[Opensim-users] Banning "bad" viewers was Re: Can this be done?

Tue Jan 12 23:39:00 UTC 2010

All it takes is one person with the knowledge of how your system works
to create a tool to bypass your security.  THAT is what script-kiddies
use.  This is why it's considered an arms race, and the people who
actually physically own the systems on the net are at a severe
disadvantage: they have to successfully defend against every attack,
while the generic class of attackers has a severe advantage: only one
attack needs to succeed.

Lock your sim permissions down, and manually grant object
creation/modification permissions to people you want to be able to do
so.  That's the only way to prevent the scribbling that you're so
afraid of.  (Well, then again, if you *really* want to be secure,
disable new account creation and remove all privileges from the
current userbase.  Otherwise, one of those accounts can be haksz0red,
and you're left with the same issue.)

Security is a balance between unusability (you don't want the attacker
to be able to use/deface your system) and usability (you do want to be
able to do something with your computer, in this case allow your
friends onto your sim).

On another mailing list, I described 'trust' thus: "trust is choosing
to open a point of vulnerability to another entity whom you believe
will not cause damage."  You obviously don't trust the hackers or
script-kiddies.  You obviously trust yourself, and you may or may not
trust the others you allow onto your sim.  But, there's no way to
resolve it via obscurity.

(Well, there is *one* way, but it's not 'obscurity', it's 'entropy'...
and that's outside the scope of this discussion, since I don't even
know if it can be done in Mono, and the required infrastructure just
doesn't exist in the world.  This way would be 'client certificate
authentication of a TLS channel to the services' so that even if they
had the channel string, they still wouldn't be able to use it without
an authorized client certificate.)

-Kyle H

On Tue, Jan 12, 2010 at 1:50 PM, Imago <imagorabbit at gmail.com> wrote:
> Most people won't bother though. Because the average user isn't going to
> attempt to break in to a website, server, etc. I've got experience with
> security, reverse engineering, programming. (Probably going on almost 20
> something years now.) So, yeah, it's not secure, but average joe user isn't
> going to attempt to hack if you don't put up a big sign that says
> "Unhackable" or "Secure as all hell." You put out stuff like that you're
> just begging for someone to take down your 64 or 128 bit encryption. Because
> in my experience everyone now thinks base64 is "unhackable" and yet it's
> being done and has been done. So, really... There is no such thing as
> unhackable.
>
> But what I'm saying is the average user has little to no working knowledge
> of how a website, program, etc works. They don't care if it runs and they
> can use it then they are happy. I've done so much website work, programming
> work, etc for people over the years I think I'm an expert on how stupid the
> average user really is when it comes to anything computer related. ;)
>
> ----- Original Message -----
> From: "Kyle Hamilton" <aerowolf at gmail.com>
> To: "opensim-users" <opensim-users at lists.berlios.de>
> Sent: Tuesday, January 12, 2010 3:37 PM
> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can this be done?
>
>
>> Security through obscurity is no security at all.  If you're relying
>> on people not figuring it out, people *will* figure it out.
>>
>> </experience of security expert for many years>
>>
>> -Kyle H
>>
>> On Tue, Jan 12, 2010 at 1:34 PM, Imago <imagorabbit at gmail.com> wrote:
>>> But really... How many people who aren't really looking for this info are
>>> going to find it. ;) Nubs aren't going to know where to look. But
>>> blocking
>>> by string probably wouldn't be the best, but it would work for dumb
>>> people.
>>> ;)
>>>
>>> ----- Original Message -----
>>> From: "Frisby, Adam" <adam at deepthink.com.au>
>>> To: <opensim-users at lists.berlios.de>; <diva at metaverseink.com>
>>> Sent: Tuesday, January 12, 2010 3:25 PM
>>> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can this be
>>> done?
>>>
>>>
>>>> While I hate to rain on anyone's parade - but you can use the "-channel"
>>>> commandline switch to edit the version string to whatever you want. I
>>>> really wouldn't rely on it.
>>>>
>>>> Adam
>>>>
>>>>> -----Original Message-----
>>>>> From: opensim-users-bounces at lists.berlios.de [mailto:opensim-users-
>>>>> bounces at lists.berlios.de] On Behalf Of Imago
>>>>> Sent: Tuesday, 12 January 2010 9:34 AM
>>>>> To: diva at metaverseink.com; opensim-users at lists.berlios.de
>>>>> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can this be
>>>>> done?
>>>>>
>>>>> Thanks, I've been looking over the code, and yeah, I know people could.
