Once his computers logged into a game, communication between them and the game server was fairly straightforward. For every action happening in the game that involved one of Thurman's 30 characters, the game server sent the details back to the relevant client computer, and vice versa. The details included the skills of a character, the status of its health, and the size of its bank account. Thurman eliminated the human element--cut out the middleman, you might say--by programming his computers to automatically respond to the incoming data from the game server.
The application performed the functions that a normal player would have to do with many repetitive keystrokes ( Ultima Online players use keyboards, not joysticks). One thing the program couldn't do was sniff out moneymaking opportunities, so Thurman did that himself. But once he identified an opportunity, he would quickly write code that told his characters what to do to capitalize.
For example, in Ultima Online , gamers can make money by cooking and selling chickens to tavern keepers. Thurman programmed his characters to buy raw birds from the butcher and then prepare the food. Ordinarily, a gamer can cook only one bird at a time, but Thurman automated the process so that his 30 PCs could cook as many as 500 birds at a time; he sold them in huge quantities to the taverns. In minutes, his bank of computers could rack up an amount of virtual money that it would take an individual player weeks to earn.
But wouldn't it be easy to spot a user who was cooking and selling, in minutes, enough chicken to feed an army? Absolutely. And that's where the real finesse of being a game hacker comes in. A big part of the tradecraft is simply managing to avoid getting busted by the company game masters, whose job it is to prowl for hackers. If they even suspect illicit activity, they look up the associated Internet Protocol address and can take action. ”They would mass-ban your accounts,” Thurman notes.
So he installed countermeasures. First, he got a separate account for each of the 30 computers. He had six cable modems, with five accounts tied to each one. He also paid his Internet service provider an extra $16 per month to get four IP addresses to use (most households have just one), and wrote software to instruct the modems to release one of those IP addresses every six hours and grab a new one to replace it. In a network with dynamically assigned IP addresses, any modem outage and reboot results in a new address assigned; Thurman effectively generated his own outages so that he could get new IP addresses. His constantly shifting array of IP addresses made it hard for the sleuths at Electronic Arts to notice the fantastic quantities of chicken he was selling, to say nothing of the ore he was mining, melting into ingots, and exchanging for game currency [see photos, MAP HACK].
But churning the IP addresses wasn't a foolproof countermeasure, he realized. Just in case his activity aroused suspicion, he rigged his bank of computers to alert him via text message or instant message to odd bursts of activity--for example, when a person from Electronic Arts was confronting one of his automated systems to see if it was, in fact, a real player or just a proxy.
That happened a few times, Thurman says, and they were close calls. One time he was traveling in Arizona when an instant message came through on his phone. The game server had sent a message to his client indicating that a game master, an employee or volunteer who, in the form of a game character, roves the game enforcing rules, was on screen. Game masters are identifiable by a special flag their avatars carry. ”GM Alert!” the message read. Thurman had set up the machines to automatically log out his other characters when that happened, just in case. But he left his one character online with the GM because it'd be too suspicious if he suddenly vanished.
Game masters try to verify that players are in front of their monitors, often by challenging them with questions that they presumably could answer only if they were sitting in front of the screen. But Thurman had anticipated such a challenge, and he had rigged his instant messaging system so that it could send crude but useful screen shots to his laptop computer. ”Are you there?” the GM asked. ”Yes,” Thurman replied. ”Prove it,” the GM replied. ”What color is my shirt?” No problem. ”Red,” Thurman typed after glancing at the screen shot. And the GM went on his way.
It took Thurman nearly two years, from February 2002 to December 2003, to perfect his system. The ”labor of love,” as he describes it, paid off. Soon he was making 45 000 units of gold per hour and, eventually, as much as 2 million units of gold every 15 minutes. All told, that translated into as much as $2400 per hour of real money: $80 per hour per character, and Thurman had up to 30 characters at his disposal. It was around then that he quit his day job as a software consultant.
With ”game gold” in hand, the next step is converting the virtual cash to real-world money. Dozens of companies are happy to help gamers do that. The biggest is Hong Kong–based IGE, which Thurman compares to Wal-Mart. The company employs more than 800 people in Seoul, Hong Kong, and Shanghai. Founder Brock Pierce said in a phone interview last year that the site brokers real-money transactions, taking a piece off the top as it connects sellers of virtual gold, earned legitimately, with buyers. He put the estimated annual earnings at $700 million. (IGE did not respond to requests for an update.)
