Account Hacks.

[Bagnu]

I had a credit card initially on file in my account. I removed it. If someone hack my account, could they still see remnants of that? And what else could they see that could be traced back to RL? My email is purely as Pearl.

[Drakonadrgora Darkfold]

no, they cant see the old credit card information. they can see your transaction history though and how much you spent. 

the only information they could see if what is on your account and profile; what is currently visible to you as is.

[Bagnu]

What about Keyloggers. Can someone install that through SL?

[Madelaine McMasters]

I don't know what safeguards LL might have in place to vet third party viewers. I'd not be surprised if there were none. So, you are trusting the providers of SL viewers to not do anything nefarious. That said, third party viewers are in use by a lot of people, some of whom are technically savvy and run tools that look for suspicious activity. If any such behavior is observed, we'll hear about it PDQ. I think it's unlikely we'll discover anything like key logging in a third party viewer.

As for the removed CC information in your LL account, I don't think that's a concern. I've heard no credible reports of SL accounts being hacked via any method other than social engineering, where someone gets a resident to reveal their password. That's a vulnerability in any system involving people. I have a "hidden" alt that holds my CC information. Other than via the L$ transaction history, there's no connection between that alt and Maddy. That's probably overkill, but it's easy to do.

[Lillith Hapmouche]

Like 99% of "security risks" sits in front of your machine and is human kind.

You can't catch "viruses" through SL. Nor keyloggers.

Don't be stupid and watch closely where you enter your login data. Best security you can get.

[Drakonadrgora Darkfold]

1 hour ago, Bagnu said:

What about Keyloggers. Can someone install that through SL?

no they cannot install one through sl itself. you would have to click a link in chat and download and install it yourself. sl cannot arbitrarily install any software without your permission. or it would need to be done by a nefarious tpv.. most that are used are fairly safe against that.

the only real way someone can hack your account is if you use a very simple password or answer a phishing email or link posted in chat or by some object you are passed by some random stranger that has you login to your sl account again to make it work aka anything that wants you to link your sl account by using your sl login and password.

even most of the games that track your play and information cant really gain access to your account as long as you dont use the same password for their site as with sl.

if you ever think your account has been hacked(you cant log in for some reason) you can always use an outside email and then put in a support ticked stating account compromise and have ll investigate it. same can be done if anyone ever trys to trick you into the so called 'perm rlv' or 'inescapable rlv' aka the 'non cheatable rlv'. which is still a farce and just an attempt to deceive and manipulate a person.

so at the end of the day, dont click on any link in chat that your dont know the person its coming from. or make sure you have a current antivirus or similar software running.

if you do happen to click a link and it suddenly asks for any other permissions aka wants access to xyz information or wants to update/install new driver/application click no..

an old scam was people sending links to site that said your flash player was needing to be updated, or that your computer is full of bugs, click here to fix.. or that your media player was out of date.. or any similar wording.

lots of people here will spout lots of lies about what sl can do or what they can do through sl.. they do this to create fear within the uneducated. to get you to trust them and do as they say.. in order to 'protect' your account better by letting them have access so they can check to make sure its setup safe.

Edited August 15, 2020 by Drakonadrgora Darkfold

[Gabriele Graves]

I add my CC information before and remove it straight after I use it.  It just takes a few extra minutes to do which, in my opinion, is worth the extra safety.  Even if I become the unwitting victim of a phishing scam, only the L$ on the account is then potentially lost.

[Gabriele Graves]

I should probably say, that I don't buy L$ inworld and tend to plan ahead on what I want to spend.  It makes doing that easier of course.

[Talligurl]

26 minutes ago, Lillith Hapmouche said:

 

Don't be stupid and watch closely where you enter your login data. Best security you can get.

Not SL, but the same thing could happen with SL. I needed to log on to a website to put in for time off from work. I didn't remember the address so I googled it. I got a hit and I clicked it and the log in page opened up. I tried to log in but it didn't work. A few days later I get an e mail saying my computer had beef hacked and all my passwords were compromised,and as proof of this they gave me one of the passwords they had. It was the password for the site I had reached through Google. Though of course I did not reach they right site. I got a fake site and gave them my e mail and one password, they tried to make me think they had everything, and get me to pay them money not to use it against me. I changed the one password and resolved to be more careful.

