Hackers are stealing Second Life’s player-made lootboxes and selling them for profit

Second Life is a virtual world stereotypically thought to be steeped in cyber sex, but beyond that thin layer of prurience is a thriving community of artists creating everything from lavish Beverly Hills-style mansions to the eyeliner your avatar wears. Its economy is a staggering $500 million USD machine of virtual ecommerce, with many players making a real-world living by creating, marketing, and selling digital products. But those same creators are locked in a long battle against groups of cheaters who, using a series of exploits, are stealing their products and selling them for profit on Second Life’s official Marketplace. It’s potentially costing Second Life’s virtual artists tens of thousands of real dollars and highlights the nightmare of defending your intellectual property on the internet.

Second Life is unique in the MMO genre for many reasons. It’s not so much a game as it is a social space that players can customize however they like. Called ‘sims,’ these sandboxes are spaces that players fill with all manner of player-designed objects. Unlike other MMOs, however, these objects aren’t created using some in-game crafting system, but built with software like 3D Studio Max, Photoshop, and a lot more. Some players build mansions and throw elegant parties while others own retail stores that sell their hand-crafted apparel. And, yes, some just want to have cybersex.

Second Life’s creators were on track to take home $60 million USD collectively in 2017.

But it’s also unique in that, unlike most MMOs, players can exchange Second Life’s ingame currency (called Lindens) for US dollars. Peter Gray, who was Linden Lab’s senior director of global communication before leaving early this year, told me via email that Second Life’s creators were on track to take home $60 million USD collectively in 2017. It’s what’s led many players to turn Second Life into a full-time job. But for two years now, those same creators have also had to deal with the frustrating rise of ‘dupers’ or ‘copybotters’—players who illegally duplicate their items for profit using exploits.

Theft of a salesman

“It’s very much a big deal,” Oobleck Allagash tells me. He’s the owner of PocketGacha, an innovative HUD-based storefront that works with several designer brands in Second Life to sell their products. Since launching in August, PocketGacha has made “more than tens of millions of Linden” in sales from “tens of thousands” of customers. While many creators in Second Life were vaguely aware that duping was an issue, Allagash became a unifying voice in the community because PocketGacha’s backend system allowed him to track sold inventory across multiple brands and see how widespread the issue was becoming. It’s how he became aware that the Marketplace was frequently featuring items for sale at seemingly infinite quantities and exorbitantly low prices—both telltale signs that they had been duplicated.

A lot of artistry goes into Second Life’s virtual products.

Allagash tells me that, in Second Life, one of the most popular ways to shop is through games of ‘gacha’ or, as its traditionally known in Japan, ‘gashapon.‘ “It’s a game where you have a machine that you play, paying typically about 50 Linden [$0.25 USD] for each go, and you are given either a common item or, if you’re lucky, you’ll eventually get a rare item which is typically more robust in its design,” Allagash explains. “It can be a vehicle or a house, for example.” Some gachas might award makeup or articles of clothing in a complete outfit, while others, like the popular Kunst brand, offer meticulously crafted themed decor.

On the surface there’s little difference between gachas and the controversial loot boxes that are appearing in many games like Star Wars Battlefront 2, but there’s several key distinctions. For one, these items have tangible value. Each play is always rewarded with an item, and any you win can be resold on Second Life’s Marketplace for Lindens and then converted into US dollars. Secondly, the proceeds of these items goes to their respective creators, not Linden Lab (though it does collect a small transaction fee for items sold on the Marketplace). And for those who hate the gambling aspect of gacha games and loot boxes, many creators also offer a buyout price to purchase the set in full.

“It develops sort of a trading atmosphere where people will trade for commons and rares,” Allagash explains. “There’s a whole cottage industry that has developed in Second Life of people reselling a lot of these items that they get.”

In Second Life, some items are ‘copy’ items, which can be copied and pasted multiple times inside of a sim. Most gacha items are different. Called ‘transfers,’ they can only be placed in a simulation once, and if you sell it, it’s gone from you inventory. Like Magic: The Gathering, it’s a market valued by the scarcity of sought-after rare products, and Second Life’s dupers are undermining the whole thing.

