Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror
×
Role Playing (Games) The Almighty Buck Technology

Crime Wave Thwarted in Second Life 183

Ponca City, We Love You writes "The Mercury News reports that a vulnerability in the way Second Life protects a user's money has been identified. Risks for users are reportedly limited because the researchers say the flaw can be quickly patched. The flaw exploits a known problem with Apple's QuickTime - when a virtual character passes by an infected object planted by hackers, the Second Life software activates QuickTime so it can play the video or picture. Hackers can direct the Second Life software to a malicious Web site that then allows them to 'take over the user's avatar and force it to hand over its Linden cash. Second Life is recommending that users disable streaming video playback in the Second Life viewer except when you are attending a known and trusted venue.' The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"
This discussion has been archived. No new comments can be posted.

Crime Wave Thwarted in Second Life

Comments Filter:
  • short answer - No (Score:3, Insightful)

    by timmarhy ( 659436 ) on Sunday December 02, 2007 @02:22AM (#21550139)
    It's not real people. look after your actual life for a change....
    • by sqrt(2) ( 786011 ) on Sunday December 02, 2007 @02:35AM (#21550209) Journal
      Yeah! I can't even imagine what kind of losers would spend that much time on a website [slashdot.org].

      I've never actually seen this "Second" life, and I can't imagine why people would spend real money on it, but apparently a lot of people do. It must be worth it to them for the entertainment value.
    • Re: (Score:1, Insightful)

      by iminplaya ( 723125 )
      HEY MODS! That's not flamebait! I fully agree with the parent. Real worlds and virtual worlds don't mix. Learn some perspective and stop trying to pretend one is the other. Man! This is getting creepy!
      • by SJ2000 ( 1128057 ) on Sunday December 02, 2007 @02:51AM (#21550269) Homepage
        "Real worlds and virtual worlds don't mix" Alert the eCommerce sites, eBay better shutdown now.
        Can't have the virtual world mixing with reality can we?
        • by iminplaya ( 723125 ) on Sunday December 02, 2007 @03:12AM (#21550349) Journal
          What kind of real items are you buying in Second Life? Furniture for your house? Food for your stomach? Yeah. That virtual steak sure was tasty. Clothes for the kids? He's not barefoot. He's got his shoes right there on his USB stick. Can't you see them? The frostbitten toes are just his imagination. IT"S A GAME! If somebody cheats, kick them off, undo, and move on. Jeeze, do you call the cops if someone doesn't pay the rent when he lands on your "Park Place"? Oh, I can see the Nigerian scam now. There's 3000 dollars in un-collected "GO" money. If you send me just $49 and your credit card number and bank account number, I'll send it right to you in six to eight weeks. Will my get out of jail cards work when the cops mash my door down and bust me with my bag of weed? You are crazy.
          • by mstahl ( 701501 )

            Jeeze, do you call the cops if someone doesn't pay the rent when he lands on your "Park Place"?

            That's the thing. Linden dollars are supposed to equate to real money. You buy them. Why you'd want to do that is beyond me but there it is.

            • Re:short answer - No (Score:4, Interesting)

              by walt-sjc ( 145127 ) on Sunday December 02, 2007 @06:45AM (#21550947)
              Yes, Linden dollars do equate to real dollars. You can buy them, or you can create them by creating objects people buy or offering a service that other people pay for. Why do people buy? It's part of the game. Nearly every game out there costs money. Many are subscription. SL is similar. You can always play and not spend any real money at all. as most places to visit are free, and there is plenty of free items out there.

              It's entertainment. People are willing to pay for entertainment.
          • What kind of real items are you buying in Second Life?

            SL works as a convenient paypal-like money transfer system. People pay me for programming projects through SL.

            It's quite possible to make a living from it. I currently probably could live exclusively from SL.
            • There's a distinction between using SL as PayPal (a brilliant idea!) and actually keeping large L$ reserves in SL to "spend" on "goods" and "services" that only exist within Second Life itself. ("Services" usually being animated cybersex, and "goods" usually being cybersex animations.)
              • Well, the definition of "large reserves of L$" varies quite widely. Things are cheap in SL. An expensive avatar might be $5. Usually much cheaper.

