Scott Jennings and NCSoft have put out a good, thorough message on the state of the game's security issues.
The message was posted very early this morning (the 20th) and within the first couple of hours has been viewed almost 10,000 times.
People really care about the security of their accounts and their game.
Security messages on the site get a lot of visits (see stats at the bottom of Scott's message). The last message on account security, from December 24th has had over 131,000 views - far more than any other recent message thread.
It will be interesting to see if this is followed up with any press releases or interviews to the games media.
Hopefully, like Jagex, NCSoft will also pursue legal recourse against criminals who engage in account theft (a clear crime under computer security laws).
Marcus Eikenberry of MarkeeDragon has a 38 minute interview with "Patrick" - a young man who made between $10,000 and $20,000 over the course of one year of criminal scamming:
There are some fascinating details (here are my notes on the highlights):
3:00 Started in Eve Online / GoonSwarm
5:30 Scammed his own Eve Online Corporation as a Director (non GoonSwarm) stole 9B ISK in 2006
6:30 WoW Scam/Griefing casual every month of so
7:30 Lost his job and decided to sell his Eve Online Account.. he took the money and realized he didn't have to transfer the account - there was no protection for intangible items in PayPal Terms of Service - He made $750... used it for rent.
10:00 In order to "beat PayPal", he mailed piece of paper with invalid information... got through Paypal security and send the Shipping Tracking information (PERSONAL NOTE: my company used physical shipments to validate shipments of license keys to avoid fraud problems in 2003).
11:45 Scammers "networking" to develop tactics... Paypal changes and protect buyers, not sellers. Reverse scam to a "Buyer Scam": Buy Item, dispute sale, Resell the account quickly
13:30 Started identity theft ... used stolen name and SSN, to set up fraudulent paypal account tied to his Real bank account + fake ID (there is no cross verification of account names - Marcus is currently checking to see if this weakness still exists)...Patrick worked in HR as recruiter... had info of anyone who applied for a job at the company (IT IS SCARY HOW MANY PEOPLE HAVE ACCESS TO YOUR NAME AND SOCIAL SECURITY NUMBER) then close Paypal account quickly before they put in a dispute... age 21,22. Blames economy, desperation - rent & food problems.
16:30 - All you need to create a PayPal account is a name & SSN (and your own bank account)
16:50 - $10 to $20K in one year... was active for one year.
17:30 - Why he was not caught - only small transactions... keep it under $1000. Paypal "caught up with him" eventually - then he started using other peoples accounts.. that is why he stared ID theft (but they didn't validate account, see above)
19:00 - Paypal is so easy, much easier than direct deposit or wire transfer... a lot of scammers only do this (scamming) once.
20:00 - Last Scam / Biggest Scam - started getting scared. Meet girls "get them to love him" and use their Paypal account (or get them to set up a Paypal account). "Most interesting" found he actually liked the girl. Got a real job and paid her back. Realized what he was doing.
22;15 - Other most exciting was the first one. When you make over $500,... a "means to get by".
23:20 - Security advise... copy of drivers license & prove its actually the person... TrustWho works (NOTE: run by MarkeeDragon - 99.7%).. if they've never done any sales before on the site, don't trust them... reputation at sites is a problem if you haven't done a sale before... TrustWho really "ruined his (scam) business". He was not able to get TrustWho verified.
29:30 CraigsList is great place to scam people. Get 18 year olds with fresh money (after graduation).
30:50 - Successful transactions in past, get drivers license (repeat)... scary how many people have your drivers license and SSN
33:00 - Wrapup by Marcus Eikenberry - scamming women, HR attacks, name & SSN is all it takes
I'd echo Marcus' comments. The potential for abuse by people in Human Resources and customer service is truly frightening, especially in this economy. It is also disheartening how weak our financial authentication systems are.
Korea's Supreme Court has ruled that game currencies can be converted back into real money, unless the game is an online gambling game, such as poker or other card games.
Now, you can play games for a living!
In some sense, the Korean Supreme Court would seem to be using the same "preponderance of skill" standard found in many states in the US for skill games.
(Comments from Korea welcomed!)
At a minimum, this has very serious customer service and security implications. After all, if currency is valuable, than a game company has an obligation to its integrity and security.
The upside for game companies...
Now, you can play games for a living!
This should also increase the attention of law enforcement to "virtual asset" theft.
Will this happen in the US?
Probably, but it will take a while. The rise of Free-to-Play games and proliferation of virtual currencies will likely accelerate the trend as players will want a refund for unused currency - just as they get now with gift cards.