>>>>> But
>>>>> really how many regular joes out there would be interested enough to
>>>>> download, compile, and play with the code. *laughs* I don't think
>>>>> there's
>>>>> many, because a lot of them would much rather have instant
>>>>> gratification
>>>>> rather then having to work for it.
>>>>>
>>>>> But in my opinion even fragile filtering is better then none at all.
>>>>> Because
>>>>> while some could get in the population en masse wouldn't be able to.
>>>>>
>>>>> ----- Original Message -----
>>>>> From: <diva at metaverseink.com>
>>>>> To: <opensim-users at lists.berlios.de>
>>>>> Sent: Tuesday, January 12, 2010 8:15 AM
>>>>> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can this be
>>>>> done?
>>>>>
>>>>>
>>>>> > As Teravus said, the LL viewer sends a string identifying itself and
>>>>> a
>>>>> > version. In the new login procedure that is captured by the
>>>>> > LLLoginHandlers as
>>>>> > if (requestData.Contains("version"))
>>>>> > clientVersion = requestData["version"].ToString();
>>>>> >
>>>>> > Right now we're not doing anything interesting with this information.
>>>>> > When this refactoring makes it to the master branch, people can
>>>>> replace
>>>>> > / augment the existing LLLoginHandlers to do other things including
>>>>> > filtering logins according to this field.
>>>>> >
>>>>> > But as others said here, this is a very fragile filtering, as any
>>>>> viewer
>>>>> > can send that field saying that it's an LL viewer.
>>>>> >
>>>>> > Imago wrote:
>>>>> >> Ah! Thank you. I did read something on the subject, but then
>>>>> suffered a
>>>>> >> hard
>>>>> >> drive death and it wiped out any settings I had. :( Google comes up
>>>>> with
>>>>> >> way
>>>>> >> too much junk when you look for stuff as well as Mantis stuff and
>>>>> Jiras.
>>>>> >> I
>>>>> >> will check in to this. So, now I know it is possible. :D Now, it's
>>>>> just
>>>>> >> finding a way to do it. *shrugs and laughs* If it keeps a few kids
>>>>> out
>>>>> >> than
>>>>> >> that's fine. I'd rather have fun then to have to police my console
>>>>> for
>>>>> >> logins. :D
>>>>> >>
>>>>> >> ----- Original Message -----
>>>>> >> From: "Teravus Ovares" <teravus at gmail.com>
>>>>> >> To: <opensim-users at lists.berlios.de>
>>>>> >> Sent: Monday, January 11, 2010 11:56 PM
>>>>> >> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can this
>>>>> be
>>>>> >> done?
>>>>> >>
>>>>> >>
>>>>> >>> The viewer information is sent when the viewer logs in. If you
>>>>> >>> check the viewer channel version string when the viewer logs in,
>>>>> you
>>>>> >>> can deny based on a string match. That's the easy (and least
>>>>> >>> effective way) to lock only specific viewers.
>>>>> >>>
>>>>> >>> I believe that diva and Melanie_T were the last to work on these
>>>>> >>> areas.. so they would probably be able to tell you where to
>>>>> check
>>>>> >>> 'best'.
>>>>> >>>
>>>>> >>> One thing to note, however, is..
>>>>> >>>
>>>>> >>> The viewer logs into the 'user service' by sending an XMLRPC
>>>>> request
>>>>> >>> to the HTTP Service with the login_to_simulator method. It's at
>>>>> >>> this time that the 'viewer channel string' should be checked.
>>>>> >>>
>>>>> >>> Teravus
>>>>> >>>
>>>>> >>> On Tue, Jan 12, 2010 at 12:34 AM, Imago <imagorabbit at gmail.com>
>>>>> wrote:
>>>>> >>>> Mostly I want this because of piece of mind, but also because I am
>>>>> >>>> considering compiling a viewer on Hippo code that will have a
>>>>> different
>>>>> >>>> channel code altogether that I will probably use for the sim. If I
>>>>> can
>>>>> >>>> lock
>>>>> >>>> off viewers that don't have my exact channel or code then I can be
>>>>> sure
>>>>> >>>> only
>>>>> >>>> official viewers can get in. Right now the sim is only for friends
>>>>> but
>>>>> >>>> if
>>>>> >>>> I
>>>>> >>>> open it up to more I wouldn't want idiots coming in and mucking
>>>>> about
>>>>> >>>> the
>>>>> >>>> place. Which is why I was asking. I know that some opensim
>>>>> *shaking
>>>>> >>>> head*
>>>>> >>>> I
>>>>> >>>> wish I could remember who and where banned certain viewers from
>>>>> logging
>>>>> >>>> in.
