(Copy of mail I just sent to Bugtraq)
Notice of intent to fully disclose
I Reference
Title: Blizzard Authenticator implementation does not secure one's World of Warcraft account from keyloggers
URLs:
Blizzard Product
http://www.blizzard.com/store/details.xml?id=1100000182 (Note: This is the US export controlled version of the Authenticator, Blizzard make available non-US controlled versions through other means [I believe by shipping them through the EU]
http://www.blizzard.com/store/details.xml?id=1100000222)
Original Manufacturer
http://www.vasco.com/products/product.html?product=70II Background
Blizzard Entertainment operate the world's most popular MMORPG, World of Warcraft. They have claimed that they have over 11 million subscribers. It is frequently believed that a World of Warcraft account is worth more on the black market that credit card details, as multiple CC details can be fleeced from unsuspecting people when attempting to 'purchase' accounts. To alleviate this issue, Blizzard implemented Vasco Digipass Go 6.
III Description
Blizzard's implementation of the Digipass Go 6 System offers very minimal increased security for a keylogged computer. Only slight modifications to existing keylogging technology would be required to bypass the security methods. The Authenticator system, as implemented by Blizzard, provides only minimal increased security.
Steps to reproduce:
The steps to reproduce the attack will be revealed Soon(TM)*
IV IMPACT
Successful implementation of the attack will render the Digipass Go 6 as sold and implemented by Blizzard Entertainment as next to worthless.
V PRODUCTS AFFECTED
World of Warcraft, World of Warcraft: The Burning Crusade, World of Warcraft: Wrath of the Lich King.
VI REMEDIATION
There are some foreseeable workarounds that might be possible so that Blizzard Entertainment completely nullifies this attack. The attack's discoverer does not have a full working knowledge of Vasco Digipass Go 6, nor how Blizzard have implemented it, so is unsure whether the proposed workarounds would actually be effective.
VII DISCLOSURE TIMELINE (Times are Australian Eastern, apply Summertime if/when appropriate)
(??) Oct 2008 - The attack's discoverer believes he posted to Blizzard WoW US Customer Support Forum, details of post were removed so that only Blizzard staff could see and forward as appropriate (Blizzard staff can read forum post edit/history, permitting sensitive info to be handed around Blizzard internally). Unfortunately, due to thevolume of his posts and the poor search functionality of the WoW forums, confirming this as fact is very difficult. He does have strong recollections of previous discussion of the issue concerned, although not the detail.
24 Oct 2008 - Informal mention of the issue to Blizzard staff member and indication that it should be addressed
25 Nov 2008 - Post on Blizzard Customer Support Forum by a customer that their account was keylogged despite having an Authenticator
25 Nov 2008 - Formal notification to the official Blizzard Hack support team (hacks@blizzard.com) of the discovered attack method
IX Credit
This attack was discovered by Peter Lawler. bleeter@internode.on.net
Peter is a computer gamer who has formerly worked as a systems integration and security engineer for Federal Hotels/Network Gaming (Australia), as well as for Access Gaming Systems (Australia) where worked in a similar role on site at La Française des Jeux, Westlotto, Holland Casino and Austrian Lotteries [customers of Access Gaming Systems (Europe)]. His current interests are in studying virtual economies and the repercussions of laundering virtual/real world monies.
X Acknowledgements: At this point in time, I acknowledge Nicolas Viot for unwittingly providing me with a template for this notice to disclose. Full acknowledgements will come with Full Disclosure.
* Soon:
http://www.wowwiki.com/Soon