Welcome to the Second Life Forums Archive

These forums are CLOSED. Please visit the new forums HERE

Rumor or real?
RaptonX Zorger
Registered User
Join date: 26 Jan 2006
Posts: 79
12-30-2007 14:07
I got a notecard today that had the following:


"Hello everyone, This has not been verified, however if it may be true, you should follow the instructions to protect yourself immediately. From Ashra Lang of AWT: the last windlight and release candidate seems to have a big security issue. It was said, that most likely login data were passed to an unknown server in Amsterdam - if that is true or not, log out, CHANGE YOUR PASSWORD and log back in with the normal client - Linden Lab closed windlight and release can"


Now they mentioned in the blog that wind light was shut down along with release can, but did not say why..... I was away while it all happened and then logged in noticing I had to update the client. Any thoughts?
Monalisa Robbiani
Registered User
Join date: 9 Jul 2007
Posts: 861
12-30-2007 14:12
This is not a hoax! Read here:

https://jira.secondlife.com/browse/VWR-4037

AFAIK only the German versions were affected. Logins were routed to sdfsdfsdf.com instead of secondlife.com. Probably the programmer forget to replace the dummy address :) (Hehe it's kind of funny isn't it.) Unfortunately someone registered sdfsdfsdf.com in the Netherlands (probably to phish logins!!). So if you ever tried to connect using the German Windlight client you should change your password now.
Tengu Yamabushi
Registered User
Join date: 25 Sep 2005
Posts: 191
12-30-2007 14:13
Real: http://www.massively.com/2007/12/29/german-second-life-users-at-risk/
Strife Onizuka
Moonchild
Join date: 3 Mar 2004
Posts: 5,887
12-30-2007 14:15
What happened is this:

The german translation files for the clients had the wrong domain name for the login server. This wasn't a problem until someone discovered this and registered that domain name.
_____________________
Truth is a river that is always splitting up into arms that reunite. Islanded between the arms, the inhabitants argue for a lifetime as to which is the main river.
- Cyril Connolly

Without the political will to find common ground, the continual friction of tactic and counter tactic, only creates suspicion and hatred and vengeance, and perpetuates the cycle of violence.
- James Nachtwey
RaptonX Zorger
Registered User
Join date: 26 Jan 2006
Posts: 79
12-30-2007 14:16
From: Monalisa Robbiani
This is not a hoax! Read here:

https://jira.secondlife.com/browse/VWR-4037

AFAIK only the German versions were affected. Logins were routed to sdfsdfsdf.com instead of secondlife.com. Probably the programmer forget to replace the dummy address :) (Hehe it's kind of funny isn't it.) Unfortunately someone registered sdfsdfsdf.com in the Netherlands (probably to phish logins!!). So if you ever tried to connect using the German Windlight client you should change your password now.



Oh, so if I live in the USA and use the USA version then I should be ok?
Strife Onizuka
Moonchild
Join date: 3 Mar 2004
Posts: 5,887
12-30-2007 14:20
From: RaptonX Zorger
Oh, so if I live in the USA and use the USA version then I should be ok?

That would be correct. Only those affected would be those that had their client display in German.
_____________________
Truth is a river that is always splitting up into arms that reunite. Islanded between the arms, the inhabitants argue for a lifetime as to which is the main river.
- Cyril Connolly

Without the political will to find common ground, the continual friction of tactic and counter tactic, only creates suspicion and hatred and vengeance, and perpetuates the cycle of violence.
- James Nachtwey
Alyx Sands
Mental Mentor Linguist
Join date: 17 Feb 2007
Posts: 2,432
12-30-2007 14:20
Does anyone actually READ the blog? The update did say that the new versions are available now and it's okay ANYWAY.
_____________________
~~I'm a linguist. RL sucks, but right now it's decided to be a little less nasty to me - you can still be nice to me if you want! ~~
->Potestatem obscuri lateris nescitis.<-
Jessica Elytis
Goddess
Join date: 7 Oct 2005
Posts: 1,783
12-30-2007 14:26
From: Alyx Sands
Does anyone actually READ the blog? The update did say that the new versions are available now and it's okay ANYWAY.


Too bad the blog doesn't say WHAT the issue was. Nor does it say it's "okay".

If passwords were even remotely possibly commprimised, LL should say that. You;d think they'd learn from past mistakes.....umm...on second thought, nevermind.

~Jessy
_____________________
When your friend does somethign stupid:
From: Aldo Stern
Dude, you are a true and good friend, and I love you like the brother that my mom claims she never had, but you are in fact acting like a flaming douche on white toast with a side order of dickknob salsa..maybe you should reconsider this course of action and we go find something else to do.
Strife Onizuka
Moonchild
Join date: 3 Mar 2004
Posts: 5,887
12-30-2007 14:27
From: Alyx Sands
Does anyone actually READ the blog? The update did say that the new versions are available now and it's okay ANYWAY.

