Second Life Users: Media on a Prim Griefer Exploit Discovered; Update Your Firestorm Viewer!

Media on a Prim is a cool Second Life feature which enables users to stream web-based media content on primitives in the virtual world. It's also now being used for a griefer exploit that Linden Lab just patched up:

Today I was at a rental office and noticed a few people hanging around the welcome area, thought nothing of it then suddenly and simultaneously my viewer (Latest Firestorm) opened up search and some offensive words appeared in the text box, as well as a "create new group" window, with some errors appearing on the screen. I quickly left and closed out all these windows. It was quite a scary experience and I was only one click away from clicking the OK to create a random group at a L$100l cost. - AmerAaron

Fortunately, it's really just a griefer exploit and apparently not something that could be used for highly malicious hacking. As Firestorm QA rep Whirly Fizzle (yes) explains:

This form of griefing has been popping up over the last few days. It uses media on a prim (MOAP) to open those floaters on your screen. If you disable media in the viewer, it will stop it. Linden Lab issued an emergency ModalHotfix viewer to fix this on Thursday [see release notes]. Firestorm Viewer will have a new beta viewer out, hopefully tomorrow with the fix...

It's just a clever use of viewer media. Though it seems very scary, all that can be done on unpatched viewers is open up any viewer floater on your screen when the media loads, plus enter custom text into the search window or Terms of Service window etc... So please don't worry - it's extremely annoying but ultimately harmless.

A Linden staffer in the security department just confirmed this description with me. I don't see any word of the Firestorm patch being available yet, but you can join the "Phoenix-Firestorm Preview Group" in-world to get the latest release that addresses this issue!

Image: From Linden Lab's MOAP tutorial. Hat tip: Cajsa!

Comments

[Shockwave Yareach]

note: The developer menu has "Force LLError and Crash". If this exploit can call that, griefers will have a very devestating weapon, far worse than the orbiter.