Interesting days ahead.
UPDATE: Players cannot cash in if they used bots or macros (good luck detecting that!).
UPDATE 2: The article also notes that Korea passed a law that the government will collect a VAT of 10 percent on these types of transactions... given the alleged trading volume of $1 Billion or more per year, that is real money in these fiscal hard times (thanks for the reminder, David). This may have even more impact on game companies in terms of record keeping and reporting.
I was watching Marcus Eikenberry's (MarkeeDragon) interview with Geoffrey Zatkin (former designer at SOE for Everquest and current owner and operator of Electronic Entertainment Design and Research) about everybody's favorite topic - Real Money Trading (RMT) / secondary markets:
My notes along the way:
"100s of CS hours per week, millions of dollars a year"
"Myth of the primary market"
"A short circuit in the secondary market is a short circuit in the primary market"
"grind is the design"
I'm always looking for metrics, so numbers like "hundreds of customer service hours per week" and "millions of dollars per year" catch my eye... because I want to focus on "Seven Figure Security" problems.
Good stuff.
Somethings did bother me:
Postulate: A player will quit earlier once they've consumed all of the content (often expressed by items that are accumlated).
Hypothesis: Buying items (via gold farming) short circuits that content.
Assertion: Having items early makes players stop playing earlier.
HOWEVER:
Hypothesis: Friends being able to give friends items is good.
If this was true, than the assertion above would say that having items earlier from friends OR farmers is bad.
...so we have a problem.
There is no secondary market or primary market.
There is only ONE market.
The intent or actions of players external to the game are not part of the market.
This is why the "secondary market" is so hard to "stop".
It is REALLY hard to determine the intent or actions of players outside of the game.
ASIDE:
Once upon a time, I was working on a really big, government security project. One of the things we needed to do was print out labels for our customers.
Our labels were supposed to be unclassified.
There was a real concern that our customers would not be all that smart and they would ask us to create classified labels (where the labels themselves were classified) as opposed to unclassified labels for classified things (and you wonder why I left that world ?).
The suggestion that was being seriously discussed when I started on the project was to create a tool that would "look" at the label data that our customers provided to determine if it was classified. This had gotten pretty serious, people were off looking at parsers, methods to determine if data was classified, etc.
I argued that this was madness.
There was no way that we could determine that other people's data was classified.
Just as there is no way for a spell checker to determine whether you've chosen the wrong word.
END ASIDE
Computers (and other rule based systems) have a heck of a time determine intent.
It is the same with any game.
Games provide mechanisms for exchanging items between players: gifting, "the auction house", contracts, loot sharing, etc.
Players will use those mechanisms to meet their objectives as people, not the developer's objectives. Whether it is for money, for fun, to play with one's friends, to save time, whatever.
Games provide mechanisms for earning items: killing monsters, questing, raiding, PvP, etc.
Players will use those objectives to meet their personal objectives. Gold farming is simply playing a game's economic system really, really efficiently... from within the game, it is not illegal. It is breaking the "social game" that the game developer attempts to impose, but it is not violating the game's mechanics (duping is not farming). Botting is similar, it is a program playing on behalf of a person (as opposed to the client program that the developer provides).
Games provide mechanisms for owning and funding accounts: credit cards, debit cards, passwords, pre-paid cards, offers, ads, Players will use these mechanisms for their own intents - power-leveling, purchasing accounts, phishing, logging in, paying, etc.
Too many times, games confuse accounts with people.
This is why these forms of "social game "cheating" are so difficult to detect... because they are not part of the game's mechanics and cannot be detected from within the game engine... the developer has to "ferret out" the intent of the player.... are you a "good" player?
The social game is important, but it is not the GAME. Its rules are squishy, subject to interpretation and error.
The GAME is simply an "API", an interface to the world, developer need to understand the difference between the game and the world and the nature of the interface. There is no secondary market - there are means to transfer goods within the game and there are means to transfer goods outside of the game.
CCP Games has come out of the closet about its war on gold farmers in its science fiction MMO Eve Online.
... before I say anything else, this is an excellent service to the game industry and it is great that CCP Games has joined Square Enix in a fairly open discussion of what they are (and have) done in their struggle with gold farming.
Thank you CCP Games!!
In short, on June 22, 2009, CCP Games banned around 6200 accounts for gold farming (out of over 300,000 total subscribers or 2 percent... which seems pretty low). Conceptually costing themselves almost $100,000 a month in revenues.
