I was recently doing some work with everyone’s favorite linux live distro, BackTrack, and had an amusing thought. Wouldn’t it be interesting if cyber criminals (and even nation-states) began developing Armed Avatar Cyber Weaponry. What exactly do I mean by that? Today, many penetration testers take advantage of lightweight, live linux distros like BackTrack and Samurai for their testing. These live distros come with a number of prominent security tools for doing all sorts of things including information gathering, network mapping, vulnerability identification, privilege escalation, reverse engineering, forensics, etc. BackTrack, Sumarai, and other pen testing linux distros essentially act as a hacker’s tool belt making it easy to store and use their favorite tools. Why not do the same for avatars?
In Second Life, a virtual environment with a rich client scripting language (LSL), users have the ability to create avatars that come with an inventory full of malicious scripts and tools. These armed avatars could be bought and sold in the same way identity info, credit card numbers, and zero days are marketed in today’s cyber underground. Nation-states could create massive armies with these avatars to combat adversaries and disrupt their order of operations in the virtual environment.
The avatar’s operator need not know a great deal concerning cyber security and coding. Instead, they would simply need to know how to effectively utilize their malicious tool set (ie: executing scripts, deploying inventory objects, etc). Also, these armed avatars would look and act just as any other avatar in the environment. Users would have no idea which avatars were armed with malicious tool sets in their inventory until it was too late.
We continue to see nation-states, terrorist organizations, and cyber criminals effectively utilize cyperspace as a platform to facilitate asymmetric warfare. Despite lacking financial and military resources, they are able to exploit cyberspace and level the playing field. They understand today’s information age and society’s dependence upon cyber technology and telecommunications. As three-dimensional virtual environments become more pervasive armed avatar armies may become a very real threat. Until then, it’s fun to speculate.
MetaSecurity 