AVG finds 11 year-old creating malware to steal game passwords

Security firm AVG thinks it has spotted a disturbing new threat in its latest threat report – children with enough programming skills to code and distribute their own malware.

The company said it had recently reverse-engineered one piece of malware that turned out to be the handiwork of an 11 year-old Canadian boy intent on stealing passwords used to access games such as Team Fortress.

Although still exceptions to the rule, AVG is convinced this type of child coder is a real phenomenon, able to wield simple programming languages such as C# (C Sharp) and Visual Basic to carry out mostly attacks aimed at stealing game logins for major platforms such as Steam or manipulating individual games.

Others just want to steal logins in order to exact revenge through an enemy’s Facebook account.

“The code usually takes the form of a basic Trojan written using the .NET framework, which is easy to learn for beginners and simple to deploy via a link in an email or posted on a social media page,” commented AVG CTO, Yuval Ben-Itzhak.

“We believe these junior programmers are motivated mainly by the thrill of outwitting their peers, rather than financial gain, but it is nevertheless a disturbing and increasing trend,” he said.

“It is also logical to assume that at least some of those responsible will be tempted to experiment with much more serious cyber-crimes.”

The 11 year old reported by AVG did make some naïve mistakes such as including the exact email address used by him to receive stolen addresses inside his code and even that he’d recently been given an iPhone by his parents.

The phrase ‘script kiddies’ has been around for years, an insulting moniker for teen nuisance hackers working from the bedroom, and then there is LulzSec, a high percentage of whom turned out to be teenage or thereabouts.

The idea that children could be a real menace is stretching this into new territory, but not surprising. If youngsters are using more and more complex games, and basic programming interfaces now exist then it would be more surprising if youngsters weren’t tempted to try some Black Hatting.

Meanwhile, the Blackhole Exploit Kit was everywhere in the recent quarter, accounting for 40 percent of all online threats detected by AVG over whole of the year. Other toolkits are chasing it hard as criminals look to make money from the software that serves the malware business, including we now know, children too.