As you develop your character, you spend a lot of time getting achievements, reputation, pets, and all those shiny epics. In a blink of an eye, it can all be removed. Sad as it is, hacking is a common thing in WoW. You see good players with geared toons get hacked frequently. You log in to find your toon someplace you didn’t leave him/her. The toon is naked, stripped, your banks are empty, and your guild bank has been violated. You get a sinking feeling in the pit of your stomach… and you get angry. Can it be recovered? Yes, but it’s iffy if you will get everything back exactly the same. Since the guild itself has seen a handful of members hacked, it brings up a solid issue of security. Personally, I’ve never been hacked, but just the thought sends my stomach quivering in anxiety. With the recent influx of victims, I think a brief overview of the topic is warranted.
How did it happen?
Well, there are varieties methods at the hackers’ disposal but below are the most commonly used ones:
Keylogger: A keylogger or keystroke loggers are pieces of software which sit in memory, capturing your keystrokes when you enter the game, the Blizzard account, or Blizzard forum web sites. A keylogger program does not require physical access to the user's computer. It can be downloaded on purpose by someone who wants to monitor activity on a particular computer or it can be downloaded unwittingly as spyware and executed as part of a rootkit or remote administration (RAT)Trojan horse. A keylogger program typically consists of two files that get installed in the same directory: a dynamic link library (DLL) file (which does all the recording) and an executable file (.EXE) that installs the DLL file and triggers it to work. The keylogger program records each keystroke the user types and uploads the information over the Internet periodically to whoever installed the program. (Source)
Phishing: A phishing web site (sometimes called a "spoofed" site) tries to steal your account password or other confidential information by tricking you into believing you're on a legitimate web site. You can even land on a phishing site by mistyping a URL (web address). Is that web site legitimate? Don't be fooled by a site that looks real. It's easy for phishers to create web sites that look like the genuine article, complete with the logos and other graphics of a trusted web site. Important: If you're at all unsure about a web site, do not sign in. The safest thing to do is to close and then reopen your browser, and then type the URL into your browser's Address bar. Typing the correct URL is the best way to be sure you're not redirected to a spoofed site. Phishers are becoming more and more sophisticated in designing their phony web sites. There's no surefire way to know if you're on a phishing site, but here's some hints that can help you distinguish a real web site from a phishing site. (Source)
The Friend (Not!): This is the person that you were leveling with and felt safe- or this is the leveling service you used. You shared your password with this person, and now, either this person is no longer your friend, or the service you paid for is up and you never changed your password after sharing it. This is a simple avoidable situation – don’t share your username/password. It also is advisable to use a strong password, something that cannot be guessed by people that may know you well. It’s best to be greater than 8 alphanumeric in length, a combination of upper and lowercase characters and numbers. Another good practice is to use a different username/password for any Warcraft sites you may belong to and frequent.
The Best Prevention
Buy an authenticator: the cost is about the same as an Extra Value Meal – a whooping $6.50 – and this will provide you with two-factor authentication. Not only your user name and password, but a generated password that expires in 60 seconds. How does it work? After you enter your normal username/password, you will get a dialog for the authenticator generated code- get a code by pushing the button (unless you have a mobile application of it), enter it and you’re protected. The catch is you need to keep it safe because while you can recover your account should you lose it, it isn’t easy. It requires a phone call to Blizzard’s Billing and Account services to verify lots of information. You can order an authenticator from the Blizzard Store or you can purchase the mobile application (it’s available for several phones) at Blizzard’s Mobile Store. If you do decide to purchase an authenticator, you should write down the serial code and keep it in a safe place (wallet, etc).