If you have any passwords stored in notecards, you'll want to change them.

JS has updated his lsl.zip file with source from my multivendor, as well as the configuration notecard. The notecard was protected, which tells me that notecards themselves are just as vulnerable as scripts. (Both access checks probably use the same code path.) The vendor is not a big deal - there's already a similar one (which actually has more features) posted in the scripting library. However, the notecard is an interesting piece, since it proves that the exploit exposed notecards as well as scripts.

If you have notecards with sensitive passwords in them, I advise you to change your passwords immediately and take any objects containing them into inventory.

I am still of the opinion that this exploit has not been permanently fixed, and advise extreme caution for anyone who wishes to protect their assets. I may be mistaken about this and I hope that I am, but I feel it is necessary to voice what I suspect is true.

That is all...

Thanks for the heads up, Huns.

Just an additional note, storing secure info in Notecards is generally a bad idea.

Rip notecard out of object, place in an object you own, and use a llRequestNotecardLine() script to print it out for you.

-Adam

Yeah that whole ripping objects out of objects you don't have mod privileges on was a really really dumb idea. Who came up with that one?

It causes sooo much grief and keeps so much from getting built (like, try before buy) and probably has been a source of over half of the duplication hacks.

Regardless of it's value (and I will grant being able to pull out things has proved handy in the past), it's there now - and removing it will break things like people who sell boxed items (although again, they should be using a scripted box).

So, we are going to have to accept it - and take it into account when analysing security risks.

-Adam

For what purpose would someone put a password on an SL notecard?

Yeah... I used it to configure a vendor that I owned. If I had ever got around to selling the vendor to others, they'd have had read/write access to the notecard anyhow.

What if the object needed to talk to another and it was some kind of communication that needed to be authenticated? For example, some vendors don't actually have inventory - they send a message to a central repository, and the repository delivers the item. That is the kind of thing you'd want a password on.

Notecards which are not modifiable that can't be read by normal means can be read easily by llGetNotecardLine() like Adam said. But the case is you have to own that notecard. For someone storing a password in their own vendor should be ok because only the owner can read that notecard unless somebody somehow finds it's key. So if you don't want the next owner to know the contents of that notecard then don't use a notecard.

The hackers posted the contents of a notecard in MY vendor, which I never gave to anyone.