Rainbow Viewers for Virtual Worlds

[Updated] 7 Mar

We all remember the drama around Emerald, Onyx, CDS and there demise. But this seems not to have been enough to encourage LL to make necessary changes, and enforce their ToS. zF RedZone is a very similar system like ModularSystems/Gemini's Onyx/CDS and in clear violation of SL's ToS, particularly section 8.3:

You agree that you will not post or transmit Content or code that may ... invade other users' privacy.

Business as usual here, ignorance from Linden's side and there will unlikely be any change to this. As Psyke Phaeton wrote in SLUniverse, we can not force LL to make changes, but we can evolve as users, it is "our world, our imagination" and we can get rid of the bad apples. Or try at least.

If you still don't have a clue what this is all about, zF RedZone is a spyware system that collects your user and usage data in SecondLife, puts them in an external database out of anyones control, to do all kind of fancy, not working, buggy, flawed and faulty data mining to supposedly identify copybotters, alts, your IP address, your ISP, your neighbour, your address, god knows what. It's obviously a lucrative enterprise, given the price and the amount of deployed aka rezzed RedZones around the grid.

I can not repeat here again what many others have said many times before, it is a black hole . Tons of information are available, please educate yourself and help to educate the ones who still believe in such snake oil. It harms us all, and benefits only one single person, the snake oil creator.

So, having written that, here is what this posting is all about and how to get rid of and kill RedZone once and for all. It's fairly simple, and thanks to http://no2redzone.wordpress.com everybody should be able to make the small changes that render the spyware useless (which it is anyway ) in a blink of an eye.

Just add the following entries to your hosts file

127.0.0.1 isellsl.ath.cx
127.0.0.1 isellsl.com
127.0.0.1 zfire.isellsl.com
127.0.0.1 girlsofthevip.com
127.0.0.1 hamlinpro.com
127.0.0.1 syscast.net
127.0.0.1 media.syscast.net
127.0.0.1 apache2-blow.port-au-prince.dreamhost.com
127.0.0.1 quickware.net
127.0.0.1 www.quickware.net
127.0.0.1 quickware.zapto.org
127.0.0.1 wh0.zapto.org
127.0.0.1 m.sparkgap.info
127.0.0.1 policedepartmentonsl.info
127.0.0.1 sparrowindustries.net

Working hosts for Vista/Win7 (just replace the existing one): hosts

You can find the file here:
WinXP - Win7: C:\WINDOWS\system32\drivers\etc\hosts
Linux: /etc/hosts
MacOS: /private/etc/hosts
(to edit the file you need admin rights)

What it does is preventing the DNS (domain name service) resolution of that website, assign your localhost IP (127.0.0.1) to it and keep everything that it wants to send to this site on your own PC.

His main site is using a free DNS service (ath.cx) and can be changed at anytime. So this may not prevent spying on you in future releases. But it should kill RedZone for now. Also he started redirecting traffic to the .com.

Not sure if girlsofthevip.com and hamlinpro.com also belong to him. They look similarly unprofessional at least . But they are hosted at the same IP (76.104.212.177) that points directly to Redzone.

The anonymously registered domains/URLs syscast.net, media.syscast.net and apache2-blow.port-au-prince.dreamhost.com were supposedly used by CDS. They may not be needed anymore. m.sparkgap.info is highly suspicious and might be associated with CDS or a similar tool. Not leaving it to chance, blocked too.

policedepartmentonsl.info appears to be another data collector hidden behind Redzone and tons of popups.

sparrowindustries.net is used by another CDS / Redzone copycat product that works the same way, and is blocked the same way.

How to block Quickware? The newcomer on the block, not much information seems to be available other than the tool does the same as RedZone, supposedly it scans residents, puts them into a database and correlates data to identify alts. Same story, ToS violation. Quickware is hosted in the Netherlands, with a number of domains linking to one IP: 193.93.174.118. So to block this spyware you should add this IP to your firewall blocks. Adding quickware.net, quickware.zapto.org and wh0.zapto.org to the hosts file may not be sufficient here. If someone can provide an update on how it exactly communicates, please do so.

