SHOCK!!! Rez-Anywhere Exploit P0wns No-Rez Land!!!

by Pixeleen Mistral on 05/07/11 at 3:50 am

For at least the last two months, a permission system exploit has allowed anyone - even those unauthorized by Second Life landowners - to create objects on "no-rez" or restricted land. This surprising news suggests players wishing to limit use of their virtual cyber-paradise may need to set aside  time to patrol their holdings, or turn on auto-return for objects not owned by those they trust -- and hope the Lab will get around to fixing the fundamental problem at some point.

Second Life players feel controlling the objects created on their land is serious business - for good reason. Linden Lab holds landowners responsible for "broadly offensive" images found on player's plots, even if the content was not created by the landowner.

Rez in No Rez
Rez in No Rez HUD sidesteps Second Life land controls

Another consideration is the limited object carrying capacity of the Lab's virtual land.

Second Life's economy is largely based on creating an artificial scarcity that ties the number of simple geometric objects - prims - which can exist on a plot of land to the overall size of the plot. Prims are used to create buildings and other props in the virtual realm, so landowners jealously guard their prim allotments and link virtual land rental/resale prices to the prim capacity of the imaginary land. In light of this, how is it possible that prims can be placed in restricted areas by unauthorized avatars?

When I first heard of this exploit, I was skeptical, but my source - who wishes to remain anonymous - was willing to demonstrate how one might overcome the Lab's object permission system. The exploit has continued to function since early May, and almost certainly existed well before my source came forward.

After observing the exploit in action and speaking with several experts, it appears that the Lab is not handling an edge case properly. As best I can tell, objects can be created by an LSL script command just outside the sim - where no user creation limit applies - then immediately moved into the sim.

According to the experts I consulted, parcel level controls are used to limit when objects can be created. Since the parcel coordinates end at 256, but sims need to be able to hand off objects between adjacent regions for vehicles in transit across sim boundaries, there is the possibility of objects being created just outside the sim and then entering the sim after avoiding the no-rez restriction.

How might this news might affect the land baron class in Second Life? Here is a transcript of land baron and metaverse media maven Crap Mariner's reactions to an impromptu demonstration:

Pixeleen Mistral: ok - this is no-rez land, right?
Pixeleen Mistral: can you verify that?
Crap Mariner: it appears so
Pixeleen Mistral: so - allow me to rez a cube on this no-rez land
Crap Mariner plays back a drumroll
Pixeleen Mistral: courtesty of a certain HUD
Pixeleen Mistral: ready?
Crap Mariner: yes
Pixeleen Mistral: here we go
Crap Mariner: i see a cube
Crap Mariner: not attached to you
Pixeleen Mistral: right
Pixeleen Mistral: if you watch really carefully
Crap Mariner: it appeared at the corner
Pixeleen Mistral: it rezes the cube just outside the sim
Crap Mariner: then popped over to there
Crap Mariner: yes
Pixeleen Mistral: then pulls in in
Pixeleen Mistral: an edge case
Crap Mariner: does it require linden water on the border (unused grid space) or can it be done where there is a sim there?
Pixeleen Mistral: anywhere if you are near the x or y coordinates > 250 ii works
Crap Mariner: impressive
Pixeleen Mistral: doesn't need a void sim or anything like that
Crap Mariner: quite... remarkable.
Pixeleen Mistral: this has been known in certain circles for at least 2 months
Crap Mariner: thank goodness it's in the hands of responsible, outstanding citizenry who'd never think to abuse such great power.
Crap Mariner smiles
Pixeleen Mistral: well - I was planning to write a story
Pixeleen Mistral: but I needed a skeptical witness
Crap Mariner: if you don't mind, could we test this on a sim i know you have no rez rights on?
Pixeleen Mistral: sure
Pixeleen Mistral: TP me
Crap Mariner: just in the extreme case that you actually can rez here
Crap Mariner: ok
Crap Mariner: heading to piper point

[we arrive at Piper Point sim]


