wow WeakAuras Gold Scamming in WoW

[Valks 2,373]

Ever wondered what it would be like to have someone walk up to you, initiate a trade and then have all your gold disappear? This could happen to you right now!

 

The first thing I'd like to say before anything else is that this is NOT a slight on the add-on itself. I love WeakAuras, I use it while raiding and it has made raid leading a million times easier. 

 

However.

 

It looks like there have been cases on live servers of gold scamming via the use of WeakAuras. For those of you that don't know, WeakAuras essentially allows players to write scripts to run commands that the interface within the game allows. It's mainly used to display certain visual effects for raiding and rotation help, such as displaying buffs and debuffs in a more noticeable fashion.

 

As stated on the US forums, it seems that certain players have managed to create a script in-game that can control your trade window. They will link a script, often asking for help with it, and as soon as you run it, your trade window will be under automatic control. If anyone comes to trade you, you will automatically trade all of your gold to that character, without clicking anything. You won't even see the trade window pop up.

 

It seems the author of WeakAuras has come forward, saying that you might not even need to run the script. You might just have to add the script to your WeakAuras and the code will run itself. 

 

The author has acknowledged these problems publicly and has said he is working hard to fix them, but this is at least something for people to know about until it is fixed. I definitely don't think people should stop using the add-on, it's an amazing creation, but I do think players just need to ensure they trust whoever is sending them scripts.
 

You can also find the Reddit thread here.

 

UPDATE: It looks like the problem could actually stem from Blizzard, not the WeakAuras add-on itself. Reddit users thefezhat and Hallgard had this to say:

"In this case someone's found a way to automate trades using the addon API, which absolutely shouldn't be possible - the relevant interface functions should be protected so that only the core game, not addons, can call them. The exploit is Blizzard's fault, Weak Auras is merely the vector for it due to the fact that you can essentially send someone a small addon by sharing an aura."

"This is something that should not be possible through WoW's API. It shouldn't be possible to transfer gold without a dialogue box popping up and manually entering in a number. If it can be automated through a script, then Blizzard needs to prevent scripts from being able to do that."

 

UPDATE 2: Official post on it by Ornyx over on the US forums.

 

Ornyx on WeakAuras

 

Thanks for the information and patience, everyone. We’ve gotten word that an update to WeakAuras will be going out tonight, and should resolve this issue. Until then, we recommend that you disable this AddOn to avoid this issue entirely.

 

We have plans in place to rectify this type of situation in the future by adding an extra step of security for all gold transfers.

 

---

 

We would like to reiterate, once again, that while the use of AddOns is permitted, they are not directly supported by us, and, as such, you should always be wary before downloading anything, or, in this case, importing any script.

 

If you believe you were affected by someone using this method please report it via a ticket to our Customer Service team here: https://us.battle.net/support/en/help/ 

 

In that ticket, please include the realm and name of your character and specify what happened. Our Customer Service team will be able to investigate the matter and take what actions are deemed appropriate. 

 

In the future, please avoid discussing and theorizing about possible exploits on the forums. This can lead to more people getting out there and "testing" the exploit, which can lead to more players being affected. If you encounter a possible exploit, please report it to our hacks team as soon as possible: http://us.blizzard.com/en-us/submit/hacks.html

 

(source)