Security hole?
|
Sling Trebuchet
Deleted User
Join date: 20 Jan 2007
Posts: 4,548
|
01-25-2010 09:57
From: Eli Schlegal I've heard that terraforming will make objects go off world and be returned and I have heard it from multiple sources. It doesn't seem to happen in all cases but I am convinced it happens in some cases. How much did you make the land rise above the object? It was normal mainland, starting at reverted levels. So I went down the max of 4 m, rezzed the cube and then terraformed up 4m plus the other 4m for a total of nearly 8m. I have some +/-40m mainland. I'll try it there. ETA: Tried that. I had a 15-prim structure buried nearly 80m underground. No problems.
_____________________
Maggie: We give our residents a lot of tools, to build, create, and manage their lands and objects. That flexibility also requires people to exercise judgment about when things should be used. http://www.ace-exchange.com/home/story/BDVR/589
|
Kit Banufong
Registered User
Join date: 5 Jul 2008
Posts: 8
|
01-25-2010 10:17
From: Wildefire Walcott This all sounds very odd. I would have assumed a terraforming attack as well, since many people check the public terraforming box to allow their friends to make changes, not knowing that deeding the land and controlling terraforming through group roles is really the way to go. However the posters here say public landshaping was disabled.
Anyway, if you haven't already, do the following: - Report all avatars with Help > Abuse Report. - Lock down your island for a while (estate-level access list or parcel access list) and see if anyone else is able to infiltrate. A stand-alone island with an access list should not be accessible to anyone who isn't an estate manager or island group member. - Request that the actual island owner requests an island roll-back. The sooner you make the request the better. You also need to report the time and day when the attack occurred so LL knows which back-up copy to restore. They only keep a few days' worth of roll-backs. We have managed to terraform the sim back to similar to what it was already so we dont need a roll back besides that wouldnt rebuild our cabin or untanlge all the returned objects .... its a mess in our inventories  ( I have reported it and so has Dakx we aren't getting much help form RGF at all except from a guy named Scyber The land is deeded to a group that dakx and I own and only we have permissions within that group , its invite only , and only Dakx and I had access up at the cabin anyway, not the other members of the group I run a RL class on the island and need public access for the first few lesson until the students learn how to communicate and accept group invites In the past I've had issues with other groups and pple adding themselves to the allowed list but this didnt happen in this instance
|
Cerise Sorbet
Registered User
Join date: 8 Jun 2008
Posts: 254
|
01-25-2010 10:18
It still happens. I tried at Torley's terraform sandbox yesterday. My prims went off world.
|
Phil Deakins
Prim Savers = low prims
Join date: 17 Jan 2007
Posts: 9,537
|
01-25-2010 10:23
From: Kit Banufong [...] so we dont need a roll back besides that wouldnt rebuild our cabin or untanlge all the returned objects [...] Yes it will - it'll put all the objects back as they were at the time of the rollback, and you'll have extra copies of it all in your inv.
|
Kit Banufong
Registered User
Join date: 5 Jul 2008
Posts: 8
|
01-25-2010 10:23
From: Sling Trebuchet Did the security orb log their names?
It sounds as if they had found some way to get Linden god powers for the land.
When Lindens are in that mode, normal scanning does not detect them. I once had 3 lindens on my land and they were invisible to my visitor scanner. Ihe orbs were returned to Dakx and lost the data The doors that were locked were returned too Theres no stored data It seems that they knew exactly where our security orbs were located ( I didn't even know that ) The chat log shows these people entering and leaving chat range the orbs didnt show a greeting in chat either Scyber suggested that this hud may have been used https://www.xstreetsl.com/modules.php?name=Marketplace&file=item&ItemID=846594
|
Wildefire Walcott
Heartbreaking
Join date: 8 Nov 2005
Posts: 2,156
|
01-25-2010 10:24
From: Kit Banufong We have managed to terraform the sim back to similar to what it was already so we dont need a roll back besides that wouldnt rebuild our cabin or untanlge all the returned objects .... its a mess in our inventories  ( You might be confusing "rollback" with "revert." A roll-back restores a sim's entire state, including terraforming, terrain textures, objects, and even script state. LL doesn't like to do it very often because it can be exploited to make unauthorized copies of no-copy items, if you know what you're doing. Anyway, sounds like you're pretty far along in your rebuilding.
