Articles and More!: accounts

Showing posts with label accounts. Show all posts

Monday, March 10, 2014

Twitter bug exposed nearly 100k protected accounts to unauthorized users

At Alternate Viewpoint, the privacy of our visitors is of extreme importance to us (See this article to learn more about Privacy Policies.). This privacy policy document outlines the types of personal information is received and collected by Alternate Viewpoint and how it is used.

Log Files

Like many other Web sites, Alternate Viewpoint makes use of log files. The information inside the log files includes internet protocol (IP) addresses, type of browser, Internet Service Provider (ISP), date/time stamp, referring/exit pages, and number of clicks to analyze trends, administer the site, track user"s movement around the site, and gather demographic information. IP addresses, and other such information are not linked to any information that is personally identifiable.

Cookies and Web Beacons

Alternate Viewpoint does use cookies to store information about visitors preferences, record user-specific information on which pages the user access or visit, customize Web page content based on visitors browser type or other information that the visitor sends via their browser.

DoubleClick DART Cookie

Google, as a third party vendor, uses cookies to serve ads on Alternate Viewpoint.

Google"s use of the DART cookie enables it to serve ads to users based on their visit to Alternate Viewpoint and other sites on the Internet.

Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy at the following URL - http://www.google.com/privacy_ads.html.

These third-party ad servers or ad networks use technology to the advertisements and links that appear on Alternate Viewpoint send directly to your browsers. They automatically receive your IP address when this occurs. Other technologies ( such as cookies, JavaScript, or Web Beacons ) may also be used by the third-party ad networks to measure the effectiveness of their advertisements and / or to personalize the advertising content that you see.

Alternate Viewpoint has no access to or control over these cookies that are used by third-party advertisers.

You should consult the respective privacy policies of these third-party ad servers for more detailed information on their practices as well as for instructions about how to opt-out of certain practices. Alternate Viewpoint"s privacy policy does not apply to, and we cannot control the activities of, such other advertisers or web sites.

If you wish to disable cookies, you may do so through your individual browser options. More detailed information about cookie management with specific web browsers can be found at the browser"s respective websites.

Twitter bug exposed nearly 100k protected accounts to unauthorized users

Tuesday, January 7, 2014

Trojan program hijacks World of Warcraft accounts despite two-factor authentication

Trojan program hijacks World of Warcraft accounts despite two-factor authentication
http://pixel.quantserve.com/pixel/p-89EKCgBk8MZdE.gif

IDG News Service – A new Trojan program is targeting users of the popular online role-playing game World of Warcraft and is capable of hijacking
accounts even if their owners use two-factor authentication.

“We’ve been receiving reports regarding a dangerous Trojan that is being used to compromise players’ accounts even if they
are using an authenticator for protection,” a technical support representative from Blizzard Entertainment, the game’s developer,
said Friday in a message on the Battle.net forums. “The Trojan acts in real time to do this by stealing both your account information and the authenticator password at the
time you enter them.”

Battle.net is Blizzard’s online gaming service and the Battle.net Authenticator is a physical token or a mobile application that generates unique codes used as a second factor of authentication in addition
to the user password.

By intercepting Battle.net log-in attempts on infected computers, the Trojan program can capture both the regular user names
and passwords and the unique codes generated by authenticators. Since the latter are essentially one-time passwords that expire
after being used, the legitimate log-in attempts are blocked by the malware, so while victims try to figure out what went
wrong, the captured information is sent to the attackers who can then hijack the accounts.

This is similar to how other Trojan programs allow attackers to defeat two-factor authentication used by Internet banking
sites.

Signs of infection with this new malware include the presence of a program called “Disker” or “Disker64″ in the Windows start-up
list. Users can view this list by generating a MSInfo report using instructions on the Battle.net site and then look under the “Startup Program” section.

In a later update on the Battle.net forum, another Blizzard tech support representative said that the company tracked down the source of infection
to a fake, but working Curse Client distributed from a fake website. The Curse Client is a third-party application that can
be used to install add-ons and modifications for several games including World of Warcraft.

Users who suspect their computers have been infected with this Trojan program were advised to uninstall the Curse Client and
then run a scan with Malwarebytes, an anti-malware tool that has a free version. However, most security products should be
able to detect the Trojan program by now, the Blizzard representative said.

Uninstalling the rogue Curse Client is an important step because the client is actively trying to hide the malware’s presence.

“For those of you interested in these MitM [man-in-the-middle] style attacks, this is the only confirmed case we’ve seen in
several years outside of the ‘Configuring/HIMYM’ trojan in early 2012 that hit a handful of accounts,” the Blizzard representative
said. “These sort of outbreaks are annoying, but an Authenticator still protects your account 99% of the time.”

The IDG News Service is a Network World affiliate.

Netflash