Logo

Sansarya · 06-11-2009, 10:07 AM

Quote:

Hypergrid Business is reporting that an unknown person or persons destroyed a large number of OpenSim regions over the weekend, by exploiting a weakness in LxLabs' Linux-based HyperVM management software. OpenSim is a popular third-party reverse-engineered implementation of Linden Lab's Second Life server software used in a variety of commercial, non-commercial and educational virtual-environment grids.

More than 100 regions are reported lost, along with any data that wasn't backed up off-site. Apparently more than just the simulators were taken down, Web-pages and other ancillary data and files on the affected servers were also lost in the attack.

OpenSim regions using virtualization software other than LxLabs' HyperVM were unaffected. The attack hit more than just third-party Second Life compatible grids, however, as more than 100,000 other websites and servers were wiped over the weekend using the software exploit.

In the wake of the attacks and massive data-loss, LxLabs' founder, K T Ligesh (32) allegedly committed suicide in his Bangalore home on Monday.

http://www.massively.com/2009/06/10/...ekend-exploit/

Joshua Nightshade · 06-11-2009, 10:08 AM

He's not related to OpenSim at all.

Also, is there a link for that story?

Sansarya · 06-11-2009, 10:11 AM

posted now, sorry, someone in my office was talking to me when I was trying to post this

What? Does she think I have nothing to do but answer her questions about stuff I taught her already fifty times?

Joshua Nightshade · 06-11-2009, 10:17 AM

Ugh Tateru.

My comment:

Quote:

This article is kindof ridiculously inaccurate.

Firstly, and most importantly, OpenSim isn't a reverse engineering of anything; there's no code from Second Life anywhere in it. While it utilizes libsl which was, in part, reverse-engineered by the libsecondlife group, OpenSim itself is not.

Secondly, this is only tangentially related to OpenSim at all. It looks like it was an exploit attacking Linux machines using HyperVM that were wiped; if OpenSim happened to be on it, then it was erased too as part of the attack. Your article implies that both OpenSim itself was targeted or vulnerable, and that the founder of LxLabs committed suicide in response to losing 100 OpenSim regions.

**Humps** · 06-11-2009, 10:24 AM

Times of India article.

Techie hangs himself in HSR Layout - Bangalore - Cities - The Times of India

**Adam Zaius** · 06-11-2009, 10:29 AM

Yeah, the problem was with the popular host 'vaserv.com' (also known as fsckvps) - they were running HyperVM and were subject to an exploit where the attacker just decided to delete the harddisks of everyones VM.

About 5% of OSGrid was hosted there (~100-150 regions out of 2000), including the author of the original HyperGrid Business article's regions.

Siggy · 06-11-2009, 11:59 AM

My Fave:

Quote:

"I did it for the lulz" doesn't cut it anymore.

The attitude of "The internets is serious business" kinda falls flat when people start dying over this crap.

Would be great if they could catch the person/persons responsible and charge them. Be even better if they could add the weight of the suicide to the case.

Now although the credo of original hackers frowns upon the destruction of data - and personally I don't think it's cool... "Doin' it for the lulz" certainly does still cut it. People didn't 'die over this crap', someone decided to opt out.

Although saying he did it because of it would be no leap of the imagination - and the most likely scenario, we'll never know for sure. But even if it was, and this will sound callous to some, that's his problem. Charge the schmucks for destruction of data if you can, most certainly, but for someone elses ultimate 'zomfg' emo moment? That's a bit much.

Gareth Nelson · 06-12-2009, 04:50 AM

Quote:

Originally Posted by Joshua Nightshade

This article is kindof ridiculously inaccurate.

Firstly, and most importantly, OpenSim isn't a reverse engineering of anything; there's no code from Second Life anywhere in it. While it utilizes libsl which was, in part, reverse-engineered by the libsecondlife group, OpenSim itself is not.

Opensim is all reverse engineered, I don't know why there's this silly "opensim wasn't reverse engineered" meme flying around - it's like a dirty little secret people are trying to cover up.

Yes, libsl did lots of reverse engineering first - but they didn't do the whole lot. Perhaps your confusion stems from the statement "there's no code from second life anywhere in it" - putting LL's code into opensim wouldn't be reverse engineering would it?

LL never released full details of how to implement an SL-compatible server, it was reverse engineered and there is nothing wrong with that.

Quote:

Your article implies that both OpenSim itself was targeted or vulnerable, and that the founder of LxLabs committed suicide in response to losing 100 OpenSim regions.

