is this real? or just another SL Urban Myth?

Warning
Sun Dec 21 09:58:14 2008

Got this IM
I just got this IM from a friend, I thought I'd pass it on.
"I can't work out the legitimacy of this but I thought I should pass it on if its true. "According to Charlie @ SL Helpdesk: "I have just recieved a notice from a very high sourse ,there is an object being passed around in SL called "Radar Free v4.4" do NOT take it, it transfers your money to the creators account."
My friend had one, she says the creator is unknown, she deleted hers to be safe.

Don't take candy from strangers. (^_^)y

Nothing can take money from you unless you answer YES to the little blue box that gives it debit permission.


ETA -- is that box still blue or did they finally change the color to help call attention to it?

Social engineering can be the most powerful hack of all:

"Unknown user would like to give you an object: 'Free Radar Hud 4.4'". Y/N. You must grant debit permission for this item Y/N."

If you were not paying close enough attention or didn't understand what was really being asked of you, you could find yourself in trouble.

Yes indeed; don't take candy from strangers.

The permission box is big and yellow-orange if it involves money. That was a change made early in 2008 (IIRC) to help avoid this very kind of problem, since we're used to saying "yes" to the blue box for so many normal purposes.

An object can't take your money unless you OK this box, and it's very visually obvious that it's not the usual kind of permission, like the little blue one for animating your avatar by a dance ball.

Spam messages like the one you're asking about are at best a nuisance, and serve no useful purpose. At their worst, they could be targeting a perfectly legit object out of spite. (For example, by an unscrupulous maker who is trying to sink a freebie competitor.)

BTW, creator often appears as "unknown" in your inventory, and you have to rez the object (drag inworld or wear) to see who the creator is.

Freebie paranoia is understandable, but overblown. There's really little a freebie can do to harm you, unless you're very careless.

I make a lot of freebies, and I enjoy passing them out (though, not apropos of nothing, not to people I haven't IM'd or chatted with, since it's just rude to sit there and pass out stuff people don't want). It's unfortunate that so many well-intentioned people have built up this paranoia over freebies and that so many people turn them for fear of things that aren't really a threat.

However, I advise reasonable caution about scripted freebies. If the script isn't modifiable, nobody can check it to see if it doesn't do something sinister.

What sinister things can scripted obects do?

Well, if worn, they can move you around (physically) or animate you, until you take them off.

They could track you and spy on chat whever you are. (This is more likely a threat to a specific avatar: your one-true-love checking up on you by making an alt and handing this to you, or an enemy looking for advantage.)

They can lag the sim, but that can be easily identified by anyone with region admin privilidges.

No doubt there are a couple other things.

But they can't take your money unless you're very careless.

Yes, the big yellow box is a vast improvement. I would still like people to be careful out there and actually read the popups. I'm a computer tech and I have to go clean up all kinds of problems because someone opened or clicked something they should have known better than to click or open. Some people have actually paid the $49.95 for WinAntiVirus 2009 or sent money to the poor widow in Nigeria.

Just be careful, that's all I'm saying.

The big different color box is a good improvement to help prevent this sort of theft happening

However most people NEVER need to give debit permissions in all the years they spend in SL.
So I would like to see permission automatically refused unless you set something in "edit - preferences" to allow you to get the box to pop up.

We have the usual blue colour boxes and now the yellow ones for more vital decisions. I'm wondering if there's a red drop-down box for anything even more critical.

since some legitamate objects would require debit permissions, vendors etc

one of the best uses for an alt is as your own personal bank

I would like to know how often this is actually happening. I've seen all the announcements but is this still going around? If so, why doesn't LL trawl the database and remove all the objects with the right name and creator to stop the flood dead?

Red popup: NOTICE: if you press OK, your RL account will be permantently deactivated!

We should try to educate those who pass on these messages, to say this instead:

"Never say YES to a big yellow-orange popup unless you know exactly what you're doing and why."

