Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×

MMORPG Developers Warned of Security Risks 91

Posted by Zonk from the not-always-just-a-game dept.
phantomfive writes "According to an article on ZDNet, hackers are now targeting players of MMORPGs (mainly WOW), stealing their passwords, then selling their gold/equipment for money in the real world. Microsoft security development engineer Dave Weinstein warned developers of the new dangers their titles face at the company's annual Gamefest event." From the article: "Online game accounts are already on sale in the black market next to stolen credit card accounts, fraudulent passports, fake work papers and other illegal items gathered by identity theft. In fact, some game accounts can be worth up to $10,000. 'For a lot of the customers out there, there is more store value on their MMO characters than there is on the credit card with which they pay for the account,' said Weinstein."
This discussion has been archived. No new comments can be posted.

MMORPG Developers Warned of Security Risks More

MMORPG Developers Warned of Security Risks

Comments Filter:

  • That's a Lot of Cash (Score:4, Interesting)

    by neonprimetime ( 528653 ) on Tuesday August 15, 2006 @09:51AM (#15909801)
    In fact, some game accounts can be worth up to $10,000

    Come on people, nobody is that addicted? Who can imagine paying $10,000 for a WOW account? It's as ridiculous as the price of some of the paintings that sell at art galleries! I can't imagine a game account selling for that much.
      • That's insane, this one even has a $1000 bid [ebay.com] already!
        • Back when SWG was at it's heyday, I was one of the first people on my server to unlock the Jedi archtype. After playing it for a few weeks and realizing that the entire class was borked, I put the account on eBay for $300... at the end of a week long auction, it sold for over $1600. I couldn't believe that anyone would pay that much for a game account, and was sure that it was some scammer. But, the funds got transfered from France through PayPal, and it was legit. I still to this day get a laugh out of it.
          • Wait... if you made $0.50 an hour off it, then at $1600, you would have had to have spent 3200 hours getting your character to that level; how much time were you spending on it? You'd have to spend over eight hours a day every day for a year to rack up that kind of time!
            • Your point being? LOL In all honesty, I was addicted to the game. I would get off work, come straight home, and start playing till the early hours of the morning, catch a few hours of sleep and start the whole process all over again. The weekends were spent in front of the computer as long as I could. Right before I sold the account, the previous 3 months I was out of work on FMLA for severe depression (which, in hindsight, I attribute to the amount of time I was playing the game and not anything else),
      • When I played Shadowbane, somebody paid $300 for a player-owned city on the Mourning server.

        The thing is player owned cities can be destroyed by other players.

        He lost the city a few months later.
    • Come on people, nobody is that addicted? Who can imagine paying $10,000 for a WOW account?
      Probably the same guys that get certain jobs just so they can continue to play at work, who make online relationships instead of real ones, and who buy $3000 laptops just so they can run the latest iteration of a game. 90% of their life is wrapped up in the game. During that other 10% of eating and sitting on the throne, they just think about how they could get more into it.
      • Why didn't he take the laptop with him to the throne? And if he's in any way reasonable, he'd eat at the computer while playing. The only thing befuddling him is why he's not getting experience for the kills he makes while sleeping. (Darn dreams aren't "real"...)

        IMarv
      • But these guys spend so much time in the game that they can get a decent character pretty quickly anyway. Obviously there must be people willing to pay that amount, since we can clearly see people are doing so, but it would appear to be a contradiction since the addicts don't have any need, and the non-addicts don't have any desire.
        • It doesn't have to do with addictions. Some rich kids who want to show off would pay for it.
        • How many rich hack job golfers at the country club drop a couple thousand on clubs that no one's really going to know or care about? It doesn't improve their shitty game, either.
           
          As online gaming becomes more prevalent, those same numbnuts will drop cash there.
        • I've seen guilds purchase characters (not at $10,000) to flesh out a class they are lacking. For example, the core guild members have too many hunters and need another priest. They purchase a 60 priest and have a one of the hunters use the character.
          I've also seen guild leaders who maintain a couple of accounts in this same way so that critical but understaffed classes (commonly healers) are always available for raiding.
          High level raiding guilds get crazy like that sometimes.

    • Re:That's a Lot of Cash (Score:5, Insightful)

      by PFI_Optix ( 936301 ) on Tuesday August 15, 2006 @10:07AM (#15909908) Journal
      I can't imagine someone paying hundreds of thousands of dollars for a single item of sports memorabilia, but it has happened. Is it really so far-fetched to suggest that there exist at least a handful of people with too much money who are willing to spend that money on having more than anyone else does on WoW?

