Take the 2-minute tour ×
Arqade is a question and answer site for passionate videogamers on all platforms. It's 100% free, no registration required.

There have been a fairly large number of fairly reliable reports that some clever and disreputable jerks have figured out how to hijack a Diablo III session, steal your Battle.net account, take all of your cool items, all of your WoW gold, and do all manner of other nefarious things - and worse yet, they can use your account to do it to your friends!

Eeeeeeeeeeeeeek! How can I stop this from happening!!?!?!?!?????

share|improve this question
5  
In short, get an authenticator. –  DwarfSlice May 22 '12 at 1:21
    
us.battle.net/account/management/authenticator.html the problem can be solved if you go to that link and check use an authenticator everytime you log in. it seems to be working for most people, or will give you enough time if it does happen once that you can change your password without losing anything. –  Kirkalirk May 22 '12 at 1:27
    
@Kirkalirk if you read the SomethingAwful thread linked in the question you'll find out that an authenticator is useless in this case –  Kappei May 22 '12 at 10:08
    
@Kappei - You cannot get the session id of a logged in player. The authenticator will protect you despite the incorrect reports on SomethingAwful. I also don't care what dirty little hacking websites claim, guess what the people who go to those types of websites, are basically scum. –  Ramhound May 22 '12 at 11:05
4  
TIL people posting on internet forums that provide no evidence are "reliable". –  Nick T May 22 '12 at 21:25

3 Answers 3

up vote 10 down vote accepted

Blizzard released an official statement about the current situation. Their official statement denies that there are any current exploits, or that Authenticator-locked accounts have been compromised. (We can always trust what a company says about their own security, right?)

However, it also mentions that, if you're concerned about security, in addition to the "authenticator" device, and the "Mobile Authenticator" iPhone/Android app, there's also a service where Blizzard will send you text messages for certain (configurable) account information changes or similar activity. If you don't want to invest in the standalone device, and you don't have an iPhone/Android phone, you may be interested in this third option.

For more information on the Authenticator, visit http://us.battle.net/support/en/article/battle-net-authenticator-faq

For more on the Battle.net Mobile Authenticator, visit http://us.battle.net/support/en/article/battle-net-mobile-authenticator-faq

For more on Battle.net SMS Protect, visit http://us.battle.net/support/en/article/battlenet-sms-protect

As always, if you think you've been the victim of an account compromise, head to the "Help! I've Been Hacked!" tool at http://us.battle.net/en/security/help for assistance.

share|improve this answer

So, with respect to this specific exploit, the most important thing is to stay out of public games, and under no circumstances accept an invitation or join request from somebody who you don't know.

You'll also want to disable Quick Join, and verify that your friends are who they say they are before playing with them as well. Once an account is compromised, it can be used to compromise the accounts of all of that persons friends, i.e. you.

More generally, you really ought to get an Authenticator. Either the physical key-fob variety or the smartphone app. Remember, Diablo 3 is a game with a built in cash marketplace. It is a prime target for unsavory sorts that want to get at your digital stuff and resell them at a profit. While having an authenticator won't protect you completely from this sort of attack, it will minimize the damage a hacker can do significantly by preventing them from changing your password or otherwise locking you out of your own account.

share|improve this answer
9  
This "expoit" does not actually exists. Blizzard already confirm in EVERY SINGLE CASE the account was compromised because the criminal had knowlege of both the USERNAME and PASSWORD and obviously NONE of the accounts were protected by an authenticator. –  Ramhound May 22 '12 at 11:06
3  
@Ramhound can you provide a link to confirm that? –  Kappei May 22 '12 at 11:09
1  
They haven't confirmed it's false, they have posted a generic reply that neither confirms or denies there is a bigger issue. us.battle.net/d3/en/forum/topic/5149619846#1 –  SLC May 22 '12 at 11:24
3  
Just spotted this: us.battle.net/d3/en/forum/topic/5149619846?page=29#571 which says that they haven't seen a single instance of someone being hacked with an authenticator. –  SLC May 22 '12 at 11:28
2  
@JoeWreschnig There's nothing contradictory about his post. The first part of his answer is intended to respond to this specific hack, and the rest is meant to be general advice with how to prevent most hacking. –  Wipqozn May 22 '12 at 12:03

It is Blizzard's position that the session ID hijacking claim is bogus. Bashiok stated in his post that thus far none of the compromised accounts they have investigated had an authenticator attached prior to the compromise. A further update specifically asserts that the session hijacking being described is technically impossible.

The advice to use an authenticator was repeated in a cut and paste response a few hours after the original post, and again a day later. The assertion that no authenticator enable account has been hacked was reiterated in a response to a user here.

The Bliz forums are painful to read and it may turn out the some vulnerability will be acknowledged in the future but at the moment the official stance is that an authenticator attached to your account, along with traditional antivirus/firewall protections are sufficient.

There is no acknowledged evidence that public games pose any threat whatsoever. The primary cause of account compromise continues to be compromised passwords (whether by social engineered attacks, weak passwords, keyloggers, etc).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.