Crap Mariner: x = 250
Pixeleen Mistral: ok
Crap Mariner: (welcome to the southernmost island in my neighrboor.)
Crap Mariner makes a note to take typing lessons
Pixeleen Mistral: ok
Pixeleen Mistral: how was that?
Crap Mariner: now i will turn off rez rights
Crap Mariner: ah already were turned off
Crap Mariner is quite the dimwitted landbaron
Pixeleen Mistral: right
Crap Mariner: ok, you have me convinced
Crap Mariner: at this point, james randi would be cutting a very large check
Pixeleen Mistral: so what this means is that you really do not have control of your land
Pixeleen Mistral: since there is an exploit that allows anyone to rez objects
Crap Mariner: at some level, there's a flaw with the security.
Pixeleen Mistral: well yes
Pixeleen Mistral: this is the story of SL
Crap Mariner nods
Pixeleen Mistral: flawed security
Crap Mariner: if the security flaws in SL were pancakes, not even Vin Diesel could eat them all.

Crap Mariner: so, does this HUD allow for other things to be rezzed?
Crap Mariner: and do they resist auto-return if not in group?
Pixeleen Mistral: auto-return still works
Crap Mariner: ah ok
Pixeleen Mistral: of course, most people will screw up their land if they turn auto-return on
Pixeleen Mistral: since they were sloppy about group ownership
Crap Mariner: we're a bit more careful than most. either a parcel has group only, or if they clean up, a-r is on
Crap Mariner: but this busts the group only block

56 Responses to “SHOCK!!! Rez-Anywhere Exploit P0wns No-Rez Land!!!”

  1. Summer Haas

    Jul 5th, 2011

    Is this really an issue? For all the years I’ve been in SL you could always sit on a physical prim and move it into no-build areas. This was not a bug but a feature, specifically for vehicles.

    Even with this exploit you can’t say a parcel owner is not responsible because they can easily turn on auto-return. Ignorance and sloppiness is a land owners responsibility IRL and in SL.

    What I would really like to see is way for parcel owners to give build and/or access rights to a secondary group that is not the land group.

  2. [...] This just in… Under the wire, it appears that according to sources over at the Alphaville Herald, that there is a new Second Life security glitch that is able to be exploited in a such a way that it allows rezzing of objects on no-rez or restricted land. This means that possibly, someone could rez a Meero on your land, not feed it, and let it die of starvation. At this point, PETA would be all over your ass. For more on this late breaking news, head on over to the source… [...]

  3. Nelson Jenkins

    Jul 5th, 2011

    Of course, it only works if the sim next to you is rez-OK. Old exploit, not big news. Snore.

  4. paul

    Jul 5th, 2011

    auto-return still works…. no biggie then.

  5. Crap Mariner

    Jul 5th, 2011

    Now you’ve got me wanting to twist Poe’s classic into “The Maven.” ;)

    Was a delight to see you again, glad to be of assistance, and have a most excellent week, Pix.

    Thanks,
    -ls/cm

  6. Yep

    Jul 5th, 2011

    YAY Tiger!!!!! :D

  7. [...] Security is just an illusion, folks. [...]

  8. Meh

    Jul 5th, 2011

    Oh yush and while that can be abused to grief a persons lands, or drop major grief attacks using VPN’s and proxies Skills Hak’s Anti Copybot/Grief system was supposed to protect everyone, but again we have a failure lulz. OH wait that was Red Zone?

    ~ Vendor Exploit ~ (FREE ITEMS)

    HippoVend, and all share vendors that allow you to buy items from yourself can be exploited to give you the item for yourself, here is what you do to reproduce the exploit.

    1. Make a script to pay yourself 1 L$ a second
    2. Place the script into a cube.
    3. Take the cube to your inventory.

    4. Buy a vendor comission vendor from the market place that allows you to buy items from your own vendor.

    5. Rez the vendor wait for it to load.

    6. Rez the cube with the script in it, and reset it/grant it permission to take money.

    7. wait for this error message.

    Too many llGiveMoney() requests; transfers halted until average falls.

    Buy the item from your own vendor, and it won’t pay the content creator, but you will get the item 100% Free.

    Note that this doesn’t work with all vendors but it works for 100% sure with hippovend.

    Oh and know that if you do this with a account you could get reported for fraud, but if you have a working permissions exploit you could ruin an entire business.

