Inventory Theft? Is it possible?

An interesting story to tell, maybe some of you can address this with more insight than I have:

Two days ago a friend of mine, we'll call her Kim was in her house changing clothes and going through her inventory when another female AV just walked into her house and stood there, we'll call her Whore. lol

Kim tried to engage Whore in a conversation but when she refused to reply Kim, being a nice person and thinking she may be AFK, decided to ignore this rude behavior and went back to her inventory.

That's when she noticed that items were vanishing from her inventory. According to Kim she actually saw the items vanish, and it wasn't everything in her inventory, only clothing and jewelry and female specific items and not even all of them, as if someone was choosing which items they wanted.

Naturally Kim was alarmed by this and said something to Whore about it at which point Whore TP'd away without a word. And the inventory losses stopped at the same time.

None of the items have returned either.

At first glance it would appear that this female AV was somehow able to hack into Kim's inventory and selective steal no-copy and no-transfer items from her.

Is this even remotely possible?

A friend of mine speculated this:

"people are really starting to uncover internal system calls in the scripting language like the trick that shut down an entire region simply by creating an object called region shutdown. it treated the creation of the object as the spawning of the process that triggered the shut down.

so if you know the right internals it would seem reasonable you could "overwrite" your internal identifier (the number the database uses to track you) and pretend to be someone else.

(though you technically wouldn't be them - so you'd have your own avatar still - so you could stand right in the room with them) but you'd have to be close enough to them to be a viable target for their actions hence standing quietly in the room next to someone.

but since SL has a clean up for hung processes (ie., if your machine crashes you time out after a while) then the impersonator would supersede you as the active account because they "became you" after you were already logged on so the real you would be presumed to be a ghost waiting for time out and the fake you would inherit the rights to your inventory (object polymorphism in object oriented environments)

it's all speculation - but if you had the know how I could see how it could be done it's reminiscent of the transwarp bug in the old mtrek game. where you could create a transwarp capable ship...and then initiate transwarp and sign off before the count down finishes then create a new ship with the same name and when you logged back on, it inherits the transwarp.

And why should that be? because in that game, the unique identifier was ship name. in SL there is underpinning numerical ID if you could figure out how to get that ID and then use some trick like a buffer overflow to overwrite their numerical ID onto your current session - voila - you have access to the inventory and their home etc ownership rights to land for the duration of your impersonation because inventory is linked to internal identifier.

now the REAL question is how can you keep it after you log off? the answer is you couldn't - you could only keep it that session but since it was misappropriated it would logically vanish from your inventory because it wasn't copyable or modifiable.

it was an object with those properties worn by an entity that effectively ceased to be at log out take those inventory items with them taking (because you know items you place on the ground for example aren't in your inventory until you pick them back up or they are returned to you) same principle would apply but in this case - it would be like dropping a non-copyable item in a region that suddenly ceased to exist it wouldn't be returned to you unless there were something in place to make sure it was returned before the region was deleted BUT in this scenario there is no mechanism because the person would be using an exploit that isn't handled by game mechanics (no mechanism for return to inventory) eh - all speculation but fascinating"

What do you guys think? Is this even possible? If so its quite scary given how much money I've spent on the items in my inventory!

Thanks for your Input
FaTeke Wottitz

I doubt it is an exploit but my reason is weak: If more than one person had access to this abilitiy, than many would and we'd have heard about it. Furthermore, if someone could forge credentials being sent to LL, it would be far more useful to take L$ from the account. Raping someone's inventory may be annoying or fun (depending on which side you are on) but it ain't lucrative.

This is slightly more conceivable as a "man in the middle attack" if the putative exploiter was in the same dorm or cafe as the exploitee, but it likely would have wedged the session of the exploitee causing the latter to timeout and drop the connection.

The Lindens are quite good at losing our inventories all by themselves, thank you.

What does your friend's Transaction History say?

Nika Talaj What does your friend's Transaction History say?

Transaction history? What is this and how do you find it? I'll have her check.
Honestly I've been in SL since last January and have never heard of this.

FaTeke Wottitz

Go to secondlife.com and log in. Select My Account. On the Your Account page, there is a Transactions History link. Pick the date range and click to view or download.

Seriously?!

Click on "My Account" Then on the right hand side click on "Transactions history" you may need to change the dates...

That's pretty amazing you've never heard of it before.

Well I don't log into SL.com much, and haven't explored the website fully. I truly had no idea you could do this but I will tell my friend about it and have her check it out.

FaTeke Wottitz