                If you're interested in stuff (as in toys and not services of some sort) you can gather a huge heap of all sorts of things for $25.

                "Goods" are far more than "cybersex animations", btw. Those generally include avatars, weapons, toys, clothes, utilities (RSS readers say), buildings, etc, etc. You want to live in a medieval castle? Or a house on a tree? A Stargate? A
          • What kind of real items are you buying in Second Life?

            Money. SL lets you buy and sell real world currency. If someone has a credit card on file, you could use their character to buy quite a lot of money and transfer it to another user before trading limits kicked in. I'm sure there are no end of effective laundering schemes to get it back out cleanly.

          • by dbIII ( 701233 )
            The problem with second life as I see it (and one reason why I don't play) is you can put arbitrary amounts of real money in and potentially get real money or real goods out. You can spend a lot on the game. I would be suprised if there are not a lot of govenments wondering how they could get a slice of this as taxes and police departments looking for a way to pounce on the first money launderer they can spot there (most likely with collatoral damage).

            I prefer the Blizzard approach where they state up fro

          • > What kind of real items are you buying in Second Life?

            Well within the game you are paying for designers, coders. However there are quite a few people in SL who take linden $ over real $ because it offers a level of anonymous access over paypal. Which is why you will find a lot of "web cam" services there.

    • I guess they modded you down cuz they couldn't find the "amen to that" mod category. I mean seriously, what are they gonna do, FDIC insure it? Give me a break.
      • If it was in Europe, they would almost certainly have to register as an electronic money issuer, just like Paypal Europe is (in Luxembourg). That does give some protection, but not as much as the FSCS guarantee, which the the equivalent of FDIC.
    • I could say the same [imdb.com] to you, Mr. Anderson...
    • It's not real people. look after your actual life for a change....
      True, it is a game of sorts, but since Linden dollars can be directly converted into real world currency, and many people actually make money that way, this is an actual problem. This isn't like somebody stealing your stuff in Wow, this is more like someone stealing your poker chips at a casino.
  • by User 956 ( 568564 ) on Sunday December 02, 2007 @02:24AM (#21550145) Homepage
    Risks for users are reportedly limited because the researchers say the flaw can be quickly patched.

    Yes, well, the other solution to this flaw is to simply spend all your money on entrance to the tentacle hentai simulator.
  • Not-so-virtual (Score:5, Insightful)

    by Calydor ( 739835 ) on Sunday December 02, 2007 @02:31AM (#21550181)
    The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"

    Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.
    • Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.
      That's not the test. The question is whether you can buy real currency with lindens.
    • Re: (Score:3, Insightful)

      by icepick72 ( 834363 )
      But I buy monopoly money with real money and there's no need to guarantee the safety of it because I've purchased play money. Linden dollars don't do anything either outside the context of a game. You have your virtual and real worlds mixed up.
      • Re: (Score:2, Insightful)

        No guarantee of safety? If someone steals your property (ie. the game or its fake money) would the poilce not deal with it as theft? It's exactly the same thing with Second Life, someone buys a product (game money) and that is taken from them without consent. Just because you don't value their property doesn't mean it has no value.
        • If someone steals your property (ie. the game or its fake money) would the poilce not deal with it as theft?

          If it's less than a few thousand (real) dollars in value, probably not. They can't be arsed to deal with anything less than grand theft auto in most cities.

      • Linden dollars don't do anything either outside the context of a game.

        Actually they do. You can sell your Lindens for Dollars (The current exchange rate is 266L per $1.) So if you have a successful online business there, you could make enough real dollars to live off of in the real world. Difficult, but not impossible. SL has a vibrant economy - Check out this link for specifics [secondlife.com].

        That is aside from the personal networking, professional and career contacts you can make in SL that can equate to job offers

    • Re:Not-so-virtual (Score:4, Insightful)

      by cos(0) ( 455098 ) <pmw+slashdot@qnan.org> on Sunday December 02, 2007 @03:25AM (#21550393) Homepage
      You can buy anything with currency. The real test might be, does the government have an interest in protecting the integrity of Linden currency to the extent of US currency?

