A digital virus spread by terrorists left bodies on the streets and cities quarantined by the government. Click here for Core Impact!
“ Not only does it present an in-game dynamic that was not expected by players or Blizzard developers, it reminds us that even in seemingly controlled online atmospheres unexpected consequences can occur. While not as serious as a classic computer virus, it reminds us that computer code can impact us and we're not always safe, regardless of what precautions we take. ”
Brian Martin, independent security consultant and World of Warcraft player
Fortunately, the epidemic was not real, but the aftermath of an inadvertent digital plague caused by a simple change to the massively multiplayer online roleplaying game, World of Warcraft.
The change? Giving a monster the ability to curse in-game avatars with a self-propagating, albeit temporary, disease. While the developers only intended the disease to affect the group of characters fighting the monster, the infectious malady quickly became a tool in the hands of malicious players known as griefers, who found ways to bring the digital virus into heavily inhabited areas of the world.
For a week, the efforts of malicious players left behind massive casualties, made cities nearly uninhabitable, and became a reminder of the uncontrollability of self-propagating code.
"There are three things you can do: infect people, die, and watch other people do the first two," said one person posting to the World of Warcraft community forum under the handle 'Modahan.' "There's no way to rush for a cure; there's no way to stop the plagued idiots from coming in, there's no quest, no change, no nothing."
While previous flaws in online multiplayer games have led to unintended consequences, this may be the first time that a disease has spread from character to character. While a developer-created digital virus killed off characters in the original Sims game, it only occurred if the player obtained a guinea pig and did not keep its virtual cage clean. Fan-created content for the sequel to that game, Sims 2, contained modifications that persisted and were inadvertently transferred from player to player creating string of virus-like effects.
The World of Warcraft's particular plague was caused by a curse known as 'Corrupted Blood' given to those in-game characters that battle a demon called Hakkar. The curse causes damage and can be passed onto other characters nearby. However, programmers at the game's developer, Blizzard Entertainment, failed to limit the area where the curse operates.
The complex epidemic that ensued after adding simple self-propagation to a feature of the game should come as no surprise, said Brian Martin, an independent security consultant who plays World of Warcraft.
"Giving it the ability to propagate at all beyond a limited environment definitely reminds us that self-propagating code is likely to bite us in the ass without careful consideration and planning," Martin said. "This also underscores the fact that adequate testing is a requirement for software, as this--and thousands of other bugs--would have easily been discovered and hopefully fixed had the testing been more thorough."
Last week, the game's developer Blizzard Entertainment rushed out a patch that limited the ability to infect others to only within the specific adventuring area known as a dungeon, a move which contained the disease to at most 20 characters. While the company would not comment on the epidemics, which happened on several of the game's servers, a spokesperson acknowledged the incidents and that the company had fixed the flaw.
The World of Warcraft has become the most popular online roleplaying game to date, with more than 4 million players worldwide, according to Blizzard.
The plagues started on September 13 after Blizzard updated the game to include, among other new content, a dungeon known as Zul'Gurub. In the heart of that dungeon sat Hakkar, an in-game demon, that cursed any characters who attacked it with Corrupted Blood, a damaging curse that spreads from player to player.
The disease would have not spread from the original dungeon but for the efforts of griefers. The online roleplaying game equivalent to terrorists, griefers would teleport their characters to inhabited areas or used their pets as plague carriers to spread the disease to the general population of a server, according to postings on various community sites.
Griefers have taken advantage of other loopholes in online games. In World of Warcraft and Everquest 2, for example, some malicious players have used time-delayed curses to turn their characters or pets into virtual bombs, teleporting to nearby inhabited areas just before the curse went off, affecting everyone in the area.
Reaction to the actual effects of the epidemic have been mixed. Some players have lauded the appearance of an epidemic as a cool in-game feature.
"Yes, there are a lot of upset people, but again, that's because this was unintentional and the effects go too far--some say," one player, using the handle 'Po,' said on the World of Warcraft forums. "However, there are a great number of folks who think this thing is spectacular."
Other players have taken exception to the fact that entire cities had become plague-ravaged and dangerous to all but very high-level characters. The player of a high-level mage complained that the game became unplayable until Blizzard fixed the problem last week.
"Basically I tried to enjoy the new game content but got griefed by my own faction," the player, who used the handle 'Starcinder,' said in a posting to the World of Warcraft forum. "Good plan Blizzard. This 'content' was visionary ... considering the maturity of the player base."
While short-lived, the incident should be a reminder that adding the ability to spread to simple features can bring complex consequences, said security consultant Martin.
"Not only does it present an in-game dynamic that was not expected by players or Blizzard developers, it reminds us that even in seemingly controlled online atmospheres unexpected consequences can occur," Martin said. "While not as serious as a classic computer virus, it reminds us that computer code can impact us and we're not always safe, regardless of what precautions we take."