I do believe that these are lost revenues since, if the gold farmers were using fraudulent credit cards, the accounts would presumably be banned as soon as the fraudster is identified.
Ban counts don't include "gold frauders" / credit card criminals (or at least, they shouldn't).
Using the graphs at MMOBux, the average price of Eve's currency, ISK, jumped in the wake of the bans -
from around $5 to $8 per 200,000,000 ISK. The prices have continued to climb to $12 which would indicate a drop in supply EXCEPT there was a much bigger drop in late May 2009.. it looks like ISK is now back where it was in the May time frame (additional info from knowledgeable folks in this area would be welcome).
The charts that CCP provides claim a reduction in ISK trading volume of 10 percent. It may be that the amount of ISK traded has dropped, but it looks like, after a brief downward spike, the number of transactions per day is back where it was (or fairly close). Eve's rich economic system is probably the most robust anti-RMT technique that they have. It would be interesting to compare total "gold farming dollars per month per subscriber" between the different games. My guess is that Eve is on the low side in this regard.
Gold farmers are apparently very CPU intensive for Eve (no data is provided on bandwidth). This number has been trending downward either due to the addition of processors (my guess) or improved efficiency.
Ingunn
Ingunn was apparently a real hub of gold farmer activity and a large number of accounts were banned in that system. Average player population dropped from around 130 concurrent players to closer to 10 or 20. Most likely, this is because of the efficiency of playing in that system for resource extraction. A more interesting question is why was the system such a hub of gold farmer activity?
QUESTION: Could CCP Games have fought gold farmers more simply by reducing the "security level" of the system and making it more of a target for PvP play?
PLEX
This is the latest tactic in CCP Games' "anti-RMT" campaign. The most notable element is PLEX, a legal, in-game version of RMT that allows players to trade game currency for game time (the dual currency system which Matt Mihaly has used and advocated). PLEX effectively creates a "ceiling" price for game currency... but, at some level, does cost CCP Games money as players can avoid paying subscription dollars by earning sufficient currency... if 1200 PLEX licences are sold each day, then the cost is 1200*30*15 just over $540,000 per month (I'm guessing on redemption rates, obviously, based on the claim by CCP Games that trading volume has stabilized).
It is tricky to determine whether this has driven the price of the game's currency down or reduced gold farmer revenues in any meaningful way.
(it would be interesting to look at "one way transfers"/ gifts of currency and item volume over time)
Gold Farmers vs. Credit Card Fraudsters
CCP Games discussion of gold farming combines credit card fraudsters with gold farmers. I don't believe that this is factually correct and is done for rhetorical purposes to tar gold farmers with the same brush as actual credit card criminals (they are not the only company to have done so).
It will be interesting to see if CCP has succeeded in reducing its gold farmer problem or simply replaced it with the "gold frauder" problem found in other games. While gold farmers violate the game's Terms of Service and cost in terms of customer support, gold frauders can pose a much more direct threat to the health of a game by increasing credit card fees and fines. CCP Games seems to have done nothing to reduce demand for ISK. If it is no longer economically viable for gold farmers to succeed, will Gold Frauders step up?
The web is abuzz. The Chinese Government has banned gold farming.
well, perhaps not.
The Chinese government has been very concerned about virtual currencies as a threat to its real currency because of the rise of QQ-coins / Q-coins in Tencent's QQ service (a topic I covered back in late 2006). If you read the actual news from the government, the focus is on QQ-coins.
Cui Ran, an expert on the Chinese online industry, said the regulation aimed to "nip illegal online activities in the bud," as current trading volume was still too small to shake the nation's entire financial system.
Its not gold farming, its a threat to the Yuan. The regulation does not even cover virtual items, only virtual currency:
...includes prepaid game cards, game currencies and game points, while tools and weapons used to play games online are not included.
There are two other concerns that the Chinese government seems to be addressing with this rule - gambling (using virtual currency and then converting it to real currency) and protecting children from "inappropriate content".
While most of the Western coverage has been entranced by gold farming, Juliet Ye of the Wall Street Journal seems to have picked up the real story (outside of Chinese sources).
The regulations also solidify some issue that are of concern to US customers of online games as well:
- If the service is shut off, customers are entitled to a refund of unused currency.
- "virtual currency should be exchanged only for virtual goods and services provided by the issuer of the currency" (this would cause problems for a lot of the third party currency folks here in the US and elsewhere)
- Companies already involved in virtual currency trading are required to register with the local cultural affairs bureau within three months.