Another article implied linux as an OS is vulnerable, rather than just hyperVM - silly silly "journalists".........

Gareth Nelson · 06-12-2009, 04:52 AM

Quote:

Originally Posted by Adam Zaius

Yeah, the problem was with the popular host 'vaserv.com' (also known as fsckvps) - they were running HyperVM and were subject to an exploit where the attacker just decided to delete the harddisks of everyones VM.

About 5% of OSGrid was hosted there (~100-150 regions out of 2000), including the author of the original HyperGrid Business article's regions.

I had a VPS there, got a backup restored within a day and they're working through all customers - I will be moving my stuff ASAP of course, but it's hardly a total data loss like is being implied.

The big lesson here is never to rely on a single provider.

Joshua Nightshade · 06-12-2009, 05:19 AM

Quote:

Originally Posted by Gareth Nelson

Opensim is all reverse engineered, I don't know why there's this silly "opensim wasn't reverse engineered" meme flying around - it's like a dirty little secret people are trying to cover up.

Yes, libsl did lots of reverse engineering first - but they didn't do the whole lot. Perhaps your confusion stems from the statement "there's no code from second life anywhere in it" - putting LL's code into opensim wouldn't be reverse engineering would it?

LL never released full details of how to implement an SL-compatible server, it was reverse engineered and there is nothing wrong with that.

Another article implied linux as an OS is vulnerable, rather than just hyperVM - silly silly "journalists".........

Oh we've been over this already the last time, you're wrong, you really need to get over your fixated grudge.

**Adam Zaius** · 06-12-2009, 05:46 AM

Quote:

Originally Posted by Gareth Nelson

I had a VPS there, got a backup restored within a day and they're working through all customers - I will be moving my stuff ASAP of course, but it's hardly a total data loss like is being implied.

The big lesson here is never to rely on a single provider.

About 30% of the VMs were total write-offs. They stopped posting the specifics on vaserv.com a few days ago; but it looked like out of 180 servers, at least 60 were destroyed completely.

And yes, a single provider is a bad move, especially for a backup routine.

Khamon · 06-12-2009, 10:03 AM

Quote:

Originally Posted by Gareth Nelson

I don't know why there's this silly "opensim wasn't reverse engineered" meme flying around

Gareth Nelson · 06-12-2009, 04:55 PM

Quote:

Originally Posted by Joshua Nightshade

Oh we've been over this already the last time, you're wrong, you really need to get over your fixated grudge.

Sorry, I didn't realise LL released full in-detail specs for the whole protocol. All those hours of reading sniffer logs must have been hallucinations then.

Joshua Nightshade · 06-12-2009, 04:56 PM

Lucifer Baphomet · 06-12-2009, 05:06 PM

K.....

Adam can correct me if I'm wrong...

Opensim was developed by looking at the data packets that the viewer sent to and recieved from LLs servers. Then The developers sat and thought "What sort of software would generate, and use this data."

So in effect it was reverse engineered from the communication protocols used, and not the server code, but it was still a process of reverse engineering.

Joshua Nightshade · 06-12-2009, 05:06 PM

Adam's already addressed that the last time Gareth whined about it.

Joshua Nightshade · 06-12-2009, 05:27 PM

For the benefit of those who don't want to search:

Quote:

Originally Posted by Adam Zaius

Actually, up until now OpenSim hasnt gained anything really from the viewer being open sourced because we dont touch the viewer code as a matter of legal policy.

IMO, I think we're going to see a lot more of the OpenSim crowd move towards Idealist - it's already a very healthy way towards implementing nice looking scenes.

Quote:

Originally Posted by Chalice Yao

The OpenSim devs certainly have learned from the opensourcing of the viewer tho, in the matter of how and when the viewer asks for what. Not source-code per-se, but from a protocol-standpoint, along with what was learned via libSL while things were closed-source only.

Quote:

Originally Posted by Adam Zaius

Again, most of this was done by libsl way before the code was released - libsl had near-complete (or at least usable by opensim) docs availible before the viewer was released.

Most of OpenSim has been put together by deduction of logical values for the containing packets rather than analysis of packet dumps (although one or two features have been done by packet dump - world map for example.)

Where the viewer code being open has really been allowing things like Hippo to be developed, rather than anything relating to the LLUDP protocol which has been for the most part solved by libsl before the viewer was open.

