Rick’s Playground

It’s probably the most [discussed,argued,rumured ...] topic in the infosec field for the past few weeks. Starting from all the media hype of “largest synchronized internet security efforts“, “Most serious security vulnerability” etc and tons of speculations on what exactly is wrong, and just a couple of days ago, the security researcher Halvar Flake revealed some educated guess (exact term used by securityfocus) about this flaw and H D Moore put up some POC exploit in Metasploit as well. For geeks who need more information, there are tons of materials on various mailing list, forum, underground articles. 

But for man on the street, Why so serious?  here is an interesting video from the researcher Dan Kaminsky who discovered this vulnerability and is going to present the details in the coming BlackHat 2008 Vigas.

Recently we have seen some rapid growth of information security topics in virtual world, typically relating to MMORPGs and both good and bad. For example World of Warcraft is getting bank-like security while Game Trojans outscore Storm worm.  It has been almost a year since I kicked off my part-time hobby research project on MMORPG security. The progress is rather slow but I am really enjoying the exploring process. It’s really amazing to witness the evolving process of all the virtual worlds. Here are a couple of MMORPG security discussion topics I have raised among the local infosecurity interest groups.

• MMORPG - InfoSec Research Nov 2007
• MMORPG - InfoSec Research Mar 2008

Based on the current trend, more and more MMORPGs are no longer “game” and they become a special type of social communities. There is a newly published research survey from CNNIC(China Network Information Centre). Majority of the users consider the virtual world is a community and have a sense of identity and belongings.

Fig 1. The meanning of a MMORPG to users

Fig 2. What are the factors of an MMORPG most valued by the users

This change of users perception towards MMORPGs also reflect the growing importance of information protection to the virtual world and remind the gaming industry to take it very seriously.