      Alternately, can one buy US currency with Linden currency? However, this test would merely cause theft of Linden currency to be a crime with "real" damages; it would not require the storage and management of currency to be as secure as with banks.
    • Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.

      IANAL or an Economist but...

      True, but the Linden dollars aren't insured nor backed by Federal Banking and SEC regulations.

      If Linden folds or they decide to devalue their currency then you have no legal recourse. Since there is no physical or scarcity limitation to their currency, once cannot 'steal' it from you because it never left the linden servers and it most likle
    • The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"

      Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.


      The hack raises tough questions for operators of amusement parks. Should the ski ball tent be as secure as banks and guarantee the safety of money and property that kids stuff in their po
    • If the goal is simulating real life, the solution is: An Insurance Company!

      Possibly, Lloyds of Linden?
  • by AySz88 ( 1151141 ) on Sunday December 02, 2007 @02:33AM (#21550191)
    If you take a look at the Second Life blog [secondlife.com], you'll see that the referenced recommendation was from a couple of days ago (November 30). A paragraph in the blog seems to say that if LL starts noticing exploits, they'll kill all QuickTime on the grid and maybe roll back exploit-induced transactions - expect this to happen soon.

    We do have the ability to turn off all videos on the grid, but have instead chosen to respect the existing in-world content and experiences which rely on streaming video, as we know that many of you enjoy these. We do recommend that you employ caution when using QuickTime in Second Life, only enabling it in environments that you trust, and are familiar with.

    We are able to track attacks, and rest assured, if we discover a malicious stream, we will vigorously pursue the attacker. This will include account termination and legal action if appropriate, as well as the appropriate assistance for affected Residents.
    • omgwtfbbq (Score:3, Interesting)

      by slyn ( 1111419 )
      Ummmmmmm...

      Can someone explain to me why Quicktime is so fucked up? I'm dead serious, and I ask this as a mac user.

      It seems like all the time there are new exploits for all different types of services (firefox exploits [slashdot.org], myspace exploits [eweek.com], this, etc.) with one thing in common: It's not [necessarily] the services fault, it's Quicktime's. Is there something about the architecture of Quicktime that makes it particularly exploit friendly? Or does it not do enough checking to see if the file is malicious? Is Quick
      • In a Related News Story... Police are still trying to explain how one million iPhones with infected copies of QuickTime have managed to induce their owners to foolishly hand large sums of cash to complete strangers. "What's especially troubling," confided one investigator, "is that we can't get 10 feet into an Apple Store before our team members are compromised!"
    • Im just blown away that quicktime doesnt have some kind of auto-updated, only itunes does. Ideally, Apple should be asking MS to put whatever patch they have into XP's auto updater like Adobe did when Flash had the vulnerability.
  • by WK2 ( 1072560 ) on Sunday December 02, 2007 @02:33AM (#21550201) Homepage
    Real life banks are not secure. They are just as likely to be hacked as any other web site. In the U.S., they are FDIC insured, though.
    • Re: (Score:3, Interesting)

      by twistah ( 194990 )
      Well, that's true, but there are lot of regulations in the U.S dealing with bank security. Sarbanes-Oxley Act (SOX), Gramm-Leach-Bliley Act (GLBA) which deals with customer information and several others must be complied with. Other countries have them too; for example, J-SOX is Japan's SOX equivalent. This means that the bank gets audited, often by two sets of outside auditors, which helps security at least somewhat. Most banks and credit unions also often go through penetration tests and vulnerability as
    • I don't know how I should best put this or if you're joking but -- no, bank web sites are usually more heavily scrutizined against attacks, and it seems successfully so. Bank sites should logically be major hacker targets, but the only way I use to see people "hack" themselves to find any bank account details here is by having people run a trojan in a mail in advance containing a keylogger. Or go to a web site set up to look like a bank site and have the user input the private details there. But in neither
    • As a technical and web infrastructure consultant, I take offense to that remark. Any financial institution worth it's money takes very serious care in web security. Nothing is bulletproof, but to say that myspace.com and usbank.com, for example, are equivalent is absolute nonsense.

      Oh, and the stuff the poster above me said is true enough as well.
  • For something like this that's easily classified as a bug, yes.

