CF Apple Computer

A vulnerability in the QuickTime media player discovered late last month has been exploited to steal virtual currency in the game Second Life (called “Linden Dollars”), a significant problem since Linden Dollars can be converted into US dollars, with an exchange rate of about 250 Linden to one US dollar.

The capability was discovered by Charlie Miller and Dino Dai Zovi , who said “Second Life allows players to embed media files in Second Life objects, and uses QuickTime to handle all video rendering. Furthermore, it is possible to have these media elements constantly playing. If a Second Life avatar walks onto a piece of land that contains an embedded malicious QuickTime File, they can be exploited.

Once the malicious file has been viewed by the victim, the attacker has complete control over the victim’s computer - and Second Life avatar. At this point the exploit could make the avatar do anything they like.