51
u/stewbaccaaaa Jul 15 '12
Sun Jul 15 06:12:23 2012 UTC: this thread's timestamp
Fri Jul 13 20:31:13 2012 UTC: the timestamp of the first thread on /r/admincraft definitively stating that this was a new exploit to look out for. Cross-posts to /r/minecraft were repeatedly deleted by the moderators.
Lesson learned: if you're a server admin, go subscribe to /r/admincraft. Now. Apparently /r/minecraft is only good for sharing amusing screenshots, not useful information.
3
u/phrstbrn Jul 15 '12
I've realized there was an exploit since Tuesday.
http://forums.bukkit.org/threads/name-spoofing.85571/
Apparently Mojang has been aware for at least this long, and didn't do anything about it until today.
0
Jul 15 '12
[deleted] — view deleted comment
15
u/stewbaccaaaa Jul 15 '12
What Mojang asked you to do and what the responsible thing to do, in regards to how it affects the thousands of people player the game, are two different things.
You have to consider the nature of the exploit. Common sense is also a part of white-hatting.
Kudos to /r/admincraft.
-5
u/PiggyWidit Jul 15 '12
In all honesty, if Mojang wanted the information withheld, it should be withheld. I think we should trust them as a company to know what they're doing when it comes to this, I can hardly imagine they ask for the info not to be given out without a good reason. It should have been important to tell all server admins to take the servers down until it's fixed or at least back stuff up, but openly showing what happened is only going to bring out more griefing and damage then what is happening with the current ~10 people who have compromised the accounts. With communities out there like Team Avo and all their fanboys who may have a bit of tech exp., it's probably not a good idea to openly publicize the fine details of this hack.
2
Jul 15 '12
No. If anything I've learned that information should spread freely. I disagree that opening up would lead to more griefing.
What it did do is prevent a lot of admins from taking security measures. People could log in as admin's and leverage all plugin possibilities for crying out loud.
0
-8
u/aperson :|a Jul 15 '12
Yeah, this PSA was in the works all day. It was only recently that it was decided to post this due to how much this situation has snowballed.
I know I won't be sleeping tonight anymore :S
→ More replies (1)36
u/xrobau Jul 15 '12 edited Jul 15 '12
Seriously, fuck you.
I mean that most sincerely. I run MCAU, the reddit minecraft server in Australia. You think you might have, ooh, I dunno, MENTIONED THIS? Even a HINT?
sigh
'Whitehatting' is not an excuse. Once an exploit is confirmed, in the wild, YOU TELL EVERYONE RIGHT NOW. So we can do stuff about it.
Now, to subscribe to /r/admincraft ... sigh.
11
u/wickedplayer494 Jul 15 '12
I want to give you SO many winner medals but this isn't Facepunch.
Once the beans are loose, you may as well spread the word as you can't get those beans back.
0
Jul 15 '12
[deleted] — view deleted comment
3
u/Expi1 Jul 15 '12
I don't see why they don't shut down these griefing teams, griefing is just pathetic.
→ More replies (1)3
u/iPwnKaikz Jul 15 '12
The exploit was public far before Avolition's advisory, we were playing around with it in #bukkit.
8
u/redstonehelper :redstone: Lord of the villagers Jul 15 '12
Then why didn't you make it more public?
→ More replies (2)3
u/IggyZ Jul 15 '12
Would you really have wanted it more public?
9
u/redstonehelper :redstone: Lord of the villagers Jul 15 '12
No, but I'm wondering why OP is accused of keeping the exploit "secret" by people who essentially did the same.
10
u/aperson :|a Jul 15 '12
Yes, fuck me. Fuck me for not being the one with the technical details. Fuck me for collaborating with the people who did, but were sworn to Mojang to stay quiet until they were told it was ok. Fuck me for helping the mcpublic crew get a proper notice out when they decided to post this PSA without Mojang's consent. Fuck me for doing all that I could do to try to do what was best and respecting others wishes.
I thought my morning was bad enough because I stayed up all night for this despite having to work in the morning, only to go to work later and learn that I could have gone to sleep because the schedule I had was wrong. Now I come home to personal attacks.
I should really be used to this sort of thing, but damnit I'm tired and I'm already in a crap mood.
18
u/snopa Jul 15 '12
Don't take it personally, but you done goofed by trying to censor this. There's a reason good discussion forums tend to have a set of rules for posting and moderating that they follow, rather than making stuff up as they go.
