Crime Wave Thwarted in Second Life 183
Ponca City, We Love You writes "The Mercury News reports that a vulnerability in the way Second Life protects a user's money has been identified. Risks for users are reportedly limited because the researchers say the flaw can be quickly patched. The flaw exploits a known problem with Apple's QuickTime - when a virtual character passes by an infected object planted by hackers, the Second Life software activates QuickTime so it can play the video or picture. Hackers can direct the Second Life software to a malicious Web site that then allows them to 'take over the user's avatar and force it to hand over its Linden cash. Second Life is recommending that users disable streaming video playback in the Second Life viewer except when you are attending a known and trusted venue.' The hack raises tough questions for operators of virtual worlds. Should they be as secure as banks and guarantee the safety of money and property that characters in the world possess?"
short answer - No (Score:3, Insightful)
Re:short answer - No (Score:4, Insightful)
I've never actually seen this "Second" life, and I can't imagine why people would spend real money on it, but apparently a lot of people do. It must be worth it to them for the entertainment value.
Re:short answer - No (Score:4, Insightful)
Is poker just a game? (Score:2)
Seriously, the consequences are as high as you want to set them. Throwing wads of money into the street has high stakes and consequences too.
Re: (Score:2)
That's quite possibly the worst analogy and analysis I've ever read on Slashdot. The feces-eater-in-the-library post was more on-point than what you said.
My statement was that there is a difference between a game, which is strictly for entertainment, and a hybrid entertainment/business environment like SL, where some people are earning (or losing) significant profits. I never said anything dramatic. To use your first half-baked metaphor, ask a professional poker player if he considers his winnings, and
Wow. (Score:2)
Now SL is a BUSINESS environment, huh? Sure, to the same extent that poker can be a business. You're horribly mistaken, Linden Lab is the business, SL is their game.
"Professional" poker players still play a game. It's still gambling, regardless of the skill or amount of money. Some may make a living off of the winnings, but the _game_ is not more serious or important to the rest of us because they do. It is purely entertainment. The same can be said for any professional
Re: (Score:2)
Now, I didn't see anyone claiming that SL was a business environment for Linden Labs. For them, it's clearly just a product. But it is being used as a business environment by many of the people in it. My analogy: Second Life is like an apartment building. Linden Labs is the landlord. But th
Re: (Score:3, Insightful)
I'm sure there exists casual SL players. Probably some that play even less than you spend on slashdot. You can easily spend hours and sink tons of real money on any hobby, if people want to throw it away on a virtual world that's their business. Some people play WoW, I can't understand that either, but a lot of
Re: (Score:1, Insightful)
Re:short answer - No (Score:5, Insightful)
Can't have the virtual world mixing with reality can we?
Re:short answer - No (Score:5, Insightful)
Re: (Score:2)
That's the thing. Linden dollars are supposed to equate to real money. You buy them. Why you'd want to do that is beyond me but there it is.
Re:short answer - No (Score:4, Interesting)
It's entertainment. People are willing to pay for entertainment.
Re: (Score:2)
SL works as a convenient paypal-like money transfer system. People pay me for programming projects through SL.
It's quite possible to make a living from it. I currently probably could live exclusively from SL.
Re: (Score:2)
Re: (Score:2)
If you're interested in stuff (as in toys and not services of some sort) you can gather a huge heap of all sorts of things for $25.
"Goods" are far more than "cybersex animations", btw. Those generally include avatars, weapons, toys, clothes, utilities (RSS readers say), buildings, etc, etc. You want to live in a medieval castle? Or a house on a tree? A Stargate? A
Re: (Score:2)
Money. SL lets you buy and sell real world currency. If someone has a credit card on file, you could use their character to buy quite a lot of money and transfer it to another user before trading limits kicked in. I'm sure there are no end of effective laundering schemes to get it back out cleanly.
Re: (Score:2)
I prefer the Blizzard approach where they state up fro
Re: (Score:2)
Well within the game you are paying for designers, coders. However there are quite a few people in SL who take linden $ over real $ because it offers a level of anonymous access over paypal. Which is why you will find a lot of "web cam" services there.
Re: (Score:2, Insightful)
Re: (Score:2)
*Guarantee*? No of course not - no one can guarantee nothing will ever happen. But expect reasonable care as any legitimate business should? Sure, why not?
The operators of SecondLife can no more guarantee that you will not get robbed in the game than the polititians and police can guarantee that I wont get robbed walking down the street.
Re: (Score:1)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
This comes from a BLOG owner (Score:5, Interesting)
Can I tell you a little secret about life? It is pointless.