Quote:

Originally Posted by Chalice Yao

Oh, libsl served the most part when it comes to the network layer, really, but you can't tell me the OpenSim devs didn't jump into the viewer code when it was released to see if what they and the libSL folks thought the viewer does when and where actually happens there :> (or to check for things they missed)

Quote:

Originally Posted by Adam Zaius

Actually, I can say pretty authoratively that the viewer code wasnt used for protocol analysis. As I said - by the time LL released the viewer code, libsl had all the major functions documented out, even if they werent implemented.

Really, the vast majority of packet decoding came from this little document:

http://www.libsecondlife.org/templat...e/1.19.1.4.txt

Take a read of that - add in the packet encoding methods and SYN/ACK system ontop of it (which libsl worked out via tedius trial, error and analysis) and you have 99% of the protocol solved.

Quote:

Originally Posted by Gareth Nelson

Perhaps Adam might like to tell you about the login request fields that were decoded by using Opengrok to well................ grok the viewer code.

Quote:

Originally Posted by Adam Zaius

Wasn't login decoded here: Hegemons Login Analysis - Second Life Wiki

That was a few days before the client source tarballs were posted.

Quote:

Originally Posted by Gareth Nelson

Joshua, no offence but you weren't actually there right at the start to claim that. As I said in my above post, opengrok was used to find certain parts of the login response at least.
Not that it matters, since copyright protects original expression, not protocol elements or knowledge.

Quote:

Originally Posted by Adam Zaius

I honestly cant remember anyone fiddling with Opengrok for the client login parameters, from my recollection Hegemon's analysis was the one that got the initial "login packet dump replayer" into something that actually processed login.

I guess it is possible however - my memory is not so great given we're talking about events occuring two years ago.

Quote:

Originally Posted by Gareth Nelson

err, i'm saying that the viewer code (specifically lluserauth.cpp) was in fact used to figure out some of the other login fields.

Quote:

Originally Posted by Adam Zaius

It's possible, although I can pretty much guaruntee none of that resulting code is in there today, if only because login has been rewritten a few times since 0.0.0/0.1.0, especially since LL decided to reformat the login sequence from one XMLRPC format to another (there's been three major changes to the viewer login since 1.16 - change in format, LLSD login and finally the web login).

That being said - we may find one or two examples where something has come from someone doing an analysis on viewer code, but had the viewer code not been around, it would have been figured out the same way the rest of the code was - horribly painful trial and error with logical deduction.

The developers have repeatedly said that OpenSim is not a reverse engineering effort and that they consider the term pejorative. And when LL's legal team hovers nebulously refusing to validate OpenSim as not impinging upon their rights, it's absolutely important to maintain that distinction.

This has nothing to do with anything, it's just something Gareth throws up to bitch about because he's not been involved with OpenSim for ages. Regardless of what happened on Day One that was removed from the code on Day Three, it's an irrelevant detail that doesn't reflect OpenSim today and it's only something he brings up to annoy people with.

Gareth Nelson · 06-12-2009, 05:46 PM

You quote a bunch of old posts referencing reading the viewer source for some of opensim, and totally miss the point about reading sniffer logs.

Whether or not the current opensim devs call the project a reverse-engineering effort is irrelevant - it was reverse engineered from day one. There is nothing dodgy about this either, it's not an insult to the skills of anyone involved (if anything it's a compliment - it's much more difficult to write an implementation of a protocol without solid specifications), nor is it in any way illegal or unethical to do this kind of analysis.

LL's legal rights are not infringed in any manner simply because someone has reverse engineered their protocol - the only form of legal protection for protocols is patents, and LL do not own a patent on the protocol.

Adam says it himself:

Quote:

it would have been figured out the same way the rest of the code was - horribly painful trial and error with logical deduction.

The protocol details were not available publically, they had to be figured out - that's pretty much reverse engineering.

Joshua Nightshade · 06-12-2009, 05:47 PM

Quote:

Originally Posted by Gareth Nelson

You quote a bunch of old posts referencing reading the viewer source for some of opensim, and totally miss the point about reading sniffer logs.

No, you missed the point.

I quoted a bunch of posts from the last time you brought it up in a typically annoying fashion.

Really, move on. You'll be happier for it.

Gareth Nelson · 06-12-2009, 05:50 PM

I am curious Joshua - where do you think the protocol details came from if not by being reverse-engineered?
libsl figured out the serialisation format for the messages, the basics of the circuit system, reliable/unreliable flags etc and figured out a lot of client-side functionality, but they did not figure out (for example) generating LayerData and RegionHandshake messages.

(the sharp ones reading will notice that some libsl devs did figure out LayerData, but it was largely due to opensim that the encoding side was implemented - kinda a libsl+opensim effort).

