Games: Virtual Thievery

Keep a close eye on your magic wand, or somebody will steal it. World of Warcraft and other Massively Multiplayer Online Role-Playing Games have recently become the target of criminals who seek in-game currency, or gold, because of its real-world value. Cyberthieves break into players' accounts, steal the artifacts and characters acquired during the course of the game, and sell them--sometimes for thousands of dollars. Whereas gold farmers in China have sought to acquire gold legitimately by playing WOW for hours on end, theft is a relatively new phenomenon, says Mikko Hyppönen, chief research officer at F-secure, a cybersecurity firm in Helsinki. "We really didn't see this a year ago."

The most common method of breaking into accounts is to use Trojans--software that installs itself on a PC without the user's knowledge. Since the beginning of the year, Hyppönen has seen 300 new Trojans specifically designed to steal data about WOW accounts emerge. Users are sometimes lured into giving away their data on phishing sites, which look like official Web sites for WOW or other games. In the past six months or so, Mark Murtagh, European technical director at the Web security firm Websense, has seen gangs targeting portals that host hundreds of thousands of game accounts. Although nobody keeps track, Hyppönen estimates that $1 million is stolen annually through these methods, but he expects that figure to climb.

One reason criminals have gone for game crime is because it's less risky than breaking into online bank accounts. Chances are your local police won't even be able to keep a straight face when you report that someone stole your magical potions.

Thieves also benefit from lax virtual-property laws in the United States, where most of these games are made. Designers are reluctant to push for legal recognition of virtual property for fear of being held liable for theft. "Game designers certainly don't want to facilitate hacking, but they often are concerned about their own potential liability for a loophole that creates a hack," says John Fairfield, associate professor of law at Indiana University. "So therefore they don't share the incentives to publicize and enforce as strongly as the owner of the virtual property would." The game companies argue that they own the virtual property, not the players. "Because players don't own it, players can't fight back when it's stolen," says Fairfield. "And that makes players easy victims." Until the matter of ownership gets cleared up, this new crime wave will be tough to stop.