Blainie

Gold Scam Discovered with No Add-Ons Required!

13 posts in this topic

LYuH3Su.png

That's right. With a vanilla UI, there are players that can steal all of your gold. Scary stuff!

This was first brought to my attention by a Reddit post from user MrNoobyy. His post reads as follows:

Quote

So recently, there's been a guy on my realm spamming trade chat, claiming to be selling 13/13M with loot and mount on behalf of a top guild on our realm. Every guild he impersonates is a guild with an l somewhere in the name, and he actually makes a guild with a captial I instead of a lower case l, which in game, both show up the same.

He tries to get you to run do a /run command, one I won't type out here, with the claim that it's so the raid frames don't get messed up on the custom UI that the raiders use. Knowing better, I of course didn't run the script - but if you do, from what I can tell, it allows the scammer to execute scripts via whisper, that forces you trade away your gold when he trades you. I'm unsure if this requires an addon to work, as when I told him I'd run the script, he told me to try again, but disable all addons first.

Anyway, I reported him, and he's been showing up differing toons throughout the week, impersonating a different guild each time. Someone posted a topic on the forums about it here: http://us.battle.net/wow/en/forum/topic/20745644941?page=1 - and it turns out this scammer is trying this on multiple realms.

Fast forward a week or so. I logged onto my main, and my GM whispered me, "Can you please type '/run blahblahblah', it's to test a guild addon." Obviously the blahblahblah was the script. The very same script this scammer tries to use.

It turns out my GM was being hacked. By the same person? Can't really know. But it gets a little more interesting. One of the people in the guild did as the hacker asked, and is now whispering other people scripts that he can't even see, the same script the scammer and hacker is using, and also a few others.

No idea what's going on. For lack of a better word, it's like...the script infects the users who run it, forcing them to become part of it.

Does anybody know anything about this? I've googled the /run command in question, and saw a reddit post about this, but nothing about this....whatever is happening in my guild right now.

So it looks like this allows a user to force you to trade over your gold through a script. Previously, this was done through the use of add-ons such as WeakAuras, but it seems they now have the ability to do it on a simple, Vanilla UI. Another user, johsko, posted an explanation for how this might be happening:

Quote

Found parts of the script, but not all of it. It works by replacing a global function that gets called (by the vanilla chat frame) whenever a message is received, with a function that runs the message as if it had been written after /run by the receiver. It allows them to remotely script your UI. The piece of code they whisper you after you input the seemingly harmless /run hooks it up to the chat message event, allowing them to hide any script messages. Meaning they can do anything an addon can, but remotely without you knowing it.

A /reloadui should get rid of it, but until that is done they can use your client for whatever they want, as long as it fits in a whisper.

Edit: This is all with the vanilla UI, no addons needed. It would be easy for Blizzard to fix this particular instance, but they won't really be able to protect against scams like this. There's always going to be some other piece of code someone can tell you to input. The best thing they can do is to disable /script and /run as commands until the player opts in through a setting or something, and put a huge warning on the opt-in to not enable it unless they are absolutely sure they want to.

There has been no official response from Blizzard yet, but a forum thread has been started. Hopefully we'll see acknowledgement and a response soon! 

  • Like 1

Share this post


Link to post
Share on other sites

Interesting to see something like this surfacing when the game is 12 years old :p

  • Like 1

Share this post


Link to post
Share on other sites

Agreed, it is interesting, but I believe it is somehow connected to the value that in-game Gold recived (ability to buy game time and black market auction).

Share this post


Link to post
Share on other sites
1 hour ago, Dantalian said:

Agreed, it is interesting, but I believe it is somehow connected to the value that in-game Gold recived (ability to buy game time and black market auction).

Most likely, yeah. Gold is easy to get in WoD for sure, so many people have larger amounts than they had in previous expansions, while it can now be used for game-time for the first time. The value of gold to these people has now gone from just buying mounts and such to actually paying to play the game.

 

Share this post


Link to post
Share on other sites

The whole story is actually pretty spooky, with all that vanilla UI, script writing and infestation stuff. Blizzard, please, react! 

Share this post


Link to post
Share on other sites

I hope players understand what is the risks are of running /script and /run. I personally will never do this until i'm 100% sure this is a valid fix for one of my issues. Don't want to get scammed and lose all my hard earned dollars :P.

