http://news.zdnet.com/2100-1009_22-6114046.html Reuters Published on ZDNet News September 10, 2006 "Second Life," the fast-growing online site where hundreds of thousands of people play out fantasy lives online, has suffered a computer security breach that exposed the real-world personal data of its users. Linden Lab, the San Francisco-based company behind the "Second Life" site, said in a letter to its 650,000 users this weekend that its customer database, including names, addresses, passwords and some credit card data, had been compromised. All users--or residents in "Second Life" parlance--are being required to request a new password. Some 286,000 residents have used the site in the past 60 days, according to a count on the home page. "While we realize this is an inconvenience for residents, we believe it's the safest course of action," Cory Ondrejka, the chief technology officer of Linden Lab, said in the message to "Second Life" customers released late on Friday. "Second Life" is a three-dimensional software world on the Web inhabited by animated characters that users design for themselves to interact with other participants. Users buy and sell virtual land and build businesses with currency called "Linden Dollars," which can be exchanged for real currency. Blurring the line between a multiplayer game and an online business, the popularity of the site has spurred Fortune 500 corporations such as Coca-Cola and Wells Fargo, along with architects, authors and musicians to erect virtual outposts of their organizations or personas. Retailer American Apparel has created a business to sell clothing for the "Second Life" avatars users create to represent themselves inside the online world. Musicians such as Duran Duran and Suzanne Vega have held concerts inside "Second Life." The database breach potentially exposed customer data including the unencrypted names and addresses, and the encrypted passwords and encrypted payment information of all "Second Life" users, Linden Lab said in the message to users. Unencrypted credit card information, which is stored on a separate database, was not compromised, it said. The breach was discovered on Wednesday. The company launched an investigation that revealed an intruder was able to access the "Second Life" databases utilizing a "Zero-Day Exploit" through commercial software used on "Second Life" servers. "Due to the nature of the attack, the company cannot determine which individual data were exposed," Linden Lab's statement said. A technical probe is ongoing, it said. The company said it will announced additional security plans on its blog. Story Copyright 2006 Reuters Limited. All rights reserved. _________________________________ HITBSecConf2006 - Malaysia The largest network security event in Asia 32 internationally renowned speakers 7 tracks of hands-on technical training sessions. Register now: http://conference.hitb.org/hitbsecconf2006kl/
This archive was generated by hypermail 2.1.3 : Mon Sep 11 2006 - 01:41:31 PDT