Report: Hackers say they can steal 'Second Life' currency

Over on Dean Takahashi's San Jose Mercury News blog today, he reported on the discovery by a pair of security researchers that it may be possible to steal Second Life users' in-world currency.

That would be a big problem, of course, because the currency, known as Linden dollars, are directly convertible to U.S. dollars.

According to Takahashi's story, hackers Charles Miller and Dino Dai Zovi told him that they have uncovered an exploit that could allow someone to fleece Second Life residents of their Linden dollars.

The exploit is related to Apple's QuickTime software, which is used to display videos in Second Life.

"The exploit works because Second Life allows users to embed videos or pictures on their characters or their virtual property," Takahashi wrote. "When someone comes nearby and is within view of the object, the Second Life software activates QuickTime so it can play the video or picture. In doing so, QuickTime directs the Second Life software to a Web site. By exploiting the flaw in QuickTime, the hackers can direct the Second Life software to a malicious Web site that then allows them to take over the Second Life avatar.

The end result of that could be that a malicious hacker could then strip the avatar of any Linden dollar holdings.

For its part, Takahashi wrote, Linden Lab told him that the exploit is easily patched. Nonetheless, the company put up a warning on its blog Friday.

Takahashi said that Linden Lab told him, "We were alerted a short time ago by Internet security professionals that a QuickTime exploit has been discovered which may allow an attacker to crash or exploit any user of the QuickTime software from Apple. The Second Life viewer uses QT to play videos and therefore this exploit could potentially affect the residents of Second Life. This exploit affects all platforms that use QuickTime and, to date, Apple has not released a fix for it."

To date, however, Takahashi wrote, Linden Lab said it isn't aware of anyone actually using the exploit to rob anyone.

For residents of Second Life, then, the solution may be to avoid holding onto large numbers of Linden dollars.

As I told Takahashi when he asked me to comment for his story on Linden dollar security, "As one SL business owner said to me...you should always have a backup plan in case of a glitch that causes you to lose everything, because you never know what might happen. And in the case of Linden dollars, that likely means doing regular (Linden dollar/U.S. dollar) exchanges so as not to keep too many Lindens in your SL account. You can't lose what's not there."