Slashdot Mirror
Major Spike in Security Threats To Online Games
Gamasutra reports on data from security software firm ESET, which shows a major increase in the number of gaming-related security threats over the last year. They attribute the rise in attacks to the amount of money involved in the games industry these days. ESET's full report (PDF) is also available.
"[ESET's research director, Jeff Debrosse] explains: 'It's a two-phase attack. If someone's account was compromised, then someone else can actually [using their avatar] during a chat session, or through in-game communication... they could leverage that people trust this person and point them at various URLs, and those URLs will either have drive-by malware or a specific [malware] executable. What ends up happening is that folks may end up downloading and using it. This is just one methodology.' These attackers also target gamers in external community sites, says Debrosse, through 'banners on websites or URLs in chat rooms or forums' — which can lead to unsafe URLs. 'If [users] don't have adequate protection, they could very well be downloading malware without their knowledge.'"
that most games are these days it seems inevitable. The last few years it seems the mentality has been to ship first patch later.
As opposed to all of the people downloading malware intentionally?
Stop learning! Only you can prevent esoterrorism.
How convenient that ESET, the author of the report, offers a product to protect against that.
No existe.
taking the PWNED to a new level!
Similar to the concept of OpenID, perhaps the solution to password theft would be a SecurID card that all the main game companies would have as an option to attach to an account. Right now, Blizzard has one, which is an OEM-ed Vasco Digipass Go 6. I just wish SOE, Valve, and other networked games would offer this.
Of course, this brings with it its own can of worms, like what to do if a token is lost, disables itself, or stolen. Blizzard requires a fax of a lot of RL info before it releases control of an account if a token is lost. PayPal/eBay have a mechanism of calling one of the phone numbers on file.
The advantage of two factor authentication is a big thing, as game accounts are worth a lot of money. Not just for characters to sell, but to use as farming/exploiting/spam bots until the MMO company bans the account.
Even though social attacks are easy and possible, aren't technical attacks a threat? Eg, buffer overflows using chat rooms, a game server designed to spew out infections code, the like. There really isn't much a user could do against this besides waiting for the next patch, unlike social attacks which can be deflected with a little education and caution.
The main paradox of this story is that, people believe other people inside a game over internet, pretending knowing them, but can't differentiate between a "standard" behaviour or a copycat, meaning they don't know them at all. Most people can easily recognise who is on the other side of the phone just by they way of speaking, even if they change their voice.
I will never understand how you can have full confiance in someone you never meet and with who you never shared a beer, but well, maybe it is just me...
Ha well, another day in gullible land...
EULA : By reading the above message, you agree that I now own your soul.
The threst of attackers pointing others to websites during chat is nonsense. Anybody with a legit account could do the same and an attacker is more likely to be identified as attacker in this. The real risk is just theft of online property and sending of spam with the account. A well-stocked WoW account can be worth 100 EUR or more.
Why are these people writing about risks in online games allways so incompetent? Are these people without a clue of online gaming or security, just construction some threat to create attention?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
I would think that a larger threat when getting a link from a friend (or an imitated friend) would be something similar to this: http://www.youtube.com/watch?v=oHg5SJYRHA0
Karnal
It actually can be a problem with the games themselves. Let me recount one example. I was once a coder for a free MMORPG. Nothing huge -- usually a couple hundred people online at any given point in time -- but still relevant. Just in the random course of looking through the code during my work, I encountered some *glaring*, as in "OMG, I can't believe these are in here" security holes. Example: there was no server validation. None, at all. If a packet had the server's IP, they automatically trusted it, and made all kinds of assumption's about the packet's size, direct-copied it into memory with that assumption, etc; if anyone was able to compromise or spoof the server's IP, every last user's computer connected to the game could have been compromised. The management refused to act on that one. In fact, there was only one issue I was able to get them to act on, and that only because I wrote a freaking exploit for it. It was due to them using popen for opening webbrowsers on URLs, and they weren't bothering to check for injection. My exploit was a bit of text that anyone could have said on a chat line or in person that would have caused the computers of anyone who clicked on the link to have their hard drives wiped (assuming adequate permissions). That's what it took to get them to patch security holes; I couldn't convince them to let me fix it until I wrote an exploit. Unbelievable. They operated for years with that timebomb just sitting around.
Nothing says 'welcome to the neighborhood' like a gunny sack full of dead squirrels.
How is the astro turf growing in YOUR stadium?
Our stadium uses ACME ASTRO TURF (TM*)! Because ACME ASTRO TURF (TM*) is shiny and greener than your average astro turf.
Look at our scientific astro turf results!
The dangers of knowledge trigger emotional distress in human beings.
in Runescape they set up trade limits. If you log into someone's account and want to dump all their stuff off onto your account, you can't unless you compensate them with a matching amount of money based on what the current market price is (which is determined by the giant, in-game ebay type of system for selling in game items for in game currency). So they worst they can do is just destroy or drop all your stuff but there is no way to get the items off their account and onto yours (except one loophole but it's sketchy). Everyone hates it but at least it keeps the idiots safe. Speaking of idiots though, anyone who goes to a community site and reads a banner that says "download out 100% rare drop generator. You'll be richer than everyone else!" and they do it cuz they're a stupid cheater like that, they deserve to have their account stolen.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
..when they give you a phone number in Malaysia or Whateverstan, you can pretty much assume as well that this isn't the friend you're looking for.
Yeah one time I almost bought a car from someone on Craigslist, but I could tell by his voice that he was black, so I knew what was up.</racism>
What problem is this supposed to solve? The thread you posted in was discussing hackers stealing WoW logins and looting their gold, then selling it. How is asking someone for their phone number going to fix it?