Slashdot Mirror
MMORPG Developers Warned of Security Risks
phantomfive writes "According to an article on ZDNet, hackers are now targeting players of MMORPGs (mainly WOW), stealing their passwords, then selling their gold/equipment for money in the real world. Microsoft security development engineer Dave Weinstein warned developers of the new dangers their titles face at the company's annual Gamefest event." From the article: "Online game accounts are already on sale in the black market next to stolen credit card accounts, fraudulent passports, fake work papers and other illegal items gathered by identity theft. In fact, some game accounts can be worth up to $10,000. 'For a lot of the customers out there, there is more store value on their MMO characters than there is on the credit card with which they pay for the account,' said Weinstein."
In fact, some game accounts can be worth up to $10,000
Come on people, nobody is that addicted? Who can imagine paying $10,000 for a WOW account? It's as ridiculous as the price of some of the paintings that sell at art galleries! I can't imagine a game account selling for that much.
'For a lot of the customers out there, there is more store value on their MMO characters than there is on the credit card with which they pay for the account,'
If that was really true, MMO's would let users pay their monthly fees with virtual gold.Rock is dead. Long live scissors and paper!
I guess It must be nice to have the burden of only your OS and all your own software being the target lifted off your shoulders, now you can blame your third party developers too. I guess that hack for MMORPG Tycoon isn't just M$ fault anymore
Did someone say cake?
I have read many tales on gaming forums of "I gave my password to person X for this reason and now 300 people have it." Do not give your password or other information to anyone for any reason. Report players who try to get it from you to the appropriate authority. Also avoid websites that offer training or any other gimmick that requires account info. I know that identity theft (real or virtual) is impossible to prevent 100% but common sense steps can make it much more difficult.
Information wants a fueled airplane waiting at the hangar and no one gets hurt.
The article (a whopping 300 words long) says not much more than "people are selling mmorpg accounts on the black market". How is this not obvious, let alone even slightly newsworthy even on a slow day?
46487 466780 252994 376409 96920 39622 205366 244315 622115 512361 668040 63608 259203 955314 811176 652718 166330 23922
Which is to say, how much of the theft is from true strangers, and how much from wives and girl friends?
I've played a few MMORPGs (WoW, Guild Wars, Anarchy Online) and I've only seen one kind of keylogger exploit - the kind you install yourself. People shout in-game "Visit www.guildcheats.com for Guild Wars god mode!" and the like. It's just a case of the greedy preying on the greedy. Circle of life. If your account is stolen it's 99.9% likely that it's your own fault.
Even so, in the case of Guild Wars, which has given me better support than any piece of software in my whole life, I go out of my way to report these instances with screenshots or URLs when I find supposed cheats in torrents. The sanctity of the game is at stake when unscrupulous parties try to hijack others' accounts and lewt.
To prevent wholesale account-jacking, any time an account has "suspicious" activity, such as wholesale giving-away of assets or being played from IP addresses on opposite sides of the planet on the same day, the game would make you answer a "security question" you set up when you created the account. It would also email you at a third-party email account and possibly even phone you or send snail-mail.
Customers who rarely trade and never play away from home will also have the option of "locking" their accounts so that, before they trade or play away from home they have to "unlock" the account. The unlock would involve more than just knowing the account login information.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
I've heard of others, but can't remember them right now. (EVE, maybe?)
"Seven Deadly Sins? I thought it was a to-do list!"
I could be mistaken on how bad the problem is on 'other' games, but Neopets (and now Gaia) are very poignant, large-scale examples of some people's willingness to cheat the system only to find themselves scammed (largely because the game itself is free, and the userbase is proportionally dumber than most systems you 'pay' for).
The only thing this article points out is how much 'wealth' is tied up in these programs (and I can believe that, seeing how I probably have a down payment for a car tied up in my Gaia account - if it were even possible for me to extract that value out of the account, since it's mostly due to a few overinflated items), but aside from that, the main issue here is not security of the games, but security of the users.
Social Engineering is alive and well on the internet. Keep your wits about you and your password strong, and there's nothing to worry about.
Most of the account stealing in question has nothing to do with security flaws within the game itself, and more to do with user stupidity.
1. User gets themselves infected with malware. Many executables out there that claim to be "cheat" tools for the game end up simply being trojans with keyloggers designed to steal your account name and password. The solution is not to download what you think is a cheat or hacks, and to follow standard steps to prevent yourself from getting malware.
2. Many users will use the same account name and password on game-related fansites and forums that they do for their actual game account. It has been revealed that many of the very popular WoW "fan sites" (some that allow you to log in and create a profile) are owned by IGE, partners of IGE, or similar "gold selling companies." No fansite should be accepted as trustworthy, including your guild's own forums. Users should never use the same account name and password they use for their game account for a login on a fan related site
3. Many users have extremely weak passwords. Simple enough.
4. Many users will flat out share their account name and password with their online friends and guildmates. Not smart at all.
It's a chop shop for WoW characters. My old 95 Nissan Altima is worth more as parts than it is as a vehicle.