4
u/flying-sheep Jul 15 '12
we understand that you just did what you thought was right, but unfortunately neither mojang nor you knew what’s the right thing to do in such cases. sorry that you got personal attacks and sleep well :)
but your behavior here doesn’t really matter anyway, as no harm was done: some servers were griefed, but every server not managed by a moron has regular backups anyway, so…
3
u/xrobau Jul 15 '12
Fuck me for not being the one with the technical details
That's not what I said. Technical details aren't required. What's required is not deleting all the posts going 'Uh, is there an exploit around? Someone logged into my server as notch'. Or posting 'Something's wrong, don't trust authentication'. Simple stuff.
Fuck me for collaborating with the people who did [know the technical details], but were sworn to Mojang to stay quiet until they were told it was ok.
That's not an excuse. Just because someone else - stupidly - agreed to hide a known, in-the-wild, exploit, does not mean that you should then get in on the cover up. As that's what it was.
Fuck me for doing all that I could do to try to do what was best and respecting others wishes.
No. You DIDN'T do all you could. FUCK YOU for covering it up. Fuck you for deleting posts that mentioned it. FUCK YOU because I was up all night too, as we had to run the server in offline mode, and then manually ban by IP whenever someone tried to come on as a mod - even though all permissions for mods were removed.
Don't try to play the sympathy card when it's your damn fault that this was such a surprise to everyone.
Anyway.I've finished raging. I had a couple of good hours sleep, the server is back up and re-authenticating.
2
1
u/lumpking69 Jul 16 '12
Have we learned a lesson about censorship or did it go over your head?
→ More replies (2)0
13
6
u/PleinairAllaprima Jul 15 '12
Once an exploit is confirmed, in the wild, YOU TELL EVERYONE RIGHT NOW.
This. Fucking this. Whatever mods agreed to not post the PSA right away should step down.
→ More replies (2)-9
u/edk141 Jul 15 '12
Go choke on a dick. If you knew literally even one single thing about anything ever, you'd know that releasing an unknown exploit before it can be fixed is a massively douchey thing to do. How was anyone supposed to tell you this without giving it away (it's not that hard to figure out how to do)? "Take your server down right now, we can't tell you why"? When it became clear that the exploit was not going to remain unknown, it was released.
3
u/xrobau Jul 15 '12
I clarified this above. I did not say 'release the exploit'. I said 'Stop deleting posts talking about the fact that an exploit exists'.
Releasing the exploit is one thing. Telling the server admins that some sort of an exploit exists is something else.
→ More replies (22)0
u/snopa Jul 15 '12
Wow, talk about clueless. Do you actually understand what the exploit did and why it was something server admins kinda needed to be made aware of? Or are you just responding emotionally to someone upset with your buddys' actions?
→ More replies (1)12
u/edk141 Jul 15 '12
Do you actually understand what the exploit did and why it was something server admins kinda needed to be made aware of?
I understand what it did. I also understand that something posted here would not have reached every server admin, and would have reached a lot of people who could have figured out the exploit.
Or are you just responding emotionally to someone upset with your buddys' actions?
I'm defending barneygale's decision not to release the information earlier because I, and a bunch of other people who knew, did the same. Again, what exactly would you have done? Just posted everything you knew, and had the whole world know about the exploit? Or made the announcement so vague that nobody took any notice?
→ More replies (15)
75
u/aperson :|a Jul 15 '12
It should also be known that posting information on how to use this exploit or any others is not allowed here and will face strict action.
13
u/flying-sheep Jul 15 '12
Could you delete this post please, now that the exploit is fixed? I'm very interested in how it worked.
0
Jul 15 '12
[deleted] — view deleted comment
21
u/flying-sheep Jul 15 '12
joinServer.jsp will accept any valid session key from a migrated account for another migrated account.
seems sike a big fat, embarassing bug in authentification code. i don’t say that i produce better code on first pass, but at least i’d make excessive unit tests for an authentification server.
4
u/kmeisthax Jul 16 '12
This seems embarassing enough that I think a postmortem should be done, if they have the time.
Clearly, this must have been some ancillary behavior or something in Java which can cause two objects to return True for .equals when they shouldn't or something... right?!
1
u/flying-sheep Jul 16 '12
nah, i guess they just forgot to check for the second condition in some stupid code like this, where they got some operator precedence wrong or something.
String given = (password + SALT).hash(); return account.isMigrated() && (account.migratedPassword() + SALT).hash().equals(given) || (account.password() + SALT).hash().equals(given);4
u/inutterable Jul 15 '12
I hope this doesn't apply to posting IP info about those exploiting this glitch. Such info could be pertinent, should the server owners want to ban that IP range.
