ENISA releases paper on Security and Privacy in online games and social and corporate virtual worlds

The European Network and Information Security Agency has just released their latest position paper on “Security and Privacy in Virtual Worlds and Gaming”.

Malicious programs that specifically target online games and virtual worlds aimed at stealing online game passwords are becoming a serious problem. Such malware is invariably aimed at the theft of virtual property accumulated in a user’s account and its sale for real money. The failure to recognise the importance of protecting the real-money value locked up in this grey-zone of the economy is leading to an exponential increase in attacks targeting online MMO/VWs.

The main body of this report describes in detail these risks and others, including privacy risks in MMO's, in-game access-control vulnerabilities, scripting vulnerabilities, denial of service, spam and threats to minors, before making a number of recommendations on how to remedy them.

To provide evidence for the report, we conducted a survey of 1500 users of MMO/VWs. The complete results can be viewed at the following link:

http://www.enisa.europa.eu/doc/pdf/other/survey_vw.pdf

(Photo under creative commons from thms.nl's photostream)