[Satangel]

Let's hope this is fixed by the time I purchase this baby. Saw it for a few hours today for the first time, impressive.

 

[emmanu888]

wow that was really fast seems blizzard has some work to do on the security side of the server

 

[Satangel]

This is why I'm going to wait until there's an exploit to make it possible to play the game offline. I didn't play the first two online, and I didn't have to be constantly connected to the internet to play, so why does this game have to be the odd one out?

DRM + cloud syncing + other things. Cloud syncing is really something useful IMHO, DRM is just BS.

 

[Seaking]

this is funny because

1. it seems saves are NOT on your local machine, correct? so that would mean its in the Blizzard "cloud" on D3 servers

This is why I'm going to wait until there's an exploit to make it possible to play the game offline. I didn't play the first two online, and I didn't have to be constantly connected to the internet to play, so why does this game have to be the odd one out?

There won't be an "exploit". You'll have to wait until custom servers can get made, if that's ever possible. Everything, right now, is stored serverside, nothing on clientside.

2. what IBNobody pointed out

All the stolen stuff doesn't even need to be sold by a third party. Why didn't Blizzard anticipate this when they decided to have the real money auction house?

They did... But in a poor way.

Note: After the first compromise restoration occurs on a Battle.net account, that account's access to the Diablo III Real Money Auction House will be restricted until an authenticator is attached. If the account is compromised a second time, access to the Diablo III Real Money Auction House will be permanently revoked.

Basically, if you get hacked, you get punished.

its been less then a month and hackers have already found a hole in the security.

being Blizzard, i was hoping this would not happen.

 

[FluffyLunamoth]

This is why I'm going to wait until there's an exploit to make it possible to play the game offline. I didn't play the first two online, and I didn't have to be constantly connected to the internet to play, so why does this game have to be the odd one out?

There won't be an "exploit". You'll have to wait until custom servers can get made, if that's ever possible. Everything, right now, is stored serverside, nothing on clientside.

 

[IBNobody]

This is why I'm going to wait until there's an exploit to make it possible to play the game offline. I didn't play the first two online, and I didn't have to be constantly connected to the internet to play, so why does this game have to be the odd one out?

There won't be an "exploit". You'll have to wait until custom servers can get made, if that's ever possible. Everything, right now, is stored serverside, nothing on clientside.

This is true. You can get lag spikes, even on single player. My ping is ~300-500 at times, and I see rubber-banding. There will need to be custom servers set up.


------------------------------------

EDIT: I just updated the OP to indicate Blizzard's initial response.

 

[xdmario1]

I fail to see why Blizzard isn't getting hell for this. I may not play Diablo III, but I do know that if this were to happen with any console, Nintendo/Microsoft/Sony would be taking it up the ass for this. Why should a computer be any different?

 

[SpaceJump]

Just checked my account and everything seems fine
Hopefully Blizzard will sort this out quickly!

 

[Covarr]

I fail to see why Blizzard isn't getting hell for this. I may not play Diablo III, but I do know that if this were to happen with any console, Nintendo/Microsoft/Sony would be taking it up the ass for this. Why should a computer be any different?

Because Blizzard is the second coming of Christ or something. People will put up with the excessive and intrusive DRM, the horribly broken launch that prevents paying customers from playing, and the accounts being hacked en masse less than a week after release, because in the eyes of the average Blizzard customer, they can do no wrong.

Seriously though, why is it that if EA sneezes the wrong way people throw a hissyfit, but if Blizzard has a whole week of problems nobody minds? I simply don't get it.

 

[MelodieOctavia]

I fail to see why Blizzard isn't getting hell for this. I may not play Diablo III, but I do know that if this were to happen with any console, Nintendo/Microsoft/Sony would be taking it up the ass for this. Why should a computer be any different?

Because Blizzard is the second coming of Christ or something. People will put up with the excessive and intrusive DRM, the horribly broken launch that prevents paying customers from playing, and the accounts being hacked en masse less than a week after release, because in the eyes of the average Blizzard customer, they can do no wrong.

Seriously though, why is it that if EA sneezes the wrong way people throw a hissyfit, but if Blizzard has a whole week of problems nobody minds? I simply don't get it.

Have you been living under a rock for the last week and a half? Nobody minds? Error 37 is now a meme. Thousands if not MILLIONS of people have been bitching and complaining (rightfully so) about the abysmal launch that Diablo III had. Why don't you check the archive of any gaming news site and you'll see how "nobody minds".

Nobody has been making a big deal on here because, frankly, Diablo III isn't targeting the average 'Temper.

 

[Wabsta]

A friend of a friend got hacked, sucked.
The whole forum and subreddit of diablo are full of people complaining about it.. I've seen people reporting websites (diablowiki apperently had a virus warning, and people who went on there have been hacked, for example)..
I've not been hacked myself yet. Not that I would REALLY mind, I'm not that far into the game yet.

 

[DiscostewSM]

Error 37 is now a meme.

[yt]I43GUnZN_s4[/yt]

 

[Deleted User]

1