Slashdot Mirror
Crime Wave Thwarted in Second Life
Ponca City, We Love You writes "The Mercury News reports that a vulnerability in the way Second Life protects a user's money has been identified. Risks for users are reportedly limited because the researchers say the flaw can be quickly patched. The flaw exploits a known problem with Apple's QuickTime - when a virtual character passes by an infected object planted by hackers, the Second Life software activates QuickTime so it can play the video or picture. Hackers can direct the Second Life software to a malicious Web site that then allows them to 'take over the user's avatar and force it to hand over its Linden cash. Second Life is recommending that users disable streaming video playback in the Second Life viewer except when you are attending a known and trusted venue.' The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"
It's not real people. look after your actual life for a change....
If you mod me down, I will become more powerful than you can imagine....
Risks for users are reportedly limited because the researchers say the flaw can be quickly patched.
Yes, well, the other solution to this flaw is to simply spend all your money on entrance to the tentacle hentai simulator.
The theory of relativity doesn't work right in Arkansas.
The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"
Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.
-=This sig has nothing to do with my comment. Move along now=-
We are able to track attacks, and rest assured, if we discover a malicious stream, we will vigorously pursue the attacker. This will include account termination and legal action if appropriate, as well as the appropriate assistance for affected Residents.
On a weird side related note, after posting that I noticed Firestarter was flashing red and 16 attempts on various ports from an IP that resolves to slashdot.org were recorded... What gives for that?
My UID is prime... is yours?
Real life banks are not secure. They are just as likely to be hacked as any other web site. In the U.S., they are FDIC insured, though.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
As someone who has been quite directly involved in Second Life (or at least griefing it), I know SL pretty thoroughly, and I especially know there are two attractions to Second Life: sex and money. They're readily interchangeable, and they're the only reasons anyone uses it, despite claims to the contrary by media-whorish Linden Labs. You're either renting land, throwing cash into a bizarro stock market, or going to a furry cybersex sim. News about security problems is common because there's so much money going through the system and a lot of people looking to exploit it, as well as a wealth of disorganized, terrible code.
A bank called "Ginko" that recently went insolvent sent shockwaves through the economy lately. Yes - there are Second Life banks, (multiple) Second Life stock exchanges, and all sorts of economic institutions: however, the operators of these venues often don't know the difference between an interest rate and their shoe so most people that end up dumping their funds into them lose all their money. Some people have thousands if not tens of thousands of dollars tied up in the game. As the Linden (the currency of Second Life) is not based on anything, Linden Labs simply dumps currency into the market whenever they feel like it. So economic problems are pretty common. Guaranteeing anything is a difficult proposition for the companies running the games: most have simply said "the *unit of currency here* is not money, nothing is guaranteed" to avoid lawsuits when someone messes up and loses a grand because a sim went down. So it's a dangerous game and the only real winners in "investing" in Second Life are LL.
Anti-spam thing.
Every time I post on Slashdot, it takes forever for me to Submit the post, because I get probed on a few ports (which timeout).
They're ports commonly used by proxies and such.
Peace sells, but who's buying?
Ummmmmmm...
Can someone explain to me why Quicktime is so fucked up? I'm dead serious, and I ask this as a mac user.
It seems like all the time there are new exploits for all different types of services (firefox exploits, myspace exploits, this, etc.) with one thing in common: It's not [necessarily] the services fault, it's Quicktime's. Is there something about the architecture of Quicktime that makes it particularly exploit friendly? Or does it not do enough checking to see if the file is malicious? Is Quicktime crack-friendly on both platforms or is it a shitty port like iTunes for windows and thus mostly windows only exploits?
I tend not to use Quicktime because it takes to long to load movies, (unlike VLC, which "streams" them and so it begins playing them almost immediately), but if any more exploits begin showing up for Quicktime, I may seriously consider not using it at all.
Life is just nature's way of keeping meat fresh.
Can I tell you a little secret about life? It is pointless.
You are born, you die. In between you have to work a lot of hours to... well to postpone the dying part or at least make the dying part less unpleasant.
Luckily, in the west we have become good enough at postponing death that we have some spare hours in our days. So we got to waste them, some watch sports, some have sex, some read books and some play games.
It is ALL useless.
Blogging got to rank near the top of most useless activities and as such you are in no position to critize second life players. You are a pot, so keep quiet about the color of kettles.
I wish people were a little bit more honest about their personal time wasters. Friend of mine follows all the soccer tournaments in the world, yet thinks playing games is a waste of time. Eheh.
