So far we stayed away from the whole Diablo III fiasco (with the exception of a poll on the site about it). For the most part there is simply too many stories about it, it is almost as bad as all of the “tech” news that is about Zuckerberg’s wedding. Sure Diablo was a great game and from many accounts Diablo III is an even better follow on. The problem is that although Blizzard’s decision to allow for the game to be distributed online was a great idea and allowed people to gain access to it on launch day in a way that we have not seen in a long time, there are and always will be issues with running online games.Even going back to games like Unreal Tournament and Quake III Arena (and before really) there have always been ways to gain access to someone’s system through game servers. I can remember hearing about several “hacks” that used the online voice systems to compromise the systems attached. Now with Blizzard we are seeing a repeat of some of the same issues they have with WOW (World of Warcraft), People are having their accounts hacked (or compromised) and everything they paid for in the game is being sold to other people.
This is not ever a good thing to have happen. Although I have not played WoW I do now three people that have had this happen. When they contacted Blizzard they received little help and were often admonished for being sure to check the security on their own systems. Nothing was ever returned and in all of the cases the end result was closing the account and opening up a new one (the thieves even reset the passwords). Now, that is not a lot of people considering the number of people that actually play WoW, but it is more than enough to show that (again) no system is secure.
Now with Diablo III people are reporting their accounts are being compromised again. Here we are seeing a large number of accounts that are being taken over and everything cleaned out. Blizzard’s direction this time? Pretty much the same thing they did before; nothing. Blizzard is operating a cloud gaming system that multiple users log into to enjoy their product. In the event of an account being compromised Blizzard should not be diverting blame back onto the end users.
Here is a little excerpt from a forum thread at battle.net:
| “The "hacking" ("compromising" is probably a better word, since no real "hacking" is going on) being seen in D3 is no different than what World of Warcraft players have been seeing for five years or so. The sad thing is, if no one bought game currency (gold, credits, whatever) from these third-party companies, then essentially no account compromises would be occurring. Compromises not done by gold selling companies are very rare indeed. They strip one player to sell to another, because it's much more efficient than "farming" gold. They still farm some of course, but they do it purely with compromised accounts. Unfortunately, these compromisers make a lot of money off of the practice (because players buy gold) and so they have a lot of resources to use to try to get your password from you directly, or through your computer. Some of their poorly translated phishing e-mails may be laughable, but their trojans, infected websites, etc. are not funny at all. If you have the physical or mobile authenticator (both of which major banks use and charge $30+ for) the chances of you being compromised are very, very small. I've personally examined the MSInfo files of nearly all of the handful of WoW players who have actually been compromised through an authenticator, and the sheer number of backdoor programs and other malware on their systems has been mind boggling. Probably not coincidentally, these same people were also running a disturbing number of file-sharing and download programs, including ones which are commonly known to not be safe. Again, compromising game accounts is a big business in some countries. They have people on their payroll who spread false rumors of "hacked through my authenticator" just to try to discourage people from using them. We charge $6.50 for the physical authenticator, because that's exactly what it costs us to make them. The mobile one is free because we don't have to pay a factory to build them. Use them, and enjoy your gaming without someone mucking with your stuff.” |
However the rest of the thread is filled with people that are claiming the opposite of this and some are understandably angry about it. In this case and with the number of hacked accounts reported we would have to think that it is more likely that a server is compromised on Blizzard’s end. This is one of the dangers of using cloud services (as we keep saying). Blizzard’s reaction to this is quite obnoxious in the face of the number of users that are currently reporting hacked accounts and some of them are even using authenticators. This is an extra layer of security that is supposed to prevent a player’s account from being hacked. Again (and in contradiction to what Blizzard is claiming) there are a number of posts in the forum stating that they have been hacked (some during actual game play) and they have authenticators in use.
| “I have an authenticator. I was hacked. I don't buy gold or items from 4rd parties (or anyone). I don't click strange links or read spam. I don't have any file sharing software on my pc. My PC is brand new, with great antivirus. Excuses pls?” |
Now, we could say that the many, many people that have been hacked were all laden with viruses and keyloggers and more malware than applications, but there is something else at play here. We know that Blizzard has always maintained that you should be very careful with your account (even treating it like a bank account) and with their Real Merchandise Auction House delayed we have to wonder even more about the cause. If there was nothing wrong and all of this was careless users why put off the auction house? If this is all foolishness on the part of users, why refund anything or give back items that were stolen? Both of these are certainly not common occurrences.
No, the evidence (circumstantial though it is) points to something else. It is possible that there is a new exploit in the game code that allows for easy access through the system. It is possible that the new DRM scheme is part of the issue. If a user is connecting the servers and the DRM system is using some sort of compromised security token system that could allow a malicious person to gain access to the account (theoretically). This seems feasible considering the reports that people connecting from the same computer are having their accounts compromised one after the other (there were a couple of reports like that in the thread). We do not know what the cause is, but we can say with some degree of certainty that it is unlikely that it is all the end users’ fault. There are simply too many hacked accounts for that to be probable.
Blizzard needs to own up to this one whatever it is or they are going to lend up looking even worse than they already do now. It is one thing to take a few isolated events and write them off to careless users, it is another to have thousands within the span of a few days and try the same thing. Also, as far as the always on DRM and the requirement to log into your account... well someone should tell Blizzard that that has not stopped any game from being pirated. DRM, in the long run, only ends up hurting the consumers... in this case popssibly the ones that are being hacked.
Discuss this in our Forum
