Incident: Malware Disguised as Cheating Add-ons Target Hearthstone Players.

Published Date: 2016-02-10

Postmortem Analysis
Timeline 1. The software failure incident mentioned in the article happened in December [40737]. Therefore, the estimated timeline for the software failure incident is December 2015.
System 1. Hearthstone cheating add-ons 2. Hearthstone Hack Tool v2.1 3. Trojan.Coinbitclip 4. Hearthstone Tracker 5. Backdoor.Breut 6. Glider
Responsible Organization 1. Cybercriminals disguising malware as cheating add-ons for Blizzard's Hearthstone game were responsible for causing the software failure incident [40737].
Impacted Organization 1. Players of Blizzard's collectible card game Hearthstone were impacted by the software failure incident reported in Article 40737. The malware disguised as cheating add-ons targeted players by stealing passwords, spying through webcams, mining bitcoin using victims' computers, and attempting to steal cryptocurrency by overwriting bitcoin addresses [40737].
Software Causes 1. Malware disguised as cheating add-ons for Blizzard's Hearthstone game, designed to steal passwords, spy through webcams, and mine bitcoin [40737]. 2. False promises made by malicious apps, such as the "Hearthstone Hack Tool v2.1", claiming to hack Blizzard's servers and provide unlimited in-game resources [40737]. 3. Malware like Trojan.Coinbitclip pretending to be a hacking tool but actually overwriting bitcoin addresses to steal cryptocurrency from users [40737]. 4. Malware disguising itself as legitimate add-ons like Hearthstone Deck Tracker, which can open back doors, record from webcams, log keystrokes, and steal passwords [40737].
Non-software Causes 1. The actions of cybercriminals disguising malware as cheating add-ons for a popular game like Hearthstone [40737]. 2. The use of deceptive tactics by malware developers to entice users into downloading malicious software by making false promises of game advantages [40737]. 3. The existence of fringe-legal add-ons like deck trackers, which although banned by Blizzard, are still used by players, creating an opportunity for malware to disguise itself as legitimate software [40737].
Impacts 1. The software failure incident led to cybercriminals disguising malware as cheating add-ons for Blizzard's game Hearthstone, potentially leading to the theft of passwords, spying through webcams, and even mining bitcoin using victims' computers [40737]. 2. Malicious apps like "Hearthstone Hack Tool v2.1" made false promises of hacking Blizzard's servers and providing unlimited in-game resources, deceiving users and potentially exposing them to security risks [40737]. 3. Some malware, such as Trojan.Coinbitclip, pretended to be a game-hacking tool but actually attempted to steal cryptocurrency from users by overwriting bitcoin addresses with its own, highlighting the financial risks associated with such software failures [40737]. 4. Even seemingly harmless apps like deck trackers were targeted by malware, with attackers disguising malicious software as legitimate add-ons, potentially leading to unauthorized access to users' webcams, keylogging, and password theft [40737]. 5. The incident created a scenario where users, in search of cheating tools or add-ons, were forced to rely on unproven software, making them vulnerable to malware authors looking to exploit the situation, thereby increasing the overall cybersecurity risks for users [40737].
Preventions 1. Educating users about the risks of downloading and using unauthorized software add-ons or tools for games like Hearthstone could have prevented the incident [40737]. 2. Implementing stricter security measures within the game itself to detect and prevent unauthorized software from interacting with the game client could have helped prevent such malware attacks [40737]. 3. Conducting regular security audits and checks on popular fringe-legal add-ons like deck trackers to ensure they are not being used as a disguise for malware could have been a preventive measure [40737].
Fixes 1. Educating users about the risks of downloading and using unauthorized software add-ons or cheats for games like Hearthstone could help prevent such incidents [40737]. 2. Implementing stricter security measures within the game itself to detect and prevent unauthorized software from interacting with the game client could mitigate the impact of malware disguised as game add-ons [40737]. 3. Conducting regular security audits and scans to detect and remove any malicious software posing as legitimate game add-ons could help protect users from falling victim to such scams [40737].
