Hackers Find Second Life Vulnerability

Could virtual pickpockets separate your Second Life avatar from its in-game money, known as Lindens?

Dean Takahashi of the San Jose Mercury-News reports that a pair of white-hat hackers have identified an SL design flaw which allows a player's Lindens to be lifted. That's especially troubling because Lindens can easily be converted into real-world money.

Charles Miller (left) and Dino Dai Zovi discovered the vulnerability by exploiting a known issue with Apple's QuickTime video software. SL uses QuickTime to stream movies in-game. Said Dai Zovi:

It’s not kindergarten work, but this is pretty easy to do.

The hackers say that they could take over any avatar and remove all of its money and property. That represents a major threat to the players who make their living by creating and selling virtual goods within SL.  

CNET's Daniel Terdiman, author of The Entrepreneur’s Guide to Second Life, told Takahashi:

Second Life does not have bank-like security, nor any guarantees that any inventory item, let alone Linden dollars, won’t disappear...

That said, the economy remains very stable and I haven’t heard of situations where people’s Linden dollar accounts have vanished... Still, as one business owner said to me when I was researching the book, you should always have a backup plan in case of a glitch that causes you to lose everything, because you never know what might happen. 

Hacker Charles Miller said:

This all started when we were thinking about the intersection of virtual worlds and computer security. Banks clearly try to make their operations secure. Game companies haven’t thought about it the same way. They need to think more about security.

Miller notified Linden Lab about the flaw before announcing it. The company has notified SL residents but is apparently dependent upon Apple for a QuickTime fix.