There is a bug where if an account is blocked by another user, then the blocked account can still send llInstantMessage requests to the user when the object is set to Group Deeded. There were a couple of allegations recently where an individual was able to bypass an account block by using this method. This allowed them to send messages from a remote region to the user in an unsolicited persistent manner while the block was in place. Whether the allegations were true or not, we were able to re-create the scenario using myself and a volunteer. While the test was conducted with a simple touch_start event, you can change it to accept any local chat input tied to an agent UUID. This will allow the attacker to post any messages to the end user with no protections against it. Edit: I was informed that some stores use this method to Bypass the blocks to post ads directly to the consumer as well.