Layne
A WoW account is a bunch of digits in some computer. Most USD10K is a bunch of digits in some computer.
So it's a matter of supply and demand. Heck it may be harder to forge items in some online games than it is to forge paper USD.
Some game items might take months to get for normal people, so if a game account has characters loaded up with rare weapons, I figure some people might actually pay USD10K for it.
Seriously though, if the cops don't take theft of such stuff seriously or similar crimes, then more and more people might actually resort to unlawful actions.
Just like that guy in China who killed a fellow gamer - the murderer lent his sword (which he only just got at that time) to his "friend" who then sold it for USD900. In China many people consider USD250 a month a good wage. And it might have been worth more than USD900 to the original owner (who might only have sold it for more- thieves often sell for lower than market rate, so I guess it could be worth significantly more which is why he wasn't happy when his "friend" offered to give him the USD900).
I'm not saying he was right to kill, but I'm not surprised he did. People have been killed for far less than four months average salary. Especially when betrayal and other stuff is involved.
To his defense, he actually did go to the cops first, but:
"Before the attack Mr Chengwei told police about the theft who said the weapon was not real property"
Not real property? Something that sold for 4 months wages? Two lives wasted (one dead and one suspended death sentence - might get out in 15 years if lucky) because the cops didn't take things seriously. Maybe the Chinese courts cut him some slack, coz over there it's real death for so many things - e.g. hooliganism, "stirring up fights and causing trouble". The parents of the dead guy are still calling for his blood though.
In South Korea the cops actually do recognize such crimes (maybe many of them play those games too and thus can understand the value of some "dragon sabre").
Many stamp collections are worth far more than their face value.
How about the recent case - a teddy bear (Mabel?) that used to belong to Elvis, apparently worth USD75K got savaged by a guard dog assigned to protect the bear collection/display.
Should the cops and courts say, "It's only an old toy bear" ? After all who can imagine paying USD75K for an old toy bear?
For justice to be served one should not be quick to judge, nor take everything at face value.
I saw Weinstein's talk at GDC a few months ago, and this article really doesn't do it justice. His talk is mostly speculative; there aren't any cases of accounts being sold for thousands of dollars out there. However, he does point out the stuff to be aware of when writing and designing an online game. He also doesn't limit the talk to MMOs, though that's the most common kind of online game these days. A game like Unreal Tournament with the server browser can also be a security risk, but it's worth less money than stealing gold in WoW.
If you have a chance, see his talk. He's an old-school gamer and game programmer, so he's not just some guy that understands security and nothing else.
Blizzard, in response to the ticket filed, locked the account while they investigated, and have said they are attempting to trace the trades with an eye to restoring all items. If they can do this (and I don't see why they couldn't, if they decide to) then my guildmate and the others affected will only be out the lost gameplay time and the aggravation - but we don't know if that 'rollback' does, in fact, remove the items from the *recipients* of the transactions. I would bet it probably would, but I'm not Blizzard. If I was the person doing this, I'd have my realworld cash already, so even if the transaction got rolled back, there'd be nothing the buyer could do- so for minimal effort over the three weeks it took for Blizzard to deal with this I'd have made my profit.
Besides, there will always be those who don't find it worthwhile to complain to Blizzard and just quit in disgust, figuring they're just out the $15 of that month's game fee. None of the measures I've discussed above address the structural problem of preventing this sort of attack in any way, because it doesn't take place on Blizzard's infrastructure; in order to address it, Blizzard would have to change their authentication systems to incorporate more robust client code and more secure methods such as the PIN-clicking method described in another post. That means coding, testing and waiting for the patch cycle - so they have a window of vulnerability anyway.
It all comes down to - the effort expended by the malware attackers is minimal. The risk is somewhat higher, but not much higher than that of being goldfarmers anyway, so why not?
A hero is someone who knows when to run away. I am a hero. -Trent the Uncatchable
As a fairly hardcore MMORPG player, who's been playing FFXI for 3 years and has played about with WoW on the side as well, I'd offer the following (fairly obvious) advice to anybody wanting to keep their character secure.
/shout from a player in Jeuno (the main FFXI hub city at the time), saying "Peacock Charm for sale, 8 million gil, check my bazaar". This prompts a frantic race to buy this item before anybody else can. The "lucky" winner was distinctly miffed when he noticed he'd just spent 8 million on a Ranger's Necklace. At current IGE exchange rates (I hate the site and all of its ilk, but it's useful for comparison here), this cost the scammed player around $220.
1) Do not ever lend "virtual" currency or items to anybody you do not know in real life unless you can accept their loss. By "know in real life", I mean "know and see on a regular basis and are on good terms with", not "met once at a convention". Many people adopt in-game personas drastically different to their "real" personas. With this separation between the player's avatar and the player themselves, it becomes all the more tempting for a even a generally well-intentioned player to give in to temptation and behave in a way that they wouldn't towards somebody they knew in real life.
