Server enables stalking by leaking teleport location to clients
closed
Extrude Ragu
Based on this community discussion
It seems it is possible under certain conditions for a client to receive the location of an avatar who has recently teleported out of the region the client is connected to.
This enables a form of stalking where someone who was in the same sim as you can follow you to wherever you teleported, leading to issues such as your Linden Home no longer becoming a private place etc.
It would be good if the server would sanity check and refuse to tell the client where the avatar is if the avatar is more than say 3 sims away.
Log In
Maestro Linden
updated the status to
closed
We haven't been able to reproduce any data leakage or gotten details of specific incidents to investigate. Closing for lack of information.
Maestro Linden
A few more checks - I set up a script to continuously monitor agent position via llGetObjectDetails() and report any changes. Source shown in child comment.
While the OBJECT_POS param of llGetObjectDetails accurately tracks agent position while they remain in the sim, I see that llGetObjectDetails
immediately
returns an empty list when the agent teleports to a far-away region and becomes a child agent of the original region. There is no sample in which an off-world position is returned. Also, if llSensor() is called at this point in an attempt to locate the departed agent, the agent is not found by the sensor and no_sensor() is triggered. Output looks like this:[12:57 PM] Object: Monitoring position changes for agent 39b44919-512a-40a5-8347-90f9125937e4 away from <127.99860, 127.99900, 23.04630>
[12:58 PM] Object: llGetObjectDetails returned empty list - agent not found!
[12:58 PM] Object: no_sensor(): agent not found
I also looked at the raw message stream that the viewer actually gets about avatar positions. Avatar movement is generally communicated via
ImprovedTerseObjectUpdate
messages, which shows the position, rotation, etc of the avatar. When an avatar teleports away, I don't see a ImprovedTerseObjectUpdate
about that avatar or their attachments indicating off-world position. Instead, there's a single KillObject
message, indicating that the avatar has 'derezzed' from the sim.What this all means is that we still lack the steps to reproduce this issue.
It could be the these stalking cases are caused by some other means, such as a script attached to the avatar reporting their post-teleport position to a 3rd party, or a script (or bot) in the destination region reporting the arrival.
Maestro Linden
// When touched, continuously polls an agent's position, and report their new position in
// nearby chat if it changes
default
{
touch_start(integer total_number)
{
key agent = "39b44919-512a-40a5-8347-90f9125937e4";
vector initial_pos = llList2Vector(llGetObjectDetails(agent, [OBJECT_POS]), 0);
integer continue = TRUE;
llSay(0, "Monitoring position changes for agent " + (string)agent
+ " away from " + (string)initial_pos);
while(continue)
{
list details = llGetObjectDetails(agent, [OBJECT_POS]);
if(llGetListLength(details) == 0)
{
llSay(0, "llGetObjectDetails returned empty list - agent not found!");
llSensor("", agent, AGENT, 1e6, PI); // try a crazy sensor call
continue = FALSE;
}
else
{
vector pos = llList2Vector(details, 0);
if(llVecDist(pos, initial_pos) > 0.01)
{
llSay(0, "Agent moved from " + (string)initial_pos + " to " + (string)pos);
llSensor("", agent, AGENT, 1e6, PI); // try a crazy sensor call
continue = FALSE;
}
}
}
}
sensor( integer detected )
{
llSay(0, "sensor(): agent found at " + (string)llDetectedPos(0));
}
no_sensor()
{
llSay(0, "no_sensor(): agent not found");
}
}
Maestro Linden
updated the status to
needs info
Maestro Linden
Hi guys, can you clarify the steps to reproduce this issue?
I'm having trouble reproducing this issue on Second Life Server 2026-07-10.29122504250. I find that when a nearby avatar teleports away, they immediately disappear from Firestorm 7.2.4's "Radar" list and also don't show up in llSensor() results.
Here's an example video - the nearby "Litmus Tester" avatar teleports to a far-away sim (Ahern) and disappears from the Radar list immediately. There isn't an update showing them to be kilometers away:
What I _do_ see is that if one has the Radar open and teleports far away, they continue to see avatars from their former region on the radar list. This persists for about a minute until the viewer's connection to the previous region is terminated. That seems to be what's shown in https://gyazo.com/5ca80c073b8a555d5f7314c661e9380e from the forum thread (though it's a bit hard to follow). I do see that 'Range' can update when an agent in the former sim moves _within_ the region, but that they immediately disappear from the list if they also teleport away.
Midnoot Resident
Maestro Linden the problem is that nobody seems to know how to to replicate it , but it IS being done . People are following avatars to their next location after they teleport , as if the name never disappears from the radar like it does for people testing it in the way that you are .
InnerCity Elf
That’s a potentially nasty bug, it would be good to see it fixed.
Midnoot Resident
It's nothing new either. I've had this happen to me off and on throughout SL, for the past at least 10+ years at least. I've seen youtube videos where a troll follows someone in a similar fashion, I've seen friends get followed this way as well.
It absolutely is some sort of exploit that requires nothing from the player being followed in order to work. No, it's not like a "phishing scam" where the player has to leave a crumb trail, or give a clue to what their location/login is.
Sure would be nice if I didn't have to log out to lose the trail of what seems like a massive amount of people that know how to do this exploit/teleport follow. But nope. Stuck logging out before I go anywhere, and logging back into another region, to prevent unwanted follows.