What you are seeing here is a sign of virtual commerce in action. Two security experts, Dino Dai Zovi and Charles Miller have devised a way to use a Second Life exploit to strip a character of all its in-game money from up to 100 virtual feet. This wouldn’t be such a big deal if virtual dollars in Second Life couldn’t be converted to honest to goodness cash.

How does it work?

Virtual Bedlam

One of the biggest draws of Second Life is that it has a rich underlying scripting language that allows you to create everything from cloths to cars from first principles. The flip side is that you can also generate some pretty nasty scripts. In this case, all an avatar has to do is wander onto the hacker’s plot of land and have video enabled. At this point the script runs and the pocket, as they say, is picked. In this example to the sound of $12 Linden dollars.

The problem is easily patched and it’s very unlikely that anyone will be seriously damaged, but the question becomes, how likely is it that other exploits just like this exist? As the lines between real world commerce and virtual economics blur, I have no doubt that industrious hackers will find any way that they can to use these systems to turn a quick buck.

Unfortunately, unlike the real world where crimes like these can be mitigated by banks and police, tracking down virtual criminals is a bit harder. While there is always the option of using real world law enforcement, that becomes difficult when the criminal is across the globe.

Is there a solution? Sure there is. Maybe we should start treating virtual worlds in the same way that we treat the real world. At least when real world dollars are at stake.

While there would be quite a bit of overhead, setting up some kind of rudimentary policing needs to happen. Strange behavior, say, transferring your entire account into another avatar’s hands, could be flagged and then if that avatar was reported he could have his account locked until an investigation was completed.

Since most of the details of the crime would be logged, it shouldn’t take too much effort to get the situation sorted and either ban the avatar or transfer his ill gotten gains back to the owner.

A similar technique could be used for everything from griefing to violations of the Terms of Service.

Web 2.0 Roundup

The point is that if you are going to start pretending that these are real worlds, you need to recognize that some of the same problems that the real world faces will start to infect your society. Simply ignoring them or hoping that they don’t become too prevalent seems like setting yourself up for a rude awakening. Instead, it would be in the best interest of the designers of these worlds to put in place the mechanisms to handle these problems as they arise.

A little proactive thinking can save a lot of future headaches. What do you think?

[Be sure to subscribe to the RSS feed before leaving]