    Hope You All Enjoy my Exploit.

    Ciao

  9. Ajax Manatiso

    Jul 5th, 2011

    Another non-story. Its rare to find a place where auto-return is NOT on. Also, all you have to do is turn on disable object entry and you can’t even do this. Land management 101

  10. Tux

    Jul 5th, 2011

    @Nelson
    Actually for ages you have been able to do this and it doesn’t require adjacent land. For example Ahern (which has a hub where four sims join). I have successfully rezzed many things there (without the need of scripts.

    @Ajax
    You are stupid. Both autoreturn and object entry are easily overcome.
    Land management 101 == FAIL.

    This has been around for ages but kept within a relatively small circle. I, myself have used this when looking for things. Perhaps Pix should also have included how simple it is to crash sims (without perms, ie. build or script). Or how simple it is to crash people (again without perms).

    I often chuckle at people like Ajax who think the land powers can stop anything. Ultimately LL need to rethink how to deal with many of the issues the normal residents know nothing about. The very same residents who then resort to calling what they don’t understand HACKING.

  11. Paul

    Jul 5th, 2011

    @tux

    Maybe the reason that no one besides a small circle of people know about this is that only that particular small circle gives a rats ass about having this capability. So good on you! go crash sims and people, or do whatever you need to do to feel important.

    Land Management 101: griefers are a once-and-a-while annoyance, nothing more.

  12. AM Oderngrl

    Jul 5th, 2011

    This is exactly the sort of thing that makes education and business land managers go bonkers, and will drive even more of them out of SL if it is not fixed. Just as the reluctant managers show up for the guided tour…can you see it? But the chances of it happening are pretty slim unless the event gets announced.

    For the whingers, the Herald has many readers who don’t comment.. And CM is about to rap to “The Maven.”

  13. Atlouis

    Jul 5th, 2011

    That’s just a picture of Post 6 Box, Obvious Schism. Pix, you troll…

  14. Xylex

    Jul 5th, 2011

    @ everyone. This has been around since 2006 and is a simple issue for them to fix. They just need to have a certain number filter to 0.

  15. [...] For at least the last two months, a permission system exploit has allowed anyone – even those unauthorized by Second Life landowners – to create objects on “no-rez” or restricted land. This surprising news suggests players wishing to limit use of their virtual cyber-paradise may need to set aside  time to patrol their holdings, or turn on auto-return for objects not owned by those they trust — and hope the Lab will get around to fixing the fundamental problem at some point……. [...]

  16. wuffie

    Jul 6th, 2011

    Hi xylex
    But yeah its been known for a while. No big news. Just idiots giving it out everywhere caused it to die faster.

  17. General Drama

    Jul 6th, 2011

    Article is fail.

  18. UMAD BRO?

    Jul 6th, 2011

    @wuffie

    Idiots like you sir? aka NEIL as in NEILLIFE SUPERLIFE FAGGOT VIEWER MAKING HOMO? Indeed I agree. Neil has been hanging around bug island and other sims trying to find out as many exploits as he can to be cool again LOL to release yet another viewer soon and ruin all far second lifes LOL. If you all think he left an stopped…he lied. Prepare for some epic fail releases.

  19. Reader

    Jul 6th, 2011

    @UMAD BRO?

    Why do people make up (what THEY think is) these provoking blog handles only to rant about someone in particular, in an attack fashion obviously displaying the “mad” they are trying to make fun of. I’m perplexed by this. Care to explain? It certainly comes off like you have this hatred thing for Neil. If this is incorrect and it is not hatred then it certainly is an obsession. Your post tag also points to a site, “http://neilsafag.com/”. What’s up with that?

  20. LeaveaReply

    Jul 6th, 2011

    It is very old trick combined with SafeJumpPos() to bombing and grieffing one mainland simulator from one remote simulator. For example it is possible from Cordoba Sandbox to attack Bay City or Abbots and perhaps Da Boom. The grieffer needs to stay in the sim under attack to send by email avatar positions. My mainland SIM was under attack two months using that trick.

  21. Paul

    Jul 6th, 2011

    wow UMAD, I wish I could be as cool, elite, and in-the-know as you!

