Second Life MMOPG Worm

Via Adam MacLeod and Nicholas Weaver, a report on a new worm, this one in the massive multi-player online game (MMOPG) "Second Life". Their discussion is adapted from a private mailing list.

Second Life is a large Massive-Multiplayer Online Game, fashioned more as a development environment than a competition.  Imagine a virtual space the size of, say, Rhode Island.  The computers that support this space divide up the work by simulating plots of land; each computer runs a number of virtual machines, and each virtual machine simulates a chunk of land approximately the size of a large Wal-Mart (including parking lot).  The system is set up to be as transparent as possible to users; that is to say, there should be no perceptual clue that a "seam" exists in virtual space.  Users of the system are allowed to access the VM via a specialized scripting language.  This allows users to imbue an otherwise static object in the virtual world with logic; such as a door that opens upon approach, or a record player that spins and plays a tune when touched.

Sunday night they were brought down by a piece of malcode which may be an Internet first.  I believe it meets the criteria of a worm; it self-replicated, was deliberately seeded on many machines, and spread to every vulnerable machine in their network (where "vulnerable" is defined as those hosts which contained a VM whose land plot was connected in a "land bridge" to a seeded VM).  However, it was not a worm in the traditional sense; it spread only inside the virtual world.  It took the form of a sphere which was programmed to replicate itself as fast as possible.  Within a few minutes, all virtual space was filled with hundreds of millions of spheres, and this took down the system.  Dan Ellis has asked me to explain a little on why it took so long to occur.  This was likely because of some safety precautions the architects of the system; certain calls to the VM include a delay on the order of seconds, and there exists a rule that prevents an object from instantiating another object more than ten virtual meters away from itself.  This means that, given the most efficient spread possible, the malcode would have to iterate several times before crossing onto virtual space run by another computer.

Nicholas Weaver:

Definatly meets the criteria: Objects are "code", and this is autonomous, self replicating code.  Although I'm guessing its spread (complete with 2-D/3-D geographic limits) probably would end up being modeled pretty good by bacterial colony growth. Its domain was just more restricted: the VMs composing the Second Life sandbox. The malcode could probably increase its speed substantially if objects can have velocity: On replication, split into two pieces, one with a random V+, and one with V-. Also even a bit of a "negative" charge on the balls, so they tend to natuarally repel each other. Thus it would spread farther geographically.  It would also up the grief-factor as the objects would be moving pretty quickly. Since the goal of crud like this ("GriefBomb") is to cause mayhem, mobility would really help.

 

This is not the first time malcode has spread inside virtual space; a few months ago another MMORPG called World of Warcraft developed a "plague" due to a programming bug.  I believe that this, however, is the first time an outsider (by using a free account) has been able to take down an enterprise via a Virtual Worm. 
       
Here's an article on the WoW plague: http://www.theregister.co.uk/2005/09/21/wow_virtual_plague/
The gist of it is simple; World of Warcraft is much more competition-oriented than Second Life.  Users fight "monsters" which are game constructs.  New sections of the virtual world are added on a regular basis by the WoW staff.  One such section included a monster that cast a spell upon the user during a fight.  A bug in the code representing the spell (called "corrupted blood"), caused the afflicted user to cast the spell on everyone that user came into contact with.  The effect killed off large numbers of users.       

Nicholas Weaver:

Moreso: You had some users ("griefers") who deliberately contacted the plague and spread it into towns. NPCs, with a fast heal rate, would become infected as well. But because of their heal rate, they wouldn't die, so they would act as carriers.  Entire towns became inhabitable.

 

I don't expect there to be articles yet on the Second Life worm.  However, I was able to find a screen capture someone took in the early stages of the infection.

(Click the screenshot for a larger version.)