August 18, 2008
Pirates of the Burning InfoSec
Woo doggie. Man I feel refreshed! I guess a year-long blogcation will do that to you. Well, anyway - I won't say much about my prolonged absence other than to say that it was a long time, I realize that it was a long time, and probably anybody who used to read this blog has since went away. Well, that's OK - we'll think of it like an experiment. If there's anything of use over here, than folks might come back. Otherwise, I should probably shut up. :-)
Moving on. I saw today an article from last month about Security Policy Considerations for Virtual Worlds by Jeff Surat over on HelpNet. Now, maybe you remember (from back in the day), that both I and a colleague did some research on this a year or so ago. Now, I like where Jeff is going with his discussion. He mentions the grey goo infestation, which I thought at the time was fascinating as hell, and he alludes to security (and business) risks that you can open yourself up to by participating in these communities. All interesting stuff.
The only thing I was disappointed by with Jeff's article was that he didn't go into some of the broader fraud impact of these communities. Consider, for example, the following scenario:
Goal: Someone wants to bring 10,000 dollars into the US without filling out any nasty paperwork, alerting the authorities, or having to answer any uncomfortable questions. Can they use SecondLife to do it? Sure... check it out:
Step 1: They sign up for Second Life and get an account.
Step 2: They use the Lindex monetary exchange to exchange their native currency into Linden Dollars.
Step 3: They trade that currency to their associate "in game"
Step 4: They withdraw that currency in the US as USD
Sweet, huh? What if they wanted to launder drug money? Do you think legions of semi-anonymous virtual transactions like a Second Life nightclub might be a good strategy to launder that money. Hmmm... Jeez, ya' think?! I seriously doubt that Linden Labs is keeping meticulous records of currency exchange in game unless somebody in authority (hey Secret Service and OCC, you listening?) requires them to. It'd sure be nice for someone to notice this completely unregulated, borderless, and anonymous monetary exchange.
Oh well. Anyway, interesting stuff over there at HelpNet.
Posted by Ed at August 18, 2008 08:28 AM | TrackBack