The Baltimore Sun reports that security firm Independent Security Evaluators has disclosed vulnerabilities in the popular MMORPGs Age of Conan and Anarchy Online. The flaws (which have since been patched) allowed a malicious user to read files from and take control of another player's computer.

Using flaws discovered in the games' coding, Independent Security Evaluators said it was able to read confidential files on massive multiplayer online (MMO) games Anarchy Online and its best-selling successor, Age of Conan. ISE, which will reveal the research today on its Web site (securityevaluators.com), said it was also able to take control of a player's computer in the older game.

The vulnerabilities, ISE says, expose a growing concern among industry experts. Many say players of such games should start worrying more about malicious attacks that can endanger confidential and financial data than the virtual battles that revolve around crushing demon skulls and laying siege to ancient towns.

Continue to read: Here

The full details of the attack are available, including a video (hi-res MOV) showing how the targeted player's client can be crashed.

First, the victim is instructed to "view" our attack web page. The cookie payload is then secretly delivered to the victim's computer. As the page reads "under construction" the user is encouraged to try the second link. This time, the payload delivered in the original cookie is loaded and overflows a buffer within the game's memory. Our exploit code then uses the game's internal functions to make the victim's avatar start dancing uncontrollably and equip an item (in this case, a bathing suit) as though the victim were doing these things him/herself. Once in control of the computer, our exploit downloads a second program from our server and executes it. This program reads the victim's Anarchy Online account user name and password from the game's memory and uploads it to our FTP server. Finally, it opens a web browser pointing to a website of our choice.

View the movie and continue to read: Here

News Original From: slashdot

click here for full image