How Minecraft undermined my digital defences By Mark Ward Technology correspondent, BBC News
9 March 2016
Could your children be your weak link when it comes to home security? Minecraft almost saved one of my children.
One of my boys wanted me to approve a mod to the computer. Because I am paranoid about what runs in our main computer, I was able to oversee the entire process.
It all looked great at first glance.
There are many mods that can be added to Minecraft. They can make a wide range of changes to the game. Some add new blocks to the game, while others make it look completely different.
Despite the fact that it was popular among his friends and colleagues, the one he wanted was very difficult to find. It was not the original creator when we found it.
I was suspicious of the buttons on the site that seemed to initiate the download, but in fact led to dead ends with links to other utilities. Grubby ads flashed alongside. I don't think mature Russian women would be interested in meeting my 12-year-old son.
Cybersecurity Alert special Index
Is your smartphone listening to you?
Blackout hacks in Ukraine "could happen anywhere"
After a few dead ends, we clicked the right link but then had to wait while we were put through several re-directs and a pop-up page that could not be shut down if we wanted the mod.
We did, so we stuck with it and the download started. And kept going. And going. It was only a few megabytes large, which was strange. My suspicions aroused, I killed the download over my son's protests. It was just fine. It was just as bad.
It was definitely not the mod that we wanted.
Big target
Soon afterwards, I found a warning about the page saying it was fake. That warning was circulated by the Stop Mod Reposts campaign. Minecraft It is trying to stop popular mods being taken over by cyber-thieves, virus writers, and conmen. It has a long, extensive list of scam pages that offer repackaged mods. It even has an extension for web browsers that warns you when you visit a questionable site.
Chris Boyd (a security researcher at Malwarebytes, and a seasoned scam-spotter) said that "Minecraft" is a large target. He has seen fake pages offering the game free of charge, asking visitors for their Minecraft password and username. There are also a number of scams that offer cheats, skins, and capes.
But, he said, there was a long history of cyber-conmen going after children and the things they do online. He recalls seeing scams in 1999 targeting the Neopets industry - a digital animal popular with younger web users.
Staying safe online
Keep all software current and up-to-date. Anti-virus and antispyware programs are recommended. A firewall is also recommended.
Give your children a computer or laptop account that restricts the types of software they can install.
Use strong passwords (mix letters, numbers and symbols) and do not share them. Do not share them with your friends.
Be cautious about links that are offered in chat forums and in-game.
Talk to your kids about the appropriate behavior.
Choose neutral user names. Use different login details on different sites.
Even if you are being friendly, do not divulge personal information.
Be skeptical about flashy ads and links that link to games, cheats, freebies, or in-game currencies.
Seek out ways to limit online play by children. Check your online privacy settings to determine with whom data is being shared.
Mark James, security firm Eset's Mark James, said that younger gamers are frequently targeted. Many people inadvertently give their age by signing up for a site or service.
Forums can be populated with scammers and conmen offering advice and links that lead to extras, cheats, and pages that contain malware.
"Often in-game chat channels play host to predators waiting for that click on a 'bad' link that infects a device," he said.
There is evidence to show that lurking on a gaming platform pays off for the evil guys. Valve, the company behind the Steam gaming service, announced late last year, that 77,000 accounts have been hijacked each month. Steam's chat system and booby-trapped hyperlinks will allow for the loss of control over those accounts.
Mr James cautioned against "freebies" on social media and warned that people should not be friends with others. He also said that parents need to educate their children about safe browsing, gaming, and what information is appropriate to share.
He said that children can become easy targets if they don't have this information.
He said that "if they want the mod or add-on, they will do almost any thing to get it." "Unfortunately, many young people don't have the perspective to see the long-term consequences if they get caught."
Symantec has statistics that show younger people are being hit frequently. It produced a report in early 2016 that showed that 25% of parents had a child or knew someone who had a child whose online security was compromised.
Jacqueline Beauchere is Microsoft's chief online safety official. She said that scammers go to great lengths in order to get children out.
"Young people are easily enticed to click flashy advertisements, visit unofficial websites of popular celebrities, download so-called 'free' games, and tap 'Agree', 'OK', or 'I accept' to quickly get to where and what they want to online," she said. "Many of these actions are just notorious pathways to viruses, spyware and other malicious software."
Ms Beauchere said that the scammers targeted children because of the caches of valuable loot they could find.
"Among criminals financial and personal data about any and every individual has become a sought-after currency' on the web," she stated. She said that cyber-thieves target children to gain access to this data.
Malwarebtyes' Mr Boyd agreed. He stated that online scammers were helped by the way children access the internet.
"A lot of kids play via their parents tablets, laptops and desktops," he said. "It's very likely that parents re-use login data on other accounts. There's likely to also be a payment option attached to it.
He said that this is the data they want.
He said that this makes it more difficult to police because children know more about technology than their parents. This competence can lead parents to believe that their children are safer online than they are.
He said, "I would be shocked if parents knew much about how technology works."
He said that it is possible to stay safe. It takes partnership between parents as well as children. Both need to educate the other about what they do and how to stay safe.
First look at Minecraft in virtual reality
Is your smartphone listening to you?
2 March 2016
How to hack an average home
25 February 2016
Hanging out with the script kiddies
17 February 2016