Slashdot Mirror
Crime Wave Thwarted in Second Life
Ponca City, We Love You writes "The Mercury News reports that a vulnerability in the way Second Life protects a user's money has been identified. Risks for users are reportedly limited because the researchers say the flaw can be quickly patched. The flaw exploits a known problem with Apple's QuickTime - when a virtual character passes by an infected object planted by hackers, the Second Life software activates QuickTime so it can play the video or picture. Hackers can direct the Second Life software to a malicious Web site that then allows them to 'take over the user's avatar and force it to hand over its Linden cash. Second Life is recommending that users disable streaming video playback in the Second Life viewer except when you are attending a known and trusted venue.' The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"
It's not real people. look after your actual life for a change....
If you mod me down, I will become more powerful than you can imagine....
Risks for users are reportedly limited because the researchers say the flaw can be quickly patched.
Yes, well, the other solution to this flaw is to simply spend all your money on entrance to the tentacle hentai simulator.
The theory of relativity doesn't work right in Arkansas.
The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"
Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.
-=This sig has nothing to do with my comment. Move along now=-
We are able to track attacks, and rest assured, if we discover a malicious stream, we will vigorously pursue the attacker. This will include account termination and legal action if appropriate, as well as the appropriate assistance for affected Residents.
Real life banks are not secure. They are just as likely to be hacked as any other web site. In the U.S., they are FDIC insured, though.
Write your own Choose Your Own Adventure. http://www.freegameengines.org/gamebook-engine/
As someone who has been quite directly involved in Second Life (or at least griefing it), I know SL pretty thoroughly, and I especially know there are two attractions to Second Life: sex and money. They're readily interchangeable, and they're the only reasons anyone uses it, despite claims to the contrary by media-whorish Linden Labs. You're either renting land, throwing cash into a bizarro stock market, or going to a furry cybersex sim. News about security problems is common because there's so much money going through the system and a lot of people looking to exploit it, as well as a wealth of disorganized, terrible code.
A bank called "Ginko" that recently went insolvent sent shockwaves through the economy lately. Yes - there are Second Life banks, (multiple) Second Life stock exchanges, and all sorts of economic institutions: however, the operators of these venues often don't know the difference between an interest rate and their shoe so most people that end up dumping their funds into them lose all their money. Some people have thousands if not tens of thousands of dollars tied up in the game. As the Linden (the currency of Second Life) is not based on anything, Linden Labs simply dumps currency into the market whenever they feel like it. So economic problems are pretty common. Guaranteeing anything is a difficult proposition for the companies running the games: most have simply said "the *unit of currency here* is not money, nothing is guaranteed" to avoid lawsuits when someone messes up and loses a grand because a sim went down. So it's a dangerous game and the only real winners in "investing" in Second Life are LL.
Anti-spam thing.
Every time I post on Slashdot, it takes forever for me to Submit the post, because I get probed on a few ports (which timeout).
They're ports commonly used by proxies and such.
Peace sells, but who's buying?
Ummmmmmm...
Can someone explain to me why Quicktime is so fucked up? I'm dead serious, and I ask this as a mac user.
It seems like all the time there are new exploits for all different types of services (firefox exploits, myspace exploits, this, etc.) with one thing in common: It's not [necessarily] the services fault, it's Quicktime's. Is there something about the architecture of Quicktime that makes it particularly exploit friendly? Or does it not do enough checking to see if the file is malicious? Is Quicktime crack-friendly on both platforms or is it a shitty port like iTunes for windows and thus mostly windows only exploits?
I tend not to use Quicktime because it takes to long to load movies, (unlike VLC, which "streams" them and so it begins playing them almost immediately), but if any more exploits begin showing up for Quicktime, I may seriously consider not using it at all.
Life is just nature's way of keeping meat fresh.
Can I tell you a little secret about life? It is pointless.
You are born, you die. In between you have to work a lot of hours to... well to postpone the dying part or at least make the dying part less unpleasant.
Luckily, in the west we have become good enough at postponing death that we have some spare hours in our days. So we got to waste them, some watch sports, some have sex, some read books and some play games.
It is ALL useless.
Blogging got to rank near the top of most useless activities and as such you are in no position to critize second life players. You are a pot, so keep quiet about the color of kettles.
I wish people were a little bit more honest about their personal time wasters. Friend of mine follows all the soccer tournaments in the world, yet thinks playing games is a waste of time. Eheh.
Stop blogging mate and save the world or accept that you are wasting your time just as much as people who care about some silly online game.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
In a Related News Story... Police are still trying to explain how one million iPhones with infected copies of QuickTime have managed to induce their owners to foolishly hand large sums of cash to complete strangers. "What's especially troubling," confided one investigator, "is that we can't get 10 feet into an Apple Store before our team members are compromised!"
This isn't a Second Life problem. It affects all QuickTime players. QuickTime has a recently discovered vulnerability which allows it to be used as a way to inject executable content into the user's machine. This can attack far more than Second Life.
See US CERT Vulnerability Note VU#659761 -- Apple QuickTime RTSP Content-Type header stack buffer overflow. "Apple QuickTime contains a stack buffer overflow vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service condition. ... We are currently unaware of a practical solution to this problem.. ...
"Note that QuickTime is a component of Apple iTunes, therefore iTunes installations are also affected by this vulnerability. We are aware of publicly available exploit code for this vulnerability.
Testing indicates that QuickTime versions 4.0 through 7.3 are vulnerable on all supported Mac and Windows platforms."
CERT suggests disabling all the ways QuickTime can be launched:
This vulnerability was first published on November 23, 2007.