Possible SL exploit

http://www.gnucitizen.org/blog/ie-pwns-secondlife

The problem isn't actually IE, although it's popular to blame Microsoft, but the fact that SL will accept command line arguments from a protocol handler.

In short it directs the viewer to connect to a possible malicious site, which would snatch your name and the MD5 hash of your password (for simple/easy passwords someone could do a reverse lookup on the hash with a pregenerated table) and that would theoretically be enough to impersonate you on the grid.

Hopefully LL will be fixing it immediately, or give a detailed explanation on why it shouldn't work in practice. Unchecking "Remember my password" would be enough to block it.

(Edited to add that it the "exploit" works on Firefox as well, so it really is LL's fault)

Interesting....

/me waits for the zealots to blame Microsoft anyway.

Yep, or not using untrusted clients. This is not an exploit, it is just another reason not to use an untrusted client. It can be a very useful tool to connect to a grid that is not LL's.

Damn that's pretty scary. Unchecking my save password box now. Now I have to go this website that says I can get free lindens....

and... with firefox too?

Unchecking the 'remember password' is advisable for EVERY program or website that has it. It's generally a very bad practice to save your password.

And make sure you use a, so called, strong password. At least 8 characters and include a couple of numbers and an alphanumeric. Best way to do this is to think of a short phrase and transpose some letters with numbers. Something like 'SL is great' translates to SL1sgre@t

Darn you Bill Gates! This wouldn't happen in Linux!

For Firefox users in about:config

set network.protocol-handler.warn-external-default to true

(which is the default setting)

...this should ensure that you get a warning before the external protocol request is processed.

You might also review all of the network.protocol-handler.warn settings as secondlife: isn't the only one that can be exploited.

I always figured storing your password was a bad idea. Anywhere on your computer.

Uh, you know, posting an exploit on the forums is a big no-no. Since LL is already aware of it, I am not sure that this post should stay.

Don't be ridiculous. It's a warning to uncheck the store password box.

Thanks for the warning, Kitty, I will promptly uncheck that box.

Since when does posting news about an exploit turn to the actual exploit itself? Besides, I'd rather work in the light than in the dark. Full disclosure is always best.

The blog is saying this doesn't work on FireFox.. I don't have FireFox - can somebody check this out and maybe send an IM to Phoenix Linden if you _can_ repro this with FireFox?

http://blog.secondlife.com/2007/09/18/second-life-url-handler-exploit/

This was talked about yesterday here: /111/52/211124/1.html

It was announced on bugtraq sunday am.

If you use anything but IE, you don't have to worry, maybe rtfa

QFT!

Seeing as how LL itself posted even more detail about how to use this exloit on their blog, I don't see the harm.

I understand that, but people have been banned in the past for alerting people of a possible exploit. Warning are nice, but they can also lead to wrongdoers doing wrong.

And on the Blog:
"We have a client side fix for this undergoing Quality Assurance. We expect to deploy the new 1.18.2.1 client this week and make it a required upgrade."

Required upgrade!!
Oh rats! I'l have to dig up all the info on how to dissect the apparently horrible and huge communication interface.
I was quite happy with the pre-Voice client thank you!

*grumbles*

Hi new here and to SL =) Unforunately, I am using IE 6.
Can someone please tell me what i need to do in order to close this loophole for the IE Exploit in plain english? This news is very disturbing!
What is it exactly that I need to do to protect myself?
Please be explicit n thanks so much

Un-check ‘Remember password’ in the login screen of the Second Life client.

AND don't go around clicking random wierd links. (the former avoids the problem but the latter is good practice - oh and don't use IE)

Except that it's apparantly been around since forever, so it's probably a safe bet bad people have known about it and used it for many months (could explain some of the hacked accounts posts) and someone posted up a whole how-to so making people aware of it is always going to do more good than harm in this case, especially since unchecking "Remember password" prevents you from currently being vulnerable..

If it was an exploit involving permissions that would be bad to post since it doesn't really do any good at all to warn against that, or if it was something I'd found on my own and wasn't "widely" known already that would be irresponsible as well.

Eep.. I missed that one .

It just simply comes right back when i reopen the SL page. This is really getting beyond scary.

mine is 26 charecters