IPB

Welcome Guest ( Log In | Register )

 
Reply to this topicStart new topic
Allakhazam Trojan Attack
Dive
post Oct 11 2005, 12:43 AM
Post #1


Antarctica Traffic Control
************

Group: Dark Templar
Posts: 1823
Joined: 10-December 02
Member No.: 1



If you visit Allakhazam, you should be aware of this.

QUOTE
This only applies to you if you are running an older version of Internet Explorer, have not updated windows with the latest security patches and do not have virus protection on your computer. Apparantly one of our ad providers was affected by a trojan and was serving it to our site for several days last weekend. This is a keylogger and could possibly compromise your game login and password. As soon as we discovered it, we pulled all of their ads.

To see if you got the trojan, go to Program Files/Internet Explorer in your directory and look for a file named "syssmss.exe". If it is there, then open your task manager and delete the file. Also go to %WIN_DIR%\Downloaded Program Files and delete a file named either "fucksnow.exe" or "muma.exe". Then once you have done that, log into the game and change your password. In fact, change every password for every place you have typed since you got the trojan.

There are also several online sites that scan your computer for free.

http://www.windowsecurity.com/trojanscan/
http://housecall.trendmicro.com/

We apologize for this. In 6 years of running this site, nothing like this has ever happened. It kills me to think that we may have, even inadvertantly, caused anyone to have their account compromised. We're all about making the games better and more fun. Believe me, we will do everything in our power to make sure it does not happen again.

Along with the advertiser who sent this, and in cooperation with the FBI, we are attempting to track down the people who sent this. I hope I get a few minutes in a back room with the bastards.


Apparently some people have had their FFXI and WoW accounts broken into and items/money stolen. A keylogger would record anything typed on the affected machine and credit card numbers, passwords, etc. could be stolen.
Go to the top of the page
 
+Quote Post
Knightsword
post Oct 11 2005, 02:09 AM
Post #2


Master of Blades and Rakes
************

Group: Arbiter Caste
Posts: 1465
Joined: 24-June 03
From: Minneapolis, MN
Member No.: 53



Who needs alla for spyware, when Blizzard does it for WoW users


http://www.rootkit.com/blog.php?newsid=358
QUOTE
I recently performed a rather long reversing session on a piece of software written by Blizzard Entertainment, yes - the ones who made Warcraft, and World of Warcraft (which has 4.5 million+ players now, apparently). This software is known as the 'warden client' - its written like shellcode in that it's position independant. It is downloaded on the fly from Blizzard's servers, and it runs about every 15 seconds. It is one of the most interesting pieces of spyware to date, because it is designed only to verify compliance with a EULA/TOS. Here is what it does, about every 15 seconds, to about 4.5 million people (500,000 of which are logged on at any given time):

The warden dumps all the DLL's using a ToolHelp API call. It reads information from every DLL loaded in the 'world of warcraft' executable process space. No big deal.

The warden then uses the GetWindowTextA function to read the window text in the titlebar of every window. These are windows that are not in the WoW process, but any program running on your computer. Now a Big Deal.

I watched the warden sniff down the email addresses of people I was communicating with on MSN, the URL of several websites that I had open at the time, and the names of all my running programs, including those that were minimized or in the toolbar. These strings can easily contain social security numbers or credit card numbers, for example, if I have Microsoft Excel or Quickbooks open w/ my personal finances at the time.

Once these strings are obtained, they are passed through a hashing function and compared against a list of 'banning hashes' - if you match something in their list, I suspect you will get banned. For example, if you have a window titled 'WoW!Inmate' - regardless of what that window really does, it could result in a ban. If you can't believe it, make a dummy window that does nothing at all and name it this, then start WoW. It certainly will result in warden reporting you as a cheater. I really believe that reading these window titles violates privacy, considering window titles contain alot of personal data. But, we already know Blizzard Entertainment is fierce from a legal perspective. Look at what they have done to people who tried to make BNetD, freecraft, or third party WoW servers.

Next, warden opens every process running on your computer. When each program is opened, warden then calls ReadProcessMemory and reads a series of addresses - usually in the 0x0040xxxx or 0x0041xxxx range - this is the range that most executable programs on windows will place their code. Warden reads about 10-20 bytes for each test, and again hashes this and compares against a list of banning hashes. These tests are clearly designed to detect known 3rd party programs, such as wowglider and friends. Every process is read from in this way. I watched warden open my email program, and even my PGP key manager. Again, I feel this is a fairly severe violation of privacy, but what can you do? It would be very easy to devise a test where the warden clearly reads confidential or personal information without regard.

This behavior places the warden client squarely in the category of spyware. What is interesting about this is that it might be the first use of spyware to verify compliance with a EULA. I cannot imagine that such practices will be legal in the future, but right now in terms of law, this is the wild wild west. You can't blame Blizz for trying, as well as any other company, but this practice will have to stop if we have any hope of privacy. Agree w/ botting or game cheaters or not, this is a much larger issue called 'privacy' and Blizz has no right to be opening my excel or PGP programs, for whatever reason.

-Greg



Go to the top of the page
 
+Quote Post
Henge
post Oct 13 2005, 07:01 PM
Post #3


OpSec
************

Group: Dark Templar
Posts: 1324
Joined: 13-December 02
From: Roseburg, OR
Member No.: 2



Dear Allakhazam.com staff,

user posted image

Signed,
~Woe
















No i didn't get owned by a trojan,I just think its fucking rediculous that they even have adds on their forum in the first place. let alone the gaul to have "premium" (pay) accounts that offer no adds, just for a bloody public community.
Go to the top of the page
 
+Quote Post

Reply to this topicStart new topic
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:

 



Lo-Fi Version Time is now: 14th December 2017 - 06:37 PM