Joshua Nightshade · 06-12-2009, 05:50 PM

libsl /= OpenSim.

As I said before this has nothing to do with this thread and I'm not really in the mood to deal with you. Stop derailing.

Gareth Nelson · 06-12-2009, 05:55 PM

You miss the point again.........

Re-read my post: libsl figured out part of the protocol, but not the server-side stuff.

Joshua Nightshade · 06-12-2009, 05:55 PM

Quote:

Originally Posted by Joshua Nightshade

Stop derailing.

Ingrid · 06-13-2009, 12:58 PM

Quote:

Originally Posted by Joshua Nightshade

Quoting yourself is one of the first signs of insanity apparently.

Khamon · 06-13-2009, 01:08 PM

so is wearing a bag over one's head

06-11-2009, 10:24 AM	#5 (permalink)
Humps Senior Member SLU Supporter I refuse to edit my status Join Date: Aug 2007 Location: UK Posts: 2,312 My Mood: SL Join Date: 19th May 2006 Business: Fab Pads! XBOX Leaderboard: 35^th Awards: 1	Times of India article. Techie hangs himself in HSR Layout - Bangalore - Cities - The Times of India __________________ "The Other Blog!"

06-12-2009, 05:06 PM	#15 (permalink)
Lucifer Baphomet Pampers Io Zenophile Join Date: Aug 2007 Location: Darkmere Posts: 12,227 My Mood: Business: Radio Free Darkmere Awards: 1	K..... Adam can correct me if I'm wrong... Opensim was developed by looking at the data packets that the viewer sent to and recieved from LLs servers. Then The developers sat and thought "What sort of software would generate, and use this data." So in effect it was reverse engineered from the communication protocols used, and not the server code, but it was still a process of reverse engineering. __________________

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

06-11-2009, 10:08 AM	#2 (permalink)
Joshua Nightshade Account Closed Unedited Join Date: Jun 2007 Posts: 33,567 My Mood:	He's not related to OpenSim at all. Also, is there a link for that story?

06-11-2009, 10:11 AM	#3 (permalink)
Sansarya Koo Koo Kachoo! Feeling Octoberish Join Date: Jun 2007 Location: Rosebud Posts: 1,504 My Mood: SL Join Date: April 2005 Blog Entries: 2	posted now, sorry, someone in my office was talking to me when I was trying to post this What? Does she think I have nothing to do but answer her questions about stuff I taught her already fifty times?

06-12-2009, 04:56 PM	#14 (permalink)
Joshua Nightshade Account Closed Unedited Join Date: Jun 2007 Posts: 33,567 My Mood:

06-12-2009, 05:06 PM	#16 (permalink)
Joshua Nightshade Account Closed Unedited Join Date: Jun 2007 Posts: 33,567 My Mood:	Adam's already addressed that the last time Gareth whined about it.

06-12-2009, 05:50 PM	#20 (permalink)
Gareth Nelson Arrogant Bitch Insert status here Join Date: Mar 2008 Location: UK Posts: 763 My Mood:	I am curious Joshua - where do you think the protocol details came from if not by being reverse-engineered? libsl figured out the serialisation format for the messages, the basics of the circuit system, reliable/unreliable flags etc and figured out a lot of client-side functionality, but they did not figure out (for example) generating LayerData and RegionHandshake messages. (the sharp ones reading will notice that some libsl devs did figure out LayerData, but it was largely due to opensim that the encoding side was implemented - kinda a libsl+opensim effort).

06-12-2009, 05:50 PM	#21 (permalink)
Joshua Nightshade Account Closed Unedited Join Date: Jun 2007 Posts: 33,567 My Mood:	libsl /= OpenSim. As I said before this has nothing to do with this thread and I'm not really in the mood to deal with you. Stop derailing.

06-12-2009, 05:55 PM	#22 (permalink)
Gareth Nelson Arrogant Bitch Insert status here Join Date: Mar 2008 Location: UK Posts: 763 My Mood:	You miss the point again......... Re-read my post: libsl figured out part of the protocol, but not the server-side stuff.

06-13-2009, 01:08 PM	#25 (permalink)
Khamon BUY TREES MOAR1 Iz a timeout Join Date: Jun 2007 Location: Alabama Posts: 4,816 My Mood: SLShopper Ads: 2 SL Join Date: November, 2003 Business: Fate Gardens Flowers and Trees	so is wearing a bag over one's head

Logo

Site Navigation