News and Updates

Archive for the ‘Security’ Category

Revised Update on Obtaining Metrics From Fresh Victims

Friday, June 5th, 2020

In April we made an update to Bloodlines to try to prevent gaming of the stats through the use of alts. We noticed that some people were obtaining unlimited metrics by registering thousands of alts and using them only for the metrics obtained from the first attack on a fresh victim. Obviously, this is grossly unfair to everyone who plays the game honestly without farming alt accounts. The metrics obtained from fresh victim attacks are meant to be a reward that you get for hunting, not something that gets farmed from alt accounts. In April we made it so that in order to get the metrics from an attack on a fresh victim, you had to have payment info used on your account (used as an indicator of a real, unique account and not an alt), and metrics from fresh victims were limited to 50 attacks per day.

We’ve realized that these limits have been inadequate, and alt farmers continue their practices despite these limits. So, unfortunately, in order to keep the game fair to everyone, we have removed the above limits, and put in place a different limit. We’ve just issued an update so that attacks on fresh victims don’t provide metrics to the attacker until the soul is transferred. When the soul is transferred from a new person to an attacker (either the first attacker, or the first attacker after a Wormwood potion is used), the metrics from the first bite are also transferred at that time. If your metrics are full at the time that this transfer takes place, they will go into your metric reserve instead, and can be obtained from a refill station. This has the additional benefit of removing the previous arbitrary limits. Now, your payment status is no longer a factor, and there is no limit on the metrics you can get from fresh victims in a day.

Ideally this will be the last change we need to make. Thanks for your patience while we’ve struggled with these bad elements. The game should now be more fair for everyone.

SL Rolling Restart Issues

Wednesday, June 14th, 2017

UPDATE 12:38PM: We discovered the issue (an unlisted change LL made in the server user agent prior to rolling restarts) and have resolved it!

All vendors and servers should be working fine now. If you have any lingering issue or concern, please nc LiquidDesigns Resident.

