Malware and Online Games

Its a crazy world out there. Fox News has a story today about how the Neopets web site is being (indirectly) used to get children to download malware to their computer. After scratching through the article, it appears that what is really happening is that the 'bad guys' are convincing kids to click a link, whether in an email or private message, which in turn causes the malware to install on the computer.

From a vendor perspective, this is both good and bad news.

The good news is that the game itself has not been compromised. This was a social engineering exploit -- try and get the child to voluntariy clikc the link. There was not any hacking and user information was not stolen -- its never a good thing to send your customer base a security breach notification letter.

The bad news is that, unlike the hacking problem, this is much more difficult to remedy or control going forward. Is the vendor supposed to scan every message, every email, every board posting for URL links and verify that the link does not cause a file download or direct to a site that causes a download? How does the vendor re-instill confidence in the game players that the game is still "safe"?

Yet another example of, while legal issues exist, the real issues are how to handle things from the practical standpoint.