- Minors may not buy virtual money. THIS IS POTENTIALLY HUGE. If enforced, this would essentially shut down most MMOs that use the Free-to-Play business model.
The gambling issue is very important. Even "virtual lotteries" are being affected. Giant Interactive, operator of ZT Online, is shutting down its "box opening" game (where players buy treasure boxes that yield random virtual prizes). Interestingly, this would not be considered gambling in the US (and elsewhere) since there is no "real" prize (I don't think - Lawyers?).
As one would expect, everyone in the industry is very positive about the new regulations.
The real question is whether these new regulations would be enforced. Gambling games for virtual currency have become very popular in Chinese casual game services (including Tencent's QQ service). The "open the box" game has been a cornerstone of ZT Online's success and has been copied by many other online game companies both inside and outside of China.
Locking out minors from buying virtual currency could be devastating (and was mentioned only in one line of the statement from the Ministry of Commerce). If it is enforced as "effectively" as the age restrictions for games, I don't think it will be problem, but if enforced vigorously, it would all but eliminate the "free-to-play" business model in what is probably the world's largest online gaming market.
China's government is quite concerned about the power of QQ-coins and any threat to its currency both as a currency and as a vehicle for money laundering. At the same time, they are legitimizing these currencies somewhat by strengthening their "real" value (in this regulation and in other rules that restrict the ability of game companies to freely ban accounts as well as several legal cases that have returned accounts to aggrieved players).
What next?
While "victory" will be declared, I do not think that the restrictions on minors will stand. This will be seen by the continued growth of the "Free-to-Play" model in China.
The game companies have always been officially against the use of their currency as real money, but have been very tolerant of it (and even encouraged players through promoting gambling games and such). These types of "obvious" gambling games are likely to go away and may really hurt the finances of companies like Tencent and Giant Interactive (as well as Sohu and others with casual game portals which are full of casino-style games). "Hardcore" game companies that have stuck with traditional revenue strategies will continue with little impact.
I would not be surprised to see many of these companies aggressively take these business models overseas where the definition of "virtual property" has not been well-defined. Especially in major developing nations like Brazil and Eastern European countries (Russia could be an interesting case as they've just officially banned gambling).
As to gold farming, any developing country loves foreign currency. Don't expect any real action on this issue anywhere anytime soon. This is "entertainment outsourcing" and is almost exclusively the concern of game publishers, not their host governments.
When I first heard about Free-to-Play MMOs, I thought - "Wow, what a great way to kill gold farming!". I grew to like the business model in its own right, but, it seemed to me, the ability to buy anything would be a real death blow to gold farmers.
Wrong-ish.
What is interesting about how most games implement the Free-to-Play model is that only some items can be purchased and others can only be "earned" through game play. This disconnect between time and money is where gold farmers find their opportunity - "game play" items are more valued and valuable than "money pay" items.
This is seen quite clearly in a recent interview with Jörg Koonen, the Community Manager for Runes of Magic. He talks about the game's problem with gold spammers and also about how the players can move from the game's free currencies to the game's paid currency... but not the other way around.
It seems that the developers perception and concern is to find a way to make sure non-paying players (players with more time than money) can earn the benefits of the paying players (players with more money than time).
Free players are not really the problem.
Paying players are.
... They're the ones with the money to go to the gold farmers, after all.
To help fight gold farming, games need a mechanism for paying customes to get the benefits that non-paying customers have (and vice versa).
The best explanation of this concept (if not its creator), is Matt Mihaly's discussion of dual currencies at Lightspeed Venture Partners blog.
In short, there are two game currencies (as in Runes of Magic and many other Free-to-Play games). Ideally, all items can be purchased in one currency or the other AND there is a way for players to directly trade the currencies (through an open stock market pricing system, not a Craigslist-style matching service). One of the key activities of the game operators is to create items in each currency to ensure that both are being consumed steadily.
It is also important that currency is not allowed to exit the game.
The other tactic, rarely used, is to have ONLY a money-based currency where everything can be purchased and no items earned. The best examples of this are Magic Online and now BattleForge, I think. Players can even sell items - it does not affect the game's economy or play of the game because success in the game comes more from game skill than from loot... a lesson that more online games should learn.
(I also recommend you read Allen Varney's interview with Richard Garfield over at The Escapist for an excellent discussion of the game design principles that are critical for these types of games).