    However, at some point they will encounter the gray areas, which are resolved by courts in real life - do they really want to go that route? For instance, are there "lemon laws" for in-game purchases, and contract law for in-game agreements? Take the whole "who owns Unix" debacle Novell and SCO have been engaged in. What if second-life outlaws resort to bartering with some other scarce resource besides money to circumvent all the rules?

  • by Carbon016 ( 1129067 ) on Sunday December 02, 2007 @02:47AM (#21550259)
    As someone who has been quite directly involved in Second Life (or at least griefing it), I know SL pretty thoroughly, and I especially know there are two attractions to Second Life: sex and money. They're readily interchangeable, and they're the only reasons anyone uses it, despite claims to the contrary by media-whorish Linden Labs. You're either renting land, throwing cash into a bizarro stock market, or going to a furry cybersex sim. News about security problems is common because there's so much money going through the system and a lot of people looking to exploit it, as well as a wealth of disorganized, terrible code.

    A bank called "Ginko" that recently went insolvent sent shockwaves through the economy lately. Yes - there are Second Life banks, (multiple) Second Life stock exchanges, and all sorts of economic institutions: however, the operators of these venues often don't know the difference between an interest rate and their shoe so most people that end up dumping their funds into them lose all their money. Some people have thousands if not tens of thousands of dollars tied up in the game. As the Linden (the currency of Second Life) is not based on anything, Linden Labs simply dumps currency into the market whenever they feel like it. So economic problems are pretty common. Guaranteeing anything is a difficult proposition for the companies running the games: most have simply said "the *unit of currency here* is not money, nothing is guaranteed" to avoid lawsuits when someone messes up and loses a grand because a sim went down. So it's a dangerous game and the only real winners in "investing" in Second Life are LL.
    • by SJ2000 ( 1128057 )
      "Ginko Financial" was not a bank. The fact you can't recognize this means you know shit. The economy started going down hill because Linden Labs finally said they would obey the law and banned in-game gambling.
      • What exactly is your definition of a bank, then? Ginko provided deposit and withdrawal of currency and issued loans. Everyone from Reuters to Philip Linden [reuters.com] called it a bank. Regardless, any economy with such a capital system (the Lindens frequently mess with it without respect for economic consequences) will ultimately fail, content ban or not.
        • by SJ2000 ( 1128057 )
          Bank in the legal sense. If it's not a legal bank it's not a bank
          • by G Fab ( 1142219 )
            Since when?

            you're just adding to the normal definition ad hoc.

            It was a bank. We all realize it wasn't FDIC insured and isn't the same as Bank of America. But go run to your dictionary and look up the word "bank", and you will realize that banks actually preexisted the laws in place today. A bank is where you store your money. In fact, a bank is just where you store anything.

            I can have a bank of thumbtacks i my garage. It's a normal word that you should relax about.

            The parent is right. Linden is profit
    • Re: (Score:3, Informative)

      by RichardX ( 457979 )
      My most insincere apologies for undermining your point of view, but I use Second Life for reasons which do no include sex or money. To me, it's like Lego, but even more fun in many ways. You can build 3D objects, with an extremely limited toolkit where somehow the limitations make it more fun, and then you can give those objects behavior via scripting. Then it gets really fun when you share in those objects with other people you meet there.

      Oh noes. What's that you say? There are furry tentacle-rape freaks o
      • Yeah, before someone points it out, I typoed "not" for "no".. when will Slashdot get with the 1990's and add an 'edit' button?
    • Re: (Score:3, Interesting)

      by cruachan ( 113813 )
      Well all this says is that you're a not very nice person who is obsessed by being an asshole (griefing), sex and money. Of course there are loads of people in SL doing the cybersex thing, and if that's what you go looking for then that's what you'll find. But it's a bit like going to Amsterdam, just touring the red light district, and then concluding everyone in Amsterdam is just interested in buying and selling sex.
      Myself I run a quite profitable RP-orientated design business which nets me around USD$500
    • by Jesrad ( 716567 ) on Sunday December 02, 2007 @07:39AM (#21551127) Journal
      "You're either renting land, throwing cash into a bizarro stock market, or going to a furry cybersex sim."

