Cancel Auctions Anytime

[Quark]

I got hacked on Friday, for the first time EVER. And that's with playing WOW for 6 years. Also, since their retarded Bnet for all games requirement, not only did I get hacked on my D3 account, but also on the WOW account, that my wife sometimes uses.

Only thing that I did late last week that I did not do before, is I posted a couple of times in the Barb forum on Thursday. More than a coincidence?

So yeah... this game is full of good news.

No, not more than a coincidence. One of these guys supposedly had a live stream showing how he was doing it and commenting on things. They were saving passwords from basically every actual hack (gawker, PSN, you name it, they've seen the list) from the past few years. They've got millions of emails and passwords to try - it only takes a few thousand hits to be worth it.

They sat on these, waiting for D3 to hit. And now that it has, they're working in full force to find every single person who's password hash has been previously compromised and doesn't have an authenticator. There was an Ars Technica article with the author bemoaning his hacked account, going on and on about the state of things, and my god how did he get hacked between Wed when he played and Fri when he added an authenticator? Oh, damn, he never changed his battle.net password from the PSN hack. (Note: as the two examples given, the gawker and PSN hacks were hashed+salt passwords. Hash without salt and plaintext are significantly worse, and had happened to others).

They'll start with the easiest - pure email and password, with no changes. Once that's through, you add in slight mutations to the password to find people who only minorly change passwords from previous known hacks. Everything after that is fairly simple to implement, but gets significantly more brute force in effort/reward ratio.

And while you're at it, if you get a hit, try it in WoW.