      For that matter, given the current state of society, should we even act surprised? These are the same rich kids who spend thousands of dollars a year to have the fastest computer on the block, the latest iPod and accessories (even though four perfectly good iPods are sitting in a desk drawer somewhere), and whatever else they perceive as a must-have status symbol.
      • The difference between the two is that sports memorabilia is physical--you can put it in a glass case, you can touch it. The only thing you can do with that level 60 Paladin decked out in Epic items is run through Ironforge.
      • These are the same rich kids who spend thousands of dollars a year to have the fastest computer on the block,

        These aren't kids usually, but rather 40 somethings with a great deal of disposable income. I've known a few to dump $7,000 on a Ultima Online account.

      • I can't imagine someone paying hundreds of thousands of dollars for a single item of sports memorabilia, but it has happened. Is it really so far-fetched to suggest that there exist at least a handful of people with too much money who are willing to spend that money on having more than anyone else does on WoW?

        That sports memorabilia can go up in value over time. A WoW account's value plummets to zero as soon as the game becomes unfashionable. Or when it's deleted due to a breach of rules. Or the game closes

        • It can go up in value only because there's some other schmuck willing to spend more money on it than you were. I can't imagine why they would want to spend the money any more than the first person. There is no value in something like that, other than being the only one to have it. The same goes for WoW items and accounts; some people buy them just to say they have them.

    • Come on people, nobody is that addicted? Who can imagine paying $10,000 for a WOW account? It's as ridiculous as the price of some of the paintings that sell at art galleries! I can't imagine a game account selling for that much.

      It may not be that someone would be $10,000 for the account. But if you sell off the individual things in that account, it might be possible to add up to that amount. A few hundred here and there add up.

      That's probably what's happening in this case.

      Cheers

      • It's a chop shop for WoW characters. My old 95 Nissan Altima is worth more as parts than it is as a vehicle.

        Layne
      • But how many individual things does each toon have that aren't soulbound? Most of the best items in the game get soulbound to the player. So, the chop-shop thought doesn't work. Unless you are talking about a guild bank type player.

        Seriously, if you really wanted to, you can hit 60 in WoW in a few weeks without killing yourself.

        This all comes down to the e-penis factor. People will pay that kind of cash to have the biggest e-penis there is. And for WoW players, that means having a completely tricked ou

        • But how many individual things does each toon have that aren't soulbound? Most of the best items in the game get soulbound to the player. So, the chop-shop thought doesn't work. Unless you are talking about a guild bank type player.

          Guild bank aside, I have a ton of stuff on my account. I have tons of high level tradeskill junk like arcanite, mooncloth, stacks of thorium bars, essences, enchanting shards and dusts. I have some rare and epic items not souldbound just sitting in the bank. I have a few hundred

    • Why is it ridiculous? (Score:4, Interesting)

      by TheLink ( 130905 ) on Tuesday August 15, 2006 @11:10AM (#15910313) Journal
      A WoW account is a bunch of digits in some computer. Most USD10K is a bunch of digits in some computer.

      So it's a matter of supply and demand. Heck it may be harder to forge items in some online games than it is to forge paper USD.

      Some game items might take months to get for normal people, so if a game account has characters loaded up with rare weapons, I figure some people might actually pay USD10K for it.

      Seriously though, if the cops don't take theft of such stuff seriously or similar crimes, then more and more people might actually resort to unlawful actions.

      Just like that guy in China who killed a fellow gamer - the murderer lent his sword (which he only just got at that time) to his "friend" who then sold it for USD900. In China many people consider USD250 a month a good wage. And it might have been worth more than USD900 to the original owner (who might only have sold it for more- thieves often sell for lower than market rate, so I guess it could be worth significantly more which is why he wasn't happy when his "friend" offered to give him the USD900).

      I'm not saying he was right to kill, but I'm not surprised he did. People have been killed for far less than four months average salary. Especially when betrayal and other stuff is involved.

      To his defense, he actually did go to the cops first, but:
      "Before the attack Mr Chengwei told police about the theft who said the weapon was not real property"

      Not real property? Something that sold for 4 months wages? Two lives wasted (one dead and one suspended death sentence - might get out in 15 years if lucky) because the cops didn't take things seriously. Maybe the Chinese courts cut him some slack, coz over there it's real death for so many things - e.g. hooliganism, "stirring up fights and causing trouble". The parents of the dead guy are still calling for his blood though.

      In South Korea the cops actually do recognize such crimes (maybe many of them play those games too and thus can understand the value of some "dragon sabre").

      Many stamp collections are worth far more than their face value.

      How about the recent case - a teddy bear (Mabel?) that used to belong to Elvis, apparently worth USD75K got savaged by a guard dog assigned to protect the bear collection/display.