But the secondary market is, to put it mildly, shadowy. It revolves to some extent around hackers who scoff at efforts by online game companies to fight against automated software. It also depends on hundreds of loosely organized gold farmers in China, who game for money around the clock and then cash out their winnings to online brokers. They may not be breaking any rules, technically, but they are sure violating the spirit of the games. In a sense, such people constitute a manual version of the automated software written by the likes of Thurman.
Documentary filmmaker Ge Jin has been chronicling the gold farms in China for a movie to be released next year. He says that while gold farming may be an oddity--if not anathema--in the West, it's more widely accepted abroad. ”The unemployment rate is soaring in China,” he says, ”so [hired gold farmers] are happy to have a job, which pays no less than other jobs available to them. The majority of them are game fans anyway; they are happy that they can be paid for playing games and can enjoy games that are expensive to subscribe to or even those not imported into China.”
According to a June report in The New York Times Magazine by Julian Dibbell, a typical gold farmer in China works 12-hour days for weeks on end, with only a few days of rest per month. The farmers work at long tables strewn with computer monitors and keyboards in small rooms crowded with dozens of people and thick with cigarette smoke. Dibbell estimated that 100 000 such workers are employed in what are called youxi gongzuoshi, or gaming workshops.
Unlike Thurman, the Chinese workers actually do go out into the ”worlds” and game. But they do so in teams--which gives them a distinct advantage in certain situations. For example, they can gang up on giant monsters whose slaughter will be rewarded with big piles of gold. ”Gold farmers attack high-level mothers,” Thurman says, a little enviously. ”They're not cooking birds.”
Patrick Bernard, 31, joined a worldwide gold-farming team after working as a product manager for a Silicon Valley dotâ''com (he declines to say which one). The gold-farming work quickly became tedious, he says. ”We just pooled monsters and killed them for dozens of hours,” he says. ”I could generate $1000 in gold per hour; my pay, at the time, was $15 per hour.” Bernard now works on the other side of the business, running Gamer's Loot, an online RMT service--one of the companies that convert game gold into real money and vice versa.
While there's no law against real-money transactions, game companies are understandably uncomfortable with the whole idea. ”We all admit that sort of thing is out there,” says David Swofford, spokesman for NCsoft of Seoul, maker of the online game Lineage. ”But it's not anything we endorse.
”It's a hazard of the business. What we're trying to do is have games create the best possible experience. If people are doing things in violation of rules…we don't want them in our game.”
Game companies and hardware manufacturers such as Intel are going after hackers with varying degrees of aggressiveness. Among the most intense is Sony. The company says that during the past few years it has booted out more than 20 000 players suspected of farming gold in EverQuest; Star Wars: Galaxies; Vanguard: Saga of Heroes; and other Sony online games. And the game companies don't take kindly to operations like IGE. ”They claim they don't have any employees doing farming,” Sony's Hartsman says, ”but they have thousands of contractors doing it. You push a button that says, ’I would like to sell a coin'; within 5 minutes you have people respond. And they're not asking where that coin came from.”
But here's a hint at how alluring, and maybe insidious, gold conversion is: for all its prosecutorial zeal, Sony itself has succumbed to the temptations of gold conversion. It now has its own service, called the Sony Exchange, which allows players to buy and sell virtual items online. Sony gets a cut, of course.
Real gamers are fed up. ”It's disconcerting to find out that the warrior decked out in purple epic bling bought all his kit on eBay,” complains Drew Shiel, webmaster of a World of Warcraft fan site called the Wizard of Duke Street (http://www.dukestreet.org). ”Having someone come in and buy a high-level character makes a mockery of the effort that other people have put into their own characters.”
But as online gaming worlds become more realistic, there's little chance of getting rid of the perceived criminal element. If anything, the most gamers and companies can hope for is that the metagamers eventually do what Thurman did: grow up and log off.
After a couple of years of gaming for dollars, Thurman got tired of living on the edge. The clincher came when a competing gold farmer began sending him messages threatening him and his family. ”We thought he'd show up at our house and kill us,” Thurman says. Even the biggest sword in Ultima Online would not be able to protect him from that.
Click here for a story on The Oldest Profession
About the Author
Contributing Editor DAVID KUSHNER blogs for Spectrum Online at http://blogs.spectrum.ieee.org/gizmos/. His latest book is Jonny Magic and the Card Shark Kids (Random House, 2005).
To Probe Further
To check out the largest online retailer of virtual items for games, go to http://www.ige.com.
Julian Dibbell’s book on his adventures inside the virtual game economy, Play Money: How I Quit My Day Job and Made Millions Trading Virtual Loot, was just released as a paperback by Basic Books. Dibbell’s New York Times Magazine article, ”The Life of the Chinese Gold Farmer,” appeared in the 17 June 2007 issue.