|
Kit Banufong
Registered User
Join date: 5 Jul 2008
Posts: 8
|
01-25-2010 10:27
From: Wildefire Walcott You might be confusing "rollback" with "revert." A roll-back restores a sim's entire state, including terraforming, terrain textures, objects, and even script state. LL doesn't like to do it very often because it can be exploited to make unauthorized copies of no-copy items, if you know what you're doing.
Anyway, sounds like you're pretty far along in your rebuilding. We are requesting a roll back now thanks to everyone that let me know that it would work  ) We re-terraformed but rebuilding is a nightmare with classes starting again next week
|
Lindal Kidd
Dances With Noobs
Join date: 26 Jun 2007
Posts: 8,371
|
01-25-2010 10:44
If the rollback isn't granted, you can locate any remaining underground objects.
1. Enable the Advanced menu, CTRL+ALT+D 2. Choose Advanced/Rendering/Types and de-select Land 3. Take any objects you see. 4. Re-enable the Render Land type.
_____________________
It's still My World and My Imagination! So there. Lindal Kidd
|
Sling Trebuchet
Deleted User
Join date: 20 Jan 2007
Posts: 4,548
|
01-25-2010 10:45
When the objects were returned, what was the text of the message?
If returned by a person it would be in the form: Your object '(object_name)' has been returned to your inventory lost and found folder by (avatar_name) from parcel '(parcel_name)' at (region_name_and_coordinates) due to parcel owner return.
If returned by a parcel setting it would be of the form: Your object '(object_name)' has been returned to your inventory lost and found folder from parcel (parcel_name)' at (region_name_and_coordinates) due to parcel auto return.
_____________________
Maggie: We give our residents a lot of tools, to build, create, and manage their lands and objects. That flexibility also requires people to exercise judgment about when things should be used. http://www.ace-exchange.com/home/story/BDVR/589
|
Treasure Ballinger
Virtual Ability
Join date: 31 Dec 2007
Posts: 2,745
|
01-25-2010 10:47
From: Sling Trebuchet When the objects were returned, what was the text of the message?
If returned by a person it would be in the form: Your object '(object_name)' has been returned to your inventory lost and found folder by (avatar_name) from parcel '(parcel_name)' at (region_name_and_coordinates) due to parcel owner return.
If returned by a parcel setting it would be of the form: Your object '(object_name)' has been returned to your inventory lost and found folder from parcel (parcel_name)' at (region_name_and_coordinates) due to parcel auto return. My friend who I mentioned earlier in the thread, her message said that her object xxxx had been returned to her inventory lost and found folder because it went offworld. Then, we found out 'why' it went offworld, because of the giant terraforming she'd inadvertently done.
_____________________
To LL: Sometimes I wondered, I didn't understand; just where you were trying to go, only you knew the plan. I tried to be there but you wouldn't let me in........ *************************************************** To my forum friends: I'm Missing You...........
|
Scyber Magne
Registered User
Join date: 26 Oct 2007
Posts: 1
|
Security hole issue:
01-25-2010 10:49
I have to agree to the security issue. I've been helping the owners of the said sim as a sim group manager about this security breach, and I will say they did not mis-configure, fiddle with land and group options, or any such thing. I checked and tripled check their settings and everything was fine. I did find the possible reason this happened, but I wont say what that 'thing' is over the form. What I will say is this is very serious and should be regarded as such with LL since people now can create things that reads your IP address, account info, invites you into groups you cannot access without permission to, terraform lands with no permissions, and even return anyone's objects. This is very real and LL is taking too long with a resolution to those who were victims of this disaster.
