"Men easily believe what they want"

Julius Caesar (101 BC-44 BC), Roman politician
(March 15, 44 B.C, Julius Caesar is killed)

Virtual worlds, real threats

PandaLabs -Panda Security's malware analysis and detection laboratory- has detected an increasing amount of malicious codes (usually Trojans) that steal online game and virtual world user credentials.

Cyber-crooks now seek to profit financially from their activity, and are using the most popular tools, programs and services to spread their creations. How does this apply to virtual worlds and online games? In most cases, certain functions, objects and even money can obtained as users play the game. As a result, some less skilled users are willing to pay for items they have been unable to obtain through playing the game. Usually, the items are bought and sold on forums, chats and online auctions. Cyber-crooks use these pages to sell the stolen items.

But even famous pages like eBay are being used to sell 'avatars'. PandaLabs recently discovered (http://pandalabs.pandasecurity.com/archive/Not-all-phishing-is-about-banking.aspx) an eBay user who sold four level 70 (really high) World of Warcraft players for $ 27,000.

"It is difficult to know if it is a stolen avatar or someone who wants to exploit their skill to make money," says Luis Corrons, and adds: "in any case, it is a clear example of the amount of money that can be obtained by selling this type of 'merchandise' and explains why cyber-crooks have focused on online games and virtual worlds".

To obtain the items, cyber-crooks steal legitimate users' passwords. To do so, they create malicious codes aimed at a highly exclusive group of players. This way, Trojans of the Lineage family focus on stealing passwords of the Lineage game, and Trojans of the WoW family target World of Warcraft players.

Consequently, malware could cause users to lose objects and characteristics they have put time and effort into obtaining.

PandaLabs provides tips for players who do not want to lose their items, avatars, etc.:

- Install a security solution with proactive technologies on the computer: This way, you will be protected against malicious codes designed to steal game passwords, even if no previous attack has been launched.

- Keep the computer up-to-date: You must know and resolve all the vulnerabilities that affect the programs used to access these games and others installed on the computer.

- Don't share confidential information: If you access forums and chats to exchange tricks, information, etc. with other players, remember not to provide confidential information (email addresses, credentials, etc.).

- Teach children: Children must know which information they can share and which not. To do so, parents must know the games they access and teach them the correct and safe way of playing.

- Only provide the information necessary in the profiles: When creating player profiles, only provide the information necessary. If it requests a credit card number, etc., select the option to prevent other users from seeing the information, to ensure players other than yourself and the administrator can access your data.

- Report crimes: If inappropriate or criminal behavior is observed, game administrators must be informed. Most virtual worlds have channels for users to report dubious activity.