References 1. Security researchers Symantec [40737]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to cheating add-ons for Blizzard's game Hearthstone is an example of a similar incident happening again within the same organization. In the past, Blizzard has faced issues with cheating tools for its games, such as the famous lawsuit against the makers of Glider, a cheating tool for World of Warcraft [40737]. This indicates a pattern of software failure incidents related to cheating add-ons within Blizzard's products and services. (b) The incident involving malware disguised as cheating add-ons for Hearthstone is not limited to Blizzard alone. The article mentions that cybercriminals are disguising malware as cheating add-ons for Blizzard's game, indicating that similar incidents may have occurred with other organizations or their products and services as well [40737]. This suggests that the issue of malware disguised as gaming cheats is not exclusive to Blizzard but may be a broader trend affecting multiple organizations in the gaming industry.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase is evident in the article. Security researchers Symantec discovered malware disguised as cheating add-ons for Blizzard's game, Hearthstone. The malware, such as "Hearthstone Hack Tool v2.1" and Trojan.Coinbitclip, claimed to provide unfair advantages in the game by hacking servers or generating resources. However, these claims were false, and the applications were designed to steal passwords, mine bitcoin, or overwrite bitcoin addresses to steal cryptocurrency from users. This indicates a failure in the design of these malicious software tools, as they were created with deceptive intentions and harmful functionalities [40737]. (b) The software failure incident related to the operation phase is also highlighted in the article. Users were tempted to download these cheating add-ons or tools that promised to enhance their gameplay experience in Hearthstone. However, these tools were actually malware in disguise, capable of spying through webcams, recording keystrokes, and stealing passwords. The misuse of these tools by unsuspecting users led to their systems being compromised, showcasing a failure in the operation or usage of the software [40737].
Boundary (Internal/External) within_system (a) within_system: The software failure incident described in the article is primarily due to factors originating from within the system. The incident involves malware disguised as cheating add-ons for the Hearthstone game, such as "Hearthstone Hack Tool v2.1" and "Hearthstone Deck Tracker.exe" [40737]. These malicious software tools are designed to deceive users by promising benefits like unlimited in-game resources or deck tracking capabilities while actually stealing passwords, spying through webcams, mining bitcoin, or overwriting bitcoin addresses to steal cryptocurrency. The failure lies within the deceptive nature and malicious intent of these software tools, which are part of the Hearthstone gaming ecosystem. (b) outside_system: The software failure incident does not involve contributing factors originating from outside the system. The malware described in the article operates within the context of the Hearthstone game environment, targeting users who seek to gain advantages through cheating add-ons. The external factors mentioned in the article, such as legal actions taken by Blizzard against cheating tools like Glider in the past, serve as a background to the overall insecurity and risks associated with using unverified software within the gaming community [40737].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: The article reports on malware disguised as cheating add-ons for the game Hearthstone, which are designed to steal passwords, spy through webcams, mine bitcoin, and overwrite bitcoin addresses to steal cryptocurrency from users. These malicious software tools are introduced into the system without human participation, leading to software failure incidents [40737]. (b) The software failure incident occurring due to human actions: The article mentions how developers create scam applications like "Hearthstone Hack Tool v2.1" and Trojan.Coinbitclip, which are designed to deceive users by making false promises and stealing sensitive information. Additionally, attackers disguise malware as legitimate add-ons like Hearthstone Deck Tracker, tricking users into installing harmful software that can record from webcams, log keystrokes, and steal passwords. These actions by humans contribute to software failure incidents [40737].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions that cybercriminals are disguising malware as cheating add-ons for the game Hearthstone [40737]. This malware is designed to steal passwords, spy through webcams, and even mine bitcoin using the victim’s computer. These actions involve exploiting hardware components like webcams and processing power, indicating a hardware-related aspect to the failure incident. (b) The software failure incident related to software: - The article discusses how malware disguised as cheating tools for Hearthstone, such as "Hearthstone Hack Tool v2.1" and "Hearthstone Deck Tracker.exe," are actually designed to steal information, overwrite bitcoin addresses, record from webcams, log keystrokes, and steal passwords [40737]. These actions are all software-related, indicating a failure due to contributing factors originating in software.
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the article is malicious in nature. Cybercriminals are disguising malware as cheating add-ons for the popular game Hearthstone, with the intent to steal passwords, spy through webcams, mine bitcoin using victims' computers, and overwrite bitcoin addresses to steal cryptocurrency from users. The malware is designed to deceive users by making false promises and posing as legitimate game-enhancing tools, ultimately causing harm to the system and the users [40737].
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor_decisions: The software failure incident described in the article is related to poor decisions made by cybercriminals who developed malware disguised as cheating add-ons for the game Hearthstone. These malicious software tools were designed to steal passwords, spy through webcams, mine bitcoin, and overwrite bitcoin addresses to steal cryptocurrency from users. The developers of these malware tools made false promises, such as being able to hack Blizzard's servers and provide unlimited in-game resources, which were impossible to fulfill. Additionally, some malware disguised itself as legitimate add-ons like Hearthstone Deck Tracker to deceive users and infect their computers with trojans [40737].
Capability (Incompetence/Accidental) development_incompetence, accidental (a) The software failure incident related to development incompetence is evident in the article where cybercriminals are disguising malware as cheating add-ons for the popular game Hearthstone. The malware is designed to steal passwords, spy through webcams, mine bitcoin, and even overwrite bitcoin addresses to steal cryptocurrency from users. The developers of these malicious apps make false promises and claims that are impossible to fulfill, such as hacking Blizzard's servers to give players unlimited in-game resources. This demonstrates a lack of professional competence by the developers in creating and distributing these harmful software tools [40737]. (b) The software failure incident related to accidental factors is seen in the article where users are tricked into downloading malware disguised as legitimate add-ons for the game Hearthstone. For example, some users unknowingly install malware disguised as deck trackers, which are technically banned by Blizzard but still popular among players. This accidental installation of malware occurs when users turn to unproven software, making them easy targets for malware authors. The accidental installation of malicious software highlights how users can inadvertently introduce security risks to their systems by downloading seemingly harmless tools [40737].