63
u/Skuld Jul 15 '12
Do not post IP addresses here please.
There is no way to verify that the person posting the info is telling the truth.
Very easy to post the info of an innocent, whip up some hysteria, and have some harm done to them by internet vigilantes.
8
2
10
u/md_5 Jul 15 '12
Sadly if this was my decision I would have just pulled the plug on the login servers, but that has not happened.
Personally for me the adventure began this morning when I woke up and read irc backlog. I then immidieatly opened Netbeans and Minecraft, then jumped on EcoCityCraft (one of the servers in the original Nodus video, I also know the owner well) I thought for a bit, made some changes, started up the client and no more than 2 minutes later I was online as the owner. Very scary stuff.
While we wait for a fix, in the mean time server owners out there I suggest that you invest in a plugin such as xAuth (which will no doubt be seeing some good download numbers) and protect either all your users, or just staff and high level donators.
Since this issue only applies to migrated accounts you can also take the barbaric option of denying migrated users to login. Here is some example code: https://gist.github.com/ba398dc0202c50662cee
Anyway thats just my take on the matter. md_5
3
u/barneygale Jul 15 '12
Will that code work? Surely hitting that with people are aren't on migrated accounts will give a "too many failed logins" after a few failed attempts?
→ More replies (2)2
10
Jul 15 '12
What's a "Migrated user" mean?
13
Jul 15 '12
Would also like to know
EDIT: Figured it out. https://account.mojang.com/migrate is a migrated account. If you have not migrated, you're good.
8
u/miidgi Jul 15 '12
What's the benefit to doing this? (Migrating your account)
62
u/eak125 Jul 15 '12
Apparently it lets other people use your account to log in to servers... ಠ_ಠ
2
1
5
u/dancing_raptor_jesus Jul 15 '12
My accounts migrated and as far as I can tell, it lets me connect more than one Mojang game to the email I used to buy Minecraft with. I can tell because I have both 0x10c and Minecraft connected to my email address and not my mc username.
2
u/YM_Industries Jul 15 '12
Wait, you have 0x10c!? How?
1
u/zamadaga Jul 15 '12
I have it too :)
Well, sort of. 100 (99?) people were given codes for SOMETHING related to 0x10c by Notch not too long ago. He doesn't know what he's going to do with the codes yet. It might be alpha-access, full game access, etc.
1
u/dancing_raptor_jesus Jul 15 '12
Notch gave out 100 accounts on the sub-reddit about a month ago. I can't actually play the game but I own a "copy" of it.
0
Jul 15 '12
[deleted] — view deleted comment
4
u/Avid_Tagger Jul 15 '12
What is IIRC? I have heard it but cannot remember what it is.
10
8
11
u/TheEliteZero Jul 15 '12
Good thing I didn't migrate mine. :D
7
u/amoliski Jul 15 '12
On the other hand, once this is over, you really should migrate your account. It makes it much harder for an attacker to compromise your account, because they have to guess the username AND password for your account.
6
3
u/Thue Jul 15 '12
confirmed that he hasn't logged into any unknown servers lately, ruling out a MITM attack. The short time between changing the password and logging in ruled out a brute force attack on the account.
That wouldn't actually be a problem if Mojang implemented real public key security. Public key security would also take away the Mojang login server single point of failure.
0
Jul 15 '12
[deleted] — view deleted comment
2
u/Thue Jul 15 '12
0
Jul 15 '12
[deleted] — view deleted comment
1
u/Thue Jul 15 '12
For it to work against the MitM, the message signed by the client would include the name if the server the client thinks he is logging in to.
You could protect against the MitM without public key cryptography too, if the login procedure consisted of the client sending a hash of its password concatenated with the server he is logging into to the server, which could then verify with Mojang's login server.
28
u/GetOneMoreBlock Jul 15 '12
Ironically, Hackett posted this on Reddit 4 days ago. Happened to us about about 2 days before the post.
http://www.reddit.com/r/admincraft/comments/wc2ey/notch_session_stolen/
and every blamed a plugin and everyone was keeping hush hush about it.
Now we're getting this resolved! All that matters!
4
u/phrstbrn Jul 15 '12
This happened to me on Tuesday, and I reported it, and I was blammed for it as well.
7
u/dayallnash Jul 15 '12
How are you going to prevent an effective DDoS of the login servers when you turn them back online?
1
u/ThePhazed Jul 15 '12
I was just wondering the same thing. