Exploiting QuickTime flaws in 'Second Life'
WASHINGTON--Researchers Charlie Miller of Independent Security Evaluators, and Dino Dai Zovi, turned their attention to Second Life during a Saturday morning presentation at ShmooCon, an East Coast computer hacking conference. The researchers didn't exploit a flaw within Linden Labs' Second Life, but within QuickTime. They showed how an attacker could make money stealing from innocent Second Life victims.
Miller and Zovi are both experienced with flaws within Apple products. Miller published the first Apple iPhone flaw shortly after its release. At last year's CanSecWest security conference, Zovi exploited a QuickTime flaw to win a "PWN to Own" hack-a-Mac contest. While Second Life does not install QuickTime, it invites users to install the player if they want to see multimedia files within Second Life.
What Miller and Zovi realized is that while direct communication between an attacker and a victim within Second Life passes through the servers at Linden Labs, multimedia objects are actually stored somewhere else. Hence, an object with a multimedia link could inject malicious code. In this case, researchers exploited a recent flaw within RTSP tunneling.
For their demonstration, they created "the most evil pink box you will ever see." They could have linked their malicious code to attributes of an avatar's hair, clothes, or anything else. They also could have buried the pink box underground or otherwise hidden it, but both researchers admitted they weren't very good players within Second Life.
Within Second Life they used a property that they own to demonstrate the exploit. Linden Labs sent a representative at the conference and a robot to the virtual demonstration site. The robot held a sign saying Hello to ShmooCon attendees watching the live demo.
In the demo, the researchers were able to show that their avatar became infected when it came too near the pink box. The code they used raided the avatar's Linden dollars and emptied the bank account. On the Internet, an attacker can get one dollar for every 275 Linden dollars stolen, so there is a financial incentive to these attacks and other future attacks. The attack demonstrated today works only on the property they own, and for the safety of others they put up signs perimeter that clearly stated a demo of an exploit was in progress.
To protect yourself while in Second Life, the researchers suggested either turning off multimedia altogether, or setting the multimedia preference within Second Life not to play streaming video when available, but to ask the user first.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.
If you're not aware of it, be sure to patch. If you're running a regular SL client, you *might* not be warned by LL; however, Windlight will force you to update QT.
- just the facts
-
by csven
February 17, 2008 8:52 AM PST
- "What Miller and Zovi realized..."
-
Reply to this comment
-
(5 Comments)Hardly. Most people in SL with half a clue know that *text* communication passes through LL servers and media streams like music and QT video are direct. No "realized" to it. The author of this story should research a bit more, imo.
In addition, what this story leaves out is whether they were hacking through the *most recent* QT update (which supposedly fixes a *new* RTSP bug announced in January... after the patch to the previous RTSP "avatar hack"). If they weren't using the latest QT, then this isn't news. Personally, I don't think it'd even qualify as a decent blog entry.