[#SVC-2514] Potential security vulnerability with account that was able to "copybot" not just items and attachments but also profiles and access closed-enrollment groups

2. Second Life Service - SVC

Potential security vulnerability with account that was able to "copybot" not just items and attachments but also profiles and access closed-enrollment groups

Created: 09/Jun/08 10:10 AM Updated: 01/Jul/08 03:31 PM

Return to search

Component/s:

None

Affects Version/s:

None

Fix Version/s:

None

File Attachments:

None

Image Attachments:

1. copybot.jpg
(73 kB)

Environment:

Affected multiple users - see description

Issue Links:

Relates

This issue Relates to:

SVC-2568 SL clients are receiving *far too many avatar textures unnecessarily*

VWR-4970 Texture UUIDs that only objects created by the uploader can use

SVC-676 Stopping texture theft and stop spreading of stolen items

Description

« Hide

My wife Sansarya Caligari and I were at a store when we encountered an avatar named YukiBear Inglewood.

She suddenly morphed into an exact copy of Sans' avatar, with the exception of the (demo) hair she was wearing. We immediately thought COPYBOT.

I started to look at the avatar's profile to find out some info to use for an AR and discovered, much to my shock, that except for the name, her profile was identical to Sans'. Then, after a couple of minutes, she became ME.

She claimed to be the owner of the store where we were, but the names didn't match. I challenged her to relog onto her main account as proof; she disappeared momentarily but reappeared shortly, still on the same account.

Sans and I both filed ARs and advised her that copybot-type scripts are a violation of the TOS. She ridiculed us.

I put out a group IM to one of the large social groups we frequent and soon eight or 10 people were there, filing ARs, but the whole time, she kept changing form into each of us. It was like fighting Mystique in X-Men.

Then it got really weird: her name began showing up as a member in some of our groups, some of which were invite-only.

Finally, after 10 minutes or so, she poofed and her name was gone from Search.

But it was definitely pretty weird, especially the profile and group part. We all agreed we had never seen anything like that before.

I am including a pic that Sans got showing her profile and the copybotter's profile (copied from hers) side by side.

One real concern is when an avatar using whatever script this may have been shows up as a member in one of our groups, is it strictly a "cosmetic" thing, i.e. artificially showing in the group list, or do they become functional members of the group? This has some very harmful possibilities and is definitely a bug that needs to be fixed.

EDIT: One of the comments asks about the name of the avatar who ended up having to kick the botter from an invite-only group. That was vendetta Lowell, though I don't know what group it was that the bot had joined. I will attempt to contact Vendetta and ask her if she'll share that information here.

I didn't include hardware or client info because there were 10+ people who witnessed this, and certainly a variety of both were in use.

There are also chat logs available if that would help.

Description

My wife Sansarya Caligari and I were at a store when we encountered an avatar named YukiBear Inglewood. She suddenly morphed into an exact copy of Sans' avatar, with the exception of the (demo) hair she was wearing. We immediately thought COPYBOT. I started to look at the avatar's profile to find out some info to use for an AR and discovered, much to my shock, that except for the name, her profile was identical to Sans'. Then, after a couple of minutes, she became ME. She claimed to be the owner of the store where we were, but the names didn't match. I challenged her to relog onto her main account as proof; she disappeared momentarily but reappeared shortly, still on the same account. Sans and I both filed ARs and advised her that copybot-type scripts are a violation of the TOS. She ridiculed us. I put out a group IM to one of the large social groups we frequent and soon eight or 10 people were there, filing ARs, but the whole time, she kept changing form into each of us. It was like fighting Mystique in X-Men. Then it got really weird: her name began showing up as a member in some of our groups, some of which were invite-only. Finally, after 10 minutes or so, she poofed and her name was gone from Search. But it was definitely pretty weird, especially the profile and group part. We all agreed we had never seen anything like that before. I am including a pic that Sans got showing her profile and the copybotter's profile (copied from hers) side by side. One real concern is when an avatar using whatever script this may have been shows up as a member in one of our groups, is it strictly a "cosmetic" thing, i.e. artificially showing in the group list, or do they become functional members of the group? This has some very harmful possibilities and is definitely a bug that needs to be fixed. EDIT: One of the comments asks about the name of the avatar who ended up having to kick the botter from an invite-only group. That was vendetta Lowell, though I don't know what group it was that the bot had joined. I will attempt to contact Vendetta and ask her if she'll share that information here. I didn't include hardware or client info because there were 10+ people who witnessed this, and certainly a variety of both were in use. There are also chat logs available if that would help. P2

Show »

All

Comments

Change History

Sort Order:

[ Permlink | « Hide ]

Gordon Wendt added a comment - 09/Jun/08 02:17 PM

This is really an issue for support, I'd suggest opening a ticket at http://support.secondlife.com

[ Permlink | « Hide ]

Aki Shichiroji added a comment - 09/Jun/08 03:00 PM - edited

From other sources of information i've been reading on this particular situation, the account in question has already been banned. I think what Phoenix is trying to bring to light here is the question of whether one such copybot (under any circumstance) would be able to clone a position within any given group (along with the permissions given to members in said role).

If so, this could be especially harmful if the malignant user were to decide, for instance, that he wanted to maliciously kick other people from the group, or maybe do something irreparable to the group's land.