      In three years sent in Second Life I have not done any of this. I must some weird and very persistent aberration, then. Or maybe you're just wrong.

      "As the Linden (the currency of Second Life) is not based on anything"

      It is based on the USD, and maintained at a rather fixed rate by LindenLab acting as a central bank. It's not perfect, but it has worked remarkably well so far.

      "Linden Labs simply dumps currency into the market whenever they feel like it."

      No, they sell some L$ only when they rate drops under 265 L$ per 1 USD to maintain the rate, and they buy back the L$ when the rate goes higher than 266 L$ per 1 USD (though they apparently never have had to do that). That's not "whenever they feel like it".

      "So economic problems are pretty common"

      Err, no. The L$ has been exceptionnally steady ever since LL introduced the measures I pointed out above, and the vast majority of players have zero problems with it. Only those who want to play games with their money and that of other people are taking risks. You're obviously confusing economy with finance if you conflate financial institutions like the "banks" and "stock exchanges" with the economy itself. But then, that's to be expected on a technology-oriented website like /.
    • Re: (Score:3, Informative)

      by ronadams ( 987516 )

      Being some random griefer who sends flying phallic objects across the Metaverse doesn't make you an expert in anything except flying genitals. So let's step through your insolent propaganda point by point.

      1. "...they're [sex and money] the only reasons anyone uses it [Second Life], despite claims to the contrary by media-whorish Linden Labs."
        Perhaps you're not aware of the number of corporate entities [blogs.com] using Second Life, not even for direct profit, but simply as a platform to deliver product information,
  • since the last Second Life story, even on other online news sites who were big into that second life thing.

    Isn't it dead already? Second Zombie?

  • In the real world, we have real, physical rules that determine what we, the "users" have to live with. Cops and the like work within those rules but since they don't make the rules of the universe itself, represent (at best) a 2nd-rate answer.

    That cops can't enforce the law 100% is due to the fact that they didn't make the universe; that onus belongs to either God or a random Higgs field.

    Here, however, the programmers are god-like. They make the rules of the universe. All of it. Therefore, the onus DOES fal
  • Is everyone still asleep from partying in their mom's basement?
  • And to think I was concerned about a trojan getting installed on my PC that would steal my USD from my checking account rather than Lindens from my SL account. Sorry, I'll get with the program soon...

    • Comment removed based on user account deletion
      • Lindens are exchangable with real money.

        Is it one way or both ways? If it's one way then it hardly matters. Lindens could always be virtually refunded or replaced.

        With real banks? Well... You'd need to make various hooks into the browser, intercept traffic from the browser and rewrite it, make a custom implementation for each bank -- to put it simply. It's a lot harder.

        Or... just copy the username and password with a key logger. A general key logger is far simpler and stealing is a lot easier if you kno

        • Comment removed based on user account deletion
          • Key loggers don't work because many banks (certainly the ones I have used) require you enter part of passwords on the site these days, usually via a on screen display (via mouse clicking) and some require you do mouse clicks.

            I have 8 accounts with 4 banks: US Bank, Bank of America, National City, and Capital Federal and none them work that way. They all require a user name (or id) and password to be typed. On the 2nd login screen for Bank of America, they display a special image I selected on signup that

            • Comment removed based on user account deletion
              • Banks have insurance, banks have additional power in the legal world to persue issues between different countries, reverse charges etc. Linden lab does not. On top of that, it does not have the information to investigate things themselves because they are not handling payments outside of Second life (their bill processor is, and if the person who is stealing the Linden is smart, he'll use one of the 3rd party sites to convert the money). The payment processor is under legal obligation to not provide them in

  • If your in a game and get killed, then someone takes all your money, obviously it's a crime in SL, but is it a crime in the real world too?
    • by Veinor ( 871770 )
      Here's how I think it should be: If it's using in-game mechanics that were deliberately placed there by the game creators, then no; the game designers meant for you to be able to lose your money in this way If it's using exploits, bugs, hacks, then yes. If you lose at a slot machine, it's not illegal, but if the slots are rigged, or someone tampers with them to make them lose more, that's illegal.
    • If you die in the game, you die for real!
  • If it's trying to represent a "second world" then is there a bank so the character does not carry linden "cash" with them? Because Banks do not protect cash once you've pulled it from an ATM, if you are robbed you are robbed. Gunpoint or buffer overflow. Now, if it's a bank transaction, then yes, they should attempt to protect it with a PIN or password or some other signature, but the players "avatar" should not be carrying it around.
  • Should [virtual worlds] be as secure as banks and guarantee the safety of money and property that characters in the world possess?

