Blainie

wow Gold Scam Discovered with No Add-Ons Required!

13 posts in this topic

LYuH3Su.png

That's right. With a vanilla UI, there are players that can steal all of your gold. Scary stuff!

This was first brought to my attention by a Reddit post from user MrNoobyy. His post reads as follows:

Quote

So recently, there's been a guy on my realm spamming trade chat, claiming to be selling 13/13M with loot and mount on behalf of a top guild on our realm. Every guild he impersonates is a guild with an l somewhere in the name, and he actually makes a guild with a captial I instead of a lower case l, which in game, both show up the same.

He tries to get you to run do a /run command, one I won't type out here, with the claim that it's so the raid frames don't get messed up on the custom UI that the raiders use. Knowing better, I of course didn't run the script - but if you do, from what I can tell, it allows the scammer to execute scripts via whisper, that forces you trade away your gold when he trades you. I'm unsure if this requires an addon to work, as when I told him I'd run the script, he told me to try again, but disable all addons first.

Anyway, I reported him, and he's been showing up differing toons throughout the week, impersonating a different guild each time. Someone posted a topic on the forums about it here: http://us.battle.net/wow/en/forum/topic/20745644941?page=1 - and it turns out this scammer is trying this on multiple realms.

Fast forward a week or so. I logged onto my main, and my GM whispered me, "Can you please type '/run blahblahblah', it's to test a guild addon." Obviously the blahblahblah was the script. The very same script this scammer tries to use.

It turns out my GM was being hacked. By the same person? Can't really know. But it gets a little more interesting. One of the people in the guild did as the hacker asked, and is now whispering other people scripts that he can't even see, the same script the scammer and hacker is using, and also a few others.

No idea what's going on. For lack of a better word, it's like...the script infects the users who run it, forcing them to become part of it.

Does anybody know anything about this? I've googled the /run command in question, and saw a reddit post about this, but nothing about this....whatever is happening in my guild right now.

So it looks like this allows a user to force you to trade over your gold through a script. Previously, this was done through the use of add-ons such as WeakAuras, but it seems they now have the ability to do it on a simple, Vanilla UI. Another user, johsko, posted an explanation for how this might be happening:

Quote

Found parts of the script, but not all of it. It works by replacing a global function that gets called (by the vanilla chat frame) whenever a message is received, with a function that runs the message as if it had been written after /run by the receiver. It allows them to remotely script your UI. The piece of code they whisper you after you input the seemingly harmless /run hooks it up to the chat message event, allowing them to hide any script messages. Meaning they can do anything an addon can, but remotely without you knowing it.

A /reloadui should get rid of it, but until that is done they can use your client for whatever they want, as long as it fits in a whisper.

Edit: This is all with the vanilla UI, no addons needed. It would be easy for Blizzard to fix this particular instance, but they won't really be able to protect against scams like this. There's always going to be some other piece of code someone can tell you to input. The best thing they can do is to disable /script and /run as commands until the player opts in through a setting or something, and put a huge warning on the opt-in to not enable it unless they are absolutely sure they want to.

There has been no official response from Blizzard yet, but a forum thread has been started. Hopefully we'll see acknowledgement and a response soon! 

1 person likes this

Share this post


Link to post
Share on other sites

Interesting to see something like this surfacing when the game is 12 years old :p

1 person likes this

Share this post


Link to post
Share on other sites

Agreed, it is interesting, but I believe it is somehow connected to the value that in-game Gold recived (ability to buy game time and black market auction).

Share this post


Link to post
Share on other sites
1 hour ago, Dantalian said:

Agreed, it is interesting, but I believe it is somehow connected to the value that in-game Gold recived (ability to buy game time and black market auction).

Most likely, yeah. Gold is easy to get in WoD for sure, so many people have larger amounts than they had in previous expansions, while it can now be used for game-time for the first time. The value of gold to these people has now gone from just buying mounts and such to actually paying to play the game.

 

Share this post


Link to post
Share on other sites

The whole story is actually pretty spooky, with all that vanilla UI, script writing and infestation stuff. Blizzard, please, react! 

Share this post


Link to post
Share on other sites

I hope players understand what is the risks are of running /script and /run. I personally will never do this until i'm 100% sure this is a valid fix for one of my issues. Don't want to get scammed and lose all my hard earned dollars :P.

I'll keep a close watch to the official forum thread. Really interested.....

