Group Deeded Objects Allows llInstantMessage To Bypass Blocks
under review
SamanthaTekcat Resident
There is a bug where if an account is blocked by another user, then the blocked account can still send llInstantMessage requests to the user when the object is set to Group Deeded.
There were a couple of allegations recently where an individual was able to bypass an account block by using this method. This allowed them to send messages from a remote region to the user in an unsolicited persistent manner while the block was in place. Whether the allegations were true or not, we were able to re-create the scenario using myself and a volunteer.
While the test was conducted with a simple touch_start event, you can change it to accept any local chat input tied to an agent UUID. This will allow the attacker to post any messages to the end user with no protections against it.
Edit: I was informed that some stores use this method to Bypass the blocks to post ads directly to the consumer as well.
Photo Viewer
View photos in a modal
Log In
Maestro Linden
updated the status to
under review
Maestro Linden
Hi SamanthaTekcat Resident, when an avatar deeds an object to a group, the agent is no longer the owner - the group is. The process is similar to setting the object as "For Sale: Original" and then having another avatar buy it. It is expected for a block/mute against the object's previous owner avatar to no longer apply after the object changes ownership.
That said, the block list tools do have a shortcoming. The viewer UI only allows you to block:
- A specific object ("Block")
- All objects with a certain name ("Block Object by name")
- All objects owned by a particular avatar("Block Resident by name")
There is no way to block a group by name - the people picker that's opened with"Block Resident by name" does not show groups in search. I think it would be valuable to add this.
Soap Frenzy
Maestro Linden I think a decent solution would be adding the ability for users to add groups to their blocklist so that it only blocks chat from objects deeded to the group but keeps normal group activities functional.
Adding a new check box to the group profile floater like "Allow deeded objects to message me" which could be enabled by default to preserve current functionality
SamanthaTekcat Resident
Soap Frenzy
I concur with this as being a potential solution.
Another solution could be that it does a group check on the owner and then falls back on looking at the last owner as a temporarily solution until the suggestion Soap made does make its way to the viewer as an option.
Either way, this has been abused and it should be closed somehow
SamanthaTekcat Resident
I just learned that some stores use this method to circumvent blocks and sends ads to the users via this method.