“Second Life from a security perspective is horribly broken*,” says Greg Hogland, author of the book Exploiting Online Games: Cheating Massively Distributed Systems. “When you look at Second Life, you know in your bones they simply did not think about security when they developed this application. It’s broken from the inside.”

Remember the Quicktime exploit? Here they first mentioned it on the Linden blog and in ‘Quicktime Security Update‘ the Lindens say they more or less fixed it. More or less? Well, you client now checks if you have a recent, patched update of Quicktime installed. If not, streaming video is disabled. The Register now mentions this is a rather one-sided and limited fix: so far, nothing has been done to prevent similar un-patched vulnerabilities from exploiting Second Life users in the future. Linden Lab has done little to change the architecture that allowed the exploit to work in the first place.

At the moment, those exploits can only be used to steal money from our balances, but a certain Mr. Miller - curious what he looks like? - says he’s in the process of rewriting the code so it automatically debits credit cards filed on Second Life servers. He also says it would be “trivial” to modify the exploit so it installs a rootkit or other type of backdoor on a vulnerable machine.

Miller also says QuickTime is only one of the potentially vulnerable engines that the Second Life client depends on to render sound or video. Separate engines called fmod and Vivox, which are used to deliver sound effects and voice chat respectively, could also put users at risk.

But sure, Lindens will notice and keep us safe, no? Nah, probably not after a lot of damage is already done and complaints and disputed Linden Dollar transfers start piling up: “They’re not doing much because last night I exploited a character 50 times,” Miller says. “It was my own character, but they didn’t know that. No power from above came down and said: ’stop that.’ They certainly don’t know when it happens because I do it all the time.“

The original exploit is to be demonstrated this weekend at the Shmoocon hacker conference in Washington. Look under ‘Virtual Worlds - Real Exploits’ by Charlie Miller and Dino Dai Zovi in the schedule. Any Lindens attending? I wonder how long it will take before someone puts this to malicious use again, and even more how long it will take Linden to do something about this type vulnerability.

Source: TheRegister

* No ‘only from a security perspective?’ jokes here, please! ;)

UPDATE: A Linden was attending: ‘For their demonstration, they created “the most evil pink box you will ever see.” They could have linked their malicious code to attributes of an avatar’s hair, clothes, or anything else. They also could have buried the pink box underground or otherwise hidden it, but both researchers admitted they weren’t very good players within Second Life. Within Second Life they used a property that they own to demonstrate the exploit. Linden Labs sent a representative at the conference and a robot to the virtual demonstration site. The robot held a sign saying Hello to ShmooCon attendees watching the live demo.‘

Source: CNet

Tags: quicktime, second life client, security

• SLim, not a 'maybe' but a 'soon' in First Look
• The Second Life User Interface Design Contest
• Help! SL Client Crash when any File Dialogue is opened. (on Vista)