Share this post


Link to post
Share on other sites
10 hours ago, Paracel said:

The whole story is actually pretty spooky, with all that vanilla UI, script writing and infestation stuff. Blizzard, please, react! 

Yeah, it's horrible to think that people can do this sort of stuff. Would be nice to see more PSAs from Blizzard on this.

Share this post


Link to post
Share on other sites

So as nice as this sounds in theory a user/addon is unable to accept a trade without a corresponding hardware event. The AcceptTrade() function has been protected from being called outside of hardware events since it's inception. While you could in theory run addon scripts remotely almost all important functions are protected currently. The only method to circumvent this efficiently would be for the remote user to add additional keybinds (possible as SetBinding() is only protected during combat) or to add additional UI elements that could register a click event (implausible with the character restriction on a whisper). 

 

TL;DR: Good on you guys for alerting the community that had missed the original post, but at this time it is implausible that this is being used for what is claimed as the API simply won't allow that. That said there is plenty of damage that can be done with the unprotected functions.

Share this post


Link to post
Share on other sites
4 hours ago, Psifour said:

So as nice as this sounds in theory a user/addon is unable to accept a trade without a corresponding hardware event. The AcceptTrade() function has been protected from being called outside of hardware events since it's inception. While you could in theory run addon scripts remotely almost all important functions are protected currently. The only method to circumvent this efficiently would be for the remote user to add additional keybinds (possible as SetBinding() is only protected during combat) or to add additional UI elements that could register a click event (implausible with the character restriction on a whisper). 

 

TL;DR: Good on you guys for alerting the community that had missed the original post, but at this time it is implausible that this is being used for what is claimed as the API simply won't allow that. That said there is plenty of damage that can be done with the unprotected functions.

Another post from Reddit on how this is happening, in addition to the one above:

Quote

Software developer here.

This actually doesn't involve any addons at all. It is somewhat misleading. What the /run command does is redirect calls to a built-in WoW API function (RemoveExtraSpaces) to another built-in WoW API function (RunScript) instead.

I suspect the attacker discovered that the default UI calls RemoveExtraSpaces on any text received via chat, including whisper. Once you run that initial script anything else they whisper to you is then interpreted as further /run commands so they've rather trivially enabled themselves to remotely execute anything on your client that can be done via /run.

After that point the cryptic bit including CHAT_MSG_ADDON is actually registering itself for an event anytime a new message is received, either locally or remotely. More than likely this is just setting up additional infrastructure to enable him to further take over your client and probably restore your chat in the process while maintaining an extra hidden button to allow him to continue to remotely execute things.

This is why he's asking you to disable your addons because he was thinking that some other addon was actually interfering with his simple RemoveExtraSpaces hack. I'm surprised we've never seen this sort of thing before as it seems quite trivial. Again though, nothing he's doing requires you to have any addons at all as RemoveExtraSpaces and CHAT_MSG_ADDON are both elements of the default WoW API (a function and event respectively).

If this happened to you a good first step to protect yourself would probably be to:

/run RemoveExtraSpaces=nil /run z:UnregisterAllEvents();

Which will undo the hooking of RemoveExtraSpaces to RunScript, and then remove the event handlers for CHAT_MSG_ADDON from the "z" button the attacker created.

 

Share this post


Link to post
Share on other sites

This is scary, but  ive never seen one on Dalaran-EU

1 person likes this

Share this post


Link to post
Share on other sites
14 hours ago, Klynwe said:

This is scary, but  ive never seen one on Dalaran-EU

I've personally never seen it on my realm either, but it seems there has been a few reports on numerous servers on the forum thread

1 person likes this

Share this post


Link to post
Share on other sites
On 7/8/2016 at 3:26 AM, Klynwe said:

This is scary, but  ive never seen one on Dalaran-EU

Stormrage has seen it.

Today, on the PTR, I tried running a simple /run command that wipes out all action bars at once and the following warning popped up. Seems Blizzard took note to a degree.

Scripts.jpg

1 person likes this

Share this post


Link to post
Share on other sites
18 minutes ago, Sajakain said:

Stormrage has seen it.

Today, on the PTR, I tried running a simple /run command that wipes out all action bars at once and the following warning popped up. Seems Blizzard took note to a degree.

Scripts.jpg

Saw this mentioned in a reddit thread, very happy to see it coming into the game.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.