Now, if there was a freebie grief object that allowed those in the know to track you if you wear it or something subtle that isn't obvious to detect by anyone paying the least bit of attention, that might be worthy of some kind of public alert.

In any case, public alerts should always be made in a way that they can be verified. At the least, pointing to a web page with full information. Urban legends always lack verifiablility.

tl;dr for too many people.

The only problem is that LL will forget to put in a cancel button.. which only leaves the OK button


I've heard of these objects off and on. Actually, I've heard of them since I joined. There are apparently several types of these objects, one of which will actually move away from you once you give it permission. However, I have never SEEN one. Maybe I'll create an alt to hunt these elusive creatures....

My experience as a network admin is that a few percent of the users would click it anyway.

In two of the 'warnings' about this object that came in group chats last night, there was this added:

", it will duplicate and send itself to other people"

and people in group just kept yelling at me when I told them that the only warning they ever needed to pass on was "do not give debit permission to any object unless you know exactly what it is and where it came from".

I have a script that does this, mainly to see how it worked.

I've seen the scam ran and it does work a lot. But I did laugh when it was tried on me


trick is social engineering to go with the script for the payout. In the script you can set anyone's name as the person to receive the money. That way someone would use their alt or whatnot and even if busted the money will still go to main which is set in the script.

Now the victim would receive a popup asking for debit. But as with most noobs, they seem too trusting, especially with a fake mentor, or sl helper tag over your head which you can make yourself with an alt. Tell them just click yes and it will charge 1 dollar but you will receive XXX dollars back. So the noob sees dollar signs and thinks sure I'll pay 1 dollar to get back xxx dollars!! so they click yes and bam, entire wallet xfered.

thats how the scam is ran, I've had idiots try to do it to me, but I laugh since I have the code anyhow

So do spread the word to noobs. on the 'internets' NEVER TRUST ANYONE.

I just got a message from someone who insisted that it didn't need to ask for DEBIT permissions. I asked them to file a report if they have evidence, and they said they didn't but a "serious hacker" could do it.

*sigh*

You can see what the next variation is going to be.

I actually did get a group message once that stated if I accepted a specific object it would wipe out my hard drive.

And I thought the spam hoax emails were bad.

Even worse, some of these "hoaxes" are intentionally started for the express purpose of overtaxing the communications system, or for someone to get their jollies watching as many groups as possible get spammed.

It's a "social virus" kind of thing. Someone, or a small group of someones, join large, open groups, and start one of these, asking everyone to spread it far and wide. It ends up spamming hundreds and thousands of groups before it finally dies out.

We usually nip it in the bud and "educate" people who bring that spam to our groups, as it is quite odious and annoying.

The rule is, if you don't know (or understand) what it is you are propagating, don't propagate it. If in doubt, or even if you think you know, ask someone who does. Ignore the supposed "urgency" to "warn as many as possible before they are harmed", as this banks on people allowing impulsiveness to override their critical thinking.

the money thing isnt a hoax though, i got a copy of the script to pick it apart, with the applied social engineering it's really nasty, i got hit with it when i first started and only had 10 lindens so i was lucky lol, like a noob i trusted the guy with a sl mentor tag (turned out fake) and it sucked my wallet to 0. but thats back when i first started.

I got a copy of the script on a notecard if anyone interested to see what it looks like

No, the hoax part comes in when it is claimed that, by simply receiving the object in inventory, all of your money will be instantly and irrevocably transferred to the person who sent it to you.

That or some similarly ridiculous statement.

Yes please. A great big red flashy warny thingy that says something like

"YOU HAVE SET YOUR LAND FOR SALE TO ANYONE AT LESS THAN HALF OFF WHAT ITS WORTH. IF YOU ARE HAPPY TO SELL IT IMMEDIATELY FOR THIS PRICE TO A LANDBOT CLICK YES. OTHERWISE CLICK !!! NO !!! AND PUT IN THE PRICE YOU THOUGHT YOU MEANT AND TRY AGAIN."

And if that doesnt sort out the tears then I dont know what else will.