You are born, you die. In between you have to work a lot of hours to... well to postpone the dying part or at least make the dying part less unpleasant.
Luckily, in the west we have become good enough at postponing death that we have some spare hours in our days. So we got to waste them, some watch sports, some have sex, some read books and some play games.
It is ALL useless.
Blogging got to rank near the top of most useless activities and as such you are in no position to critize second life players. You are a pot, so keep quiet about the color of kettles.
I wish people were a little bit more honest about their personal time wasters. Friend of mine follows all the soccer tournaments in the world, yet thinks playing games is a waste of time. Eheh.
Stop blogging mate and save the world or accept that you are wasting your time just as much as people who care about some silly online game.
Re: (Score:2)
Oh wait - maybe entertainment is not pointless. Maybe it lets us express ourselves, or enjoy our time outside of work. Maybe SL is a way to interact with people from different countries / cultures - playing together. Or you can spend your life working, eating, and sleeping and nothing else. I think SL is a little silly, but I feel the same about all video games.
Re: (Score:2)
Re: (Score:2)
Ha! Such a good point, so rarely articulated. Is this the emptiness that chases all those useless retail purchases, looking for meaning where there is none to justify our slave existence?
Re: (Score:2)
Re: (Score:2)
For example spending 3 years playing computer games vs spending 3 years obtaining a degree. If you get pleasure out of the games you might not consider it a waste of time, but only one has a serious potential for enriching the rest of your life. If you study something you actually enjoy, it might set you up for years of maki
Re: (Score:2)
Second LIfe is not like RL, for one, I can't fly in RL. Neither could I meet a tiny squirrel, hop in Ornithopters and shoot at each other. Or play En Garde with the squirrel, or go to a musical performance with the squirrel, or say build something real
an alternate, and more entertaining solution (Score:5, Funny)
Yes, well, the other solution to this flaw is to simply spend all your money on entrance to the tentacle hentai simulator.
Re: (Score:3, Informative)
http://slurl.com/secondlife/bel%20Highland/171/143/33 [slurl.com]
Should be near where you can get the baby unicorn. NSFW link:
http://www.secondlifeherald.com/slh/2007/09/afternoon-delig.html#more [secondlifeherald.com]
It might be a custom thing though so it might not actually be there.
Not-so-virtual (Score:5, Insightful)
Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.
Re: (Score:1)
Re:Not-so-virtual (Score:5, Informative)
Re: (Score:3, Insightful)
Re: (Score:2, Insightful)
Re: (Score:2)
If it's less than a few thousand (real) dollars in value, probably not. They can't be arsed to deal with anything less than grand theft auto in most cities.
Re: (Score:2)
Actually they do. You can sell your Lindens for Dollars (The current exchange rate is 266L per $1.) So if you have a successful online business there, you could make enough real dollars to live off of in the real world. Difficult, but not impossible. SL has a vibrant economy - Check out this link for specifics [secondlife.com].
That is aside from the personal networking, professional and career contacts you can make in SL that can equate to job offers
Re:Not-so-virtual (Score:4, Insightful)
Alternately, can one buy US currency with Linden currency? However, this test would merely cause theft of Linden currency to be a crime with "real" damages; it would not require the storage and management of currency to be as secure as with banks.
Re: (Score:2)
Re: (Score:2)
IANAL or an Economist but...
True, but the Linden dollars aren't insured nor backed by Federal Banking and SEC regulations.
If Linden folds or they decide to devalue their currency then you have no legal recourse. Since there is no physical or scarcity limitation to their currency, once cannot 'steal' it from you because it never left the linden servers and it most likle
Perspective anyone? (Score:2)
Considering that you buy Lindens with real currency, then yes. Yes, they should be just as secure, since it's real money you're dealing with.
The hack raises tough questions for operators of amusement parks. Should the ski ball tent be as secure as banks and guarantee the safety of money and property that kids stuff in their po
Re: (Score:2)
I agree completely with your premise -- I'm surprised at your conclusions.
The nature of the action being done here is entertainment. Amusement. Distraction. Think video arcade, think amusement
Re: (Score:2)
Second Life [wikipedia.org] is [wikipedia.org] a game [wikipedia.org]
Opportunity (Score:3, Funny)
Possibly, Lloyds of Linden?
Old recommendation, Quicktime prob killed soon (Score:5, Informative)
We are able to track attacks, and rest assured, if we discover a malicious stream, we will vigorously pursue the attacker. This will include account termination and legal action if appropriate, as well as the appropriate assistance for affected Residents.
omgwtfbbq (Score:3, Interesting)
Can someone explain to me why Quicktime is so fucked up? I'm dead serious, and I ask this as a mac user.