>>>>> >>>> I'm not sure how she/he did it, though, but it got me curious as
>>>>> to how
>>>>> >>>> it's
>>>>> >>>> done. That and I wouldn't really want someone using something like
>>>>> Cryo
>>>>> >>>> or
>>>>> >>>> even Meerkat, but as you said... They probably all have the same
>>>>> >>>> default
>>>>> >>>> code. But if I put in another code and compiled it off of hippo or
>>>>> >>>> Linden's
>>>>> >>>> viewer I could put in my own channel and have others not able to
>>>>> enter.
>>>>> >>>> I
>>>>> >>>> like security and peace of mind, but security in this day and age
>>>>> is a
>>>>> >>>> myth.
>>>>> >>>> (Like those stupid broadcasting things that were supposed to stop
>>>>> >>>> copybot.)
>>>>> >>>>
>>>>> >>>> But I was just curious if anyone had done it or heard of it. I
>>>>> want to
>>>>> >>>> say
>>>>> >>>> openlifegrid did it, but I can't remember so I don't want to say
>>>>> for
>>>>> >>>> sure
>>>>> >>>> until I find it again. (computer crashes suck.)
>>>>> >>>> ----- Original Message -----
>>>>> >>>> From: "Karen Palen" <karen_palen at yahoo.com>
>>>>> >>>> To: <opensim-users at lists.berlios.de>
>>>>> >>>> Sent: Monday, January 11, 2010 11:24 PM
>>>>> >>>> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can
>>>>> this be
>>>>> >>>> done?
>>>>> >>>>
>>>>> >>>>
>>>>> >>>>> As I think of it the answer is the same.
>>>>> >>>>>
>>>>> >>>>> The Linden Labs viewer does send an identification and version
>>>>> number,
>>>>> >>>>> bat
>>>>> >>>>> that really does very little. Almost every viewer out there is
>>>>> based
>>>>> >>>>> on
>>>>> >>>>> the current LL viewer and many people don't bother changing this
>>>>> code
>>>>> >>>>> for
>>>>> >>>>> their experimental versions.
>>>>> >>>>>
>>>>> >>>>> For example I just checked and I have a customised LL viewer
>>>>> where the
>>>>> >>>>> only change is that it will log on to my private sim by default.
>>>>> The
>>>>> >>>>> ID
>>>>> >>>>> codes are identical to the original since I never bothered to
>>>>> change
>>>>> >>>>> them.
>>>>> >>>>>
>>>>> >>>>> I use it to make sure that my private sim will run OK with the
>>>>> >>>>> "official"
>>>>> >>>>> viewer.
>>>>> >>>>>
>>>>> >>>>> I am not really sure why you would want that restriction though.
>>>>> >>>>> Should
>>>>> >>>>> I
>>>>> >>>>> be considering that for my sim? Have I missed something here?
>>>>> >>>>>
>>>>> >>>>> Sorry.
>>>>> >>>>>
>>>>> >>>>> Karen
>>>>> >>>>>
>>>>> >>>>> --- On Mon, 1/11/10, Imago <imagorabbit at gmail.com> wrote:
>>>>> >>>>>
>>>>> >>>>>> From: Imago <imagorabbit at gmail.com>
>>>>> >>>>>> Subject: Re: [Opensim-users] Banning "bad" viewers was Re: Can
>>>>> this
>>>>> >>>>>> be
>>>>> >>>>>> done?
>>>>> >>>>>> To: opensim-users at lists.berlios.de
>>>>> >>>>>> Date: Monday, January 11, 2010, 10:05 PM
>>>>> >>>>>> I don't think anyone is
>>>>> >>>>>> understanding. :D It's not just Cryo. I want only
>>>>> >>>>>> Linden Lab viewers to be able to login. I've seen it done
>>>>> >>>>>> on other
>>>>> >>>>>> opensim's. I know people can get around that. But the point
>>>>> >>>>>> is... Not
>>>>> >>>>>> everyone is a coder. So, while they could compile and make
>>>>> >>>>>> it look like a
>>>>> >>>>>> Linden Lab viewer then so be it. I just want to know if
>>>>> >>>>>> there's a mod or
>>>>> >>>>>> string that I can put in to opensim to see what channel the
>>>>> >>>>>> viewer is
>>>>> >>>>>> sending, and if it's not the right one than to display an
>>>>> >>>>>> error message that
>>>>> >>>>>> would tell them to download an official release in order to
>>>>> >>>>>> login.
