Authicator

oakfn · 03-31-09, 09:24 PM

Hi I just noticed you can get a Battle.net authicator on your account is there a fee for this?And says can do mobile any idea what phones it works on?

Thanks

***Cairenn*** · 03-31-09, 09:27 PM

http://www.worldofwarcraft.com/index.xml

oakfn · 03-31-09, 09:30 PM

Doh! Thanks Cairenn

***Cairenn*** · 03-31-09, 09:32 PM

Hehehe. You're welcome.

Sythalin · 03-31-09, 09:33 PM

Keep in mind that the authenticator is not 100% safe. Guildie of mine the other day got his account hacked and he has one.

jonathon · 03-31-09, 09:50 PM

Originally Posted by ChaosInc

Keep in mind that the authenticator is not 100% safe. Guildie of mine the other day got his account hacked and he has one.

you know, i've never actually talked to anyone who has had their account hacked while using one... its always a friend of mine, or a guildie of mine, or the friend of my uncles pool boy... not saying it didn't happen, just saying that I've never heard that first hand....

***Cairenn*** · 03-31-09, 10:02 PM

Pop into the IRC channel sometime, there are people in there that know exactly how to get around it. Nothing like a bunch of geeks presented with a challenge.

You should see the fun they have when they get their teeth into a new virus/trojan/keylogger. *giggle*

[edit]For the record, the reason they know how to get around it is because they were deliberately trying to so they could provide the info to Blizz. I know, since I'm the one that forwarded their findings. Not the first time my wonderful geeks have broken stuff so the info can be passed along to Blizz/other game company/virus scanner companies, etc. <3 my geeks.

Vyper · 03-31-09, 10:21 PM

Originally Posted by Cairenn

<3 my geeks.

/sigh.... I wish I was one of Cairenn's geeks.

***Cairenn*** · 03-31-09, 10:39 PM

/me chuckles

DamonDK · 04-02-09, 03:44 AM

While I ofc am glad that there's some white-hat hackers who see every securitymeasure as a challenge and can present the inventors of said measures with ways to improve them, I'm very interested in hearing how it's possible to hack an authenticator?

I would presume the setup is this :
There's a keylogger installed and you have X amount of valid keycodes complete with timestamps.

You then reverse engineer the algorithm (or allready know it because you've bought 2+ authenticators to compare the outputs with their serial number)

So in the end what you're going for is the serial code of the authenticator, since that is the "seed" by which blizz can verify the authenticator codes.

How many keycodes would it take from a keylogged pc to come up with the serial number and thus enable a full working authenticator emulation?

***Cairenn*** · 04-02-09, 03:49 AM

Well it's not like I'm about to post it here, now is it?

DamonDK · 04-02-09, 05:48 AM

I'm not asking for a complete guide on how to do it, and my math/programming skills aren't up to that kind of work anyway.

I'm asking for a ballpark figure here, so I'll use a metaphor :
Is the Authenticator as safe as WEP or WPA2?

WEP can be hacked in less than 5 minutes if you have the software to do so.
WPA2 can be hacked, in theory, but in reality it would take months to compute and try out all the combo's.