You are reading:
Under the Surface of Azeroth:
A Network Baseline and Security Analysis
of Blizzard's World of Warcraft

Step 5: Authenticating into the World of Warcraft

The authentication process into the World of Warcraft universe is relatively straightforward. Once the version check has completed, the World of Warcraft login screen appears.

The login screen is a very graphical full-screen display complete with wisps of smoke, flaming torches, and an orchestral ovation. Even though the screen is rich with sensory input, there's absolutely nothing happening over the network. There are no packets transferred while the account information is entered into the login screen.

Once the "Login" button is pressed, a TCP connection on port 3724 is made to us.login.worldofwarcraft.com. The next obvious step is for the username and password to be sent to the central authentication sever. Although the password is not sent in plain text across the network, the account name is easily readable inside the network packet.

The authentication process actually occurs in three quick steps:

* The account name and account password is verified

* A list of available World of Warcraft Realms and IP addresses are received from the login server

* The character select screen is loaded


Verifying the username and password

The login process begins with sending the account name to the World of Warcraft login server in frame 6. This frame also contains the version number of the client so that the World of Warcraft login server can perform a final verification of the client software. Prior to this point, every version check could have been bypassed by simply disconnecting from the live Internet connection.

As mentioned previously, the account name information in frame 6 is sent as plain text without any type of encryption. Frame 7 is a TCP acknowledgement to the information in frame 6, and frame 8 is a frame of additional information sent from the logon server. This additional content in frame 8 may include a "salt" value that's used to create a hash of the password.

Frame 9 appears to be the password hash that was created by combining the password with the dynamic salt value. Because the salt is different every time, the password hash is also different each time. This provides additional account security because the account password is not only hashed, but the hashed value changes each time.

This analysis of the password transmission is an educated guess based on the information traversing the network. Although the details of the password transfer aren't public knowledge, it's useful to know that the password is not sent in the clear and the information transferred is different each time.