  • Similar Content

    • By Stan

      A new build of Patch 7.2 went live yesterday and we've published initial dev notes here. In this article, we're taking a look at the most notable additions of Build 23657, such as items, achievements, pets & mounts and the new Artifact Knowledge scaling.
      Achievements
      Mythic: Kil'jaeden now awards "the Darkener" title Every class got a new achievement for finishing their class campaign - Destiny of the Illidari, The Eternal Dream etc. Artifacts
      The 7.2 "infinite trait" Concordance of the Legionfall now increases Versatility for tanks. Artifact Knowledge
      We've covered initial changes in highlights of the previous build AK was increased up to level 50 New compendiums were added. They're working up to AK level 45 -  Artifact Research Compendium: Volumes I-IX Artifact Knowledge Scaling
      Now that the AK cap's increased to 50, multipliers have changed again.
      Artifact Knowledge Level New Value 26 100,000% 27 130,000% 28 170,000% 29 220,000% 30 290,000% 31 380,000% 32 490,000% 33 640,000% 34 830,000% 35 1,080,000% 36 1,400,000% 37 1,820,000% 38 2,370,000% 39 3,080,000% 40 4,000,000% 41 5,200,000% 42 6,760,000% 43 8,790,000% 44 11,430,000% 45 14,860,000% 46 19,320,000% 47 25,120,000% 48 32,660,000% 49 42,460,000% 50 55,200,000% Items
      Many Legionfall items were updated with reputation requirements Legionfall Banner, Cauterizing Void Shard available at Honored Repurposed Fel Focuser, Legion Pocket Portal available at Revered Legion Invasion Simulator, Legionfall Tabard available at Exalted Relinquished Relic was added You can purchase epic Relinquished items for 2,000 Nethershards. Pricing may change at any time during testing Weaker versions of Relinquished items carrying the "Dauntless" prefix, e.g. Demonbane Hood can be purchased for 1,000 Nethershards New mage toys - Akazamzarak's Spare Hat, Magical Saucer Reputation Paragon reward from the Warden's cache is Sira's Extra Cloak Orphaned Felbat was added as a new battle pet in this build. New Mount
      Riddler's Mind-Worm has been added to the game. It uses the same model as Abyss Worm from Mistress Sassz'ine and the Mount Journal says its a drop from Gift of the Mind-Seekers (something related to the Tomb of Sargeras).
      New Pets
      Hunters will be able to tame (Tome of the PTR Beast) new Wolfhawk pets that perfectly match their Class Mount.
      Class Mount Updates
      Archmage's Prismatic Disc received an update with more visuals for all three tints.
      Farseer's Raging Tempest got a new flying animation, /mountspecial and the Restoration version has been improved.
    • By Stan