I'll keep a close watch to the official forum thread. Really interested.....

Share this post


Link to post
Share on other sites
10 hours ago, Paracel said:

The whole story is actually pretty spooky, with all that vanilla UI, script writing and infestation stuff. Blizzard, please, react! 

Yeah, it's horrible to think that people can do this sort of stuff. Would be nice to see more PSAs from Blizzard on this.

Share this post


Link to post
Share on other sites

So as nice as this sounds in theory a user/addon is unable to accept a trade without a corresponding hardware event. The AcceptTrade() function has been protected from being called outside of hardware events since it's inception. While you could in theory run addon scripts remotely almost all important functions are protected currently. The only method to circumvent this efficiently would be for the remote user to add additional keybinds (possible as SetBinding() is only protected during combat) or to add additional UI elements that could register a click event (implausible with the character restriction on a whisper). 

 

TL;DR: Good on you guys for alerting the community that had missed the original post, but at this time it is implausible that this is being used for what is claimed as the API simply won't allow that. That said there is plenty of damage that can be done with the unprotected functions.

Share this post


Link to post
Share on other sites
4 hours ago, Psifour said:

So as nice as this sounds in theory a user/addon is unable to accept a trade without a corresponding hardware event. The AcceptTrade() function has been protected from being called outside of hardware events since it's inception. While you could in theory run addon scripts remotely almost all important functions are protected currently. The only method to circumvent this efficiently would be for the remote user to add additional keybinds (possible as SetBinding() is only protected during combat) or to add additional UI elements that could register a click event (implausible with the character restriction on a whisper). 

 

TL;DR: Good on you guys for alerting the community that had missed the original post, but at this time it is implausible that this is being used for what is claimed as the API simply won't allow that. That said there is plenty of damage that can be done with the unprotected functions.

Another post from Reddit on how this is happening, in addition to the one above:

Quote

Software developer here.

This actually doesn't involve any addons at all. It is somewhat misleading. What the /run command does is redirect calls to a built-in WoW API function (RemoveExtraSpaces) to another built-in WoW API function (RunScript) instead.

I suspect the attacker discovered that the default UI calls RemoveExtraSpaces on any text received via chat, including whisper. Once you run that initial script anything else they whisper to you is then interpreted as further /run commands so they've rather trivially enabled themselves to remotely execute anything on your client that can be done via /run.

After that point the cryptic bit including CHAT_MSG_ADDON is actually registering itself for an event anytime a new message is received, either locally or remotely. More than likely this is just setting up additional infrastructure to enable him to further take over your client and probably restore your chat in the process while maintaining an extra hidden button to allow him to continue to remotely execute things.

This is why he's asking you to disable your addons because he was thinking that some other addon was actually interfering with his simple RemoveExtraSpaces hack. I'm surprised we've never seen this sort of thing before as it seems quite trivial. Again though, nothing he's doing requires you to have any addons at all as RemoveExtraSpaces and CHAT_MSG_ADDON are both elements of the default WoW API (a function and event respectively).

If this happened to you a good first step to protect yourself would probably be to:

/run RemoveExtraSpaces=nil /run z:UnregisterAllEvents();

Which will undo the hooking of RemoveExtraSpaces to RunScript, and then remove the event handlers for CHAT_MSG_ADDON from the "z" button the attacker created.

 

Share this post


Link to post
Share on other sites
14 hours ago, Klynwe said:

This is scary, but  ive never seen one on Dalaran-EU

I've personally never seen it on my realm either, but it seems there has been a few reports on numerous servers on the forum thread

  • Like 1

Share this post


Link to post
Share on other sites
On 7/8/2016 at 3:26 AM, Klynwe said:

This is scary, but  ive never seen one on Dalaran-EU

Stormrage has seen it.

Today, on the PTR, I tried running a simple /run command that wipes out all action bars at once and the following warning popped up. Seems Blizzard took note to a degree.

Scripts.jpg

  • Like 1

Share this post


Link to post
Share on other sites
18 minutes ago, Sajakain said:

Stormrage has seen it.

Today, on the PTR, I tried running a simple /run command that wipes out all action bars at once and the following warning popped up. Seems Blizzard took note to a degree.