  22. General Drama

    Jul 6th, 2011

    Article is win, even tho the trick is old, the fact that its been around this long without LL fixing it demonstrates how pathetically apathetic LL is toward bugs and exploits.

  23. Vagabond 'Tony' Carter

    Jul 6th, 2011

    This is a very old trick, and not really an exploit, the prim is rezzed where there is permission to do so (the neighboring sim), then moved in.. turning off object entry cures this. Doing that will also prevent cars and the like from crossing under ~96m from ground level .

  24. Obvious Schism

    Jul 7th, 2011

    @ Atlouis

    “That’s just a picture of Post 6 Box, Obvious Schism. Pix, you troll…”

    It can’t be me as I was on holiday at the time. It does look a bit like my uncle, though.

  25. Rock Ramona

    Jul 8th, 2011

    This exploit,or boo boo has been around for a while,you can actually use this and one other “boo boo” to shut down the entire grid if you wanted to by overwhelming system thru replication……Thank God SL is full of good and honest citizens like myself ;o)….Leper Messiah

  26. Tux

    Jul 8th, 2011

    @ Vagabond ‘Tony’ Carter
    No offence, my spandex clad superhero, but you don’t really know what you are talking about. I suggest you stay safe within the confines of Justice Island. This can be used on any sim and not only does it NOT require adjacent permissions, but there is also a simple method of defeating object entry.

    Of course expecting a member of the JLU to learn these things is a bit too much. I guess you guess spend all your time looking for alts of the mighty griefer ring leader ‘Robble Rubble’!

    If you spent as much time learning and reporting on exploits as you do cyberstalking, harassing and victimising, perhaps people may give you a little more credibility.

    Although I think it is awesome a member of the JLU has the balls to post on a public site that allows open comments. Didn’t Kalel blanket ban you guys from doing this?

  27. At0m0 Beerbaum

    Jul 8th, 2011

    you can also set “do not allow objects to enter the parcel” and this exploit would be defeated.

  28. Dontspill McGinnis

    Jul 8th, 2011

    I find it quite strange that Tony “Vagabond” Carter would even read the Herald, let alone comment in it.

    Whenever I can be bothered to read the heavily moderated JLU “Rah-rah” E-fanzine he writes in, he is busy castigating the herald as a cesspit full of Griefers and Trolls.

    I suppose even he feels restricted over there.
    It must be nice to have a little freedom to write what you REALLY think now and then.

    Go on Tony, Fill your boots mate!.
    (Do Sooper heroes wear boots? or do they just spray paint their feet?)

  29. General Drama

    Jul 8th, 2011

    Whatzamatta, Tux, they not letting you post on Krypton Radio, so you fake a post from Carter to snipe at?

    Please.

  30. Vagabond 'Tony' Carter

    Jul 9th, 2011

    Actually Dontspill , I’ve never said that, I’ve called the Herald what it is , and even what Pix I’m sure wouldn’t disagree with, a tabloid.

    As for posting here, well I know GLE does on occasion, and I see no problem with commenting if I feel I can add something. Cheers.

  31. Tux

    Jul 9th, 2011

    @ GD
    I lol’d.

    @ Vagabond
    I thought Kalel told you guys not to post on unmoderated media. Even though he often does here.

  32. Vagabond 'Tony' Carter

    Jul 9th, 2011

    @Tux
    Well clearly you were mistaken, and that’s ok , it happens.
    I’m big enough to admit I too was mistaken in my initial analysis of this particular exploit. I’ve since tested and verified it , though by research it is indeed very old, and filed a JIRA on it. Other may wish to do the same.
    Cheers.