As I wrote there is a lot of more information and discussion around. Just a number of links, in case you want to get more details about it. I also copy the very good combined writeup from a number of people (Free, Samantha, Ann, Elysium, (Thanks!) here that summarizes it all.

"WHAT IS SPYWARE?

Spyware is a type of malware (malicious software) that can be installed on computers, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's personal computer.

While the term spyware suggests software that secretly monitors the user's computing, the functions of spyware extend well beyond simple monitoring. In an attempt to increase the understanding of spyware, a more formal classification of its included software types is provided by the term *privacy-invasive software*.

Source: Spyware - Wikipedia, the free encyclopedia


SPYWARE AND SECOND LIFE

A number of Second Life products claim to protect content creators from anyone who may 'rip' content illegally (i.e., copybotters). Many do this in part by detecting the type of viewer in use, and then banning individuals suspected of copybotting from locations where the product is installed.

For this to work "well" they need to collect information on EVERY visitor, copybotter or not, and retain it in a database. Both the collection and retention of that data occurs without your awareness, or consent. Data often includes IPs (Internet addresses), and can correlate alt accounts and resident locations.

For these reasons, we consider such products to be spyware.

Further troubling, there are few to no safeguards on how your data may be used or distributed, and little in the way of recourse from Linden Lab in cases of abuse. And despite the marketing, these systems stop only the most casual of copybotters as they have numerous ways to avoid detection, and they're more likely to rip content from locations and avatars beyond where any "protection" systems are run.


PROTECTING YOURSELF

No method is full proof, but there are a few things you can do to try and protect yourself and your information from spyware in Second Life:

1) Keep Parcel-based Media (Streaming music, Media) turned off in your Sound & Media Preferences unless you know you are somewhere trustworthy. Don't access Shared Media (web-on-a-prim) unless you trust the object or person who created/owns it. These can provide the holes which allow your personal information to be captured.

2) Find out if places you frequent use RedZone, CDS, or similar large-scale "copybot" scanning systems. If they do, you can stop patronizing them. You might inform the owners WHY you won't return until they stop using them, but let's stress they see these systems as an attempt to protect their content, not an opportunity to violate your privacy. They may have little idea how they work and surrounding issues. When contacting them, do so *politely*. Send them this notecard, or direct them to one of these locations for more information:

ZF Redzone, Disclosure of SecondLife Alts. - SLUniverse Forums
GreenZone

3) Learn more about these types of products on your own. Take your concerns to Linden Lab. Consider voting for, watching, and commenting on this JIRA:

https://jira.secondlife.com/browse/VWR-24746

4) And spread the word. Send this notecard to friends. Blog about the issue. Knowledge is power.

(The U.S. The Do Not Track Me Online Act, introduced by Rep. Jackie Speier, would direct the FTC to create standards for a nationwide do-not-track mechanism allowing online users to opt out of tracking and sharing of consumer data among businesses. If you live in the U.S., contact your representatives and demand they support this legislation.)

WHAT SPYWARE-FREE MEANS

Content protection and stopping copybotters are important goals. But first and foremost, we believe customers deserve to be treated with respect and dignity. This includes having a healthy concern for your privacy.

Spyware-Free is a pledge that we will never use such a system ourselves. You can shop or hang out here with confidence!"

And some more links for more information. Google is your friend too :

Soft Linden warns Second Life users against Quickware Alts Pro
ZF Redzone, Disclosure of SecondLife Alts
SL Jira VWR-24746 - RedZone Security violates TOS, exposes private information and is being misused
no2redzone
Ban Redzone @ BDSM Institute
RedZone – security, scam, or scraping?
Forceme Silverspar - zf REDZONE

Thanks for reading. Now open your hosts file in your favorite editor and let's get rid of RedZone!
Boy


WARNING: Greenzone is not always able to pick up Redzone, especially the latest versions. Also Greenzone confirmed to run their own list/database, and uses it against others. Based on a no-mod unverifiable script. I therefore can not recommend to use this tool. Links for details: GreenZone gets nasty and confirmation from the author (see Addendum)