My friend who creates UGC emotes, 7B6L , has become the target of a new unique exploit used to attempt to terminate accounts. I am posting this for him as he does not have devforum posting permissions.
I will describe his situation chronologically, and then I will explain how the exploit works step by step. For the sake of readability, Roblox communities will be referred to as groups.
His story:
7B6L was invited to a group at some point, and he does not remember joining it. Today he found out that he was recently made owner of the group, and that he was the only member. This group has dozens of ‘half-head’ items previously uploaded which infringe on the Roblox TOS. He (7B6L) cannot transfer ownership back as the original creator left the group, and there are no other members to transfer ownership to. The attacker effectively forced him to own a ‘poisoned’ group.
These are the steps the attacker took which I can infer were used:
- Create a group and give it a name which I will refer to as “A”
- Gain members through any means, in the case above the attacker reuploaded other peoples UGC assets to gain sales and group members. This is to make the group appear legitimate and less suspecting.
- Invite targets using the invite feature, and then repeat steps 2 and 3 until any target joins somehow.
- Once the target joins the group , begin uploading many directly TOS infringing assets and move on immediately to step 5.
- Transfer all the funds to yourself.
- Kick out everyone in the group except for yourself and the target.
- Clear any and all information in the group such as posts and the name. Change the name to a name I will refer to as “B”
- Give ownership of the group to the target and then leave the group.
Outcome:
The target sees they are the owner of the group, and is unsure of when or how it happened. Because the name was changed from A to B, the target is confused and does not know what to do. New members cannot become group owner, and since everyone was kicked out the target is completely vurnerable to false moderation . The target would have to wait 14 days before even attempting to transfer ownership to a throwaway account in the worst case scenario. Since you cannot leave a group without giving ownership in addition to not being able to delete a group, the target is completely stuck with a ‘poisoned’ group.
Expected behavior
Ideally transferring ownership would require the new owner to accept and ownership invitation, rather than it going through unprompted.
A private message is associated with this bug report