|
Kit Banufong
Registered User
Join date: 5 Jul 2008
Posts: 8
|
01-25-2010 11:07
From: Treasure Ballinger My friend who I mentioned earlier in the thread, her message said that her object xxxx had been returned to her inventory lost and found folder because it went offworld. Then, we found out 'why' it went offworld, because of the giant terraforming she'd inadvertently done. We didnt inadvertently terraform , these people invaded our island and harrassed and made fun of us , even if they hadnt buried our sim the fact that we couldnt eject , freeze , ban or get rid of them in any way was extremely upsetting , let alone the fact that they helped themselves to permissions 
|
Treasure Ballinger
Virtual Ability
Join date: 31 Dec 2007
Posts: 2,745
|
01-25-2010 11:09
From: Kit Banufong We didnt inadvertently terraform , these people invaded our island and harrassed and made fun of us , even if they hadnt buried our sim the fact that we couldnt eject , freeze , ban or get rid of them in any way was extremely upsetting , let alone the fact that they helped themselves to permissions  Oh yes, I do understand, your situation is totally different from the one I referred to, you were definitely griefed in some way that I don't yet understand; but up above, Sling was saying that her objects were not returned to her when she terraformed over them, that's what I was talking about. I do understand that you have a whole different thing going on.
_____________________
To LL: Sometimes I wondered, I didn't understand; just where you were trying to go, only you knew the plan. I tried to be there but you wouldn't let me in........ *************************************************** To my forum friends: I'm Missing You...........
|
Phil Deakins
Prim Savers = low prims
Join date: 17 Jan 2007
Posts: 9,537
|
01-25-2010 11:15
If I were the sim owner, paying LL a significant amount of money every month for the sim, I would expect a rollback without having to persuade them in any way. I would also expect them to examine the item mentioned above to see if it is capable of doing things like this, and I wouldn't take no for an answer on either count.
|
Kit Banufong
Registered User
Join date: 5 Jul 2008
Posts: 8
|
01-25-2010 11:20
From: Phil Deakins If I were the sim owner, paying LL a significant amount of money every month for the sim, I would expect a rollback without having to persuade them in any way. I would also expect them to examine the item mentioned above to see if it is capable of doing things like this, and I wouldn't take no for an answer on either count. We pay tier to RGF , it's a homestead not a full sim I'd love to be able to afford an island of my own but its just too expensive  I do pay premium , but that doesnt seem to make a difference with LL , everytime i try and talk to Live support i get told to submit a ticket and that takes weeks , i dont imagine it will be any different with this either
|
Phil Deakins
Prim Savers = low prims
Join date: 17 Jan 2007
Posts: 9,537
|
01-25-2010 11:26
Yes, I meant the sim owner - RGF.
If RGF won't do anything, I'd move away from them.
|
Kit Banufong
Registered User
Join date: 5 Jul 2008
Posts: 8
|
01-25-2010 11:39
i think we may have to , its not an option right now though with a new term stating next week 
|
Argus Collingwood
Totally Tintable
Join date: 5 Dec 2005
Posts: 600
|
01-25-2010 12:12
From: Phil Deakins Yes it will - it'll put all the objects back as they were at the time of the rollback, and you'll have extra copies of it all in your inv. This!! We had a rollback on a sim we owned and it is exactly as Phil says.
_____________________
~*~ Please behave before I have to slap you naked and hide your clothes! ~*~ Argus-eyed = carefully observant or attentive; on the lookout for possible danger 
|
Chris Norse
Loud Arrogant Redneck
Join date: 1 Oct 2006
Posts: 5,735
|
01-25-2010 12:13
From: Kit Banufong We pay tier to RGF , it's a homestead not a full sim I'd love to be able to afford an island of my own but its just too expensive  I do pay premium , but that doesnt seem to make a difference with LL , everytime i try and talk to Live support i get told to submit a ticket and that takes weeks , i dont imagine it will be any different with this either Ok, so you don't own the land. That does add to the possibility that they had inside help getting control of your permissions.
