Vulnerabilities / Threats
3/11/2010
07:02 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

GDC: Developers Vs. Cybercriminals

At the Game Developers Conference, accounts of run ins with hackers show many gaming firms haven't grasped how cybercrime can ruin everything.

Cybersecurity is a serious issue for any online business, but for online gaming companies it's doubly so.

Beyond issues of data protection, which are similar for any company that handles customer data, Internet gaming companies can be damaged by cyber attacks in a broader variety of ways than other companies.

Online retailers for example may suffer financially when they get hacked or hit with a denial of service attack, but damage to physical assets is likely to be insulated from online threats.

For operators of online games, however, hackers threaten not only revenue and user trust, but user experience and the intellectual property -- game source code -- upon which the business is built.

The ongoing exploitation of game bugs for fraud and cheating can be compared to altering Amazon.com so that links don't work, pages don't load, and recommendations don't fit users -- the result is a poor user experience that can drive customers away and limit both immediate and future revenue.

It can also raise support costs as frustrated players call to recover stolen game items or to deal with in-game problems.

At the Game Developers Conference on Wednesday afternoon, Patrick Wyatt, COO of En Masse Entertainment, recounted his extensive experience with hackers, cheaters, griefers, and cybercriminals in an effort to help game developers understand that game security can't be an afterthought. Having worked on Warcraft, Diablo, Starcraft, Guild Wars, and Aion, he has seen his share of hacking.

"Hacking games is as easy to do now as it was 20 years ago," Wyatt lamented, pointing to the recently released blockbuster Modern Warfare 2, which is vulnerable to a character speed hack.

And the incentive to hack games has risen as virtual goods have been embraced by the masses: Online games are like banks, but without regulations and expensive security measures. Gold farming and gold frauding -- undesirable and illegal methods respectively of amassing huge amounts of in-game currency for black market resale -- cause losses to the gaming industry of somewhere between $1 billion and $15 billion, Wyatt estimated, though he conceded that no one really has accurate figures.

The potential ramifications for gaming companies are significant: degradation of the play environment, fraud prevention technology integration costs, customer support costs, billing transaction costs, billing charge-back fees (from stolen credit cards used to open accounts), fines from credit card brands, enforcement false positives (turning away legitimate customers), and problems selling digital goods.

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0986
Published: 2015-05-26
Multiple stack-based buffer overflows in Moxa VPort ActiveX SDK Plus before 2.8 allow remote attackers to insert assembly-code lines via vectors involving a regkey (1) set or (2) get command.

CVE-2015-3808
Published: 2015-05-26
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not reject a zero length, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

CVE-2015-3809
Published: 2015-05-26
The dissect_lbmr_pser function in epan/dissectors/packet-lbmr.c in the LBMR dissector in Wireshark 1.12.x before 1.12.5 does not properly track the current offset, which allows remote attackers to cause a denial of service (infinite loop) via a crafted packet.

CVE-2015-3810
Published: 2015-05-26
epan/dissectors/packet-websocket.c in the WebSocket dissector in Wireshark 1.12.x before 1.12.5 uses a recursive algorithm, which allows remote attackers to cause a denial of service (CPU consumption) via a crafted packet.

CVE-2015-3811
Published: 2015-05-26
epan/dissectors/packet-wcp.c in the WCP dissector in Wireshark 1.10.x before 1.10.14 and 1.12.x before 1.12.5 improperly refers to previously processed bytes, which allows remote attackers to cause a denial of service (application crash) via a crafted packet, a different vulnerability than CVE-2015-...

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.