      Should the cops and courts say, "It's only an old toy bear" ? After all who can imagine paying USD75K for an old toy bear?

      For justice to be served one should not be quick to judge, nor take everything at face value.

      • Not real property? Something that sold for 4 months wages?

        It's not his property, it's an item in a game owned and operated by someone else, which at one point was carried by his character in that game. If people want to attach value to virtual items which can be arbitrary created and destroyed, that's their problem.

        Supposing you bought a sword for $500, then the game designers made a change that made that sword worthless, or removed the item from the game altogether, what would you do then?

        • There are lots of items that can be devalued at someone else's whim. Once it gets serious enough that more companies start implementing in-game, "legit" systems, I bet you see the item fluctuations controlled more.
        • I think if I steal your casino chips it's still theft.

          I could say a very similar thing for shares traded on a stock exchange. How many think Skype was worth what ebay paid for it?

          There are laws regulating publicly held companies - they can't just create new shares arbitrarily, or suddenly not recognize existing shares.

          Also, if the central bank of your country chooses to print/create more money, it will devalue the money you already have. It's called inflation. Hyperinflation did actually happen in many coun
          • I think if I steal your casino chips it's still theft.

            You pay the casino for the chips. You don't play Blizzard for your Supreme Sword of 0wn-ness, you pay them to play the game.

            Stealing someone's WoW item is like stealing money from the bank in monopoly.
        • I think the sword was a real sword, not from a video game.

    • Re:That's a Lot of Cash (Score:1, Insightful)

      by Anonymous Coward
      Come on people, nobody is that addicted? Who can imagine paying $10,000 for a WOW account? It's as ridiculous as the price of some of the paintings that sell at art galleries! I can't imagine a game account selling for that much.

      The account itself may not sell for $10,000, because that's a lot of money and it's something that is fairly easily traced, assuming the victim presses the issue with Blizzard. However, if you can snag the passwords for an account, it may have several well-developed characters w

  • 'For a lot of the customers out there, there is more store value on their MMO characters than there is on the credit card with which they pay for the account,'

    If that was really true, MMO's would let users pay their monthly fees with virtual gold.

    • Re:Value is in the eye of the beholder (Score:5, Insightful)

      by ichigo 2.0 ( 900288 ) on Tuesday August 15, 2006 @10:08AM (#15909919)
      If that was really true, MMO's would let users pay their monthly fees with virtual gold.

      Read the quote you copied again. Some of the customers value their MMO characters more. If a customer values rocks more than dollars, does it mean Dell will sell him an laptop for rocks? Of course not. To a MMO customer virtual gold is a limited commodity, and involves grinding and work to create. To Blizzard virtual gold has no value, as they can create it in unlimited amounts with a press of a button.
      • The quote reads as I stated, not as you claim.

        It specifically says there is more store value to the account than to the credit card used to pay the subscription fees. Store value, not perceived worth by the customer themselves.

        • No, it specifically says that there is more store value to the account than to the credit card used to pay the subscription fees, for a lot of the customers out there. Obviously you're not one of those customers (neither am I), but there are people out there to whom their account is worth a lot more than the subscription fees they've paid for them.
          • The definition of "store value" refers to the ability of an entity as a deposit for later financial recoup. Specifically, this is a feature of negotiable currency, which is referred to as its "store of value" nature. Since the article specifically uses the phrase "store value", the article is referring to a negotiable financial store. If the value were a perceived value by the owner, the phrase "store value" would not have been used.

            In other words, it's not perceived value, it's a specific value of a monet
            • If many customers are prepared to pay real money for items and characters in a MMO, then don't the items then have store value to the customers? That doesn't necessarily mean that entities outside this economic system have to accept items from these customers as payment. Lots of people think paper money stores value, but if I decide that it isn't worth the paper it's printed on, then you can't force me to accept it as payment. Therefore, virtual gold has store value to those that believe it has, but it does
    • Puzzle Pirates is an MMO where you can pay your fees in virtual gold. For example, a shop badge (which lets you play more puzzles) costs 5 doubloons/month. You can buy 5D for ~$1-2 real money, or you can buy doubloons with the in-game currency of pieces of eight at about 1000 POE= 1D. You can buy a ship for ~50D: real cash that's $20 or about 50,000 POE. You'd have to play a lot, but it's doable.

      I've heard of others, but can't remember them right now. (EVE, maybe?)

    • I DO pay for my Eve access with my ingame currency. Here's how:

      The one way in which CCP allows Eve users to use ingame currency for out of game stuff is to buy timecodes from other players. Those players spent real game cash to get the timecards, so CCP is still getting their cut. So it's true that CCP is not accepting the currency for playtime directly, they are agreeing in principle that paying for gametime with ingame currency is "OK".