      Darkmoon Faire, Mists of Pandaria Timewalking, several bonus events and Patch 7.2 testing on PTR await this month in WoW. 
      Blizzard published an official preview of events in the month of March. Mists of Pandaria Timewalking will be up for the first time ever. Darkmoon Faire, opening of the last LFR Wing with Gul'dan and many more details for this week can be found here.
      Blizzard (Source)
      The month of March is upon us, and the first breath of Spring is blowing across Azeroth. It smells faintly of fel, so we don’t advise breathing too deeply. There is much to see and do this month as we continue our battle against the Burning Legion. Read on to learn more.
      In-Game Events
      Nighthold Raid Finder Wing 4 Opens: March 8
      The fourth and final wing of the Nighthold raid opens in Raid Finder on March 7—get ready to  face Gul’dan within the Font of Night. Learn more about the Nighthold in our raid preview.
      Darkmoon Faire: March 5–March 11
      The Darkmoon Faire is open for business once more! Meet Silas Darkmoon and his troupe, play games that test mind and the nerve, and behold exotic sights from the four corners of Azeroth . . . and beyond!
      Timewalking: Mists of Pandaria: March 8–March 14
      While this event is active, players level 91 or higher may access a special Timewalking Dungeon Finder queue, which scales players and their items down to revisit past dungeons from the Mists of Pandaria expansion. While Timewalking, bosses will yield loot appropriate for a player’s regular level.
      Battleground Bonus Event: March 15–March 21
      While this event is active, random Battlegrounds will award Honor at an increased rate. Glory awaits on the fields of battle!
      Legion Dungeon Event: March 22–March 28
      While this event is active, the final boss of each Legion dungeon awards an extra item when defeated.
      Pet Battle Bonus Event: March 29–April 4
      While this event is active, your pets will earn experience at triple the usual rate. Get out there and battle!
      Eye on Archaeology
      Every two weeks, a new Archaeology quest in the Broken Isles is available from Archaeology trainer Dariness the Learned in Dalaran. These quests offer a wide variety of rewards, including gold, toys, and mounts—and who doesn’t want a ghost moose mount? You’ll just need to do a little digging for them.
      Obtain eight rare archaeological finds and you can earn the achievement This Side Up, which rewards a new Artifact appearance.
      Unleashed Monstrosities
      Each week, one of 11 different world bosses appears on the Broken Isles. Killing eight of these will reward the Unleashed Monstrosities achievement. Just open the Group Finder (default “I”) and search for a group within the Premade Groups (Raids – Legion); with a little time and persistence, you’re bound to slay them all.
      Did You Know?
      You can travel between major locations within Azeroth, Outland, and Draenor in many different ways. Beyond using flight paths, boats, and zeppelins, you can also use portals found in several locations. These portals become available depending on your level and the areas you’ve begun adventuring in.
      Setting your Hearthstone in a city that has access to multiple other locations via these portals will often save you travel time. Dalaran, for example, has portals available to both Alliance (Stormwind, Ironforge, Darnassus, and the Exodar) and Horde (Orgrimmar, Undercity, Thunder Bluff, and Silvermoon) capital cities as well as portals to the Vale of Eternal Blossoms in Pandaria.
      Mages also have access to portals that they can use for themselves or to open for others in their group to use. If you do manage to procure the services of one, make sure to tip generously or you may end up going somewhere unexpected.
      It’s the Little Things
      Azeroth is filled with opportunities to engage in a little whimsy. One of these is right within Thunder Totem in High Mountain. You’ll need to make sure your sound is on then head down into the Hall of Chieftains. Once there, stand near Mayla Highmountain and . . . jump.  Each time you jump, you’ll “bang” the drum that’s right beneath your feet and hear it reverberate in the hall.  Make up your own rhythm and enjoy the moment before heading back into battle.
      Getting to Know the World of Warcraft Official Site
      The new World of Warcraft site has been out for almost a year, and we’ve been adding more features since its launch to help you stay at the top of your game. Whether your goal is being competitive in Mythic Keystone dungeons or topping the Player vs. Player leaderboards, we can show you just where you rank. Visit each at the links below and make sure to bookmark them so you can return often.
      Mythic Keystone Leaderboards Player vs. Player Leaderboards Current Promotions & New Releases
      Earn a New Mount—For Azeroth!
      There’s still time to earn a new mount—For Azeroth! Beginning February 14 and running through March 13, players can join together with friends for the quest “For Azeroth!” in Heroes of the Storm to earn the new Primal Flamesaber mount in World of Warcraft. Learn more in our blog.
      World of Warcraft: Chronicle Volume 2 Available March 14 in English
      Good news, lorekeepers—World of Warcraft: Chronicle Volume 2 is nearly here! This second volume will reveal more intricate details about the game universe’s history and mythology. Showcasing lush, all-new artwork from artists such as Peter Lee, Joseph Lacroix, and Alex Horley, there’s something to discover for all players—casual and collectors alike.
      You can preorder from your favorite retailers or purchase your copy soon from the Blizzard Gear Store on March 14. Don’t have Volume 1 yet? Purchase yours now so that you are prepared!
      Patch 7.2: The Tomb of Sargeras on the PTR
      Patch 7.2: The Tomb of Sargeras is currently in testing on the Public Test Realm, and you're invited to join us! Visit the World of Warcraft PTR Discussion, Bug Report, and Class Development USA forums to learn more about the ongoing development of the patch.
      To stay on top of the latest official World of Warcraft news, follow us on:
      Twitter: Warcraft, WarcraftDevs, and BlizzardCS Facebook YouTube
    • By Starym