Thanks for your patience!

~~~~~~~~~~~~~~~

Hello everyone – just a heads up, today’s rolling restarts seem to have created some issues with the vendors. Any sim that is rolling restarted by LL, the vendors end up spamming messages and not reconnecting / functioning properly.

We’re working on resolving the situation, but until we do, if you encounter vendors that are exhibiting strange behavior (affiliate or on our sims) please refrain from purchasing on them and go to a sim where they are fine.

Currently our own sims that are being affected are:

Bloodlines West  *(resolved)

We’ll update this blog post as we get the situation sorted out! Thanks for your patience.

Safely Purchasing Used Blood / Lumen Containers

Friday, March 10th, 2017

Every few years there seems to be a rash of scammers that try to defraud BL players; lately there seem to be some fake tanks making the rounds.

We thought it’d be good to re-post the link to one of our previous entries about how to avoid fraud, and as well we’ll be posting the names of fake tank sellers here as updates, in case that helps you avoid or report them.

Thanks to everyone who’s been helping stay on top of this, and be careful out there when buying second hand items!

Known Fake Tank Sellers:

melissa18100 Poza

lady45 Resident

Dianabelle00 Resident

christelle000 Resident

pikpik Resident

vicvalentine Resident

There may be more out there of course, so just because someone’s name isn’t on this list doesn’t mean they’re safe! Do your due diligence and learn to buy safely:

Avoid Fraud: How to Buy a Blood Container

Keep your Second Life Account Secure

Wednesday, November 11th, 2015

Recently, we have gotten some reports of Second Life accounts getting taken over and their Lindens and /or Bloodlines assets transferred to other accounts. Many refer to this as their account getting “hacked”, but it is more likely that they are getting phished, brute-forced, or their passwords simply guessed. Accounts are not getting compromised “through” Bloodlines or because of Bloodlines. There is absolutely no way that someone could gain access to your Second Life account through your Bloodlines account. The Bloodlines system does not interact with your Second Life authentication in any way.

Regardless, there are a few easy, simple things you can do to make sure this never happens to you. Keep in mind that we are not talking about your slbloodlines.com account here, or your account on this blog, we are talking about the authentication you use to log into the Second Life viewer.

  1. Make sure your password is strong, and is not anything remotely related to your name, or any word, or anything that remotely makes sense. Make sure it is long, includes numbers, symbols, and both capital and lowercase letters. If your name is Wilson, “wilson” is a bad password. So is “w1ls0n5”. Your password should look something like this: “FSm%9G*NxrZM#C”. Yes, it’s inconvenient to have a password like this, but so is getting all of your stuff stolen.
  2. Never give your password to anyone.
  3. Really, never ever give your password to anyone, for any reason. I mean it.
  4. NO, not even your girlfriend, boyfriend, wife, mother, son, or siamese twin. Nobody. Never, never, NEVER give your password to anyone!!!
  5. Ok, now that that’s out of the way: DON’T CLICK ON LINKS POSTED IN GROUPS OR IN ANY CHAT ANYWHERE IN SECOND LIFE! Once again, if someone posts a link to something in Second Life: DO NOT CLICK ON IT!!! This is how you get phished, someone will post a link to a “marketplace” listing that you think goes to marketplace.secondlife.com, but it really goes to marketplace.secondlife.phishingsite.com, which looks just like the sl marketplace, and is designed to capture your login and password (once you type it in), so then they can log in as you and steal all of your stuff. In this example: marketplace.secondlife.phishingsite.com, “phishingsite.com” is the domain you’re going to, and marketplace.secondlife has been set up as a subdomain there. Anyone who owns a domain can set up any subdomain they like on it. Make sure you look at the domain right before the “.com” to see what the real domain is that you’re visiting.
  6. Don’t type your password into anything except a trusted Second Life viewer, or into the website secondlife.com, after you have manually typed secondlife.com into your browser window, and made sure that the last thing before the first “/” in the URL is “secondlife.com”, and not “secondlife.somethingsomething.com”. A good practice is to never type your SL password into anything unless you manually typed the URL into your browser.
  7. Don’t worry so much about people getting your public IP address. This tells them very little, and everything you do on the internet exposes your public IP address in some way. This is not how they are getting you. They are getting you because you are doing something like:
    1. Having an insecure password that is easy to guess.
    2. Giving your password to someone.
    3. Clicking on links in chat groups.
    4. Typing your password into sites that you clicked on from chat groups.

On top of that, if someone comes to you saying they are “quitting Second Life” and want to sell you all of their souls and containers, it is likely to be a scam. If someone tells you this, and you buy all of their stuff, and then we find out later that the account had been taken over by someone else, we are going to return everything that you bought from them. If someone is offering a large dump of resources like this, it is a good idea to contact their liege and confirm it with them, or someone else in their clan who knows them. Something else you can do is give them a waiting period, tell them you will buy it in 3 days if everything is still for sale, and report it to Lyle Maeterlinck, and we can check on it. If the person is truly quitting Bloodlines or Second Life, then they shouldn’t mind if we lock their Bloodlines account for 3 days to make sure that the real account owner doesn’t come back. If you’re really quitting Bloodlines or Second Life and want to sell all of your stuff, contact Lyle Maeterlinck first, and I can lock your account for a waiting period to make sure the real account owner doesn’t come back.

If someone asks you to transfer money outside of second life through Paypal or a bank transfer or any other way, it is almost definitely a scam. Don’t do this.

Given all of this, we can never guarantee or be held responsible for third-party transactions. If you are buying containers directly from us, we absolutely guarantee them, but if you are buying souls or containers from anyone else, there is a risk involved. Be careful, take things slowly, and use good judgment. Feel free to contact me directly in Second Life (Lyle Maeterlinck), or comment on this post if you have questions.

Beware of Fake Affiliate Vendors

Tuesday, February 11th, 2014

