How Minecraft undermined my digital defences

Mods for Minecraft are often repackaged to contain all kinds of malicious extras

Could your children be your weak link when it comes to home security? One of mine almost was thanks to Minecraft.

One of my boys wanted to install a mod for it and needed me to approve it. And as I am paranoid about what runs on our main computer, I oversaw the whole process.

At first, it all looked fine.

There are thousands of mods or add-ons for Minecraft that make a variety of changes to the game. Some add new blocks, others change the way it looks and some turn it into an entirely different game.

The one he wanted was hard to find, despite it being popular among his friends. When we found it, I was not sure we were getting it from the person who actually created it.

I was suspicious because the site was festooned with buttons that looked like they would start the download but instead led to dead ends populated by links to download accelerators and other utilities we did not want. Grubby ads blinked alongside. I'm not sure mature Russian women are keen to meet my 12-year-old son.

Cybersecurity Alert special index

Is your phone listening to you?

How to hack the average home

Hanging out with the script kiddies

Ukraine blackout hacks 'could happen elsewhere'

Scams aimed at young web users and fans of popular games, such as Neopets, have a long history

After a few dead ends, we clicked the right link but then had to wait while we were put through several re-directs and a pop-up page that could not be shut down if we wanted the mod.

We did, so we stuck with it and the download started. And kept going. And going. Which was odd given it was only a few megabytes in size. My suspicions aroused, I killed the download over my son's protests. It was just as well. Running it through an online malware scanner revealed that though it was not actively malicious it would have installed adware and hijacked searches.

Definitely not the mod we wanted.

Big target

Soon afterwards, I found a warning about the page saying it was fake. That warning was circulated by the Stop Mod Reposts campaign. It is attempting to stop popular mods being hijacked by conmen, virus writers and cyber-thieves. It maintains a long, long list of the scam pages offering re-packaged mods. It even makes an extension for web browsers that warns when you stray on to a dodgy site.

"Minecraft is a huge target," said Chris Boyd, a security researcher at Malwarebytes and a veteran scam-spotter. He has seen fake sites offering the game for free, fake pages asking visitors to log in with their Minecraft name and password as well as a variety of other scams offering skins, capes and cheats.

But, he said, there was a long history of cyber-conmen going after children and the things they do online. He remembers seeing scams in 1999 that targeted the economy around Neopets - digital creatures popular with younger web users.

Staying safe online

Keep all software up-to-date and patched. Use anti-virus and anti-spyware software. And a firewall.

Give your children an account on a PC or laptop that restricts what they can install.

Use strong passwords (mix letters, numbers and symbols) and do not share them. Not even with friends.

Be wary of links offered in chat forums or in-game.

Talk to your children about what is appropriate behaviour.

Choose neutral user names. Use different login details on different sites.

Do not reveal personal information, even to those who are being friendly.

Be sceptical of flashy ads and links to games, cheats, and freebies that offer in-game currencies.

Check if there is a way to restrict who children play with online. Check online privacy settings to see with whom data is being shared.

Younger gamers are regularly targeted, said Mark James of security firm Eset and many inadvertently give away their age with the names they choose when they sign up to a site or service.

Scammers and conmen can lurk in forums offering advice and links to extras, cheats and advice pages that are actually laced with malware.

"Often in-game chat channels play host to predators waiting for that click on a 'bad' link that infects a device," he said.

There is evidence that lurking on a gaming service pays off for the bad guys. Valve, which runs the massively popular Steam gaming service, revealed late last year that 77,000 accounts for the service are being hijacked each month. Control of those accounts will be lost via Steam's chat system or through booby-trapped links.

A flashy advert can entice a child to click where they shouldn't

Mr James warned against befriending people on social media just to get "freebies" for games and said parents needed to educate children about safe browsing and gaming and what information was appropriate to share.

Without this, he said, children can be an easy target.

"If they want that mod or add-on they will do almost anything to get it," he said. "Unfortunately many young people do not have the perspective to see what long-term damage could be done if they are caught out."

Statistics from security firm Symantec suggest that younger people are getting hit regularly. A report it produced in early 2016 revealed that a quarter of parents have had a child or know someone with a child whose actions compromised the family's online security.

Jacqueline Beauchere, Microsoft's chief online safety officer, said scammers go to great lengths to catch children out.

"Young people are easily enticed to click flashy advertisements, visit unofficial websites of popular celebrities, download so-called 'free' games, and tap 'Agree', 'OK', or 'I accept' to quickly get to where and what they want to online," she said. "Many of these actions are just notorious pathways to viruses, spyware and other malicious software."

The scammers went after children, said Ms Beauchere, because of the cache of valuable loot that one mistake might lead them to.

Pick passwords that are hard to guess and do not share them around or re-use them.

"Among criminals, personal and financial data about any and all individuals has become the sought-after 'currency' of the web," she said. Cyber-thieves targeted children only to get at this data, she said.

Mr Boyd from Malwarebtyes agreed. And, he said, what helped the scammers was the way children typically get online.

"A lot of kids play via their parents tablets, laptops and desktops," he said. "It's quite likely that parents will re-use login details on other accounts. And there's likely to be a payment method attached to it."

That is the data they are after, he said.

What makes this tougher to police, he said, is that children often know more than their parents about the technology. That competence can fool many parents into thinking their offspring are safer online than they actually are.

"I would be surprised if parents know much about how the technology works," he said.

But, he added, staying safe is not impossible. It takes collaboration between parents and children. Both need to educate the other about what they do and how to stay safe.