Over the weekend Blizzard alerted World of Warcraft players of the first ever recorded hacking of an Authenticator protected account:

Kropacius (Link)

After looking into this, it has been escalated, but it is a Man in the Middle attack.
http://en.wikipedia.org/wiki/Man-in-the-middle_attack

This is still perpetrated by key loggers, and no method is always 100% secure.

The way that this was done is a trojan on the player's computer transmitted their account information and authenticator information to a remote server, while sending an incorrect authenticator number to WoW servers. The hackers then used the information and the authenticator information within the small window where it was still valid to log on to the player's account and take his items and gold.

Check if you have the Virus:

Just search for a file named "emcor.dll" on your computer, it is most likely located in "C:\Users\(Your user name)\AppData\Temp" but I suggest that you check everything just to be sure. If you do find the file, delete it and make sure you update your anti-virus to prevent any further problem. (Thanks MMO-Champion)

This is by no means a strike against the Blizzard authenticators. They still provide a remarkable level of security for your account, it is simply the reality that there is no way for Blizzard to protect players completely. You still have to be responsible for keeping your own computer Virus free.


To read the latest guides, news, and features you can visit our World of Warcraft Game Page.

Last Updated: Mar 13, 2016

Comments