[Bagnu]

1 hour ago, Drakonadrgora Darkfold said:

no they cannot install one through sl itself. you would have to click a link in chat and download and install it yourself. sl cannot arbitrarily install any software without your permission. or it would need to be done by a nefarious tpv.. most that are used are fairly safe against that.

the only real way someone can hack your account is if you use a very simple password or answer a phishing email or link posted in chat or by some object you are passed by some random stranger that has you login to your sl account again to make it work aka anything that wants you to link your sl account by using your sl login and password.

even most of the games that track your play and information cant really gain access to your account as long as you dont use the same password for their site as with sl.

if you ever think your account has been hacked(you cant log in for some reason) you can always use an outside email and then put in a support ticked stating account compromise and have ll investigate it. same can be done if anyone ever trys to trick you into the so called 'perm rlv' or 'inescapable rlv' aka the 'non cheatable rlv'. which is still a farce and just an attempt to deceive and manipulate a person.

so at the end of the day, dont click on any link in chat that your dont know the person its coming from. or make sure you have a current antivirus or similar software running.

if you do happen to click a link and it suddenly asks for any other permissions aka wants access to xyz information or wants to update/install new driver/application click no..

an old scam was people sending links to site that said your flash player was needing to be updated, or that your computer is full of bugs, click here to fix.. or that your media player was out of date.. or any similar wording.

lots of people here will spout lots of lies about what sl can do or what they can do through sl.. they do this to create fear within the uneducated. to get you to trust them and do as they say.. in order to 'protect' your account better by letting them have access so they can check to make sure its setup safe.

What about scripts in gifts?

[Lillith Hapmouche]

9 minutes ago, Bagnu said:

What about scripts in gifts?

  

2 hours ago, Lillith Hapmouche said:

You can't catch "viruses" through SL. Nor keyloggers.

 

[Madelaine McMasters]

19 minutes ago, Bagnu said:

What about scripts in gifts?

Script's can only access keyboard input directed into the game for messaging or limited controller input. You never enter password or CC information in such circumstances, so you're safe. You do need to be careful about scripts that request access to your L$ balance. Once you give that permission, the script can debit as it pleases. Exercising reasonable care in SL will keep you safe.

Edited August 15, 2020 by Madelaine McMasters

[Bagnu]

1 hour ago, Madelaine McMasters said:

Script's can only access keyboard input directed into the game for messaging or limited controller input. You never enter password or CC information in such circumstances, so you're safe. You do need to be careful about scripts that request access to your L$ balance. Once you give that permission, the script can debit as it pleases. Exercising reasonable care in SL will keep you safe.

Thank you!!! Perfect!!!

[Lindal Kidd]

People can give you gifts that can harm you, but they can't hack your account that way.  The primary ways that scripted items can harm you are:

• Once you grant it, take the permission to animate you permanently
• Deform your avatar
• Monitor your location
• Monitor your local chat (not your IMs)
• Rez griefing objects, sound and/or particle emitters, or graphics crashers
• Replicate itself and offer itself to others in your name
• Lock you in a cage, undress you, and other things...IF you have enabled RLV(a) in your third party viewer
• Send you a malicious link in a chat notice
• Once you grant it permission, drain the $L from your account (yes, I know...who would be dumb enough to do that?  But plenty of people do it.)

For more on these exploits and others, take my free Avatar Safety class at Caledon Oxbridge University, Sundays at 10 am SL Time!

Edited August 15, 2020 by Lindal Kidd

[Drakonadrgora Darkfold]

ohh. I might just attend that one time to see if there is anything I have missed. always up to learn something new to keep safe with. been tricked a few times before by people in the past.. especially with rlv.. and a few permissions scripted items. hence my own posts in the forums about rlv myths and such.. hoping to help inform others so they dont fall for the same tricks.

[Jennifer Boyle]

6 hours ago, Lindal Kidd said:

For more on these exploits and others, take my free Avatar Safety class at Caledon Oxbridge University, Sundays at 10 am SL Time!

I will do it!

[Nalates Urriah]

No one pointed out that the scripts used in SL run on the Linden servers, region servers. They do not run on your local machine. Your local machine tells the region server what scripts to run and gets 'results' information from the region server. As an example think of AOs. You wear an AO. That 'wearing' tells the region server to run the AO scripts. The AO script runs and tells the system which animations to run. The region servers then tell the viewer how to get the correct animation which it downloads. That animation information is then used to move avatar bones. The code that reads the information and moves the bones is built into the viewer not the animation file.

Some years ago the Emerald Viewer was caught misbehaving. Part of the coding team had... I'll say, "joined" the vigilante side to stop griefers (and that is being overly kind). Like most vigilantes they went too far and their methods provided a channel likely to be abused and it was. So we have proof that viewers can be abused and were. But, we also have proof they get caught because of the nature of open source projects.

There are darkside third-party viewers. These are  usually copy-bot viewers. These are considered to be viewers compiled for nefarious purposes, usually stealing content. If you are going to use a viewer made by a thief why would you think they would not also steal from you? People do use them and then cry when their password is stolen. Duh!

There is a saying, something about not being able to con an honest man...