Who? Us? Read the blog? Never. :p
Ok so I read it religiously and have a feed setup for sl related news... Have to stay informed when your a mod... if the sky is going to fall you need to know before everyone else (so you can formulate a battle strategy and write stickies).
_____________________
Truth is a river that is always splitting up into arms that reunite. Islanded between the arms, the inhabitants argue for a lifetime as to which is the main river.
- Cyril Connolly

Without the political will to find common ground, the continual friction of tactic and counter tactic, only creates suspicion and hatred and vengeance, and perpetuates the cycle of violence.
- James Nachtwey
Novis Dyrssen
Girl Geek
Join date: 6 May 2007
Posts: 1,452
12-30-2007 15:16
From: Strife Onizuka
if the sky is going to fall you need to know before everyone else


And you're waiting for the BLOG then...? :p
_____________________
~~ immortal words of Rob Thomas ~~
Hey-yeah, welcome to the Real World
Nobody told you it was gonna be hard
Alicia Sautereau
if (!social) hide;
Join date: 20 Feb 2007
Posts: 3,125
12-30-2007 15:31
From: Strife Onizuka
Who? Us? Read the blog? Never. :p
Ok so I read it religiously and have a feed setup for sl related news... Have to stay informed when your a mod... if the sky is going to fall you need to know before everyone else (so you can formulate a battle strategy and write stickies).

!quit !quit !quit !quit
_____________________
Damanios Thetan
looking in
Join date: 6 Mar 2004
Posts: 992
12-30-2007 15:44
What happened (speculation):

While writing/adjusting the german user interface code for the new login page,
an LL engineer (or translator) put in a placeholder in the specific XML code. Basically some random line of characters, later to be replaced with the correct data. The keyrange: 'sdfsfsfds' is the effect of simply randomly moving your fingers over the keys on the left side of your keyboard.

Instead of it being replaced, it ended up like that in the actual releases for Unix and Mac versions. As the URL is not actually necessary (the login page 'falls back' to the LL servers if no correct URL is given), it was never noticed by testers or quality control.

Some people, reading the UI XML data simply found this strange URL, and decided to register it, maybe with the intention to later, built some kind of server code to check out what actually was sent there.

The specific url in the UI data: sdfsfsfds.com was registered through 'leaseweb', a dutch webhost. The domain was never actually attached to any backend server though. (It was 'parked' as it's called). The specific people never came so far as actually using it for anything malicious.

There could even be some debate if the domain was 'actually' completely registered, as the same provider, now already allows for registering this same domain name.

Some other people noticed the specific URL in the backend code, notified LL (through JIRA and other channels). LL immediately responded by freezing access to the login servers using these clients, and fixing and releasing a version without the issue.
_____________________
Lindal Kidd
Dances With Noobs
Join date: 26 Jun 2007
Posts: 8,371
12-30-2007 17:04
Dami Thetan: Better than the Blog!
_____________________
It's still My World and My Imagination! So there.
Lindal Kidd
Tegg Bode
FrootLoop Roo Overlord
Join date: 12 Jan 2007
Posts: 5,707
12-30-2007 21:01
From: RaptonX Zorger
I got a notecard today that had the following:
"Hello everyone, This has not been verified, however if it may be true, you should follow the instructions to protect yourself immediately. From Ashra Lang of AWT: the last windlight and release candidate seems to have a big security issue. It was said, that most likely login data were passed to an unknown server in Amsterdam - if that is true or not, log out, CHANGE YOUR PASSWORD and log back in with the normal client - Linden Lab closed windlight and release can"
Now they mentioned in the blog that wind light was shut down along with release can, but did not say why..... I was away while it all happened and then logged in noticing I had to update the client. Any thoughts?
Hmm wasn't this yesterdays news?
_____________________
Level 38 Builder [Roo Clan]

Free Waterside & Roadside Vehicle Rez Platform, Desire (88, 17, 107)

Avatars & Roadside Seaview shops and vendorspace for rent, $2.00/prim/week, Desire (175,48,107)
Cherry Czervik
Came To Her Senses
Join date: 18 Feb 2006
Posts: 3,680
12-31-2007 01:12
From: Alyx Sands
Does anyone actually READ the blog? The update did say that the new versions are available now and it's okay ANYWAY.


Nope. Including Mentors a lot of the time.

= guilty
Strife Onizuka
Moonchild
Join date: 3 Mar 2004
Posts: 5,887
12-31-2007 05:37
From: Alicia Sautereau
!quit !quit !quit !quit

*runs around screams and then explodes... fluff goes everywhere and slowly drifts down out of the air*
_____________________
Truth is a river that is always splitting up into arms that reunite. Islanded between the arms, the inhabitants argue for a lifetime as to which is the main river.
- Cyril Connolly

Without the political will to find common ground, the continual friction of tactic and counter tactic, only creates suspicion and hatred and vengeance, and perpetuates the cycle of violence.
- James Nachtwey
Novis Dyrssen
Girl Geek
Join date: 6 May 2007
Posts: 1,452
12-31-2007 05:58
Oh no! You killed Strife! You bastard!

:p
_____________________
~~ immortal words of Rob Thomas ~~
Hey-yeah, welcome to the Real World
Nobody told you it was gonna be hard
Alyx Sands
Mental Mentor Linguist
Join date: 17 Feb 2007
Posts: 2,432
12-31-2007 09:20
From: Novis Dyrssen
Oh no! You killed Strife! You bastard!

:p

Let's hope he will be back next episode then.... ;)
_____________________
~~I'm a linguist. RL sucks, but right now it's decided to be a little less nasty to me - you can still be nice to me if you want! ~~
->Potestatem obscuri lateris nescitis.<-