Virtual worlds are playgrounds not just for people engaging in online fantasy role-playing but for cybercriminals who are looking for places to launder money and steal data, according to a new white paper from McAfee.
The in-game economies of virtual worlds are being hijacked by criminals who are attempting to hide their profits through the exchange of virtual currencies, Dr Igor Muttik, a senior architect at McAfee's Avert Labs, states in the white paper, Securing virtual worlds against real attacks — The challenges of online game development.
"Typically, when a gaming account is compromised, attackers will convert the objects they steal into virtual currency, and then convert the virtual currency into real money," the white paper states.
Scammers also are increasingly attracted to virtual worlds, where they have numerous methods of trying to steal private data for fraud. For instance, sloppy scripting in some online games allows viruses to automatically execute and propagate. Also a threat are phishing attempts and messaging spam luring members to malicious sites for 'free' games.
Also increasing in number and frequency are data-stealing Trojans that use keystroke loggers and other software to record IDs and passwords, mouse movements and even screenshots, the report states.
There have been other threats in the virtual worlds as well. A virtual illness wiped out entire servers of users in World of Warcraft in 2005 when a design flaw allowed the disease to spread throughout low-level players. Meanwhile, user-created code caused a virtual terrorist attack in Second Life, according to the report.
Because virtual worlds appeal to the criminal elements, the possibility also exists that they could serve as honeypots for attracting criminals and terrorists, thereby providing law-enforcement bodies with a glimpse into their activities.