Scripts.jpg

Saw this mentioned in a reddit thread, very happy to see it coming into the game.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now


  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Stan

      Burning Crusade Timewalking returns this week and you can enter Black Temple to gear up your characters! This week's world bosses are Ana-Mouz and Sotanathor. Don't forget to complete the Deepwind Dunk PvP Brawl and all weekly quests associated with the world events.
      Mythic Keystone Affixes
      Bolstering Skittish Fortified Argus Weekly Quests
      Just a reminder! Fuel of a Doomed World and Invasion Onslaught weekly quests reward 1,000 reputation with both Army of the Light and Argussian Reach factions in Patch 7.3.5. Make sure to complete them, because unlocking Lightforged Draenei and Void Elves is gated behind Exalted reputation standing with these factions. You can find more information here. World Bosses (Upcoming World Boss Schedule (Until February 2018)
      Ana-Mouz
      Look for the epic world quest "Ana-Mouz" in Suramar.
      Loot Tables
      Crop Top Chain Hauberk Demonic Birthstone Ring Imp Mother's Loincloth Imp-Eye Diamond Low-Cut Chestplate Sheer Felthreaded Robe Skimpy Demonleather Tunic Vantus Rune Technique: Tichondrius Sotanathor
      Sotanathor is up on Argus and the portal is located in Mac'Aree (44, 50). Argus world bosses drop ilvl 930 loot, so don't forget to bring a Seal of Broken Fate for bonus roll.
      Loot Tables
      Bracers of Diabolic Fury Enthralling Chain Armor Fel-Linked Crushers Gauntlets of Barbaric Cruelty Gloves of Grim Direction Gore-Soaked Legplates Horned Hood of Retaliation Robes of Demonic Purpose Spaulders of Vile Determination Spike of Immortal Command Sotanathor's Thundering Hoof Subjugated Drudge's Leggings Waistguard of Devilish Deeds World Events
      PvP Brawl: Deepwind Dunk (January 23 - 30)
      Complete the weekly quest Something Different to get a Brawler's Footlocker, 3 Marks of Honor and Soldier's Legacy (10 billion Artifact Power @ AK level 55).
      Can you even dunk? If you want to win this brawl, you’re going to need to work on your skills because Dunkball has come to Pandaria. You’ll race to claim balls from the map’s center, or northern, or southern mines, take them to your enemy’s base, and then go for a magnificent long range shot or go all in for the dunk.
      Burning Crusade Timewalking Dungeon Event (January 23 - 30)
      Items obtained from dungeons during Burning Crusade Timewalking have a base item level of 880. Items obtained from Black Temple Timewalking have a base item level of 930. Complete 5 Timewalking dungeons for the weekly quest "A Burning Path Through Time" and get Accolade of Victory (2.5 billion Artifact Power @ Ak level 55), 1 Seal of Broken Fate & Cache of Antoran Treasures that contains a single piece of Normal difficulty Antorus loot. Reins of the Infinite Timereaver has a chance to drop from any dungeon boss as Personal Loot. Black Temple is also available during Timewalking, go to Shattrath (Outland) and talk to Vormu. Demon Hunters can collect the appearances of Illidan's warglaives (Arsenal: The Warglaives of Azzinoth).
      While this event Is active, players level 71 or higher may access a special Timewalking Dungeon Finder queue, which scales players and their items down to revisit past dungeons from The Burning Crusade expansion. While Timewalking, bosses will yield loot appropriate for a player’s regular level. During Burning Crusade Timewalking, you may assemble a raid group of between 10 and 30 players, travel to Shattrath City in Outland, and speak with Vormu to access a Timewalking version of the Black Temple raid.
    • By Stan

