AVG finds 11 year-old creating malware to steal game passwords

Kid Canadian pwned gamers

Security firm AVG thinks it has spotted a disturbing new threat in its latest threat report - children with enough programming skills to code and distribute their own malware.

The company said it had recently reverse-engineered one piece of malware that turned out to be the handiwork of an 11 year-old Canadian boy intent on stealing passwords used to access games such as Team Fortress.

Although still exceptions to the rule, AVG is convinced this type of child coder is a real phenomenon, able to wield simple programming languages such as C# (C Sharp) and Visual Basic to carry out mostly attacks aimed at stealing game logins for major platforms such as Steam or manipulating individual games.

Others just want to steal logins in order to exact revenge through an enemy's Facebook account.

"The code usually takes the form of a basic Trojan written using the .NET framework, which is easy to learn for beginners and simple to deploy via a link in an email or posted on a social media page," commented AVG CTO, Yuval Ben-Itzhak.

"We believe these junior programmers are motivated mainly by the thrill of outwitting their peers, rather than financial gain, but it is nevertheless a disturbing and increasing trend," he said.

"It is also logical to assume that at least some of those responsible will be tempted to experiment with much more serious cyber-crimes."

The 11 year old reported by AVG did make some nave mistakes such as including the exact email address used by him to receive stolen addresses inside his code and even that he'd recently been given an iPhone by his parents.

The phrase 'script kiddies' has been around for years, an insulting moniker for teen nuisance hackers working from the bedroom, and then there is LulzSec, a high percentage of whom turned out to be teenage or thereabouts.

The idea that children could be a real menace is stretching this into new territory, but not surprising. If youngsters are using more and more complex games, and basic programming interfaces now exist then it would be more surprising if youngsters weren't tempted to try some Black Hatting.

Meanwhile, the Blackhole Exploit Kit was everywhere in the recent quarter, accounting for 40 percent of all online threats detected by AVG over whole of the year. Other toolkits are chasing it hard as criminals look to make money from the software that serves the malware business, including we now know, children too.

Tags Personal TechsecurityAVG

Comments

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Business Risk Management Solutions

Create and deliver online assessments to identify business risks and track their mitigation and resolution.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.