GDATA reports cyber criminals targetting teen MMO Habbo Hotel

 

Gallery

Posted on 10 Dec 2009 at 16:27

Habbo Hotel, a virtual world aimed at teenagers, has been targeted by recent phishing websites, according to German anti-malware firm GData.

According to GData's Thorsten Urbanski, "it is practically impossible for children and even adults to differentiate between genuine and counterfeit sites."

Although Habbo Hotel is free to use, users can purchase in-game credits with a credit card or via premium text message and phone numbers. According to GData, once a user's login details have been obtained, "the account thief can spend the victim's available Habbo coins. The perpetrators also try in various ways to sell this virtual money for real money. For example, a sale takes place on the eBay auction platform - the exchange of the virtual money then takes place in the game."

A related phishing scam involves websites that pass themselves off as an official outlet for the sale of Habbo coins in order to obtain the credit card details of users.

Oisin Lunny, Habbo Hotel's UK Country Manager, aknowledges that, like other big online communities, Habbo Hotel's 15 million monthly users are targetted by phishing attempts, but told us that Habbo "have not noticed any international phishing waves lately and work all the time to prevent users from misusing the service".

Lunny also noted that "many scams (e.g. phishing attempts) happen outside Habbo Hotel, often in external sites maintained abroad, in which Habbo can't interfere. Many scams happen via simple social engineering (the scammer persuading the victim to hand over their password of their own free will) and although Habbo gives security recommendations to users, it cannot prevent users giving away password information if they are persuaded to do so by another".

As always, we recommend that you access any online service only by typing its URL directly into your browser's address bar or by using a bookmark that you've made after doing this. Never visit a site of this sort by clicking on a link in an email. As you can see from the screenshot above, phishing sites can be virtually indistinguishable from the real thing, so the URL may be your only clue.

If you're a parent, take an interest in your kids' online activities. If you're summoned to the PC to buy them some credits, make sure the website you're typing your details into is secure and has the right URL.

Author: Kat Orphanides