    Do they want their players to keep on playing, and spending that real cash on their Second Life subscriptions?

  • by Animats ( 122034 ) on Sunday December 02, 2007 @11:12AM (#21551957) Homepage

    This isn't a Second Life problem. It affects all QuickTime players. QuickTime has a recently discovered vulnerability which allows it to be used as a way to inject executable content into the user's machine. This can attack far more than Second Life.

    See US CERT Vulnerability Note VU#659761 -- Apple QuickTime RTSP Content-Type header stack buffer overflow [cert.org]. "Apple QuickTime contains a stack buffer overflow vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service condition. ... We are currently unaware of a practical solution to this problem.. ... "Note that QuickTime is a component of Apple iTunes, therefore iTunes installations are also affected by this vulnerability. We are aware of publicly available exploit code for this vulnerability. Testing indicates that QuickTime versions 4.0 through 7.3 are vulnerable on all supported Mac and Windows platforms."

    CERT suggests disabling all the ways QuickTime can be launched:

    • Block the rtsp:// protocol
    • Disable the QuickTime ActiveX controls in Internet Explorer
    • Disable the QuickTime plug-in for Mozilla-based browsers
    • Disable file association for QuickTime files

    This vulnerability was first published on November 23, 2007.

  • To those asking... (Score:2, Interesting)

    by achenaar ( 934663 )
    "does anyone really play this thing?"
    The answer is yes. A few. Enough.
    When I first made my Second Life account one bored weekend many moons ago, I was just checking to see if any VR style system had anything going for it. I'd been wandering from one MMO to another looking for some escapism and mostly just finding frustrating grind fests and vacuous time wasters.
    I was initially pretty unimpressed by the graphics but eventually I started to see *past* the visuals and started visiting classes to teach noobs
    • I can understand why people are attracted to this game. It does sound like a great place explore your creativity. However, there is a HUGE problem with SL.

      When I was younger, I spent a lot of my time playing Doom, and Quake. I even made my own levels, and some models. My friends and I had tons of fun playing in our own creations. Everyone has access to modeling tools, and there are plenty of games and 3D worlds to share your creativity in. The problem with modding games is that there's a very steep le
  • You should turn off streaming media and automatic loading of web profiles by default.

    Not just because of this, but because it reduces the security of the SL client, in a number of ways.

    First, there's vulnerabilities in the plugins and the browser software. Yes, they're using a pretty secure browser based on Gecko, without user-loaded or downloaded XUL components, but still these are complex programs that you really don't need. About the only web-based technology in SL that's reasonably safe is the new search... since it's generated by Linden Labs, and they have better avenues of attack. :)

    Second, If you look at the Linden blog on this, you see that one of the messages reads:

    Way to go LL, help griefers some more why dont you? Using video streaming to IP log griefers as they crash sims is one of the important ways to fight griefing and document who the real abusers are. Eliminating this ability only helps griefers, much as your stupid idea to enable people to hide groups. Far more than helping to get rid of griefing or give us more security features, you keep enabling griefing with your stupid decisions like this one.
    There are SL "landowners" using streaming audio and video to track visitors by their IP address. This allows them to cross-reference addresses and identify players living in the same household, players with multiple accounts, people playing from work, and so on. And these kinds of "web-bugs" inside SL can not only get the "landowner" a pretty reliable ID for you (your account name), they can also distinguish whether users you're "verified" by a credit card or paypal.

    This kind of tool is useful to track griefers, I guess, but anyone who "owns" land in SL can do it... including those charming guys with their spammy ad-farms. :)

Don't tell me how hard you work. Tell me how much you get done. -- James J. Ling

Working...