“Some bad guys have figured out how to duplicate as many of these transfer items as they want,” Allagash says. “You can duplicate thousands of them, and they have real value on the reseller market.” While the exact exploit is a closely guarded secret, the general idea is that these dupers strategically “crash” a sim, which somehow allows them to create infinite duplicates of an item. Dupers can even duplicate in-game gift cards for various player-owned stores, letting them buy anything for free.

Buyer beware

According to several players I spoke with, it’s been a problem for years that Linden Lab only acknowledged in November after mounting pressure from the creator community. “Recently, we closed an exploit that fraudulent gacha re-sellers had used,” the company said in an update posted on November 2. “Our governance team can now catch them when they attempt the cheating method that we have already fixed.”

Second Life’s creators hoped it would be an end to duping. Inevitably, it wasn’t. I spoke with one creator who requested to remain anonymous. Their brand is one of the more popular in Second Life and it’s become a full-time job that earns them a healthy income. Days after launching a new product line after Linden Lab allegedly shut the exploit down, they found a suspicious listing on the Marketplace offering the entire product line in one bulk package for almost 1300 Lindens less than the competition.

I don’t even like to imagine [the damage to my business] most of the time.

Anonymous

Second Life’s Marketplace doesn’t let customers see metrics like units sold, so this creator and Allagash had to get creative. The maximum amount of quantity that can be purchased at one time is ten, so they began buying up stock to see how much this alleged duper had. It was an impossible amount. During my interview with Allagash, he demonstrated this by sharing his screen with me via Skype. I watched as he purchased almost 40 full sets of this creator’s product line from the alleged duper. He then showed me PocketGacha’s backend tracking system, which operates similarly to any retail store, to show how unlikely it was that one person could have potentially over a hundred copies of this particular item when only several hundred had been given away through the gacha game.

Making matters worse, this alleged duper was the most popular listing for these particular items on the Marketplace, effectively tanking their value. “The damage is huge,” the anonymous creator tells me. “I’m the one paying for the subscriptions for the programs to create my products, I’m paying for marketing, I’m paying for the cost of running the sims—everything to keep my business going. Then there’s the emotional and time investment into the work. The amount of time it takes to make a gacha release, for example, can lead to 16-hour days. I don’t even like to imagine [the damage to my business] most of the time. Over a day or two it might just be a hundred dollars maybe, but over years…”

A screen capture of one alleged duper selling items for well below their going rate.

One thing that isn’t clear is what these dupers hope to gain, but Allagash and the creator I spoke to both insist it has to be real-world money. “They’re clearly not just doing this to be able to have fun in Second Life. They’re making significant money,” Allagash tells me. Because Second Life’s virtual economy is susceptible to money laundering, Linden Lab has a strict process for withdrawing US dollars. Allagash says that if it’s possible these dupers have found ways to undermine the game, it’s plausible they might have found loopholes in withdrawing their money too.

Creators aren’t the only ones finding it hard to compete with dupers, either. As Allagash tells me, Second Life has a massive economy of professional resellers. These players gamble on gachas and then sell the items they receive to ultimately turn a profit themselves. It can be a very lucrative business, according to one reseller—until dupers get involved, that is. “When [dupers] steal designs to sell I no longer invest in a set, depriving the creator of money,” Sushnik Samas, a reseller, tells me. “The expected return on a copied set plummets. Others may not be quite as scientific as I am, but surely realize they are bleeding money and also stop playing a set giving the thief free reign on the copied virtual goods.”

A history of being duped

Wanting the perspective of someone whose livelihood wasn’t impacted by this, I reached out to Wagner James Au, a tech consultant and owner of the prominent Second Life and virtual reality blog, New World Notes. He tells me that, despite the outrage, the problem of duping is largely contained within the niche of gacha sellers. “For one thing, only a fraction of the total [Second Life] economy is based around the web-based Marketplace—most active SLers prefer to conduct many or most transactions in-world, since it’s a more seamless, immersive experience.”

This is just one more chapter in Second Life’s long history of intellectual copyright theft.