There are exploits of the SL System. The Lindens complain about how much time they spend knocking those down. From what they say, we know there is an ongoing escalation to hack SL. As best I can tell most of those are griefing attempts (things like making a blizzard of flying *****es) or attempts to steal content.

The nature of the SL System is such that little can be done to you, the RL you. Your account information and financial information are over in the web properties side of SL. The viewer has very little access to that information. Use reasonable care with your password and avoid doing stupid and you are safe.

 

[Bagnu]

16 hours ago, Lindal Kidd said:

People can give you gifts that can harm you, but they can't hack your account that way.  The primary ways that scripted items can harm you are:

• Once you grant it, take the permission to animate you permanently
• Deform your avatar
• Monitor your location
• Monitor your local chat (not your IMs)
• Rez griefing objects, sound and/or particle emitters, or graphics crashers
• Replicate itself and offer itself to others in your name
• Lock you in a cage, undress you, and other things...IF you have enabled RLV(a) in your third party viewer
• Send you a malicious link in a chat notice
• Once you grant it permission, drain the $L from your account (yes, I know...who would be dumb enough to do that?  But plenty of people do it.)

For more on these exploits and others, take my free Avatar Safety class at Caledon Oxbridge University, Sundays at 10 am SL Time!

This all sounds extreme. If it happens, does that mean they are irrevocable, and have to start with a new AV?

[Nalates Urriah]

10 minutes ago, Bagnu said:

This all sounds extreme. If it happens, does that mean they are irrevocable, and have to start with a new AV?

No. But it is a pain to get cleaned up. You generally have to get SL Support to help.

Plus, you get warnings when you attempt to give such permissions.

Edited August 16, 2020 by Nalates Urriah

[Bagnu]

Some of this is part of kinky play though, I just want learn how far is TOO far before I get into anything like that.

[Drakonadrgora Darkfold]

14 minutes ago, Bagnu said:

Some of this is part of kinky play though, I just want learn how far is TOO far before I get into anything like that.

That is the problem for some people there is no TOO far.. about what they will try or do to someone else irregardless of consent. they feel its their right or entitlement or power or choice to do it to you.. and once you gave consent you cant change your mind or revoke that consent. that you just have to deal with the consequences of your choice. There are a lot of abusive people in SL and they feel its not ok to ever shame or call them out for it. Many of them are in the kink communities. They use bdsm or kink or fetishes as their excuse for their behavior and that everyone has to just allow and accept them to be how they are.

Never trust anyone completely with anything about your account or avatar ever. Even your most trusted friends/owners/masters may back-stab you if given the right reasons or chance to do so.

dont fall for the head/mind games that some people like to play.

[Lindal Kidd]

4 hours ago, Bagnu said:

This all sounds extreme. If it happens, does that mean they are irrevocable, and have to start with a new AV?

Pearl, I didn't mean to frighten you!  Please remember two things:

• MOST people in SL are honest and won't knowingly do anything to hurt you
• With the exception of phishing and the account debiting scam, most "bad" things that can happen to you in SL are annoyances only.  They can be aggravating, but are not ultimately harmful.

[Drakonadrgora Darkfold]

9 minutes ago, Lindal Kidd said:

Pearl, I didn't mean to frighten you!  Please remember two things:

• MOST people in SL are honest and won't knowingly do anything to hurt you
• With the exception of phishing and the account debiting scam, most "bad" things that can happen to you in SL are annoyances only.  They can be aggravating, but are not ultimately harmful.

Yep, most can be undone wither with a support ticket or by yourself by remaining calm and asking for help in the right places.

even the rlv things are just minor problems that can be fixed without much effort. so no panicking Pearl. Its not the end of the world... yet!

[Bagnu]

 

12 minutes ago, Lindal Kidd said:

Pearl, I didn't mean to frighten you!  Please remember two things:

• MOST people in SL are honest and won't knowingly do anything to hurt you
• With the exception of phishing and the account debiting scam, most "bad" things that can happen to you in SL are annoyances only.  They can be aggravating, but are not ultimately harmful.

Thanks Lindal!!! I know all about phishing tom RL., and haven't fallen for it. Can account debiting be reversed in SL???

[Ted McGregor]

Don' t believe them, Pearl.

PEBCAK hacked your account and got your creditcard number.

I' ll reveal it to you if you send all of your money to me first as soon as possible : TDD123@bitcoin.com .

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Spoiler :  Sikes ! 😁

[Bagnu]

I'm not panicking at all. I'm as

Just now, TDD123 said:

Don' t believe them, Pearl.

PEBCAK hacked your account and got your creditcard number.

I' ll reveal it to you if you send all of your money to me first as soon as possible : TDD123@bitcoin.com .

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Spoiler :  Sikes ! 😁

Lmao, I don't have a credit card on file!!!