As such, i believe it is relevant to JIRA and needs to be addressed.

[ Permlink | « Hide ]

Lex Neva added a comment - 09/Jun/08 03:21 PM

I agree with Aki that we should keep this open until we hear more about this possible group bug. If someone can improperly gain membership in a group that is invite-only, that'd be a security exploit. Has anyone else seen this?

[ Permlink | « Hide ]

Dante Tucker added a comment - 09/Jun/08 04:46 PM

This was revewed and tested using the libsl test client. Trying to join a closed group fails after the join request with "Second Life: You cannot join '[group name here]':
The group no longer has open enrollment."

I vote this remains closed.

[ Permlink | « Hide ]

Gordon Wendt added a comment - 09/Jun/08 06:59 PM

Dante, I agree if there is a bug in groups or such that allow this then it needs to be addressed however there is no info on whether that's possible and that's not really even the described issue it seems.

[ Permlink | « Hide ]

Joshua Nightshade added a comment - 09/Jun/08 11:11 PM - edited

Stop closing this issue. Over ten of us were present in world when this happened. If it gets closed again I'm reopening it unless it's locked by a Linden.

Whether this was done strictly via the libSL client or a hacked/modified viewer is irrelevant, I watched with my own eyes what happened and it's clearly indicative of a security vulnerability that needs to be addressed and not swept away as "Well I don't have the skills to hack it myself, ergo no one else can."

[ Permlink | « Hide ]

Joshua Nightshade added a comment - 09/Jun/08 11:17 PM

Updated the JIRA issue a bit to clarify the problem.

[ Permlink | « Hide ]

Dante Tucker added a comment - 09/Jun/08 11:34 PM - edited

Hi again everyone... If you are all so certain this is a security vulnerability then it needs to be moved to SEC - Security exploits

However simply taking someones profile picture, skin textures and joining groups there in is not. Why? Becuase you can do all those things without a special program.

The only thing that is not posible without a special program (and then only becuase the button is not visable) is joining a closed group.
What I tested was the original theory that was discused when this was brought up in the forums and the client used is irrelivent. Manually sending the join group request therefore bypassing any client side restriction was the problem, and determined that is not the case.

So move it to SEC.

Also I didn't close the issue. I never do that without leaving a few days for responses.

[ Permlink | « Hide ]

Joshua Nightshade added a comment - 09/Jun/08 11:38 PM

There's no harm in it being made here as well. The ability to join closed groups is a security vulnerability in and of itself, not the least of which the fact that despite the bot being able to just join as the "Everyone" roll, many group owners who operate closed groups assign full responsibilities to that roll because they assume nobody except those invited can get in to begin with.

There's no detriment to a public JIRA issue being made about this to raise awareness.

[ Permlink | « Hide ]

Dante Tucker added a comment - 10/Jun/08 12:01 AM

As this is going to serve as a public awareness message rather then a real issue I suggest adding the workarounds that were discussed such as having your group require payment to join.

Take no offense to "rather then a real issue" I only say that because of the fact this is missing repro, therefore making the issue impossible to fix at the moment.

[ Permlink | « Hide ]

Joshua Nightshade added a comment - 10/Jun/08 12:07 AM

Because you and I can't reproduce this because we lack whatever client was used (and I know I'm not willing to open myself up to a ban for trying to brute force my way towards figuring out how they did it) doesn't mean the Lindens can't, having, you know, greater access to the entire security substructure and all that.

[ Permlink | « Hide ]

wildefire walcott added a comment - 10/Jun/08 12:27 AM

Folks, I think it's pretty naive to assume that trying to join a closed group in whatever off-the-shelf libsl stuff you download is a sufficient test of whether it's possible. This person could well have been using an exploit that's not publicly known, or using a custom-hacked client. All I know is that one of our friends who was in the room with us said the botter had joined her invite-only group, and was added in the Everyone role, and she had to eject the guy from the group. I don't know the group name, but as it was her personal group, I expect her to know the permissions she's set on it. None of us here knows exactly what this person was doing and what software they were using. By closing this jira you could be holding the window open for people who know of this exploit, if the exploit does indeed exist.

[ Permlink | « Hide ]

Harleen Gretzky added a comment - 10/Jun/08 02:34 AM

Is there a snapshot of the profile showing one of these invite-only groups in the bot's profile?

[ Permlink | « Hide ]

Lex Neva added a comment - 10/Jun/08 09:44 AM

(note, no one has CLOSED this issue, they have resolved this issue, which means "sent back to the reporter for reconsideration")

I'd be glad to move this to SEC if necessary. If any details of how to reproduce this exploit are posted here, that would be the best course to take because it would give LL time to fix it before others start exploiting it.

It would help if we know what group(s) the person joined, the name of wildefire's friend whose group the person joined, and the name of the person who was doing the copying. The approximate time might be helpful too, in case LL has logs. If your friend doesn't want their name or their group's name made public here, I can move the issue to SEC where it won't be visible by the public.

As suggested above, it might be a good idea to open a support ticket as well to get more immediate attention to this issue.

[ Permlink | « Hide ]

Soft Linden added a comment - 01/Jul/08 03:31 PM

@phoenix psaltery - Please file a separate ticket in the SEC- (security) project with the closed groups that this avatar was able to join. We can do more research with that information.

Thank you