fraud in virtual worlds
via: Elinor Mills @ http://news.cnet.com/8301-1009_3-10027609-83.html
The in-game economies of virtual worlds are being hijacked by criminals who attempt to hide their profits through the exchange of virtual currencies, Dr. Igor Muttik, a senior architect at McAfee’s Avert Labs says in a white paper entitled “Securing Virtual Worlds Against Real Attacks–The Challenges of Online Game Development.”
McAfee reveals specific threats within virtual worlds, costs of vulnerabilities on the black market, and details how game developers can keep games safe for their users:
• Money laundering: The in-game economies of virtual worlds have been hijacked in many cases by cybercriminals attempting to hide their profits through the exchange of virtual currencies
• Economic value: As virtual items become rarer or more difficult to achieve, their inherent time value creates a fiscal worth in the game’s currency and real life
• User created content: A user-created code in Second Life caused a virtual terrorist attack
• Unforeseen consequences of in-game events: A virtual illness created for World of Warcraft wiped out entire servers of users when a flaw in its design allowed the disease to spread throughout low-level players
• Scripting holes: Sloppy scripting allows viruses to achieve persistency, auto-execution, and propagation
• Messaging spam: The internal messaging services of most online games have often been leveraged for spam by malicious users
• Phishing: One example is a spam campaign related to W32/Nuwar (also known as Stormworm) The bad guys created a web page offering “free” games. Links to it were widely spammed, but clicking anywhere on this web page led visitors to malware. Perhaps worst spamming runs were related to W32/Nuwar (also known as Stormworm), used a gaming theme.
• Data-Stealing Trojans: In a typical attack, data-stealing programs record user IDs and passwords along with the IP addresses or the names of the servers they use. This is done with a keylogger, which records all keystrokes. In more sophisticated attacks, the web forms are captured, as are mouse movements and even screenshots. The attacker can log into the compromised account and retrieve anything of value. Typically, when a gaming account is compromised, attackers will convert the objects they steal from online gamers into virtual currency—and then convert the virtual currency into real money.






