search

secondlife / jira-archive

2 stars 0 forks source link

[BUG-228689] Apparent severe security issues with Second life #6696

Closed sl-service-account closed 7 months ago

sl-service-account commented 4 years ago

What just happened?

I turned this in as case # 1518260 and was told by EdwinA Scout to submit this as a bug. Background: end of last year my security software was being hit by both Linden lab requests and IP out of Cupertino CA (ex 17.154.66.74) for access to my SL viewer. If I denied it would freeze me, kick me out. Then if i logged on again it would not ask again and sl worked but sometimes my security logs were crazy with hits. I basically ignored it as my security systems were handling it. Then I had to download an update fir SL around April 19, 2020. It stopped asking and i was like thank goodness for update. Then i noticed at log in sl was asking for access to monitor my key stroke input from my keyboard even while using other apps and this was logged by Apple. Apple support said - no way this should be given and this is serious issue. So I would like this fixed As it appears to be privacy/security issue and it just keeps it up.

What were you doing when it happened?

Logging into SL

What were you expecting to happen instead?

I was expecting SL not to impact my security or want to log my keystrokes for other apps as this is issue for privacy, banking, passwords, and rtc.

Other information

I have a premium account and would like this fixed as I have been alerted by both Norton and Apple. I am including screen examples. The IP examples were from last year but it was nightly until the new download around April 19, 2020 when it wanted to monitor keyboard.

Attachments

Links

Duplicates

Original Jira Fields | Field | Value | | ------------- | ------------- | | Issue | BUG-228689 | | Summary | Apparent severe security issues with Second life | | Type | Bug | | Priority | Unset | | Status | Closed | | Resolution | Duplicate | | Reporter | Nari Navarathna (nari.navarathna) | | Created at | 2020-05-07T01:21:04Z | | Updated at | 2020-05-07T18:41:05Z | ``` { 'Build Id': 'unset', 'Business Unit': ['Platform'], 'Date of First Response': '2020-05-07T13:41:05.538-0500', "Is there anything you'd like to add?": 'I have a premium account and would like this fixed as I have been alerted by both Norton and Apple. I am including screen examples. The IP examples were from last year but it was nightly until the new download around April 19, 2020 when it wanted to monitor keyboard. ', 'ReOpened Count': 0.0, 'Severity': 'Unset', 'System': 'SL Viewer', 'Target Viewer Version': 'viewer-development', 'What just happened?': 'I turned this in as case # 1518260 and was told by EdwinA Scout to submit this as a bug. Background: end of last year my security software was being hit by both Linden lab requests and IP out of Cupertino CA (ex 17.154.66.74) for access to my SL viewer. If I denied it would freeze me, kick me out. Then if i logged on again it would not ask again and sl worked but sometimes my security logs were crazy with hits. I basically ignored it as my security systems were handling it. Then I had to download an update fir SL around April 19, 2020. It stopped asking and i was like thank goodness for update. Then i noticed at log in sl was asking for access to monitor my key stroke input from my keyboard even while using other apps and this was logged by Apple. Apple support said - no way this should be given and this is serious issue. So I would like this fixed As it appears to be privacy/security issue and it just keeps it up. ', 'What were you doing when it happened?': 'Logging into SL', 'What were you expecting to happen instead?': 'I was expecting SL not to impact my security or want to log my keystrokes for other apps as this is issue for privacy, banking, passwords, and rtc. ', 'Where': 'Old was macOS Sierra for IP issues. It is currently Catalina 10.15.4. Safari is my browser. I do not have any virus as Norton and malware bytes gave checked it extensively multiple times (esp Norton as I was complaining about it to Norton and Apple). I have the date and time stamps. The most recent asking for monitor input was 2020-04-20 at 10.51.19 PM (EST)', } ```
sl-service-account commented 4 years ago

Nari Navarathna commented at 2020-05-07T01:28:54Z

Note I blocked the IP requests. The asking to monitor I denied but the request was logged by Apple and you can see it in the screen shot with no check in check box since it was denied.

sl-service-account commented 4 years ago

Nari Navarathna commented at 2020-05-07T01:33:03Z

Also my friends say they do not see this but I also tend to have a heavier ($$$) security load than they do as well And I am constantly checking it and adding more features as when I was tracking the nonlinden IPs that hit only when I logged into SL or was on SL to see they were from CA around the San Fran Area.

sl-service-account commented 4 years ago

Nari Navarathna commented at 2020-05-07T01:53:40Z

I just downloaded sl tonight again and an additional security issue popped up. Now in addition to monitoring my key stokes SL wants to control other apps. “Allow Apps below (SL) to control other apps. This will provide access to documents and data in those apps, and to perform actions within them”. I denied it, Apple logged it, and i took a screen shot. I would like SL to be a game and stop trying to log my key strokes, access my documents/data on programs outside SL, and try to perform actions with those documents/data/software. Also to quit hitting my security with massive up requests. Let me know if you want screenshot it was under security privacy and automation.

sl-service-account commented 4 years ago

Nari Navarathna commented at 2020-05-07T02:25:43Z

Also two new IP hits tonight and when I blocked it froze sl session. I have screen shots of those as well. One said linden labs IP and when denied immediately I was hit by vox .

sl-service-account commented 4 years ago

Nari Navarathna commented at 2020-05-07T02:28:18Z

Plus SL also requested access to my photographs. I have screen shot of that too and it was logged by Apple with sl logo and everything.

sl-service-account commented 4 years ago

Nari Navarathna commented at 2020-05-07T02:30:46Z

I checked with Norton and no virus. This only happens with SL and it all disappeared when I removed SL viewer and reappeared when i reinstalled.

sl-service-account commented 4 years ago

Kyle Linden commented at 2020-05-07T18:41:06Z

Hi Nari,

Thank you for taking the time to report these issues. In this case it is a known issue and generally speaking, a duplicate of BUG-227740.

Please let me assure you that all of what you are seeing is normal interaction with the Second Life viewer. We do not log keystrokes, but our client does use the keyboard and mouse input for chat, creating notecards and scripts and even allow you to edit scripts with an external editor and pass those edits directly into the Second Life viewers open script editor for real time updates.

A large part of the Second Life experience is creating new content, textures, photos, meshes all of which require direct file access to your local computer to allow uploading your creations into Second Life.

I hope you understand that Second Life will only fully function if you allow all the ports and IP address we need to function. You can read more about those requirements in this article: https://community.secondlife.com/knowledgebase/english/using-second-life-with-a-firewall-r599/

You may also find this article from Apple about allowing trusted applications helpful too. https://support.apple.com/en-us/HT202491

Lastly, when you are in Second Life there are any number of ways "other media" may try to play as you explore our virtual world. Visiting new regions and parcels will expose you to the parcel media settings of other residents. In this case the 17.x.x.x IP address is likely some kind of music stream and not within our control. While I cannot endorse or rely on the results of third party services I did use this for reference: https://www.abuseipdb.com/whois/17.154.66.74

In conclusion, yes we need to sign and notarize our applications better (its on the road map to do so) to prevent all the Catalina alerts. Please always use your best judgement when securing your computer systems and if you find any other bugs please let us know!

Thanks!