Meeroo Store Attack - Could this happen to you?

[Chronometria]

Your shop, even in a no build enabled area, could be completely overlaid by a false one that takes all your customers' Lindens. Think about that for a moment.

 

For those not familiar with Meeroos, they are a successful breedable pet and their seller is currently under dedicated attack by thieves who have managed to find some means to slam their own false store right over the Meeroo Stores - To the point of forcing them to go marketplace only.

 

How is this possible in a no build sim? Why is it that the response from LL was to ban them as well as the fraudulently named alts that impersonated them? How does this affect other successful stores?

 

When will it happen to you and what are you going to do about it?

[WADE1 Jya]

I don't think this is possible under normal curcumstance, if the landowner has taken appropriate precautions.

If this has been done to these people, it is because object entry to parcel is allowed and they are sliding the fake store in from an adjacent parcel where rezzing is allowed.... easily resolved, just set appropriate land permissions.

A fake store built on their land could also be instantly removed by the landowner... no serious problem.

Avatars who placed a face store could be banned from the region by the landowner... no serious problem.

I suspect since Lindens banned all involved there is more to this story :matte-motes-impatient:

[Chronometria]

Well, i have been looking in to it as much as i am able. The official account was unbanned, though no explanation was given for any of it.

My concern is that a flagship vendor, which is a big part of advertising and recruiting for second life, is basically being forced off of the grid due to an organised thief attack. If it happens to meeroos, then its likely to happen again to another popular store.

MMO's have gold sellers as their troublemaker of choice....but second life looks to have some sort of bank robber type group that launches these vicious attacks, crippling vendors. I want people looking into this and making sure it doesnt happen again.

[Mickey Vandeverre]

Lots of things can happen.

Particularly if you're involved with a service provider who does not handle customer service well.

If you're not a major player, and have to wait two weeks or longer for a response to a ticket, and phone calls don't work either...one really needs to be aware that they could lose everything in an instant, and plan accordingly.

[Chelsea Malibu]

I'm sorry but what you are saying makes absolutely no sense to me.  If the land is set up right and the store your friend is using, is in fact their land, they need to disable the ability to build on their land.  Also they can return or even auto return if its there land.

We have all had squatters over time and when you get them, you remove them.  If they come back (or even before) you can ban them from your property.

It sounds more you need to read the Knowledgebase on how to manage your land.

[Chronometria]

I know how it works, as do the meeroo store folks. It has been speculated that there is some kind of exploitable loophole allowing this to happen and that warnings about it have gone unheeded.

 

*update* - Meeroo blog reports that linden lab is aware of the exploit used to achieve this and is working on a fix.

[Ziggy21 Slade]

I think the most worrying thing about this attack is the exceptionally poor response from LL.

My understanding is that the thieves used alt accounts with similar names to the Meeroos sales account, and after receiving hundreds of complaints, LL just disabled every account that was a variation on that name, including the genuine one and then took 30 hours or so to restore it.   

In an ideal world every issue of this nature deserves a quick response, although we don't have an ideal world, you would think that LL would at least react quickly and accurately when dealing with such a high earning business, this is a product that has pumped thousands and thousands of dollars into our economy and is partly owned by one of SLs oldest and most well connected residents, I think they deserved much better service than they received, even if ultimately it was them that messed up (although it may well not have been).

[Pussycat Catnap]

The land in question had no rez, no object entry, and no script. But also no auto-return.

It now has auto-return after advice from many of the users.

 

As for how to get something there, Ann O'toole has pointed out a method exists that is known. I believe the details are not usually posted here but might be on a 3rd party forum somewhere.

Another method was seen in that lot with the bot sitting on the ground we all decorated and took  snapshots next to - drive your build onto the lot as a vehicle.

I blogged about this briefly last night, but not in a structured way:

http://catnapkitty.wordpress.com/category/second-life/meeroo/

 

You can read details on the Meeroo website, as well as discussion.

 

[Peewee Musytari]

 

---

Chronometria wrote:

I know how it works, as do the meeroo store folks. It has been speculated that there is some kind of exploitable loophole allowing this to happen and that warnings about it have gone unheeded.

 

*update* - Meeroo blog reports that linden lab is aware of the exploit used to achieve this and is working on a fix.

---

Link to the JIRA ?

[Deej Kasshiki]

If it's a security flaw/exploit the JIRA won't be publicly accessible (assuming there is one) for obvious reasons.

[Peewee Musytari]

There are JIRAs for security exploits all the time, they don`t include a "how to" guide,  but if its a known issue that LL is working on it would be on the issue tracker.

[Chronometria]

Well, this looks to have become a long term battle and a real public test of Linden Lab's ability to protect successful merchants. The griefers are continuing to assault the meeroo sims and have demanded 800US Dollars in payment to stop their attacks.

Apparently the Lab's are now taking this seriously, but no details on how they have "upped their game" have been released. Some meeroo owners suggested that the police be brought in as money was being demanded with menace...a potential "cyber crime"

It's also proving to be a real test of marketplace, which struggled to cope with demand. The marketplace boxes were actually destroyed by demand and had to be rebuilt. It also apparently affected the marketplace server itself.

[Aili Panthar]

I have seen people selling HUDs that allow one to rez things on no-rez lands, maybe the thieves used that. I can't see any legitimate use for an item like that. I hope they fix the loophole quickly. :matte-motes-stress:

[Pussycat Catnap]

Drama on this is queiting down a bit. But I've put up some bits on my blog with my theories:

http://catnapkitty.wordpress.com/category/second-life/meeroo/

 Followed up yesterday with:

http://catnapkitty.wordpress.com/2011/08/04/meeroos-under-assault-pt-2-what-is-unauthorized-food/

 

Interestingly enough, this one reached out beyond SL and got a writeup in a few mainstream news sources. I'll have to dig up links to that later.

 

[Sigren Panthar]

Nope, drama on this is not dying down.  It appears this is due to an exploit LL were well aware of back months ago.  Their handling of the current saga involving these money-spinner breedables is risible, and hardly sends out confidence in the management and competence of LL.

There is a write-up here, which pulls no punches....

http://alphavilleherald.com/2011/08/meeroo-scandal-no-surprise-ll-hides-behind-privacy-shield.html

The only slight upside is that the creator(s) concerned seem to have done very nicely indeed, thank you, from sales so far.  A smaller, newer creator could well have thrown in the towel over this.