The Addon Junkie

Via WoW.com:

The source of the malicious code appears to be a number of web sites listed as paid promoted links on google searches. They’re all things like wowmatrixf.com or deadlybossmodss.com. The IP address they were all registered to seems to have disappeared overnight and no longer appears in my Reverse DNS searches, but at its peak the one IP, which is registered in Singapore, was linked to 11 different sites, all similarly named to the ones above, all featured results on google searches for their legitimate counterparts. So again, it falls to the browsing community to be very careful where they click – especially when downloading and installing software.

It has been confirmed by Blue posters on the World of Warcraft Forums that a (sort of) new attack is now circumventing (sort of) authenticators.

While the total explanation is much much more detailed, here’s the basic rundown:

This appears to be a classic man-in-the-middle attack. The malicious code (read: probably not technically a virus) hijacks the WoW client and causes it to connect to the attacker’s computer, rather than Blizzard’s official servers. Because Blizzard has not coded the client in such a way as to enforce secure connections with signed SSL certificates (which is why private servers still work) it is trivial to force your client to connect to another system and send it your login credentials. Note that this is really nothing new. If an attacker had infected you with a keylogger that was capable of reporting your keystrokes back in realtime (which many can) the effect would be the same.

The important points here are:

1. This only provides the attacker with temporary access to your account. Authenticator codes expire in about 30 seconds, so if the attacker is quick enough with your data to actually log in, they only get one chance.
2. This is a new vulnerability, but it uses old methods. Any virus scanner worth it’s salt should pick this up merely by its behavior, even if it’s not in any databases yet.
3. This currently only affects Windows users, but don’t rest too easy just because you use a Mac or Linux. This brings us to point #4
4. This is not Blizzard’s problem. Sure, there are some things they could do to beef up security a bit, like the SSL thing I mentioned above – and they’ll probably do them, which makes them an outstanding company because, you see, they don’t really have to do anything because it’s not their problem. The security of your system is your problem, always has been. Rest assured that Blizzard is working hard to fix this, because they’re just good guys that way, but you need to do your part too. Practice safe browsing habits, don’t be “average” (i.e. avoid the “most-commons” like IE6 or Outlook Express), run good antivirus software and if it makes you feel better you can certainly go out and buy a Mac or download Linux. Keep in mind that while Macs and Linux are immune to this problem, they are not immune to everything. They make you a faster moving and more heavily armored target, but you are still a target and if you start doing stupid things, you become the proverbial low-hanging fruit.