>>>>> >>>>>>
>>>>> >>>>>> Maybe I should have chosen my words better. Mentioning Cryo
>>>>> >>>>>> is like
>>>>> >>>>>> mentioning copybot, and responses only seem to be based on
>>>>> >>>>>> theft and copy
>>>>> >>>>>> protection. I just want to know if there's a string to
>>>>> >>>>>> block a viewer. I
>>>>> >>>>>> know people have done it I just can't remember what opensim
>>>>> >>>>>> I saw it done
>>>>> >>>>>> on. I also know that if I had Cryo source code I could
>>>>> >>>>>> compile and make it
>>>>> >>>>>> look like a Second Life release viewer. But not everyone is
>>>>> >>>>>> a hacker or a
>>>>> >>>>>> coder or both. Most people don't know how or can't compile
>>>>> >>>>>> a viewer or are
>>>>> >>>>>> too lazy to. So, they go look for one, and that's the basis
>>>>> >>>>>> for my thinking
>>>>> >>>>>> most theives are too lazy to try to figure out a way and
>>>>> >>>>>> will move on to the
>>>>> >>>>>> next target.
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>> So, the question I'm asking is:
>>>>> >>>>>> Is there a way for OpenSim to check a viewer string and
>>>>> >>>>>> allow or disallow
>>>>> >>>>>> based on that, and if so please let me know where that code
>>>>> >>>>>> is, and if
>>>>> >>>>>> not... Then I'll be burning the midnight oil again coding
>>>>> >>>>>> one up.
>>>>> >>>>>>
>>>>> >>>>>> ----- Original Message -----
>>>>> >>>>>> From: "Karen Palen" <karen_palen at yahoo.com>
>>>>> >>>>>> To: <opensim-users at lists.berlios.de>
>>>>> >>>>>> Sent: Monday, January 11, 2010 10:44 PM
>>>>> >>>>>> Subject: [Opensim-users] Banning "bad" viewers was Re: Can
>>>>> >>>>>> this be done?
>>>>> >>>>>>
>>>>> >>>>>>
>>>>> >>>>>>> The short answer is no.
>>>>> >>>>>>>
>>>>> >>>>>>> The more complete answer is that you while can easily
>>>>> >>>>>> detect some
>>>>> >>>>>>> characteristic of a viewer (or other software) which
>>>>> >>>>>> identifies that
>>>>> >>>>>>> viewer and use that to ban it, nothing can stop the
>>>>> >>>>>> authors of that viewer
>>>>> >>>>>>> from changing whatever characteristic you use.
>>>>> >>>>>>>
>>>>> >>>>>>> Worse yet, whatever characteristic you select to
>>>>> >>>>>> identify the "bad"
>>>>> >>>>>>> software will inevitably turn up in some other
>>>>> >>>>>> (innocent) viewer sooner or
>>>>> >>>>>>> later and will cause them to be banned for no reason.
>>>>> >>>>>>>
>>>>> >>>>>>> The best you could hope to achieve is some sort of
>>>>> >>>>>> "arms race" between
>>>>> >>>>>>> "bad" viewer creators and sim operators.
>>>>> >>>>>>>
>>>>> >>>>>>> In addition any viewer could be adapted for piracy.
>>>>> >>>>>> The original
>>>>> >>>>>>> experiments that resulted in
>>>>> >>>>>> libsecondlife/openMetaverse were based on
>>>>> >>>>>>> analysing the data stream between the Second Life
>>>>> >>>>>> Servers and the viewer
>>>>> >>>>>>> software (at the time ONLY the Linden Labs viewer) and
>>>>> >>>>>> had access to all
>>>>> >>>>>>> of that information. This was all done without
>>>>> >>>>>> modifying the viewer in any
>>>>> >>>>>>> way - it was proprietary at the time.
>>>>> >>>>>>>
>>>>> >>>>>>> Sadly the lesson of the endless failures of DRM
>>>>> >>>>>> schemes elsewhere shows
>>>>> >>>>>>> that the real losers are the honest/innocent users who
>>>>> >>>>>> are unable to do
>>>>> >>>>>>> the things that they really should expect to do with
>>>>> >>>>>> the content that they
>>>>> >>>>>>> have purchased.
>>>>> >>>>>>>
>>>>> >>>>>>> For example, I have completely stopped buying anything
>>>>> >>>>>> in Second Life
>>>>> >>>>>>> since I want to use the inventory I buy in my private
>>>>> >>>>>> sims as well. Sure I
>>>>> >>>>>>> can use pirate tools to do this, but if I have to do
>>>>> >>>>>> that to use my
>>>>> >>>>>>> purchases where I want to use them then why not just
>>>>> >>>>>> steal the stuff in
>>>>> >>>>>>> the first place?