      This practice is somewhat controversial in the Eve community. It's not
    • If that was really true, MMO's would let users pay their monthly fees with virtual gold.

      You can do this in Eve.


    • Some MMOs actually do allow players to pay for their accounts with in-game currency.

      People in EVE-ONLINE do it all the time. CCP allows people to buy an EVE-ONLINE Time Card and resell it to gamers for in-game currency isks. So some people do pay for their accounts with virtual money; but, at some point, someone had to pay for with the less virtual but noless intangible hard formal currency.
    • You can pay your monthly fees in EVE Online using virtual ISK (dollars) collected in the game.

  • Good practices (Score:5, Insightful)

    by andrewman327 ( 635952 ) on Tuesday August 15, 2006 @09:54AM (#15909820) Homepage Journal
    As with all of these hacks, the key is vigilence. I know that Runescape has an optional banking PIN number that has to be selected by clicking on randomly positioned numbers. I know that screengrabbers can still read it, but it is a good step. Change your password often, especially if you game from public computers. Even reputable Internet cafes can have a malicious user who installed a small hardware keylogger a few hours ago to steal passwords.


    I have read many tales on gaming forums of "I gave my password to person X for this reason and now 300 people have it." Do not give your password or other information to anyone for any reason. Report players who try to get it from you to the appropriate authority. Also avoid websites that offer training or any other gimmick that requires account info. I know that identity theft (real or virtual) is impossible to prevent 100% but common sense steps can make it much more difficult.

  • Write Little Say Little (Score:2, Insightful)

    by FST ( 766202 )
    The article (a whopping 300 words long) says not much more than "people are selling mmorpg accounts on the black market". How is this not obvious, let alone even slightly newsworthy even on a slow day?
  • ...of somebody breaking into my house and stealing all my cigs, scotch and cocaine?



    Which is to say, how much of the theft is from true strangers, and how much from wives and girl friends?

  • PEBCAK (Score:5, Informative)

    by spyrochaete ( 707033 ) on Tuesday August 15, 2006 @10:14AM (#15909947) Homepage Journal
    I've played a few MMORPGs (WoW, Guild Wars, Anarchy Online) and I've only seen one kind of keylogger exploit - the kind you install yourself. People shout in-game "Visit www.guildcheats.com for Guild Wars god mode!" and the like. It's just a case of the greedy preying on the greedy. Circle of life. If your account is stolen it's 99.9% likely that it's your own fault.

    Even so, in the case of Guild Wars, which has given me better support than any piece of software in my whole life, I go out of my way to report these instances with screenshots or URLs when I find supposed cheats in torrents. The sanctity of the game is at stake when unscrupulous parties try to hijack others' accounts and lewt.
  • To prevent wholesale account-jacking, any time an account has "suspicious" activity, such as wholesale giving-away of assets or being played from IP addresses on opposite sides of the planet on the same day, the game would make you answer a "security question" you set up when you created the account. It would also email you at a third-party email account and possibly even phone you or send snail-mail.

    Customers who rarely trade and never play away from home will also have the option of "locking" their accou
    • This kind of authentication will only happen if and when account hijacking is caused by something other than the end user trying to cheat. Right now MMOGs can't be bothered to make life easier for cheaters. People lose accounts because they try to install third party software on top of their games. No systemwide keylogger cares about game passwords yet.

      According to Guild Wars, all trades and transactions are final and cannot be undone by anyone. All account\behaviour violations result in a permenant
  • I could be mistaken on how bad the problem is on 'other' games, but Neopets (and now Gaia) are very poignant, large-scale examples of some people's willingness to cheat the system only to find themselves scammed (largely because the game itself is free, and the userbase is proportionally dumber than most systems you 'pay' for).

    The only thing this article points out is how much 'wealth' is tied up in these programs (and I can believe that, seeing how I probably have a down payment for a car tied up in my Gai

  • Typically the user's fault. (Score:1, Insightful)

    by Anonymous Coward
    Most of the account stealing in question has nothing to do with security flaws within the game itself, and more to do with user stupidity.

    1. User gets themselves infected with malware. Many executables out there that claim to be "cheat" tools for the game end up simply being trojans with keyloggers designed to steal your account name and password. The solution is not to download what you think is a cheat or hacks, and to follow standard steps to prevent yourself from getting malware.