      Patch 7.3 introduced a fixed world boss rotation. Now that all bosses were up at least once, we gathered enough data and compiled a table of upcoming world boss spawns and some of their loot you might be interested in.
      Naz'ak the Fiend will be up during the week of January 16. The boss drops Recipe: Potion of Prolonged Power.
      Date* World Bosses Interesting Loot November 28 Humongris / Mistress Alluradel   December 5 Shar'thos / Matron Folnuna Skull of Shar'thos December 12 Flotsam / Sotanathor The Warmace of Shirvallah December 19 Drugon / Inquisitor Meto Vantus Rune Technique: Guarm December 26 Calamir / Pit Lord Vilemus   January 2 Withered J'm / Occularus Unstable Arcanocrystal January 9 Levantus / Mistress Alluradel The Warmace of Shirvalla January 16 Naz'ak the Fiend / Matron Folnuna Recipe: Potion of Prolonged Power January 23 Ana-Mouz / Sotanathor Vantus Rune Technique: Tichondrius January 30 Nithogg / Inquisitor Meto Skull of Nithogg February 6 The Soultakers / Pit Lord Vilemus Runes of the Darkening February 13 Humongris / Occularus   February 20 Shar'thos / Mistress Alluradel Skull of Shar'thos February 27 Flotsam / Matron Folnuna The Warmace of Shirvallah *For EU add one day to the dates above
    • By Starym

       
      Today's hotfixes bring a bunch of class and dungeon bug clearing, Uuna fixes, some old quest fixes and more...well, fixes!
      January 22 (source)
      Achievements
      The consolidated Algalon achievement Observed should now properly grant both the “Starcaller” and “Astral Walker” titles. Characters
      Addressed a graphical error with characters who have markings such as tattoos. Uuna will now react to her surroundings when taken to Suramar, for both Horde and Alliance characters. Classes
      Demon Hunter Fixed an issue where Fel Eruption would not deal damage to stun-immune targets. Rage of the Illidari again correctly deals damage. Mage Frost Mages can again obtain their Frostfire Remembrance artifact appearance. Shaman Artifact traits and other effects that increase all of your healing correctly benefit Healing Stream Totem and Healing Tide Totem. Warlock Haunt will no longer incorrectly reset its cooldown when used against certain creatures with scaling health. Warrior Fixed a bug that prevented Warriors who have completed two Artifact acquisitions from starting “One More Legend” to obtain their third Artifact. Dungeons and Raids
      Deepholm Fixed a bug where Aeonaxx would fail to drop loot. Return to Karazhan Attumen should once again properly respect tank threat for his Mounted Strike and Stamp attacks while astride Midnight. Shadowfang Keep Some enemies will now properly benefit from damage scaling when attacked by high-level players, in Normal difficulty. Vault of the Wardens Fel Furies that spawn in the Mythic Tirathon Saltheril encounter will no longer evade. Mounts and Pets
      Fixed a bug that caused custom pet names to sometimes partially disappear. Mailing the Vicious War Fox will no longer cause it to become the other faction's War Fox. Professions
      Skinning Noxious Whelps can again be skinned for Green Whelp Scales. Quests
      The Dragonblight quest "An End And A Beginning" can now be completed normally. The Huge Boulder for the Redridge quest "Saving Foreman Oslow" has been returned. Previous patch 7.3.5 hotfixes:
      January 17
    • By Stan