  33. grinch

    Jul 14th, 2011

    Landmanagment 101= complete fail

    Last nights raids were epic lulz and we once again have proven that this is the golden age of sl griefing until v1 is blocked, no rez fixed, and graphics crash fixed. Just ask green lantern core, bloodlines, valeria, and insilico what went down last night, hmmmm I think rape in spades is putting it mildly. See what you all don’t get is that super griefers are a higher life form that you will never understand and we would have it no other way, you may think that your insults hit pay dirt but we just sit back and laugh at you. When it comes to the classical offense defense yin and yang…..offense is always one step ahead. To put it simply we love second life we love the challenge of assaulting your base it makes me smile the moment i touch down on a sim that has max security knowing that even without no rez or viewers the end result is always the same. You whine and cry the lab bans and i’m back again in under 5. Please keep it up we love you all so much its like a drug

    ohh ps. yeah its fixed but we just broke it again today :P

  34. grinch

    Jul 14th, 2011

    Damn you jlu morons are so retarded its almost not worth coming after you again!!!! Its not a neighboring sim trick, its rezzed at 256,256,0 and pulled in through prim_position, tell you what me and the goons will come show your sorry asses tonight, and in niels defense, who among you have actually found expliots and would it not have made sense for the lab to take him seriously during the N-life 3.51 saga…..You are the architects of you own demise. Besides he has more balls then most of you for doing what he does :) proof is in actions not interpretations, where is your actions? where is your spine? where is your credibility? fuck thats right you don’t have any of the above. See you in world douche bags hope your well prepared for rape tonight

  35. Paul

    Jul 14th, 2011

    @grinch

    LMAOOOOO! that was rich.

    what a ‘higher life form’ thinks is time well spent and a job well done:

    I have no life so I have plenty of time to figure out little tricks to annoy for a little while a handful of people who play a game thought nobody really knows or cares about.

    well done, grinch, well done. What will you do next? burp loudly in a movie theater and make an old lady wrinkle her nose in disgust?

  36. grinch

    Jul 15th, 2011

    lmfaoooooo! that was perfect, most of us are blessed with many wonderful things in life, it doesn’t take long at all to figure this stuff out are you kidding? And a handful?? :) I’m going to the movies tonight just to find an old lady and i’m going to fart harder than i ever have in my whole life just to make the point that we don’t give a %$#@ but you sure seem to :) why so serious? naaanaanaanaanaanaanaa why so serious why?
    Hi tharr Kaloooool are you ready to play tonight? Remeber the PN days, isn’t it wonderfull that we have so many exploits and viewers to choose from, in fact i don’t think the bag O tricks has ever been this deep.

    Now for the fun part, we figured out how to break sim/ban/adult privileges, your island is looking real tasty and i would hope that you will put up a good fight but we all know you are behind the curve a little too far at this point so i expect a massacre XD but please do your best to stop us, it wouldn’t be any fun otherwise :) i’m thinking about 10 or 11 takes time to round up the crew and get everyone in line and besides i allways have better things to do than grief second life but this is a labor of hate as they say :)

  37. Paul

    Jul 15th, 2011

    *buzzz* wrong! Not “kalooool”. not even close, and I never wear superhero tights.

    I have no griefing or antigriefing skills whatsoever. Why would i bother learning any of that? A similar amount of effort in RL actually gets me something worthwhile, like a job and a girlfriend. You should try it!

    If you came to my sim, I am sure you could knock it over in a second. Awww gee, what do I do then ? well, i suppose I would just turn off the ‘puter and watch television, eat a sandwich, or something like that while you froth at the mouth in triumph at your labor of hate.

    You say you have better things to do than grief second life. Congrats! you have joined the rest of humanity, who ALREADY have better things to do then grief second life….but…despite that, you plan on going to grief second life tonight. lmao what a loser.

  38. grinch

    Jul 15th, 2011

    Yup i’m a looser gotta hate me :) My girl loves watching me ruin your little virtual paradise and besides you wouldn’t have put so much thought into this if you didn’t care “that much” life is pain get over it sucker

  39. grinch

    Jul 15th, 2011

    ahh it just struck me, how would you know jlu wears tights if you were not attached to sl by the hand at some point LULZ must be hard to talk with meh cock so far down yer throat :) HAAAAAAAHHAAHAHAHAHHAHAA

  40. paul

    Jul 15th, 2011

    yep yep yep you got me… only an in-the-know-insider could know that a superhero named Kal-el wears tights. Shucks…busted again!

    ok…very well then… bring it on! come get my virtual paradise. lay it waste. I will try not to cry and sob, and you will feel like you have a purpose in life, if only for a moment!

