What can scripts do w/o permission?

[xAlassrax]

I have recently started playing, and I purchased a tv from a video shop for 'renting' movies.  The TV required to be deeded to the group in order to be used on the group land, but my friends said no because that would allow the creator/script access to the land?  So I placed the TV in my SL premium house.  This was last week sometime when this happened.  Then 2 days ago I purchased lindens, I added a new credit card to my SL acct. at the time of purchase.  Today, that credit card had an attempted unauthorized charge tried to take from it.  I have not used the credit card in over 6 months before using it to purchase Linden 2 days ago.  My first thought was that it was a possible breach/security issue on the SL site when purchasing linden.  However, my friends immediately said that it could have been from the TV, and claim that the scripts in the TV can be used to gain access to any info. saved on my SL account.  I have not done scripting in a very very long time, and never on SL, but I have on other games, but again long time ago.  I don't recall scripting ever being an entryway into accessing outside of game information such as they are suggesting.  Is it possible?  They are convinced that I need to delete the tv all together, because it was a cheap tv therefore it's likely being used to gain access to items on my account including credit card info.  And just having it up in the prem. house or in my inventory, the scripts can still run and gain access to whatever info. the creator requests.  I am not thinking they are clear on what can and can't be done w/scripting, but as I said, I've not done it in a very long time, over 10 years now, so maybe it's changed?  Can creators who script or SL staff advise if this would be possible, can a item on SL access my RL credit card info that was entered on the SL website w/o me knowing it?  Thanks.  

[Chaser Zaks]

Most TVs these days do not require you to deed them to the land group. However, that does not mean that it is harmful to deed it, simply means it is a older system.

Everything that a script does without permission is typically harmless. The most a script can do without permissions is push your avatar around, grief, etc. Which if it hasn't done so already, I'd say it is probably safe.

If you deed it to land, a script gains the following benefits:

• Ability to terraform.
• Ability to change parcel media settings
• Ability to eject, teleport agents home, and manage parcel access list.

Terraform(terrain modification) griefing and parcel access list griefing are some of the rarest things in SL, and you would have to go out to find something extremely fishy to find such a thing.

The TV would require it to be deeded so it can modify the parcel media settings, specifically, it wants to modify the URL and mime type part of this panel:

 

As for "Can scripts see your RL information?": Absolutely not, even with every permission, LSL cannot see your real life information, including credit card information. The most that it *can* do money wise, is take all your L$, but that requires you to grant this very loud permission dialog access to do so:

 

If you have any follow up questions, or even, would like to test it on my land, I would be more than happy to answer or let you deed it to my land to test it! If it does go haywire, which I doubt it will, I will easily be able to fix it.

Edited June 1, 2020 by Chaser Zaks

[Lindal Kidd]

While Chaser's mention of the "debit permission" function is quite correct, even that exploit would not allow a scammer access to your payment method (credit card).  Your friends are incorrect that your TV could be the cause of the unauthorized access attempt.

Can you get information from your CC company about who attempted the access?

[xAlassrax]

57 minutes ago, Chaser Zaks said:

Most TVs these days do not require you to deed them to the land group. However, that does not mean that it is harmful to deed it, simply means it is a older system.

Everything that a script does without permission is typically harmless. The most a script can do without permissions is push your avatar around, grief, etc. Which if it hasn't done so already, I'd say it is probably safe.

If you deed it to land, a script gains the following benefits:

• Ability to terraform.
• Ability to change parcel media settings
• Ability to eject, teleport agents home, and manage parcel access list.

Terraform(terrain modification) griefing and parcel access list griefing are some of the rarest things in SL, and you would have to go out to find something extremely fishy to find such a thing.

The TV would require it to be deeded so it can modify the parcel media settings, specifically, it wants to modify the URL and mime type part of this panel:

 

As for "Can scripts see your RL information?": Absolutely not, even with every permission, LSL cannot see your real life information, including credit card information. The most that it *can* do money wise, is take all your L$, but that requires you to grant this very loud permission dialog access to do so:

 

If you have any follow up questions, or even, would like to test it on my land, I would be more than happy to answer or let you deed it to my land to test it! If it does go haywire, which I doubt it will, I will easily be able to fix it.

Thank you for the info. and offer Chaser!  I appreciate the help!

[xAlassrax]

15 minutes ago, Lindal Kidd said:

While Chaser's mention of the "debit permission" function is quite correct, even that exploit would not allow a scammer access to your payment method (credit card).  Your friends are incorrect that your TV could be the cause of the unauthorized access attempt.

Can you get information from your CC company about who attempted the access?

They gave the name of where the charge was attempted, it was some Holland something, they said it looked to be a toy company?  It was an attempt online, so they were not able to say who attempted the purchase, just that my CC info was used and they declined to let the charge go thru because it seemed suspicious.  

[Lindal Kidd]

Well, millions of datasets of personal info are for sale for a few bucks each on the Dark Web, including CC numbers.  So my bet's on coincidence.

I would, however, ask your CC company to cancel your card and issue you a new one with a different number.

[Polenth Yue]

On 6/2/2020 at 1:30 AM, xAlassrax said:

They gave the name of where the charge was attempted, it was some Holland something, they said it looked to be a toy company?  It was an attempt online, so they were not able to say who attempted the purchase, just that my CC info was used and they declined to let the charge go thru because it seemed suspicious.  

A friend had an issue with a suspicious transaction from a toy company... which turned out to be an online gaming company and he had a subscription with that company. Worth thinking about whether you had any purchases that might have hit the same time.

Edited June 4, 2020 by Polenth Yue