Second Life Forums Archive - Security issue

Daisy Rimbaud

Registered User

Join date: 12 Oct 2006

Posts: 764

03-18-2007 04:54

I had an alarming experience that I think people should know about.

On Thursday I was standing on my porch, chatting to a friend by IM, when I noticed another friend I hadn't seen in a while log on about 60m away, and walking towards me. So I said on the IM, "Excuse me, I see someone coming to see me".

I started walking to intercept friend #2, who had now entered a building between my house and where they logged on. I went in to the building and said hello.

No reply. Even odder, avatar was walking backwards and forwards and bumping into the furniture. "What's the matter?" I said. No reply. Eventually avatar is stuck in a corner and logs off.

This is someone I know IRL, and I know they have internet connection problems, so I thought maybe that was the cause.

Then yesterday, I met said friend again, and said, "Why did you ignore me on Thursday?" Came the reply: "I wasn't on on Thursday."

So we went over it all, and sure enough, when they logged on, they were stuck in the corner where I said. Fortunately, no money was taken from the account, and there was nothing in the transaction log. The account password has not been shared by my friend with anyone.

I thought maybe I spooked whoever was running the avatar by coming over, but on reflection, it may have been getting stuck that caused them to log off. It didn't look as if there was anyone human in charge. I'm suspecting now that someone is using some sort of program to do a brute force or dictionary attack on SL account passwords, and then using a bot to activate any avatars that get cracked in that way. Needless to say, there was some quick password changing ...

Has anyone else seen any sign of this? I think some care is needed all round.

Gaybot Foxley

Input Collector

Join date: 15 Nov 2006

Posts: 584

03-18-2007 05:41

That sounds really scary. Did they change their password yet? Eeek, bad bots taking control of avatars via black hat hackers? You know LL just sent out some emails to people who's accounts may have been compromised by last year's hack fiasco. http://blog.secondlife.com/2007/03/10/email-from-linden-lab/ Maybe it's just the devil trying to take over the world by using the "Metaverse". lol My avatar had better not become possessed.

Fenix Eldritch

Mostly harmless

Join date: 30 Jan 2005

Posts: 201

03-18-2007 06:00

This is news to me - and alarming news at that. However...

Does you friend share his computer with anyone? More importantly, does he have his SL viewer remember his password?

If so, perhaps that's how his account was accessed. Bot or not, I find it strange that your friend's account was left undamaged - especially after a day's elapse. If someone with the intent to hijack an avatar got into an account, I would think they would be right quick about screwing that avatar over as quickly as possible.

Troubling times. *sigh*

Daisy Rimbaud

Registered User

Join date: 12 Oct 2006

Posts: 764

03-18-2007 06:20

From: Fenix Eldritch

Does you friend share his computer with anyone? More importantly, does he have his SL viewer remember his password?

If so, perhaps that's how his account was accessed. Bot or not, I find it strange that your friend's account was left undamaged - especially after a day's elapse. If someone with the intent to hijack an avatar got into an account, I would think they would be right quick about screwing that avatar over as quickly as possible.

That's a possible explanation - I'll check it out. If so it would be very reassuring to find out that it was just a nosy housemate.

Daisy Rimbaud

Registered User

Join date: 12 Oct 2006

Posts: 764

03-19-2007 13:57

Checked and that's not possible. The computer is locked away. So it is a hack of some sort.

Welcome to the Second Life Forums Archive

Security issue - bots on the loose?

Security issue - bots on the loose?
Daisy Rimbaud Registered User Join date: 12 Oct 2006 Posts: 764	03-18-2007 04:54 I had an alarming experience that I think people should know about. On Thursday I was standing on my porch, chatting to a friend by IM, when I noticed another friend I hadn't seen in a while log on about 60m away, and walking towards me. So I said on the IM, "Excuse me, I see someone coming to see me". I started walking to intercept friend #2, who had now entered a building between my house and where they logged on. I went in to the building and said hello. No reply. Even odder, avatar was walking backwards and forwards and bumping into the furniture. "What's the matter?" I said. No reply. Eventually avatar is stuck in a corner and logs off. This is someone I know IRL, and I know they have internet connection problems, so I thought maybe that was the cause. Then yesterday, I met said friend again, and said, "Why did you ignore me on Thursday?" Came the reply: "I wasn't on on Thursday." So we went over it all, and sure enough, when they logged on, they were stuck in the corner where I said. Fortunately, no money was taken from the account, and there was nothing in the transaction log. The account password has not been shared by my friend with anyone. I thought maybe I spooked whoever was running the avatar by coming over, but on reflection, it may have been getting stuck that caused them to log off. It didn't look as if there was anyone human in charge. I'm suspecting now that someone is using some sort of program to do a brute force or dictionary attack on SL account passwords, and then using a bot to activate any avatars that get cracked in that way. Needless to say, there was some quick password changing ... Has anyone else seen any sign of this? I think some care is needed all round.
Gaybot Foxley Input Collector Join date: 15 Nov 2006 Posts: 584	03-18-2007 05:41 That sounds really scary. Did they change their password yet? Eeek, bad bots taking control of avatars via black hat hackers? You know LL just sent out some emails to people who's accounts may have been compromised by last year's hack fiasco. http://blog.secondlife.com/2007/03/10/email-from-linden-lab/ Maybe it's just the devil trying to take over the world by using the "Metaverse". lol My avatar had better not become possessed.
Fenix Eldritch Mostly harmless Join date: 30 Jan 2005 Posts: 201	03-18-2007 06:00 This is news to me - and alarming news at that. However... Does you friend share his computer with anyone? More importantly, does he have his SL viewer remember his password? If so, perhaps that's how his account was accessed. Bot or not, I find it strange that your friend's account was left undamaged - especially after a day's elapse. If someone with the intent to hijack an avatar got into an account, I would think they would be right quick about screwing that avatar over as quickly as possible. Troubling times. sigh
Daisy Rimbaud Registered User Join date: 12 Oct 2006 Posts: 764	03-18-2007 06:20 From: Fenix Eldritch Does you friend share his computer with anyone? More importantly, does he have his SL viewer remember his password? If so, perhaps that's how his account was accessed. Bot or not, I find it strange that your friend's account was left undamaged - especially after a day's elapse. If someone with the intent to hijack an avatar got into an account, I would think they would be right quick about screwing that avatar over as quickly as possible. That's a possible explanation - I'll check it out. If so it would be very reassuring to find out that it was just a nosy housemate.
Daisy Rimbaud Registered User Join date: 12 Oct 2006 Posts: 764	03-19-2007 13:57 Checked and that's not possible. The computer is locked away. So it is a hack of some sort.