Au goes on to explain that this is just one more chapter in Second Life’s long history of intellectual copyright theft. Since 2006, players have frequently found their virtual products stolen and duplicated in a number of ways, which “inevitably (and usually belatedly), Linden Lab tamps down with some increased whack-a-mole against infringers, and the outrage is shunted elsewhere.”

But even Au agrees that while duping might not be killing Second Life, it’s still an issue. “Linden Lab has not been transparent or sufficiently responsive to duping issues like this, especially when many people’s literal livelihood depends on their responsiveness. The fact that the [Second Life] virtual economy as a whole is more or less doing well doesn’t change that.”

Speaking with Allagash and the others affected by this, Au’s statement echoes their frustrations: Dupers are to be expected, but Linden Lab needs to improve. The company employs measures to protect its creators’ rights chiefly through a DMCA filing process and an internal abuse reporting system. The problem, as Allagash tells me, is that neither of these systems is very efficient.

“The DMCA report is managed by an outside company will take this particular thing down faster than an abuse report,” Allagash tells me. “So what happens in this sort of spider web is that the DMCA report will take [the Marketplace listing] first, which is immediately helpful for that creator. But after the DMCA report takes it down, there’s no [evidence for the abuse report] and so Linden Labs does nothing. The person isn’t banned, there’s no punishment. They come right back and do it again.”

For the creators who are, in many ways, the lifeblood of Second Life, it’s immensely frustrating since both systems can take days or weeks to produce results. “I feel like they see the DMCA as the end-all to the problem,” the anonymous creator told me. “And in some sense, it is—the item is removed from sale. But the problem is that someone can just make a new account and upload the item again. It’s [Linden Lab’s] follow through with repeat offenders that is lacking, and it’s their unwillingness to comment or work with us on it that makes me feel not valued as a creator.”

Linden Lab, however, feels differently. “We take the protection of SL content creators and our community very seriously,” Peter Gray, who was Linden Lab’s senior director of global communications until departing the company during the writing of this story, told me via email. “We do not share metrics on account bans, but can confirm that we have permanently closed a number of accounts for this activity and are committed to vigorously pursuing any violation of our Terms of Service and Community Standards.”

“Unfortunately, it’s not uncommon for bad actors to move onto new methods. We are engaged in an ongoing pursuit of cheaters and continuously closing loopholes and working to protect our creator community,” Gray added.

When asked about the specific actions creators could take to protect their intellectual copyright, Gray said, “We follow the DMCA take down process as prescribed by the law. Abuse reports submitted by users are normally reviewed within 72 hours, although the process may take longer in some cases, depending on the type of report and information provided. We cannot comment on specific accounts, and therefore users who submit abuse reports are not notified about actions taken as a result of their reports. Unfortunately, that may lead some users to feel as if their reports may be ineffective, even when they actually result in account bans and other enforcement actions.”

But that’s not good enough for many of Second Life’s creators. While the MMO is often passed off as an aging game with a limited playerbase, CEO Ebbe Altberg told Motherboard in an interview in 2016 that 900,000 players still log in monthly. And for those who have turned their passion for it into a full-time job as a virtual designer, it’s easy to see how the continuing theft of their hard work is so damaging. “We just want our work to be protected,” the creator tells me. “In the age that we live in, it’s a basic right on the internet—I would hope.”

ZoHa Islands 10 Year Customer Appreciation SALE & Celebration Starting October 27th!!

As many of you know ZoHa Islands is celebrating its tenth year in business with a celebration on October 27th from 1 PM SLT to 11 PM SLT with 10 live performers and a plethora of wonderful raffles and prizes to win! More info about the event can be found here. There will be a prize given each hour for TEN hours straight!

ADDITIONAL LAND SALE!!  SALE!! SALE!!

Starting October 27th, we will be holding a land sale that will benefit all existing ZoHa Customers seeking extra prim!

Additional Full Prim region parcels and sims will be 20% off list prices.
Additional Homestead region parcels and sims will be 10% off list prices.

This sale includes 20% off full prim sim land – this includes 20k (15995L/week with 20% discount) and 30k (17595L/week with 20% discount) prim sim regions AND PARCELS.