It has come to our attention that someone has copied the prims and textures of our affiliate vendors, and is passing them out. The fake vendors don’t contain our scripts, but they do contain a script by someone else that asks for permission to take Lindens from your account when you rez the vendor. If you grant permission, it will drain your account of Lindens, and then self-destruct.

No one is authorized to hand out Bloodlines affiliate vendors, and real vendors do not have transfer permission. If someone hands you Bloodlines affiliate vendors, they are fake, and will probably try to drain your account. The only place you can get real Bloodlines affiliate vendors is delivered in a crate from our in-world servers in response to you requesting them from the vendors on Liquid Estate. The servers that the vendors are delivered from are all owned by Mars Bracken, and the vendors themselves will be listed as created by Mars Bracken.

If you have fallen victim to this scam, please check your transaction history by logging into secondlife.com, and find the name of the person that your money was sent to, and file an abuse report on that person for Fraud > L$. Be as detailed as possible in your abuse report.

If you have any questions, please feel free to contact Lyle Maeterlinck directly. Be careful out there!

Privacy Concerns

Wednesday, April 4th, 2012

Some people have been expressing concerns regarding privacy when logging into the slbloodlines.com website. There have been some unfounded rumors going around, such as that the new Bloodlines HUD “logs your IP”, which is false. It may be possible for some items within Second Life to get access to your IP address using shared media, depending on what viewer you’re using, but no Bloodlines item currently uses shared media features within SL. For more information on shared media and what you can do to protect your privacy, see this linden blog post on shared media. The website does collect hardware and software information when you log in for the purpose of maintaining sessions between the server and your client (browser), but this is not different than any website that you can log into. Keep in mind that you are not required to log into the website in order to play Bloodlines. The reason we created the website logins is to deliver cool new features like profile photos, customized profiles, clan profiles, and a richer way to interact with each other on the website. In order to provide these features, we need to put authentication in place, so that only you can edit your own profile. You have the option of logging into the website if you want access to these upcoming features, but it is by no means required.

Some have also expressed concerns about privacy when changing their password in-world. Also, some people have been trying to log into slbloodlines.com with their Second Life password. Do not try to log into slbloodlines.com with your Second Life password, it won’t work. We don’t know what your Second Life password is, and can’t authenticate you with it. Your password for slbloodlines.com is a different password that you create with your HUD by going to Settings > Account > Register. Right now, when you change your password, you do it over chat on a randomly selected channel. It is technically possible for someone to hear this password if they have a channel scanner. So, we advise you to only change your password when you are out of chat range of other avatars. We will be issuing another update soon that will make an attempt to make this process more secure. Please do not make your password for slbloodlines.com the same as your second life password; use a unique password. We don’t store passwords in plain text, we only store passwords as encrypted hashes, so not even we can see the password you have chosen, and if an attacker were to gain access to our database, they would not have the passwords you have chosen either.

We take your security and privacy seriously, and we take measures to keep your information as secure as possible. If you have any questions about privacy or security, please see our privacy policy, or feel free to contact Lyle Maeterlinck in-world with questions.

Warning: Never Buy Blood or Lumen Containers on the SL Marketplace

Wednesday, January 5th, 2011

All of the blood containers being sold on the Marketplace are fake or deactivated copies. If you buy a deactivated container on the Second Life Marketplace, we cannot help you. We do not sell official containers on the Marketplace, because as long as copy exploits still exist, we have to have containers rezzed and registered in-world before we can sell them. The only place to buy guaranteed blood containers is in the Bloodlines stores on the following regions:

Liquid Designs

Liquid East

Liquid Badlands

Liquid South

If you are anywhere else, you are buying a container that we cannot guarantee will work. ALWAYS test containers before you buy them. NEVER buy containers on the Marketplace, because it is not possible to test them first. Please see the procedure for how to test a blood container before you buy. Also, this is what to do if you have a deactivated container. Please be careful!

UPDATE: If you do end up buying a deactivated container on the SL Marketplace, please write a review on it saying that it is a scam, and warning others not to buy it. Also, please file an abuse report for fraud on the person who sold you the tank. You can get the name of the person who sold you the tank through your transaction history.

New War Weapons and War Updates

Tuesday, August 10th, 2010

We’re pleased to announce a release date for the new Bloodlines: War weapons. The Handgun, The Sword, and The Flamethrower will be released one week from today, on Tuesday, August 17th! The Handgun has a ‘silenced’ mode so that you can have a gunfight anywhere in Second Life without rezzing bullets and creating collisions with other residents. You can also use this silenced mode in areas where you don’t have permission to rez objects. Both the bullets and the sword contain blood effects when they make contact with other Bloodlines War players.

We will also be updating the Health Serum and the Mine so that they are no-transfer. We regret having to do this, but there are a small group of residents who have permissions-cracked versions of our transferable items, and sell them at below cost. As a result, we have to update all of our transferable items to be no-transfer, and we will not be releasing any more transferable items. So, you have one week to use up all of your current health serums and mines (a great excuse to create a nice big minefield), because after 8/17/10, they will no longer work. If you still have any mines or health serums left over after this date, you can trade them in for the new versions. If you see residents selling any health serums or mines for very low prices, please don’t buy them, they are counterfeit. We are only able to trade in mines and health serums if you originally purchased them directly from us, and not from a reseller. We can’t guarantee any item that’s purchased from a reseller. You must seek a guarantee from the avatar you’re buying from.