      The XP boost from RaF has been reduced from 200% bonus to 50%. Heirloom gear XP bonuses will no longer stack with the RaF XP boost, effective today, January 22, 2018. Ongoing RaF participations remain unaffected for up to 90 days.
      With dynamic leveling in Patch 7.3.5, Blizzard came to a conclusion that the existing RaF program did not provide the best experience and as a result, they decided to nerf the XP bonus from RaF down to 50%. The leveling rate is now under a third of what it was before the changes.
      Blizzard (Source)
      In Patch 7.3.5, we made significant changes to the level 1–100 experience to ensure players can better enjoy the stories, quest lines, and zones they want to at their own pace. Because of this, we are adjusting the XP bonus on the Recruit-A-Friend (RAF) program to ensure it reflects the updated pacing of the game as new players level their characters and explore Azeroth.
      DYNAMIC LEVELING IN PATCH 7.3.5
      As you may have heard, Patch 7.3.5 significantly overhauled the level-up experience in World of Warcraft so that zones from 1–100 will dynamically scale to your character’s level. Why? Over the years, we’ve made multiple changes to adjust the leveling curve—and as a result, the pace of characters’ progress has become significantly out of sync with the content. Players often out-level areas long before they’ve had a chance to complete key stories and quest lines, leading to a less-than-ideal experience.
      With this significant update to pacing, the existing Recruit-A-Friend program would no longer provide the best experience for players new to World of Warcraft. Even with scaling zones, triple-speed leveling would mean new players going into dungeons could find themselves overwhelmed by multiple new abilities gained over the course of a single instance run, and might still outpace storylines that help the world make sense and make players feel like they’re part of it—and we want new players to feel at home in Azeroth.
      To align the Recruit-A-Friend XP bonus with the upcoming leveling changes, we have reduced the XP boost gained from the Recruit-A-Friend program when playing with a linked friend down from 200% (300% XP vs. base XP) to 50%* (150% XP vs. base XP). We are making these changes to ensure the XP boost doesn’t upset game balance and undermine the experience, while still giving a significant XP bonus to you and a friend as a thank-you for being part of the Recruit-A-Friend program.
      RECRUIT-A-FRIEND CHANGES IN FULL
      The XP boost has been reduced from 200% bonus to 50% bonus*, effective today, January 22, 2018. If you’re already actively participating in the program, fear not! If you either sent or received an invite before the change went into effect today, once the invite is accepted you and your friend will still receive triple XP* (200% XP bonus) until the link between your accounts expires (90 days from the date the new recruit’s account was first created). Please note: RAF invites expire after seven days. Heirloom gear XP bonuses will no longer stack with the RAF boost (i.e., the maximum XP boost you will see from today onwards is 50%). If you were already on the program, Heirloom gear will still stack. All other rewards are unchanged and yours to enjoy: Summon your friend once every 30 minutes. 10% bonus reputation from kills that grant reputation.* Level granting: for every two levels your friend gains while the accounts are linked, they can grant one level to one of your characters. Recruiter rewards, including game time and epic mounts. *For a full list of the rewards and the in-game criteria for receiving them, visit our RAF In-Game Bonuses page.
    • By joat
      Who We Are
      Tequila Sundown is a growing raid team formed within the <Karma Horde> guild on US-Stormreaver. Lead by a husband/wife team with high-level raiding experience dating back to WotLK, we're a "positively determined" progression team that maintains a light-hearted atmosphere while tackling mythic difficulty content. We're mature adults with jobs and family seeking like-minded players who have a passion for the game but want to avoid the needless angst or drama that often gets associated with progression raiding. We log on to have fun - so come have some fun with us!

      A Team Within a Community
      Our raid team is one of four within the larger guild of <Karma Horde>, which was formed back during WotLK. As such, the guild and Discord are very active and social. There are always people around online and in-game. The community atmosphere is welcoming and friendly to players of all levels. The guild enforces a Code of Conduct that has zero tolerance for hate/offensive speech.

      We care more about the people we play with than their item levels or progression rankings. We want players who are going to log in on non-raid nights and be down for all the other things we're into: pushing mythic+, doing world quests, PVP shenanigans, achievement hunting, hyper-competitive fishing.. there's so much to do and so many ways to enjoy the game. This is our favorite hobby and we'd like to play with you if it is yours, too.

      Progression Goals
      We are 1/11 Mythic, Heroic AOTC Antorus progression.
      We strive for a fun environment that takes the challenges of mythic seriously and giving the content the respect it deserves. Our aim is, as all mythic teams, full clear of content but with always keeping the friendly spirit of camaraderie alive. Performance matters, but so does staying positive and finding the fun in the difficulty of a raid.
      We do not require mythic raid experience to join our team but we do expect mythic-level dedication and accountability from all of our raiders.

      Raid Days/Times
      Our mandatory raids are:
      Tuesdays 8:45pm PT - 11:45pm PT
      Thursdays 8:45pm PT - 11:45pm PT
      Optional:
      Sundays 8:45pm PT - 11:45pm PT
      Sundays are for raiding the previous raid difficulty.

      Recruitment Needs
      DPS: Will consider all specs, but would love to add a Shadow Priest, Rogue, and Mage.

      The Nitty Gritty
      If you're intrigued, please check out our wiki on the <Karma Horde> subreddit. This will give you a deeper dive into the raid team.
      https://www.reddit.com/r/FTH/wiki/tequilasundown

      Contact Us
      You can reach us on bnet: joat#1832 & lambkill#1856
      or Discord: joat#6049 & saever#4432