Category: SL Tech

Oskar Linden has provided an update / post-mortem on the recent bout of griefing that took place across the grid as a result of person or persons unknown abusing the advanced user experience code that was released onto the Magnum Release Channel two weeks ago.

The problem hit on Monday 4th June when the advanced teleport functions released to Magnum were used to teleport individuals or groups around the grid, with some people reporting they were teleported to the likes of The Cornfield, while others found themselves unexpectedly picked up and dropped into stores or meetings.

Linden Lab reacted rapidly to the issue, determining a fix for the exploit on the afternoon of the 4th (SLT) and deployed across the entire grid in a rolling restart that affected the main channel and all release channels.

The key points relating to the issue remain:

• The exploit came about due to a permissions restriction within the advanced tools not working as anticipated
• To prevent further misuse of the code, the advanced tools were also removed from the Magnum RC channel
• Both the code and the associated test plans have been revised and are being run through LL’s QA process to better ensure the situation of the 4th June is unlikely to be repeated when the code is rolled-out once more
• Coyot Linden estimates that the advanced experience tools project has been delayed by around 2-3 weeks as a result of these events
• LL are at this point in time unclear as to when the tools are likely to be rolled back out onto a Release Channel; the slot assigned to the tools on the Magnum RC has now been taken by other security issues in preparation for their roll-out to the grid.

One immediate outcome of the griefing situation is that the teleport capability has been revised so that when someone is teleported, the function will tell them the name of the owner of the object that teleported them (thus allowing any potential abuser of the system to be reported to LL via an Abuse Report).

With thanks to Nalates Urriah.

Update 11th June: Oskar Linden has provided further feedback on this situation. 

Update June 6th: Oskar Linden has confirmed that the Advanced Creation Tools capabilities that were rolled-out to the Magnum RC channel will remain disabled until at least next week, although no firm decision has been on re-enabling them.

Update June 5th 11:30 UTC: The rolling restarts completed at 03:39 UTC. At present, no further updates have been given on the forum post relating to the restarts, but this may change later during the course of today. Oskar Linden has reiterated that due to this rolling restart, there will be no main channel deploy today and that details on Wednesday’s RC deploys are still TBA. My apologies for late timing of this update; a small matter of real life prevented me putting my nose in front of the keyboard any sooner!

Last week saw elements of the new Second Life Advanced Creator Tools rolled-out to the Magnum channel. As I reported at the time, the tools were issued without the new permissions system, but with safeguards that (it was hoped) would prevent misuse.

Today, however, a party or parties unknown started to use teleport functions of the new tools outside of the Magnum Release Channel as a means of griefing. People first became aware of the issue as individuals and groups started finding themselves randomly teleported around the grid, which sparked speculation on Twitter. Later, messages started circulating in-world among groups, outlining issues, such as this one, sent out to the NCI Citizens Helper Group (with thanks to Raylene Gothly)

Ok to everyone, there is something seems grid wide, we do not know if its a bad code in certain sims or if someone has found a way to teleport grief. But its happening all over, so I’m not sure. however I’d like to let everyone know we are aware of this. Suddenly you are just teleported away, best to log off and relog to get out of it, as it seems to continue to teleport you, I was teleported 3 times when I relogged… Dont be frightened it just seems to be a mess up.

The only regions unaffected by the griefing tool appear to have been those on the Magnum RC (where the new teleport functionality has safeguards) and those sims that had script capabilities disabled. Messages were thus circulated to land holders to disable scripting in their regions to avoid the issue, at least until Linden Lab responded to the situation.

Linden Lab themselves commenced efforts to stop the problem with emergency rolling restarts across the grid, announced via a Grid status update and a forum post:

To solve a security issue with the Experience Tools that were deployed to Magnum last week we are doing an emergency simulator rolling restart deploy. This has already begun.

Regions on the following channels will be restarted with the fixed code:

Main Channel
BlueSteel
LeTigre

Magnum will not be restarted because the issue is not possible in Magnum regions. We will have no rolling restart Tuesday morning. The Wednesday morning RC channels will roll at the usual time.

We apologize for any inconvenience and appreciate your understanding.

I’ll update here when further information is available.