If you need to trade in your items, please observe the following procedure:

  1. Items must be placed in a folder, and NAME THE FOLDER WITH YOUR NAME ONLY. To do this, go to your inventory, and select New > Folder. Right-click on the folder and select ‘Rename’, then type your avatar name. Drag and drop your items into this folder.
  2. Please don’t name the folder with any text other than your avatar name. Including additional or different text will delay your trade-in.
  3. Include a note card with a copy of your transaction history for the purchase. You can get this by logging into your account on Secondlife.com, then going to Account > Transaction history, and copying and pasting the transaction information into the notecard. Drag the note card into the folder with your name on it.
  4. Pass the folder to Noire Luminos, but please do not start sending in mines or health serums until after they are deactivated on 8/17/10.

We appreciate everyone’s patience while we worked on the new War Weapons, and for your patience with the item trade-ins. We have more exciting Bloodlines additions that will be released in the coming weeks, so check this blog often for updates.

Warning: Do Not Buy Amulets From Other Avatars

Sunday, October 18th, 2009

We have discovered avatars selling counterfeit Infinity Amulets. If anyone tries to sell you an Infinity Amulet for less than the price of $7999, it is definitely counterfeit, and will be deactivated, and you will probably not get your money back. There is absolutely no legitimate reason for anyone to be selling an Infinity Amulet for less than $7999, as there is no legal way to get one from us for less than that price. Infinity Amulets only work for the first person to wear them, so there is no way for someone to use it for a while, then sell it for a lower price. The item is transfer, but the protection it gives is not.

If you have purchased an Infinity Amulet for less than this price from anyone, your best bet is to come forward to us and let us know who you bought it from, and for how much. We’ll do our best to help you, but only if you’re honest with us. If anyone offers or has offered to sell you an Infinity Amulet for less than $7999, please report their name to us right away. If you want to buy an Infinity Amulet, make sure you buy it yourself directly from a vendor. If you legitimately bought an Infinity Amulet from one of our vendors, you have nothing to worry about.

Avoid Fraud: How to Buy a Blood Container

Friday, March 6th, 2009

Below is a procedure you can use to help make sure you don’t buy a tank or cask that doesn’t work or has been deliberately removed from the system by us when an account is terminated.

1. Check to see if the avatar you’re buying from has an active Bloodlines account. Type their name into the search box on www.slbloodlines.com, and if you can’t find their page, don’t buy from them, regardless of what excuses they give you.

2. See if the container in question appears on their Blood Cellar page. (Make sure that if you’re buying a full 20 L cask, that you see at least one full 20 L cask on their blood cellar page. If there isn’t one, don’t buy it.) You can get to their Blood Cellar page by clicking on the blood container icon on their profile.

3. Check the creator of the object – including the linked prims! This isn’t foolproof, because scammers have found ways to repurpose Mars Bracken prims to link as the root, but have the seller rez the container in front of you. Right-click on it and select ‘edit’. Your build tools window should open. Look on the “General” tab, and make sure the creator is Mars Bracken on all the prims (or Voluntas Blackburn or Lyle Maeterlinck, other BL creators) and that the owner is the name of the avatar you’re buying from. Again this one isn’t 100% foolproof, but often times you can spot a fake this way.

4. In the build window, go to the ‘Content’ tab, and make sure that the container contains a script called ‘Bloodlines Blood Container’ for pre-version 5 containers, and for new containers, look for scripts named “_1_container_api_[version]” and “_2_container_operate_[version]”.

5. Have the seller set the container to open access and fill/drink mode. Once they’ve done this, when you click on the container, you should get a menu with ‘Fill’ and ‘Drink’ buttons.

6. Fill the container with 0.1 L of blood. (If the tank is full, then drink 0.1 L). Make sure that the blood comes off of your vital blood and goes into the container. The best way to check this is by looking on your own Bloodlines profile, and on the Blood Cellar page of the avatar selling the tank. Make sure that your vital blood dropped by 0.1 L, and that the amount in the tank went up by 0.1 L (or vice versa if you drank instead of filled). If this worked, the tank is good.

7. Now, if you’re ready to buy the container, DO NOT pay the avatar directly and have them hand it to you. Don’t take your eyes off of the container that you just checked. Have the seller set it for sale at the agreed price, and then right-click it and select ‘buy’. You will now be the owner of the container.

General tips:

  1. If they’re selling it in the Bloodlines store, NEVER buy from them. Selling blood in the store is prohibited. Please report them to us.
  2. If you see anything funny happen after you check the container, check it again.
  3. Don’t let them rush you. You’re the one that stands to lose if this deal goes bad. Take your time, and if you’re not certain it’s good, don’t buy it. If they’re in a hurry, ask to meet at a better time for them.
  4. Don’t let them talk you into any other custom procedure, no matter what explanation they give you. In fact, if they try to talk you into anything else or convince you of anything, it’s a good sign that they’re scamming you.
  5. If they say they work for Bloodlines, or that they’re friends with the creators, or that Bloodlines or the Lindens certified their tanks, they are lying to you.

If they give you any trouble or you get a bad feeling about them or anything else, trust your gut and don’t buy it.

If you do end up buying a tank that doesn’t work, I’m sorry, but we won’t be able to replace it for you. Here is the action you can take:

1. File an abuse report on the person for Fraud > $L. We’re not sure that they will be able to help you, but it’s worth a shot.
2. Send us their name so we can possibly take action against them, including but not limited to: banning them from our land, draining and deregistration of additional blood containers and termination and destruction of Bloodlines account(s).

We want to support the blood trade, but we take theft and fraud very seriously, and we pursue blood thieves and frauds to the extent that we are able.