Report: Hackers say they can steal 'Second Life' currency

Over on Dean Takahashi's San Jose Mercury News blog today, he reported on the discovery by a pair of security researchers that it may be possible to steal Second Life users' in-world currency.

That would be a big problem, of course, because the currency, known as Linden dollars, are directly convertible to U.S. dollars.

According to Takahashi's story, hackers Charles Miller and Dino Dai Zovi told him that they have uncovered an exploit that could allow someone to fleece Second Life residents of their Linden dollars.

The exploit is related to Apple's QuickTime software, which is used to display videos in Second Life.

"The exploit works because Second Life allows users to embed videos or pictures on their characters or their virtual property," Takahashi wrote. "When someone comes nearby and is within view of the object, the Second Life software activates QuickTime so it can play the video or picture. In doing so, QuickTime directs the Second Life software to a Web site. By exploiting the flaw in QuickTime, the hackers can direct the Second Life software to a malicious Web site that then allows them to take over the Second Life avatar.

The end result of that could be that a malicious hacker could then strip the avatar of any Linden dollar holdings.

For its part, Takahashi wrote, Linden Lab told him that the exploit is easily patched. Nonetheless, the company put up a warning on its blog Friday.

Takahashi said that Linden Lab told him, "We were alerted a short time ago by Internet security professionals that a QuickTime exploit has been discovered which may allow an attacker to crash or exploit any user of the QuickTime software from Apple. The Second Life viewer uses QT to play videos and therefore this exploit could potentially affect the residents of Second Life. This exploit affects all platforms that use QuickTime and, to date, Apple has not released a fix for it."

To date, however, Takahashi wrote, Linden Lab said it isn't aware of anyone actually using the exploit to rob anyone.

For residents of Second Life, then, the solution may be to avoid holding onto large numbers of Linden dollars.

As I told Takahashi when he asked me to comment for his story on Linden dollar security, "As one SL business owner said to me...you should always have a backup plan in case of a glitch that causes you to lose everything, because you never know what might happen. And in the case of Linden dollars, that likely means doing regular (Linden dollar/U.S. dollar) exchanges so as not to keep too many Lindens in your SL account. You can't lose what's not there."

[Vegaman_Dan]

Linden's Liabilty: Zero

I lost $20K Linden currency last spring during a transfer online within the SL system. There was records of the funds being sent, transferred- and then the system hiccuped. The funds vanished.

The records clearly show it was withdrawn and transferred, but never delivered due to system error. I contacted Linden about it and their answer was that yes, they are aware of the issue and can see that the system failed in this transaction. Their action? None- because the money is virtual, there is no legal liability on their part to do anything about it. They recommeded that I could use my credit card to buy more Linden dollars to replace the funds that their system had lost.

I can understand why they don't want to be liable. The moment you can put a real world value on it inside the game, then that money can be taxed and people would find themselves at the mercy of the IRS for all these transactions. SL could be sued by all those involved, so they have to stay separate.

In cases such as mine, it's just 'too bad, so sad, have a nice day'.

I'm not on SL anymore as a result. I find I have more time for Real Life which is far more intersting.

[gsekse]

Hmmm

Surprising that they just didn't credit you back when they acknowledged the problem.

Guess customer satisfaction is second to getting more of your money.

(never played second life myself, too busy with the real one)

[Perilux]

Apple QuickTime flaw

I want to reiterate that this is an Apple QuickTime issue, not a flaw inherent in Second Life, and as such, affects all platforms and browsers that use QT. Second Life remains a viable environment for conducting business, with a stable economy and the appropriate Resident and economic controls in place.

Linden Lab alerted all Second Life Residents of this exploit both on the official Linden Lab blog and at log-in on Friday afternoon. In addition, the Second Life community is doing a great job of spreading the word, and letting their fellow residents know about the potential issues surrounding the use of QT. I can assure you that no other affected platform is communicating with their customers as thoroughly as we are.

We have measures in place to deal with this type of exploited vulnerability ? including the ability to log and track URLs, identify the attackers and take the appropriate measures, as well as making sure that affected Residents are reimbursed if they should lose any Linden dollars.

We?re hopeful Apple will remedy this problem as soon as possible, and we pledge to alert Residents as soon as the fix has been made.

Joe Miller
VP, Linden Lab
San Francisco, CA

[Lee in San Diego]

I hope you get the bastards

The flaw may be in QuickTime, but the crime was done by people. I
hope that you get the bastards.

[kieranmullen]

This just in...

CNET does another usless story on second life...

Do they own stock or what?

Ratio of players in World of Warcraft is much higher. Yet the number of Second life stories to World of Warcraft is higher.

Go figure. Does CNET own stock in them?

KieranMullen
http://360oregon.com

[troppp]

If...

To Think, if they removed the Linden from the USD and pegged it to the gold standard, the Linden would be worth much more than the USD in notime at all.