2) Do not share access to your account EVER, even with people you know well in real life. I've known more people come to serious grief this way than in any other. Real-life relationships can break down too, and deleting or emptying out a MMORPG character is, in many ways, the geek relationship equivalent of taking a kitchen knife to an ex-partner's wardrobe. Make sure that logging in to your account requires the use of at least one password that only you know. Disable any "auto login" options. If you have housemates, particularly if your relations with them aren't great, or they have an "odd" sense of humour, never go away from your keyboard while leaving your character logged in. Don't make a big deal out of it, just make it part of the routine. I know this sounds paranoid and draconian, but I can think of at least 3 FFXI players, one of whom I knew well in-game who have lost characters in this way when a real-life relationship has broken down.
3) Be very, very careful about using *any* third-party software relating to the game. Not only is this probably against the EULA (and hence potentially going to get you banned by a GM), but it exposes you to the risk of malware. In general, it's the 3rd party tools that offer the most (eg. cheats) which are most likely to turn sour on you. As ever, it's easiest to trick people through greed. However, even the most innocent little tool can have a nasty payload.
4) Any website other than ones run by the game's developer which requires you to enter your login details is a scam. End of story. If you are uncertain as to whether a site is run by the developer, check the game's manual to find the game's official website. The official forums for some games do require you to use your game login to access them. This is OK, but be sure to protect your login details (eg. don't have your browser auto-remember them if you have housemates).
5) Any in-game offer which looks too good to be true probably is. Casino scams in FFXI are one of the most obvious examples, but there are plenty of others. There's an amusing example here from FFXI. There are two pieces of neck gear, the Ranger's Necklace and the Peacock Charm, which both use the same graphical icon. The former is automatically given to players when they complete the flag quest for the Ranger job. It sells for about 1000 gil. The latter is an incredibly rare and powerful item, dropped only very occasionally from a tough arena fight. It sells for 14 million gil or so, on average. Just 3 months ago, I saw a
I know all of the above really is "water is wet, fire is hot" type stuff, but it's amazing how many people forget it, some of them multiple times.
Wait... if you made $0.50 an hour off it, then at $1600, you would have had to have spent 3200 hours getting your character to that level; how much time were you spending on it? You'd have to spend over eight hours a day every day for a year to rack up that kind of time!
Well if you consider that 8 or 9 years ago, this same type of thing was happening in UO, i'd say the articles a bit late. The funniest part about this is whenever i hear someone say "i got haxed!!!", the first thing i always say to them is "who did you tell your password to?". I would say 95% of all cases of this i have heard of in various games has been user error. Trust NO ONE. I've never given my password to anyone, except people i can beat down in real life, and coincidentally I have never had a game account hacked.
Its all user error. There is no "Security Risks" to mmo players any more theres a security risk to email users that give out their hotmail passwords.
I'll just use my special getting high powers one more time...
This has been going on for years! No wonder it was so wide-spread if the developers had no idea it was going on. Not to mention that their games are to blame for this. Most are very insecure. I can remember my best friend having one of his Diablo 2 accounts stolen about 4-5 years ago. There was no recourse he could take to get his account back. Atleast now a days in WoW ther eis a process you can go through to reclaim your account and any items the hacker might have destroyed or characters he might have deleted. Of course in other games you are not so lucky. The value put on these account is a direct result of bad game design. If you design a game that takes 15 days on average (ingame time) to reach to maximum level, then you add a bunch of "rare" items which take even long to acquire, you have only yourself to blame for what happens. A game where items are easily attained and lost, where the grind isn't so extensive and the main attraction of the game is the human interaction would not have these problems.
I play everquest 2 on a station exchange server.
.. well.. I don't know.. at least $4k. Why? that's how much I made working within the rules of the station exchange in a year's time.
To me, my two accounts are worth
How much will I make next year? A third year?
I won't be truly able to put a price on those accounts until I leave eq2, the station exchange completely fails or until eq2 is taken offline.
The loss of either account would set me back for a month or two, both and I'd have to start over from scratch which would be more than I could bear.
An entire account with 6+ characters with different tradeskills (capable of making many different items and thus, lots of money) would be worth a lot of real $$$ to a hard worker/successful seller. Especially on a non-exchange server.
I figure this will only become worse as MMO's become more popular. The irony is I was just working on our plans to address this growing problem the other day. We got some ideas on how to address this in the works.
D.Bunker
Game Designer
POSSe Entertainment
You can pay your monthly fees in EVE Online using virtual ISK (dollars) collected in the game.
I ate your fish.
Whether or not you believe it, people can and do sell online accounts and items for RW money. I think the going rate on ebay right now is something like $1 U.S. dollar for 3,000 platinum pieces. Maybe one person doesn't sell an entire account for ten thousand dollars, but selling a bunch of people $50 dollars worth of online MMORPG items, it can add up really fast. I'm just glad that runescape, my MMORPG of choice, has never allowed people who sell items for real world money to keep their accounts. Thats not to say that people don't get caught, but most do.
To live without killing is a thought which could electrify the world, if men were capable of staying awake long enough.