Duration temporary The software failure incident described in the article is more aligned with a temporary failure. The incident involves cybercriminals disguising malware as cheating add-ons for the game Hearthstone, which leads to various malicious activities such as stealing passwords, spying through webcams, mining bitcoin, and attempting to steal cryptocurrency from users. These malicious activities are introduced by certain circumstances, such as users downloading and installing the fake cheating add-ons, rather than being inherent to the software itself. The malware disguises itself as legitimate tools like deck trackers, further emphasizing the temporary nature of the failure as it relies on users interacting with specific malicious elements [40737].
Behaviour crash, omission, timing, value, byzantine, other (a) crash: The article reports on malware disguised as cheating add-ons for the game Hearthstone. Some of these malicious apps are designed to steal passwords, spy through webcams, and even mine bitcoin using the victim’s computer. This behavior can lead to a system crash where the system loses its state and fails to perform its intended functions [40737]. (b) omission: The malware mentioned in the article, such as "Hearthstone Hack Tool v2.1" and Trojan.Coinbitclip, promises to provide players with unlimited resources in the game but actually performs malicious actions like stealing passwords and overwriting bitcoin addresses. This behavior can be categorized as omission, where the system omits to perform its intended functions and instead engages in harmful activities [40737]. (c) timing: The article discusses how some malware disguises itself as legitimate add-ons for the game Hearthstone, such as Deck trackers. These add-ons allow users to track their cards during gameplay. However, the malicious software, like Backdoor.Breut, can open a back door, record from the webcam, log keystrokes, and steal passwords. This behavior can be seen as a timing failure, where the system performs its intended functions but at the wrong time, leading to security breaches [40737]. (d) value: The malware mentioned in the article, particularly the apps like "Hearthstone Hack Tool v2.1" and Trojan.Coinbitclip, promise players unlimited resources in the game but actually perform malicious actions like stealing passwords and overwriting bitcoin addresses. This behavior can be categorized as a value failure, where the system performs its intended functions incorrectly by deceiving users and engaging in harmful activities [40737]. (e) byzantine: The article highlights how some malware, like Trojan.Coinbitclip, pretends to be a legitimate tool for hacking in-game resources but actually overwrites bitcoin addresses with its own, attempting to steal cryptocurrency from users. This deceptive and inconsistent behavior can be classified as a byzantine failure, where the system behaves erroneously with inconsistent responses and interactions, leading to unauthorized actions [40737]. (f) other: The article mentions that fringe software, including cheating tools and add-ons for games like Hearthstone, can be a hotbed of insecurity. Users may be forced to turn to unproven software, making them easy targets for malware authors. This behavior can be categorized as an "other" failure, where the system behaves in a way not described in the specific options (a to e), leading to vulnerabilities and security risks [40737].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence harm, property, non-human, other (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [40737]. (b) harm: The article discusses how cybercriminals are disguising malware as cheating add-ons for the game Hearthstone, which can lead to harm such as stealing passwords, spying through webcams, and attempting to steal cryptocurrency from users [40737]. (c) basic: There is no mention of people's access to food or shelter being impacted due to the software failure incident in the provided article [40737]. (d) property: The software failure incident resulted in potential harm to people's material goods, money, and data as cybercriminals were attempting to steal passwords and cryptocurrency from users [40737]. (e) delay: The article does not mention any delays caused by the software failure incident [40737]. (f) non-human: Non-human entities, such as computers and software systems, were impacted by the malware disguised as cheating add-ons for the game Hearthstone [40737]. (g) no_consequence: The software failure incident had real observed consequences, such as cybercriminals attempting to steal information and cryptocurrency from users [40737]. (h) theoretical_consequence: The article discusses potential consequences of users being forced to turn to unproven software, making them easy targets for malware authors, but it does not specify if these potential consequences actually occurred [40737]. (i) other: The software failure incident led to users being targeted by malware authors, impacting their online security and potentially compromising their privacy and personal information [40737].
Domain entertainment (a) The software failure incident reported in the article is related to the entertainment industry. The incident involves cheating add-ons for Blizzard's popular collectible card game, Hearthstone, which are disguised as legitimate tools but actually contain malware designed to steal passwords, spy through webcams, mine bitcoin, and overwrite bitcoin addresses to steal cryptocurrency from users [40737]. This incident highlights the risks associated with using unauthorized software in the gaming and entertainment sector.

Sources

Back to List