Stop blogging mate and save the world or accept that you are wasting your time just as much as people who care about some silly online game.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
In a Related News Story... Police are still trying to explain how one million iPhones with infected copies of QuickTime have managed to induce their owners to foolishly hand large sums of cash to complete strangers. "What's especially troubling," confided one investigator, "is that we can't get 10 feet into an Apple Store before our team members are compromised!"
Or netfilter rules with a DROP policy. :)
:/
I am only forced to use Windows at work.
Peace sells, but who's buying?
Anonymous coward is telling the truth. I've seen one that someone made. Pictures? Wouldn't you like to know. :-) But this might be a location to check out:
http://slurl.com/secondlife/bel%20Highland/171/143/33
Should be near where you can get the baby unicorn. NSFW link:
http://www.secondlifeherald.com/slh/2007/09/afternoon-delig.html#more
It might be a custom thing though so it might not actually be there.
This isn't a Second Life problem. It affects all QuickTime players. QuickTime has a recently discovered vulnerability which allows it to be used as a way to inject executable content into the user's machine. This can attack far more than Second Life.
See US CERT Vulnerability Note VU#659761 -- Apple QuickTime RTSP Content-Type header stack buffer overflow. "Apple QuickTime contains a stack buffer overflow vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service condition. ... We are currently unaware of a practical solution to this problem.. ...
"Note that QuickTime is a component of Apple iTunes, therefore iTunes installations are also affected by this vulnerability. We are aware of publicly available exploit code for this vulnerability.
Testing indicates that QuickTime versions 4.0 through 7.3 are vulnerable on all supported Mac and Windows platforms."
CERT suggests disabling all the ways QuickTime can be launched:
This vulnerability was first published on November 23, 2007.
If the goal is simulating real life, the solution is: An Insurance Company!
Possibly, Lloyds of Linden?
"does anyone really play this thing?"
The answer is yes. A few. Enough.
When I first made my Second Life account one bored weekend many moons ago, I was just checking to see if any VR style system had anything going for it. I'd been wandering from one MMO to another looking for some escapism and mostly just finding frustrating grind fests and vacuous time wasters.
I was initially pretty unimpressed by the graphics but eventually I started to see *past* the visuals and started visiting classes to teach noobs how to get along in SL. (Thanks again Bob Bunderfeld)
Then it clicked. It wasn't about playing a game any more. It was literally a creative medium.
Take, for example, WOW. I liked it, it was fun. Smiting hordes of enemies, chatting to the other players. Good times were had by all. But the investment of time weighed in heavily and I realised that if I wanted to have any of the perks that high level characters get I'd need to play the damn thing every hour of my life for weeks.
When I started in SL I was a huge noob with respect to how the system worked but I had other skills. I wasn't too bad at 3d modelling (lightwave, maya et al) and I'm a pretty decent coder. The thing I found is that I could use those skills to help form my identity in SL. I started out building models of things, then tried my hand at scripting. Before long I'd built a fairly decent smoke machine that I went around selling to club owners for their dancefloors.
I started writing scripts for commission and I made a bit of money from it. Not huge dough but enough to make me feel like I was spending my time having fun/being productive at the same time.
There's a lot more to SL than 3d IM, although for a lot of people that's all they'll use it for. You can build and script and texture and sell and buy all sorts of things.
For instance, my missus makes horses in SL (Hoof It!) to sell to folks and together we've made some pretty neat products. She builds the horses and textures them and I script them so they can be ridden and rear up and poo and make noises and suchlike.
Try doing that in WOW.
Seriously though, if you've got some free time, just give it an hour or two and you might find quite a lot to love about Second Life.
Regards,
Achenaar
Not just because of this, but because it reduces the security of the SL client, in a number of ways.
First, there's vulnerabilities in the plugins and the browser software. Yes, they're using a pretty secure browser based on Gecko, without user-loaded or downloaded XUL components, but still these are complex programs that you really don't need. About the only web-based technology in SL that's reasonably safe is the new search... since it's generated by Linden Labs, and they have better avenues of attack.
Second, If you look at the Linden blog on this, you see that one of the messages reads:There are SL "landowners" using streaming audio and video to track visitors by their IP address. This allows them to cross-reference addresses and identify players living in the same household, players with multiple accounts, people playing from work, and so on. And these kinds of "web-bugs" inside SL can not only get the "landowner" a pretty reliable ID for you (your account name), they can also distinguish whether users you're "verified" by a credit card or paypal.
This kind of tool is useful to track griefers, I guess, but anyone who "owns" land in SL can do it... including those charming guys with their spammy ad-farms.