An attack against a prominent online computer game has prompted fears that lucrative virtual communities could be the next target for internet extortionists.

Final Fantasy XI, a popular fantasy role-playing game run by Japanese company Square Enix, suffered disruption after being bombarded with bogus traffic sent from hundreds of remotely controlled computers.

The game's operators acknowledged the attack in a message issued to players on 15 April. "Our technicians are taking every measure possible to prevent further attacks," the statement reads. "However, attack methods have varied, which has caused a more time-consuming review of our network protection."

A so-called distributed denial-of-service (DDoS) can be very difficult for administrators to block because the packets used to overload a site come from so many different sources at once. The computers involved are often home PCs that have been infected with a virus and corralled into an attack network, known as a "botnet".

Obvious targets

The game's operators have not said whether they have received any threats or demands for money, but some experts believe virtual games would make an obvious target for computer crooks.

Final Fantasy XI has more than 550,000 subscribers, who each pay $12.95 per month to play. So any disruption could prove financially damaging to the company behind it.

"It raises the prospect that online games may be emerging as a new target for DDoS blackmail schemes," says Rich Miller, analyst with UK internet-monitoring firm Netcraft. "Given the number of subscribers these games have, it seems worth considering."

Other online businesses have already been targeted by DDoS extortionists. Several major betting sites have admitted to receiving threats and experiencing attacks in the run up to major betting events like the US Superbowl.

Gigabytes per second

There are many other successful massively multiplayer online role playing games (known as MMPORGs) that could be faced with such a threat.

"If they're taken offline, they have no business," says Paul Wood, chief Information Security Analyst with UK company MessageLabs. He adds that "defences can be hugely expensive, while botnets are relatively cheap to operate”.

A botnet of thousands of machines can send gigabytes of data to a site every second, and blocking such a huge quantity of traffic can be complex and time consuming for administrators.

However, Miller points out that several companies now offer technology to counter such attacks. Prolexic Technologies, based in Florida, US, provides a distributed system that can intercept incoming traffic and remove the DDoS packets aimed at a site. The company has been used by a number of large gambling sites, he notes.

But both Miller and Wood expect the attacks themselves to become increasingly complicated and effective. "These types of attack are on the increase," Wood says, "and there are some very sophisticated criminals groups behind them."