       
      It's Mythic time for three days this and next week over on the PTR, as Tomb of Sargeras bosses get tested on the highest difficulty. We'll be seeing all but the final boss show up, as is tradition (as Gul'dan also wasn't tested on Mythic), so no Kil'jaeden, but the Fallen Avatar is plenty exciting and will be saved for last. There will also be some LFR action over the weekend.
      Kaivax (source)
      On Thursday, Friday, and Monday, March 2-6, we will be conducting raid testing of Tomb of Sargeras bosses on MYTHIC difficulty
      Remember that Mythic difficulty requires 20 players..
      Thursday, March 2
      Goroth - Mythic Tomb of Sargeras
      11:00 PST (14:00 EST, 20:00 CET)
      Demonic Inquisition - Mythic Tomb of Sargeras
      13:00 PST (16:00 EST, 22:00 CET)
      Harjatan - Mythic Tomb of Sargeras
      14:00 PST (17:00 EST, 23:00 CET)
      Friday, March 3
      Sisters of the Moon - Mythic Tomb of Sargeras
      11:00 PST (14:00 EST, 20:00 CET)
      The Desolate Host - Mythic Tomb of Sargeras
      13:00 PST (16:00 EST, 22:00 CET)
      Mistress Sassz’ine - Mythic Tomb of Sargeras
      14:00 PST (17:00 EST, 23:00 CET)
      Monday, March 6
      Maiden of Vigilance - Mythic Tomb of Sargeras
      13:00 PST (16:00 EST, 22:00 CET)
      Fallen Avatar - Mythic Tomb of Sargeras
      14:00 PST (17:00 EST, 23:00 CET)
      After testing concludes on Friday, we plan to open Raid Finder Tomb of Sargeras over the weekend.
      As always, this testing schedule is very fluid and subject to the realities of a PTR environment. We might have to change the time of a testing session, change the bosses being tested, or cancel a test entirely, due to bugs, server hardware issues, etc. Keep an eye on this forum for the latest information, and thank you in advance for testing and providing feedback.
      Q: How do I get into the raid zone?
      A: In Dalaran, Orgrimmar, or Stormwind, you may speak to Nexus-Lord Donjon Rade Sr. in order to teleport into the raid zone while it is open for testing. (The option to teleport into a zone will not be available when the zone is not open for testing.)
      Q: What character should I use to test the raid?
      A: Whichever you prefer. We will be scaling players' effective level to 110 for raid testing, and their item level to an appropriate threshold for the encounter(s) being tested. For 7.2 raid testing, we'll be granting players all the new 7.2 artifact traits IF players have done the quest to reveal those new traits. Complete the Broken Shore intro experience in order to access this quest.
      Q: How long does testing last?
      A: The primary purpose of testing is to give us the information we need to balance the encounters, evaluate how mechanics are playing out in practice, and identify bugs. Once we're satisfied that we've received that information for a given boss, we'll be shutting down testing. Usually this takes anywhere from 45 minutes to 2 hours, but there are no guarantees.
      Header art by Dmitry Vernygor.
    • By Babblet
      Location: Horde – US Connected Realms: The Venture Co - Maelstrom - Lightninghoof
      About us:
      Converge has been around since WoW Vanilla and has been raiding together since Molten Core; most of our members have been playing together for years. In its older days, when most of us where young, we were more raid focused and demanded a lot from our members. Over the years we had to adjust our playtime and priorities with a growing list of RL responsibilities and are now, for all intents and purposes, a two day raiding guild. We had to cut our total hours spent playing WoW but we still remain just as competitive and result oriented.
      Mandatory reading.
      Basics: ilvl 885+; 40+ points in MS Artifact Weapon; DMG Dealers 400k+ DPS ST.
      Raiding 101: ability to execute/avoid fight mechanics; communicate in English and use a microphone.
      We raid twice a week, a total of 8 hours; attendance of 90% is mandatory. We require you to function at 100% from the second the raid starts all the way to its end; if you cannot commit to a raiding schedule and be online on time this is not a guild for you.
      GRepairs and flasks are provided by GBank; members pitch in mats and/or gold to help out. Guilds preparedness to raid and supply its members with enchants/etc is a team effort. If you are accepted as a member be prepared to do your part.
      Raid Times: 8:00 PM – 12:00 AM Eastern Time – Monday/Tuesday.
      Recruitment: Currently we are only accepting Ranged DPS / Heals.
       
      Legion Progression:
      EN 7/7 Normal - 7/7 Heroic
      ToV 3/3 Normal - 3/3 Heroic
      NH 10/10 Normal - 9/10 Heroic
       
      Contacts:
      Battle.net BTag: Sodium#11394
    • By Stan

      Two Death Knight pets receive HD models in Patch 7.2.
      Unholy Death Knight rejoice! The ghoul (Raise Dead) and abomination (Sludge Belcher) are getting visual updates in the forthcoming patch. It's time to say goodbye to the old low resolution models!