You may also want to check out Chapter 22 - Game Commerce: Virtual Items, Real Money Transactions, Gold Farming, Escorting and Power-Leveling in my book Protecting Games.
NHN USA has chosen Live Gamer to operate its player-to-player trading service. The interesting question is whether this is an outsourced offering (where NHN is paying Live Gamer to offer the service) or if Live Gamer pays NHN USA a royalty.
To my view, managing these services should be considered outsourcing. As seen with Sony's move to add formal RMT to Vanguard, the costs of managing these transactions is high in terms of customer support and risk of fraud... and players can still choose to use an unauthorized trading platform to reduce costs.
The real question is whether there is enough margin left in these services to really make money in the face of competition from unauthorized trading.
(By the way, does anyone have any data on how much "unofficial" trading goes on at Sony's Everquest servers that allow RMT?).
Everyone goes on (and on) about the $2 Billion marketplace in virtual goods. However, the theoretical market for the trading service providers (TSPs)? is only a fraction of that. They are competing with unofficial TSPs, they are also competing with gold farmers who act as their own intermediaries. On the high end, their margins are probably 10%, but a good portion of that goes to payment processing, customer support, and handling chargebacks.
If these services are deeply integrated into a game's operations and actual code, they could reduce costs (and manage fraud).
Essentially, this should move towards outsourcing of customer service & payment processing by game companies. In this case, the game operators are mainly funding the operation and marketing of the game and leaving its support to others.
Yves, from France about Making Anti-Piracy Pay - Rethinking DRM Thu, 09.09.2010 01:32 Nearly 2 months without any po
st, even during summertime, th
at's noticeable for all your r
eaders.
sugy steel about NCSoft Responds on GameBots / Bots Thu, 02.09.2010 21:35 is it possible for you to remo
ve a bot that snuffs me approx
6 times a day on mafia wars ?
thanks
Jim Profit about Item Farming in Team Fortress 2 - The Idle Threat Mon, 30.08.2010 01:44 I really don't know why so man
y kiss the ass of Valve. You k
now, fuck. These people also p
robably denounce organiz [...]
marjun about NOTED: Nexon's Combat Arms reaches 2 million users Mon, 26.07.2010 23:47 dude US server s for SA and NA
American country only! and EU
server s for European country
.... i kno it suck but i [...]
Copyright
2005-9. IT GlobalSecure, Inc. All rights reserved. IT GlobalSecure makes every
effort to include citation of sources. If you determine inaccuracies or
omissions, please
contact us. Playnoevil.com is the blog of CEO, Mr. Steve Davis. IT
GlobalSecure~
and its SecurePlay~
are trademarks of IT GlobalSecure, Inc. IT GlobalSecure supports secure
e-commerce processing for web sites including the
SecurePlay Store and commercial
clients, such as Urban Revivals
LLC.
?).
Comments
Thu, 09.09.2010 07:26
You and .... ?
Thu, 09.09.2010 01:32
Nearly 2 months without any po st, even during summertime, th at's noticeable for all your r eaders.
Tue, 07.09.2010 06:54
Yves - Thanks. I was wonder ing if anyone noticed. Stev e
Tue, 07.09.2010 06:08
Nice to see that you're back t o blogging...
Mon, 06.09.2010 05:36
My biggest concern about the S team account bans is my Punkbu ster experience with Battlefie ld 2. I had a graphics [...]
Thu, 02.09.2010 21:35
is it possible for you to remo ve a bot that snuffs me approx 6 times a day on mafia wars ? thanks
Mon, 30.08.2010 22:24
sony can i plz have my account back i av learnt that it was rong to disobay the rules so c an i plz have my account [...]
Mon, 30.08.2010 01:44
I really don't know why so man y kiss the ass of Valve. You k now, fuck. These people also p robably denounce organiz [...]
Tue, 24.08.2010 06:15
lol
Sun, 22.08.2010 23:55
When will there be a new artic le?
Tue, 10.08.2010 15:55
Can anyone tell me...I have a new Dsi machine from KL. It ca me with an R4 which has been u sed in the machine. I th [...]
Mon, 26.07.2010 23:47
dude US server s for SA and NA American country only! and EU server s for European country .... i kno it suck but i [...]
Fri, 16.07.2010 19:55
I,myself have tried to cheat.I t doesn't ban me though but I think they disable the cheats. Bad words result in be [...]
Thu, 15.07.2010 08:19
any 1 tell me how 2 update the client in eudemons online
Wed, 14.07.2010 01:20
wizard 101 is cool