Ability to block groups
tracked
Aleksandr String
It's a weak point in security when object deeded to group can send instant messages to avatars. You cant block such spam because you see only group name as object owner. While you jump to spamming prim it can selfdelete... And spammer can use several avatars to rez and deed prims. So it would be good if adding group by UUID in a block list would stop spam from deeded objects.
Log In
Maestro Linden
Merged in a post:
Group Deeded Objects Allows llInstantMessage To Bypass Blocks
SamanthaTekcat Resident
There is a bug where if an account is blocked by another user, then the blocked account can still send llInstantMessage requests to the user when the object is set to Group Deeded.
There were a couple of allegations recently where an individual was able to bypass an account block by using this method. This allowed them to send messages from a remote region to the user in an unsolicited persistent manner while the block was in place. Whether the allegations were true or not, we were able to re-create the scenario using myself and a volunteer.
While the test was conducted with a simple touch_start event, you can change it to accept any local chat input tied to an agent UUID. This will allow the attacker to post any messages to the end user with no protections against it.
Edit: I was informed that some stores use this method to Bypass the blocks to post ads directly to the consumer as well.
Photo Viewer
View photos in a modal
Maestro Linden
Hi SamanthaTekcat Resident, when an avatar deeds an object to a group, the agent is no longer the owner - the group is. The process is similar to setting the object as "For Sale: Original" and then having another avatar buy it. It is expected for a block/mute against the object's previous owner avatar to no longer apply after the object changes ownership.
That said, the block list tools do have a shortcoming. The viewer UI only allows you to block:
- A specific object ("Block")
- All objects with a certain name ("Block Object by name")
- All objects owned by a particular avatar("Block Resident by name")
There is no way to block a group by name - the people picker that's opened with"Block Resident by name" does not show groups in search. I think it would be valuable to add this.
Soap Frenzy
Maestro Linden I think a decent solution would be adding the ability for users to add groups to their blocklist so that it only blocks chat from objects deeded to the group but keeps normal group activities functional.
Adding a new check box to the group profile floater like "Allow deeded objects to message me" which could be enabled by default to preserve current functionality
SamanthaTekcat Resident
Soap Frenzy
I concur with this as being a potential solution.
Another solution could be that it does a group check on the owner and then falls back on looking at the last owner as a temporarily solution until the suggestion Soap made does make its way to the viewer as an option.
Either way, this has been abused and it should be closed somehow
Soap Frenzy
SamanthaTekcat Resident I looked into how the viewer handles ownership ID's when it comes to group deeded objects.
when the viewer recieves a message from an object it contains as part of its data
<SourceID> The UUID of the object/prim itself running the script.
<OwnerID> Contains the UUID of the owner:
- Individual-Owned: Contains the Avatar’s UUID.
- Group-Deeded: Contains the Group’s UUID.
LLMuteList already natively supports LLMute::GROUP and syncing it with the Linden Lab database.
So all that needs to be done is adding some UI elements for adding groups to the blocklist.
SamanthaTekcat Resident
Soap Frenzy
That's perfect, maybe we can talk to the Aurora and Slipstream devs as well to add that.
I'd imagine you can add it to your own as well.
Soap Frenzy
SamanthaTekcat Resident I did add it into my own viewer and it works great. I could add it to the slviewer and PR it against the issue once it's tracked
SamanthaTekcat Resident
I just learned that some stores use this method to circumvent blocks and sends ads to the users via this method.
Aleksandr String
Can block objects deeded to blocked groups too. Blocking groups doesnt help.
Aleksandr String
Tests showed it's possible to block group by UUID using Block Resident -> Search by UUID (Firestorm browser block list).
Maestro Linden
updated the status to
tracked
Andrea14071789 Resident
But they will pass!