  41. BorgiaMatrice

    Jul 15th, 2011

    There are people who will always figure out ways around measures put in place to prevent them from doing whatever it is they want to do. The very fact that Linden Labs has given land owners the ability to prevent the rezzing of prims on their parcels or sims creates a challenge for some people to overcome. Your game is preventing these people from doing so, their game is to show you at every turn they will always outsmart and outmatch you, no matter what you do.

    And then they pass it along to an army of people who have no problem sticking it in the eye, repeatedly, of those who would make a big deal out of this, just to hear you cry. If you were not whining about it, they wouldn’t care and wouldn’t try because it wouldn’t matter.

    So the next time you see a black cube fly by with the graphics “it’s king goon motherfucker”, or a mario jumping around your sim, or a pile of spinning cubes rez almost instantly in the middle of your sim, remember, you made it worth all their while.

    You can discount their methods, you can talk about their talents, you can pretend it doesn’t matter but look above my post. Look at how much discussion this has all generated and then ask yourself this. Has anything you have said made any difference or convinced anyone to stop trying or stop inventing ways to do whatever they want?

    Their are 10 different ways to rez on no rez land, and to run scripts on no script land, to defeat auto return or to do anything, anyone wants to do.

    “Yes, I am a criminal. My crime is that of curiosity. My crime is
    that of judging people by what they say and think, not what they look like.My crime is that of outsmarting you, something that you will never forgive me for.”

    “I am a hacker, and this is my manifesto. You may stop this individual, but you can’t stop us all… after all, we’re all alike.”

    +++The Mentor+++

  42. Yep

    Jul 15th, 2011

    “yep yep yep you got me”

    Hmm ok now that I got you what shall I do with ya? :P

    Oh I know… I’ll give him to Tiger>

    Go getem Tiger :D

  43. paul

    Jul 15th, 2011

    oh goodness gracious…first the m*ron hacker and now the blowhard tiger????

  44. Yep

    Jul 15th, 2011

    “oh goodness gracious…first the m*ron hacker and now the blowhard tiger????”

    No there is only one awsome Tiger :D

  45. grinch

    Jul 18th, 2011

    Actually borgy is better then me, i just like watching your fail :) , Just go ask JLU and bloodlines what happened the other night……….i’m willing to bet it was something along the lines of i turned the place upside down for hours and then you predictably are predictably predictable. I think this weeks theme will be moar mario with a slight splinkling of tube girl and dead niggra storage, extra spam on the house courtesy of…….duu duu du daaaa King and his merry fuckin Goons.
    Please keep feeding me and posting this thread it all never seems to get old with U idiots

  46. BorgiaMatrice

    Jul 18th, 2011

    People that do not understand or cannot comprehend are almost always afraid of the unknown. These very same people gave us the “Holy Crusades” the Nazi’s, the Stalinism purges that killed 10s of millions, the Moaism “Great Leap Forward” that killed even more, multiple genocides all over the planet, etc.

    I wouldn’t waste any time arguing with them. We have listened to their whining and dribble all these many decades while they have waged wars both social, religious, political and otherwise while we have silently been learning, building an army of people who now are just starting to rise up and gaining notice. Sometimes it’s someone griefing in Second Life, and sometimes it’s someone exposing governments for the evil the perpetuate.

    They almost never have anything worth pondering, they will never attempt to understand only reticule and point their fingers from their assumed lofty heights.

    To all of you who are so generous with your hatred, I raise both my hands high in the air, and extend both middle fingers, just for you, in stereo. Enjoy!

  47. paul

    Jul 18th, 2011

    @Borgia
    nah you give him too much credit with your historical comparisons, SL griefers (like Grinch claims to be) are just a sad & lonely punks shadow boxing in a a most pathetic little arena.

  48. Saxanagalior

    Jul 19th, 2011

  49. grinch

    Jul 19th, 2011

    It must be getting hard to talk with our collective cock so far down your throat. All your base are belong to us ect. time to switch targets and go harass whats left of junior LOLZ and no rez still works just fine, you don’t even need a script to pull it off

  50. Nelson Jenkins

    Jul 19th, 2011

    @ grinch

    *yaaaaaaaaaaaawn*

Leave a Reply