Vulnerabilities / Threats
3/11/2010
07:02 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

GDC: Developers Vs. Cybercriminals

At the Game Developers Conference, accounts of run ins with hackers show many gaming firms haven't grasped how cybercrime can ruin everything.

Cybersecurity is a serious issue for any online business, but for online gaming companies it's doubly so.

Beyond issues of data protection, which are similar for any company that handles customer data, Internet gaming companies can be damaged by cyber attacks in a broader variety of ways than other companies.

Online retailers for example may suffer financially when they get hacked or hit with a denial of service attack, but damage to physical assets is likely to be insulated from online threats.

For operators of online games, however, hackers threaten not only revenue and user trust, but user experience and the intellectual property -- game source code -- upon which the business is built.

The ongoing exploitation of game bugs for fraud and cheating can be compared to altering Amazon.com so that links don't work, pages don't load, and recommendations don't fit users -- the result is a poor user experience that can drive customers away and limit both immediate and future revenue.

It can also raise support costs as frustrated players call to recover stolen game items or to deal with in-game problems.

At the Game Developers Conference on Wednesday afternoon, Patrick Wyatt, COO of En Masse Entertainment, recounted his extensive experience with hackers, cheaters, griefers, and cybercriminals in an effort to help game developers understand that game security can't be an afterthought. Having worked on Warcraft, Diablo, Starcraft, Guild Wars, and Aion, he has seen his share of hacking.

"Hacking games is as easy to do now as it was 20 years ago," Wyatt lamented, pointing to the recently released blockbuster Modern Warfare 2, which is vulnerable to a character speed hack.

And the incentive to hack games has risen as virtual goods have been embraced by the masses: Online games are like banks, but without regulations and expensive security measures. Gold farming and gold frauding -- undesirable and illegal methods respectively of amassing huge amounts of in-game currency for black market resale -- cause losses to the gaming industry of somewhere between $1 billion and $15 billion, Wyatt estimated, though he conceded that no one really has accurate figures.

The potential ramifications for gaming companies are significant: degradation of the play environment, fraud prevention technology integration costs, customer support costs, billing transaction costs, billing charge-back fees (from stolen credit cards used to open accounts), fines from credit card brands, enforcement false positives (turning away legitimate customers), and problems selling digital goods.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2006-1318
Published: 2014-09-19
Microsoft Office 2003 SP1 and SP2, Office XP SP3, Office 2000 SP3, Office 2004 for Mac, and Office X for Mac do not properly parse record lengths, which allows remote attackers to execute arbitrary code via a malformed control in an Office document, aka "Microsoft Office Control Vulnerability."

CVE-2012-2588
Published: 2014-09-19
Multiple cross-site scripting (XSS) vulnerabilities in MailEnable Enterprise 6.5 allow remote attackers to inject arbitrary web script or HTML via the (1) From, (2) To, or (3) Subject header or (4) body in an SMTP e-mail message.

CVE-2012-6659
Published: 2014-09-19
Cross-site scripting (XSS) vulnerability in the admin interface in Phorum before 5.2.19 allows remote attackers to inject arbitrary web script or HTML via a crafted URL.

CVE-2014-1391
Published: 2014-09-19
QT Media Foundation in Apple OS X before 10.9.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted movie file with RLE encoding.

CVE-2014-3614
Published: 2014-09-19
Unspecified vulnerability in PowerDNS Recursor (aka pdns_recursor) 3.6.x before 3.6.1 allows remote attackers to cause a denial of service (crash) via an unknown sequence of malformed packets.

Best of the Web
Dark Reading Radio