>>>>> >>>>>>>
>>>>> >>>>>>> This is very similar to the situation with music CDs
>>>>> >>>>>> and DVDs, why build
>>>>> >>>>>>> an expensive collection if you will just have to
>>>>> >>>>>> re-purchase it in a few
>>>>> >>>>>>> years for the next technology and some DRM scheme
>>>>> >>>>>> tries to keep me from
>>>>> >>>>>>> playing my collection on the new equipment?
>>>>> >>>>>>>
>>>>> >>>>>>> There are several efforts being directed at come sort
>>>>> >>>>>> of "portable"
>>>>> >>>>>>> content. I hope that one or more actually proves to
>>>>> >>>>>> work, but I have no
>>>>> >>>>>>> illusions about that actually happening any time
>>>>> >>>>>> soon.
>>>>> >>>>>>> My opinion is that the best we can do at present is
>>>>> >>>>>> similar to the real
>>>>> >>>>>>> life piracy situation: stop the commercial marketing
>>>>> >>>>>> of pirated
>>>>> >>>>>>> merchandise as it is detected and reported. Ban anyone
>>>>> >>>>>> who engages in such
>>>>> >>>>>>> activities and if they persist bring real world law
>>>>> >>>>>> enforcement to bear.
>>>>> >>>>>>> For once Linden Labs seems to be using a reasonable
>>>>> >>>>>> version of this when
>>>>> >>>>>>> they state that the viewer is not the problem, it is
>>>>> >>>>>> the use of the
>>>>> >>>>>>> viewer. They have promised to act promptly to ban
>>>>> >>>>>> anyone using any viewer
>>>>> >>>>>>> for piracy.
>>>>> >>>>>>>
>>>>> >>>>>>> Karen
>>>>> >>>>>>>
>>>>> >>>>>>> --- On Mon, 1/11/10, Imago <imagorabbit at gmail.com>
>>>>> >>>>>> wrote:
>>>>> >>>>>>>> Is it possible to stop
>>>>> >>>>>>>> certain viewers from logging
>>>>> >>>>>>>> in to your opensim? Like Cryo?
>>>>> >>>>>>>
>>>>> >>>>>>>
>>>>> >>>>>>>
>>>>> >>>>>>> _______________________________________________
>>>>> >>>>>>> Opensim-users mailing list
>>>>> >>>>>>> Opensim-users at lists.berlios.de
>>>>> >>>>>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>> >>>>>>
>>>>> >>>>>> _______________________________________________
>>>>> >>>>>> Opensim-users mailing list
>>>>> >>>>>> Opensim-users at lists.berlios.de
>>>>> >>>>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>> >>>>>>
>>>>> >>>>>
>>>>> >>>>>
>>>>> >>>>> _______________________________________________
>>>>> >>>>> Opensim-users mailing list
>>>>> >>>>> Opensim-users at lists.berlios.de
>>>>> >>>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>> >>>> _______________________________________________
>>>>> >>>> Opensim-users mailing list
>>>>> >>>> Opensim-users at lists.berlios.de
>>>>> >>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>> >>>>
>>>>> >>> _______________________________________________
>>>>> >>> Opensim-users mailing list
>>>>> >>> Opensim-users at lists.berlios.de
>>>>> >>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>> >>
>>>>> >> _______________________________________________
>>>>> >> Opensim-users mailing list
>>>>> >> Opensim-users at lists.berlios.de
>>>>> >> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>> >>
>>>>> > _______________________________________________
>>>>> > Opensim-users mailing list
>>>>> > Opensim-users at lists.berlios.de
>>>>> > https://lists.berlios.de/mailman/listinfo/opensim-users
>>>>>
>>>>> _______________________________________________
>>>>> Opensim-users mailing list
>>>>> Opensim-users at lists.berlios.de
>>>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>> _______________________________________________
>>>> Opensim-users mailing list
>>>> Opensim-users at lists.berlios.de
>>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>
>>> _______________________________________________
>>> Opensim-users mailing list
>>> Opensim-users at lists.berlios.de
>>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>>
>> _______________________________________________
>> Opensim-users mailing list
>> Opensim-users at lists.berlios.de
>> https://lists.berlios.de/mailman/listinfo/opensim-users
>>
>
> _______________________________________________
> Opensim-users mailing list
> Opensim-users at lists.berlios.de
> https://lists.berlios.de/mailman/listinfo/opensim-users
>