It seems like all the time there are new exploits for all different types of services (firefox exploits [slashdot.org], myspace exploits [eweek.com], this, etc.) with one thing in common: It's not [necessarily] the services fault, it's Quicktime's. Is there something about the architecture of Quicktime that makes it particularly exploit friendly? Or does it not do enough checking to see if the file is malicious? Is Quick
In a Related News Story (Score:3, Funny)
Re: (Score:2)
Real life banks are not secure. (Score:5, Insightful)
Re: (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
Oh, and the stuff the poster above me said is true enough as well.
guarantee the safety of money and property? (Score:2)
However, at some point they will encounter the gray areas, which are resolved by courts in real life - do they really want to go that route? For instance, are there "lemon laws" for in-game purchases, and contract law for in-game agreements? Take the whole "who owns Unix" debacle Novell and SCO have been engaged in. What if second-life outlaws resort to bartering with some other scarce resource besides money to circumvent all the rules?
SL's economy is a giant sinkhole anyway (Score:5, Insightful)
A bank called "Ginko" that recently went insolvent sent shockwaves through the economy lately. Yes - there are Second Life banks, (multiple) Second Life stock exchanges, and all sorts of economic institutions: however, the operators of these venues often don't know the difference between an interest rate and their shoe so most people that end up dumping their funds into them lose all their money. Some people have thousands if not tens of thousands of dollars tied up in the game. As the Linden (the currency of Second Life) is not based on anything, Linden Labs simply dumps currency into the market whenever they feel like it. So economic problems are pretty common. Guaranteeing anything is a difficult proposition for the companies running the games: most have simply said "the *unit of currency here* is not money, nothing is guaranteed" to avoid lawsuits when someone messes up and loses a grand because a sim went down. So it's a dangerous game and the only real winners in "investing" in Second Life are LL.
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
you're just adding to the normal definition ad hoc.
It was a bank. We all realize it wasn't FDIC insured and isn't the same as Bank of America. But go run to your dictionary and look up the word "bank", and you will realize that banks actually preexisted the laws in place today. A bank is where you store your money. In fact, a bank is just where you store anything.
I can have a bank of thumbtacks i my garage. It's a normal word that you should relax about.
The parent is right. Linden is profit
Re: (Score:2)
However, the same could be said of people trusting American banks before reforms were enacted. You didn't have to use then and they were not associated with the government of the US. Of course, many did and were screwed, and eventually the people demanded the US government do what it had the power to do: reform the banks. And everyone was happier.
Linden makes a fortune off these shams. By screwing with the currency they are making money, pure and simple. Are these ba
Re: (Score:3, Informative)
Oh noes. What's that you say? There are furry tentacle-rape freaks o
Re: (Score:2)
Re: (Score:3, Interesting)
Myself I run a quite profitable RP-orientated design business which nets me around USD$500
Re:SL's economy is a giant sinkhole anyway (Score:5, Informative)
In three years sent in Second Life I have not done any of this. I must some weird and very persistent aberration, then. Or maybe you're just wrong.
"As the Linden (the currency of Second Life) is not based on anything"
It is based on the USD, and maintained at a rather fixed rate by LindenLab acting as a central bank. It's not perfect, but it has worked remarkably well so far.
"Linden Labs simply dumps currency into the market whenever they feel like it."
No, they sell some L$ only when they rate drops under 265 L$ per 1 USD to maintain the rate, and they buy back the L$ when the rate goes higher than 266 L$ per 1 USD (though they apparently never have had to do that). That's not "whenever they feel like it".
"So economic problems are pretty common"
Err, no. The L$ has been exceptionnally steady ever since LL introduced the measures I pointed out above, and the vast majority of players have zero problems with it. Only those who want to play games with their money and that of other people are taking risks. You're obviously confusing economy with finance if you conflate financial institutions like the "banks" and "stock exchanges" with the economy itself. But then, that's to be expected on a technology-oriented website like
Re: (Score:3, Informative)
Being some random griefer who sends flying phallic objects across the Metaverse doesn't make you an expert in anything except flying genitals. So let's step through your insolent propaganda point by point.
Perhaps you're not aware of the number of corporate entities [blogs.com] using Second Life, not even for direct profit, but simply as a platform to deliver product information,
Re: (Score:2)
It's been a while ... (Score:1)
Isn't it dead already? Second Zombie?
The rules of the game (Score:2)
That cops can't enforce the law 100% is due to the fact that they didn't make the universe; that onus belongs to either God or a random Higgs field.
