Virtual worlds, real attacks

Online gamers have become a soft target for cybercrime with scams in virtual worlds having a measurable effect on the real economy, as Greg Day explains to Police Professional.

Computer games have been around for as long as many of us can remember and during this time, they have evolved significantly. While one of the most obvious changes has been in the graphics we see as we play, there has also been a considerable evolution in terms of the role gaming plays in our lives and the opportunities it offers.

When gaming first became popular, it was primarily a solo activity and the only way to compete against other gamers was to huddle around one computer. The Internet has changed this: there is no longer a need to be physically in the same place in order to compete, and the growth of virtual worlds has taken gaming to another level, with the integration of the worlds of social networking and gaming.

Nowadays, gaming provides the opportunity to live another life in parallel to the one you have in the real world and, as in reality, money often plays a pivotal role. As a result of this drastic change, online games are now a lucrative business – for game developers, players and cyber crooks. Revenues for virtual worlds topped $1.1 billion in 2006 and are expected to triple by 2009.

As a result, online games have become a prime target for cybercriminals looking to exploit vulnerabilities for money-making gains.

The number of online games, especially massively multi-player online role-playing games (MMOGs), has grown rapidly in recent years and security and data issues have increased in line with this. Online gaming is now starting to suffer from real-world problems – theft of identity and virtual assets, extortion and even terrorist attacks.

MMOGs are supported by virtual online communities, where people compete, fight, buy, sell, trade, study, travel and do many other things that people do in real life. It is therefore not surprising that online gaming is beginning to be plagued by almost all of the problems of the real world.

Online communities can grow their own economies, and virtual currencies are converted into real money and then back into virtual funds, so it is only natural that virtual profits have become increasingly targeted by cybercriminals. If Willie Sutton, the accomplished 20th century American bank robber, was alive today, he would probably have an avatar and would be writing password-stealing Trojans.

Online computer games are large, intricate programs that require permanent Internet connections, so exploitation of vulnerabilities in an online game could be used to steal user data from both real and virtual environments.

Since the beginning of this century, we have seen significant growth in advertising and shopping within games, and this leads to spam, phishing, adware and spyware.

The number of online games and their subscribers is growing at an extraordinarily rapid rate.

According to one study, the online gaming market grew 288 per cent from 2002 to 2005. And according to market research firm Parks Associates, worldwide revenues from online gaming exceeded $1.1 billion in 2006 and the company predicts that the revenues will be three times that next year.

The biggest share of this market is currently MMOGs; predictions are that this position will not change. Moreover, the amount of time people spend playing online games is considerable, with more than 25 per cent of gamers playing for more than 30 hours every week.

So what does all this really mean in terms of the potential for threats to become prevalent and for cybercrime to infiltrate the world of gaming?

In most games, players collect and produce some sort of virtual commodities. These can be virtual objects, such as weapons, clothes, property, furniture, and music, as well as money and relationships – you can be a lord of a castle with many subordinates and even get married virtually. Even names of characters are valuable and can be