Homestead region parcels and sims will be 10% off list prices.  This means Homestead sims for 6925L/week!

Have a friend to refer?
Refer a friend and have them speak to an agent today!

Are you wanting to return to ZI after a nice long summer away in RL?
2 weeks down gets you the same deal. Come on over and speak to an agent today!

New to ZoHa Completely?
Speak to an agent today!

Please find a list of standard pricing here that discounts maybe applied to.

ATTENTION:
Speak to a sales agent BEFORE buying your additional land to get this promo!

 

Bright Canopy — Replacement for Onlive!

BREAKING NEWS! SLers who were sad to see Onlive go, now have another option!!

Remember OnLive? The company that brought you the streaming service which gave you the ability to run SL on older computers? Well there is a new kid on the block named Bright Canopy and they’re aiming to fill the void left behind by OnLive!

Released in the last weekend of August, Bright Canopy is offering SL streaming services for $17 for 20 hours. Additional time costs $0.02/minute, and each session is charged for a minimum of 30 minutes. Their high performance spec servers will stream SL to you through your web browser with ultra high graphics and no visible lag!

According to the Bright Canopy blog, this is how the pricing system works:

“If you sign up for Bright Canopy, you will be charged $17. You will receive 20 hours of server time. Once you have used that time, if you continue to use the service, you will build-up overage time at $0.02 per minute with a minimum purchase of 30 minutes ($0.60). If you use less than 10 more hours, your card will be charged for those additional minutes (plus the $17 for the new month’s subscription) at the beginning of the next month. If you use 10 or more hours of additional minutes before the end of the month, those minutes will be charged immediately.

“So if you use 5 additional hours during the month, you would spend $6 more. This would mean your credit card would be charged $21 at the beginning of the next month. If you use 10 additional hours, you would be charged $12 now and $17 for your monthly subscription at the beginning of the next month.”

This is exciting news and good for those who have older machines, or who wish to stream into SL from a computer that just can’t quite handle the load SL requires. The burning question is: Does Bright Canopy run on mobile devices? The company has stated on their website that mobile is not available yet, but it is coming. Here’s a quote from the website:

“We understand how important mobile support is for many people, and we do have a plan to provide it. We already have clients which will run on mobile devices, but the Second Life Viewer and Firestorm will need modifications to support multitouch. Our plan is to create these features and donate them to the top level open source viewer project, making them available for all viewers.

Right now, we are focusing on the Chrome browser on non-mobile devices (eg. laptops and desktops) so that we can get that right. Then we are working on providing a monthly plan. Once we have those in place we will begin working on mobile.”

I decided to try it out. I’m at work right now in RL, and our computers at work don’t have the graphics capability to run the regular Second Life viewer. So I eagerly signed up for an account using my Second Life user name and email address to create an account. I then ponied up my money ($17 for 20 minutes).

I was so excited to check it out that I really didn’t read the fine print. As I was trying to connect to the Bright Canopy servers (a message pops up as you are waiting to log into the Frame launchpad that Bright Canopy uses, that basically tells you that you cannot “bank” time from one session to the next. Clearly this service isn’t nearly as user-friendly as Onlive, because if I log out prior to my 30 minute time, I lose any remaining time. Hmmmm. Also, after I logged into Bright Canopy and paid, the screen that came up said “waiting to connect to Frame” and said I had 3 minutes remaining. It ended up connecting me after less than 3 minutes but I probably waited about a minute and a half. I’m not sure if they were waiting for space on their Cloud-based server, but it was only slightly annoying to wait.

Then it offers you the choice of using the SL Official Viewer interface or the Firestorm. Since I’m a Firestorm junkie, I chose the Firestorm option. It logs you into SL and looks exactly like it does in your viewer window. However, since I went back to type some more in this blog about my observations, it logged me out since I’d been inactive for 10 minutes. I had to log out of Bright Canopy and log back in. So be careful of long AFKs.

I found when I logged into my home in SL, I was experiencing a great deal of lag. I turned my graphics down a notch (I usually operate on Ultra, so I went down to High) and that seemed to improve things. Our work computers really don’t have much in the way of resources, so that could be part of the problem. I tp’d around to different places and found lag to be better and worse depending on the location. It’s not perfect, but it is an awesome way to be able to access Second Life from a computer with limited resources.