Here, however, the programmers are god-like. They make the rules of the universe. All of it. Therefore, the onus DOES fal
No Snowcrash tag? (Score:2)
Am I the only one who doesn't get it? (Score:2)
Re: (Score:2)
Re: (Score:2)
Is it one way or both ways? If it's one way then it hardly matters. Lindens could always be virtually refunded or replaced.
Or... just copy the username and password with a key logger. A general key logger is far simpler and stealing is a lot easier if you kno
Re: (Score:2)
Re: (Score:2)
I have 8 accounts with 4 banks: US Bank, Bank of America, National City, and Capital Federal and none them work that way. They all require a user name (or id) and password to be typed. On the 2nd login screen for Bank of America, they display a special image I selected on signup that
Re: (Score:2)
Re: (Score:2)
Thoughts? (Score:2)
Re: (Score:2)
Re: (Score:2)
is it a bank? (Score:2)
Re: (Score:2)
Why should they protect player's cash? Here's why (Score:2)
Do they want their players to keep on playing, and spending that real cash on their Second Life subscriptions?
It gets worse. All QuickTime files now threats. (Score:5, Informative)
This isn't a Second Life problem. It affects all QuickTime players. QuickTime has a recently discovered vulnerability which allows it to be used as a way to inject executable content into the user's machine. This can attack far more than Second Life.
See US CERT Vulnerability Note VU#659761 -- Apple QuickTime RTSP Content-Type header stack buffer overflow [cert.org]. "Apple QuickTime contains a stack buffer overflow vulnerability that may allow a remote, unauthenticated attacker to execute arbitrary code or cause a denial of service condition. ... We are currently unaware of a practical solution to this problem.. ...
"Note that QuickTime is a component of Apple iTunes, therefore iTunes installations are also affected by this vulnerability. We are aware of publicly available exploit code for this vulnerability.
Testing indicates that QuickTime versions 4.0 through 7.3 are vulnerable on all supported Mac and Windows platforms."
CERT suggests disabling all the ways QuickTime can be launched:
This vulnerability was first published on November 23, 2007.
To those asking... (Score:2, Interesting)
The answer is yes. A few. Enough.
When I first made my Second Life account one bored weekend many moons ago, I was just checking to see if any VR style system had anything going for it. I'd been wandering from one MMO to another looking for some escapism and mostly just finding frustrating grind fests and vacuous time wasters.
I was initially pretty unimpressed by the graphics but eventually I started to see *past* the visuals and started visiting classes to teach noobs
Problem... (Score:2)
When I was younger, I spent a lot of my time playing Doom, and Quake. I even made my own levels, and some models. My friends and I had tons of fun playing in our own creations. Everyone has access to modeling tools, and there are plenty of games and 3D worlds to share your creativity in. The problem with modding games is that there's a very steep le
You should turn streaming off by default, anyway. (Score:3, Informative)
Not just because of this, but because it reduces the security of the SL client, in a number of ways.
First, there's vulnerabilities in the plugins and the browser software. Yes, they're using a pretty secure browser based on Gecko, without user-loaded or downloaded XUL components, but still these are complex programs that you really don't need. About the only web-based technology in SL that's reasonably safe is the new search... since it's generated by Linden Labs, and they have better avenues of attack.
Second, If you look at the Linden blog on this, you see that one of the messages reads: There are SL "landowners" using streaming audio and video to track visitors by their IP address. This allows them to cross-reference addresses and identify players living in the same household, players with multiple accounts, people playing from work, and so on. And these kinds of "web-bugs" inside SL can not only get the "landowner" a pretty reliable ID for you (your account name), they can also distinguish whether users you're "verified" by a credit card or paypal.
This kind of tool is useful to track griefers, I guess, but anyone who "owns" land in SL can do it... including those charming guys with their spammy ad-farms.
Re: (Score:2, Interesting)
Re: (Score:3, Interesting)
Every time I post on Slashdot, it takes forever for me to Submit the post, because I get probed on a few ports (which timeout).
They're ports commonly used by proxies and such.
Re:I'm sorry (Score:5, Informative)
Re: (Score:3)
I am only forced to use Windows at work.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Second Life appeals to non-geeks, even more so than WoW. It also appeals to creative types, say the folks who are art students, jewelry designers, graphic designers.
When you played SL for those five minutes, what did you do? Did you try out the building and scripting tools? Did you try Googling for interesting stuff to do? Did you try the "head for a clump of green dots and see what's up game"? Did you talk to anyone at Orientation Island?
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
I usually consider a crash SL's way of saying find something else to do.