AVG finds 11 year-old creating malware to steal game passwords

Kid Canadian pwned gamers

Security firm AVG thinks it has spotted a disturbing new threat in its latest threat report - children with enough programming skills to code and distribute their own malware.

The company said it had recently reverse-engineered one piece of malware that turned out to be the handiwork of an 11 year-old Canadian boy intent on stealing passwords used to access games such as Team Fortress.

Although still exceptions to the rule, AVG is convinced this type of child coder is a real phenomenon, able to wield simple programming languages such as C# (C Sharp) and Visual Basic to carry out mostly attacks aimed at stealing game logins for major platforms such as Steam or manipulating individual games.

Others just want to steal logins in order to exact revenge through an enemy's Facebook account.

"The code usually takes the form of a basic Trojan written using the .NET framework, which is easy to learn for beginners and simple to deploy via a link in an email or posted on a social media page," commented AVG CTO, Yuval Ben-Itzhak.

"We believe these junior programmers are motivated mainly by the thrill of outwitting their peers, rather than financial gain, but it is nevertheless a disturbing and increasing trend," he said.

"It is also logical to assume that at least some of those responsible will be tempted to experiment with much more serious cyber-crimes."

The 11 year old reported by AVG did make some nave mistakes such as including the exact email address used by him to receive stolen addresses inside his code and even that he'd recently been given an iPhone by his parents.

The phrase 'script kiddies' has been around for years, an insulting moniker for teen nuisance hackers working from the bedroom, and then there is LulzSec, a high percentage of whom turned out to be teenage or thereabouts.

The idea that children could be a real menace is stretching this into new territory, but not surprising. If youngsters are using more and more complex games, and basic programming interfaces now exist then it would be more surprising if youngsters weren't tempted to try some Black Hatting.

Meanwhile, the Blackhole Exploit Kit was everywhere in the recent quarter, accounting for 40 percent of all online threats detected by AVG over whole of the year. Other toolkits are chasing it hard as criminals look to make money from the software that serves the malware business, including we now know, children too.

Tags: Personal Tech, security, AVG

Forget BYOD – it's now BYOC

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Email Security and Data Protection

Encrypt your sensitive email

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.