It will be great when they get their mobile app going!

Check them out! Click here for the website: Bright Canopy

I remain respectfully yours,
~ Suzanne Piers, ZoHa Islands Blogger/Social Media

Giftbot Discount Scam in Second Life

It never fails to amaze me at the lengths people will go to get something that doesn’t belong to them. How these people sleep at night is beyond me. But sure as the sun rises in the east, if there is a way for a scammer to get your money, be it real life dollars or Linden dollars, they will do it. Strawberry Singh recently blogged about a scam (that’s a clickable link) that is going around SL right now called the Giftbot Discount Scam.

Strawberry landed at Glam Affair and as soon as she landed there, she received an object from a one day old Second Life resident. The object was supposedly a discount object that claimed it would give her 60% off at Glam Affair, where she had just landed. Apparently many merchants have been complaining about these giftbot avatars that send these kinds of things to their customers as soon as they land on the sim. It’s basically an object and once you wear/attach/rez it, you get this kind of message asking you to give it access to your linden dollars:

gift bot

Because people have received this object that is supposedly for the store where they just landed, they trust the object and accept without really reading. Too late, they realize that the bot script has stolen all their lindens. Every content creator tries to make sure their customers have a pleasant shopping experience and their sim is a safe place to shop. These kinds of things can make that difficult.

Strawberry goes on to say:

“Unfortunately there is not much the content creators can do aside from letting Linden Lab know about the account and banning it from their sim. However, . . . it’s futile since these are bots and a new one is created by the culprits within minutes to replace the banned one.

“If this sort of thing happens to you, these are the steps that you can take:

• Deny/Delete Object: Immediately deny or delete object without attaching, rezzing or wearing from your inventory.
• Report: File an Abuse Report against that resident/bot right away to make Linden Lab aware of it so they can take the appropriate action.
• Block: Block/Mute that avatar/bot right away.
• Inform Sim Owner: It might be a good idea to also let the sim owner know, even though they cannot do much else but ban from the sim.

“Most of these bots that you may encounter on popular sims will be named ‘shopsdiscount’ or ‘giftbot’ or something similar. So if you encounter an avatar like that, especially if they are only a few days old, please don’t accept anything from them. However, be aware that the names change frequently, it’s not really the name of the avatar that matters. What matters is the entire idea about this discount/free gift scam that you need to be aware of , watch out for and also tell your friends and family about. We don’t need more people losing money to these scammers.

“Hopefully if you ever experience this kind of script asking for permission to access your lindens, you will make sure the source is a legit one and you will read it carefully before accepting because this kind of message and script is used legitimately in certain situations. [There are some] instances in which you may accept giving permission to access your lindens:

• If you are a shopper, certain vendors that have shop at home HUDs sometimes require access.
• If you are a merchant and setup a certain type of vendor, you may need to give access for various reasons such as: to give refunds to your customers in certain situations.
• For a vendor at an event or rental sharing percentage with landlord.
• For different charity or partnership vendors.
• If you are a DJ, perhaps you may need to give access to a tip jar if you are splitting tips with club or host.”

There are certain legitimate situations where this kind of script for giving access to your lindens is acceptable. Just keep in mind that these scams are out there, and if you do not 100% know what the thing is and where it came from, and are not entirely certain it is legit: DO NOT ALLOW! It’s just not worth the risk! When in doubt, throw it out!

I hope this raises your awareness of this latest scam. We all need to watch out for one another and pass this information along so that hopefully these scammers will no longer have victims in Second Life.

I remain respectfully yours,
~ Suzanne Piers, ZoHa Islands Blogger/Social Media

JD’s Rendezvous Provides Venues!

Awhile back, I blogged about Dori Helstein’s art gallery, where she featured amazing SL photographer Rhy Breil.

Well Dori has come up with another wonderful idea! Just across from her art gallery, Dori has opened JD’s Rendezvous, where they offer three different themed venues that you can rent out for parties, receptions, weddings, and so forth. This is a well-put together location and meets almost any need for parties in SL. Guests are limited to 30, and you can hold your birthday, rez day, engagement, or any other type of party.