    2. Many users will use

  • Quite a feat fitting 5 figures in there (Score:3, Funny)

    by sixdaywar ( 995478 ) on Tuesday August 15, 2006 @10:59AM (#15910232)
    In fact, some game accounts can be worth up to $10,000.
    I've also heard the population of African Elephants has tripled in the last six months.
  • selling their gold/equipment for money in the real world.
    This has been a popular way to make money in EverQuest for YEARS. Only not hackers, but actual players sell their stuff. Nothing new at all. Hackers selling your stuff? It's like a theif selling your stuff at a pawn shop. It was bound to happen sooner or later.

  • Saw it at GDC (Score:4, Informative)

    by Dixie_Flatline ( 5077 ) <vincent.jan.gohNO@SPAMgmail.com> on Tuesday August 15, 2006 @11:12AM (#15910328) Homepage
    I saw Weinstein's talk at GDC a few months ago, and this article really doesn't do it justice. His talk is mostly speculative; there aren't any cases of accounts being sold for thousands of dollars out there. However, he does point out the stuff to be aware of when writing and designing an online game. He also doesn't limit the talk to MMOs, though that's the most common kind of online game these days. A game like Unreal Tournament with the server browser can also be a security risk, but it's worth less money than stealing gold in WoW.

    If you have a chance, see his talk. He's an old-school gamer and game programmer, so he's not just some guy that understands security and nothing else.

    • Re:Saw it at GDC (Score:2, Informative)

      by Araxen ( 561411 )
      Apparently you missed the boat, because when Everquest was at it's height of popularity. It wasn't uncommon to see accounts going for $2000+ easily.
    • there aren't any cases of accounts being sold for thousands of dollars out there.

      You're right that this isn't the case now, because the market is saturated with accounts for sale. 3-4 years ago, though, it was not unheard-of for an Everquest account with multiple well-equipped high-level characters to go for over $1000.
  • WARNING: Anecdotal reply. :-) On the WoW server I am on, two players that I am aware of (one from my guild) have had their accounts jacked by keyloggers in the past week. In the case of my guildmate, the keylogger was, as far as we can tell, installed by website malware and not by trojan. S/he logged on to find every possession of every 'toon gone, and even the hunter toons pets dismissed - a purely malicious touch, since there was no way for the intruder to make money off of that. However, I just wante

  • Basic rules of not getting scammed in a MMORPG (Score:1, Interesting)

    by Anonymous Coward
    As a fairly hardcore MMORPG player, who's been playing FFXI for 3 years and has played about with WoW on the side as well, I'd offer the following (fairly obvious) advice to anybody wanting to keep their character secure.

    1) Do not ever lend "virtual" currency or items to anybody you do not know in real life unless you can accept their loss. By "know in real life", I mean "know and see on a regular basis and are on good terms with", not "met once at a convention". Many people adopt in-game personas drastical
    • Though its been stated on slashdot in the past, there are a number of scams within the game of WOW being used to steal your gold. One involves the Auction house. For those of you who don't play WOW, the AH works like ebay, with a buyout feature. These scammers put a fairly low minimum bid price for items (like 2 gold), with a 99 gold buy out. People see the low minimum bid and attempt to buy the item out, not noticing that they've paid 99 gold for something not worth 5.

      A second scam involves the mail sy
  • Well if you consider that 8 or 9 years ago, this same type of thing was happening in UO, i'd say the articles a bit late. The funniest part about this is whenever i hear someone say "i got haxed!!!", the first thing i always say to them is "who did you tell your password to?". I would say 95% of all cases of this i have heard of in various games has been user error. Trust NO ONE. I've never given my password to anyone, except people i can beat down in real life, and coincidentally I have never had a game ac
  • This has been going on for years! No wonder it was so wide-spread if the developers had no idea it was going on. Not to mention that their games are to blame for this. Most are very insecure. I can remember my best friend having one of his Diablo 2 accounts stolen about 4-5 years ago. There was no recourse he could take to get his account back. Atleast now a days in WoW ther eis a process you can go through to reclaim your account and any items the hacker might have destroyed or characters he might have del
  • I figure this will only become worse as MMO's become more popular. The irony is I was just working on our plans to address this growing problem the other day. We got some ideas on how to address this in the works.
  • Whether or not you believe it, people can and do sell online accounts and items for RW money. I think the going rate on ebay right now is something like $1 U.S. dollar for 3,000 platinum pieces. Maybe one person doesn't sell an entire account for ten thousand dollars, but selling a bunch of people $50 dollars worth of online MMORPG items, it can add up really fast. I'm just glad that runescape, my MMORPG of choice, has never allowed people who sell items for real world money to keep their accounts. Thats

Slashdot Top Deals

"Ninety percent of baseball is half mental." -- Yogi Berra

Close