_____________________
I'm going to pick a fight William Wallace, Braveheart
“Rules are mostly made to be broken and are too often for the lazy to hide behind” Douglas MacArthur
FULL
|
Wildefire Walcott
Heartbreaking
Join date: 8 Nov 2005
Posts: 2,156
|
01-25-2010 12:44
From: Scyber Magne What I will say is this is very serious and should be regarded as such with LL since people now can create things that reads your IP address, account info, invites you into groups you cannot access without permission to, terraform lands with no permissions, and even return anyone's objects. This is very real and LL is taking too long with a resolution to those who were victims of this disaster. If you have uncovered some form of exploit, please file a security Jira so LL knows about it. Security jiras are only visible to LL employees, and they get super-duper top priority over other problems filed there.
|
Lear Cale
wordy bugger
Join date: 22 Aug 2007
Posts: 3,569
|
01-25-2010 13:27
FYI, one form of the terraforming attack is by a scripted object. If the owner rezzes it and grants permission it can terraform at will, using the owner's permission. I don't think that terraforming permissions are granted automatically on sit or wear, so I think permissions would have to be explicitly granted.
That's just a warning to folks that setting your land terraforming options correctly don't guarantee your land won't get terraformed. Be VERY CAREFUL what permssions you grant!
But I doubt that was the case here, since it wouldn't disable ban lists or prohibit freezing etc. THAT is really scary. I hope LL gets to the bottom of it quickly, and I hope the perpetrators get what they deserve. That's unlikely, though people like that are also very unlikely to live fulfilling lives.
|
Abigail Merlin
Child av on the lose
Join date: 25 Mar 2007
Posts: 777
|
01-25-2010 14:20
From: Phil Deakins If I were the sim owner, paying LL a significant amount of money every month for the sim, I would expect a rollback without having to persuade them in any way. I would also expect them to examine the item mentioned above to see if it is capable of doing things like this, and I wouldn't take no for an answer on either count. So far I never had to explain why I wanted a roll back, just file a ticket and half an hour later at most it is done, they do ask that you tell them what happened in case it is a glitch so they can get it fixed so for simowners the level of help is yes on both counts. Turning off public access to the sim and disabeling scripts should stop any attack.
|
Sling Trebuchet
Deleted User
Join date: 20 Jan 2007
Posts: 4,548
|
01-25-2010 14:30
Here's a thought:
If these people had obtained general group powers or even godlike powers, why didn't they freeze, eject, ban people? It would seem like an obvious griefy thing to do.
I just ran a test with group co-owner on group-deeded land. We could eject each other from the land, despite being group owners with full powers. We could freeze and ban. Being the group founder was not a protection either.
It's possible that whatever the exploit was, it didn't involve power over anything but terrain and (some) objects.
_____________________
Maggie: We give our residents a lot of tools, to build, create, and manage their lands and objects. That flexibility also requires people to exercise judgment about when things should be used. http://www.ace-exchange.com/home/story/BDVR/589
|
Phil Deakins
Prim Savers = low prims
Join date: 17 Jan 2007
Posts: 9,537
|
01-25-2010 14:39
Here's another thought:
I just remembered that the OpenMetaverse people gave people God powers at a Linden event some months ago. If it can be done by an OpenMV based programme, then perhaps that's how it was done.
|
Eternus Soulstar
Registered User
Join date: 7 Feb 2009
Posts: 71
|
01-25-2010 15:08
From: Sling Trebuchet Here's a thought:
If these people had obtained general group powers or even godlike powers, why didn't they freeze, eject, ban people? It would seem like an obvious griefy thing to do.
I just ran a test with group co-owner on group-deeded land. We could eject each other from the land, despite being group owners with full powers. We could freeze and ban. Being the group founder was not a protection either.
It's possible that whatever the exploit was, it didn't involve power over anything but terrain and (some) objects. because there's no fun in griefing people that aren't there.
_____________________
Just set the plate down, and back away slowly.
|