When you land, you will receive a notecard with information about the venues and a reservation form to fill out and return. Your event fee includes a DJ for your party. One of the perks of having your event here is the ability to have a closed party, so unwanted guests do not crash your party. Below is the information from the notecard:

JD’s Rendezvous is dedicated to providing SL residents with a location where they can hold private parties for up to 30 guests as well as a DJ who is provided specifically for that event. Customers can reserve one of three themed venues at JD’s Rendezvous (Interlude–Jazz and Romantic; Silver Rock Cafe–Oldies 1950’s-1980’s; and The Mustang Club–Country Music) for 2 hours at a flat rate of 3,500 L$ (per venue reserved).

Only invited guests will have access to the reserved venue. To assure such privacy, JD Rendezvous management needs to have the complete guest list no less than 24 hours prior to the event. The venue will only admit those individuals who are on the guest list for the two hour duration of the event. Once the event is over the venue will be open to the public and streamed music will commence. Guests can thus stay longer to enjoy the evening and company; however, so can members of the public who may come into the venue.

JD’s Rendezvous is honored to be able to provide leading professional SL DJ’s for these private events. Because the DJ’s are compensated for the event by JD’s Rendezvous, tipping is not allowed. However, they have scheduled appearances in public venues, so please feel free to ask them for their schedule of appearances. The DJ will perform at the venue for the two hours of the event.

JD’s Rendezvous wants to provide a safe, fun, and engaging event for all of our guests. The sim where we are located is PG and Mature only. In keeping with this and the rules of JD’s Rendezvous management, nudity, sex, violence, harassment, griefing, or attempts to abuse guests, the public, or property, will result in the immediate expulsion and banning of the offending individual by management.

ADDITIONAL SERVICES
JD’s Rendezvous will provide you with invitation cards with the name of the venue and any message you may want to add to the card for your guests. The card will have the landmark of the venue which your guest can obtain by clicking on the card. An announcement board, which will be a copy of the invitation card, will be placed in front of the venue next to the landing point for your guests.

CONTACT
Dori Helstein, Business Manager & Builder/Designer of JD Enterprises Ltd. Please contact Dori Helstein concerning reservations or any other matter regarding the venues. To make certain we receive your inquiries please send notecards.

Here are some pictures of the venues:

JD's Rendezvous Courttyard

JD’s Rendezvous Courttyard

JD's Rendezvous Courtyard

JD’s Rendezvous Courtyard

Interlude Exterior Romantic Jazz Theme

Interlude Exterior
Romantic Jazz Theme

Interlude Interior

Interlude Interior

Interlude Interior

Interlude Interior

Mustang Club Exterior Country/Western Theme

Mustang Club Exterior
Country/Western Theme

Mustang Club Interior

Mustang Club Interior

Mustang Club interior

Mustang Club interior

Mustang Club Interior

Mustang Club Interior

Silver Rock Cafe exterior 50's Diner theme

Silver Rock Cafe exterior
50’s Diner theme

Silver Rock Cafe Interior

Silver Rock Cafe Interior

Silver Rock Cafe Interior

Silver Rock Cafe Interior

Silver Rock Cafe interior

Silver Rock Cafe interior

I encourage you to come by and check out these locations.

Here’s the SLURL (click on the link): JD’s Rendezvous Landmark

I remain respectfully yours,
~ Suzanne Piers, ZOHa Islands Blogger/Social Media

VR With Eye Tracking!

High Fidelity announces the ability to track eye movement in a modified oculus rift headset!

They released the following statement: “We believe that eye tracking, with it’s potential for both enhancing live communication and controlling/interacting in VR environments, is very likely to be a part of second generation HMD’s. So we’ve gotten a pair of custom Oculus DK2s modified by SensoMotoric Instruments to include hardware capable of fast, accurate tracking of the eye. This video shows the first results. The experience of making eye contact with another person is remarkable and can’t be described in a video – but you get the idea.”

I remain respectfully yours,
~ Suzanne Piers, ZoHa Islands Blogger/Social Media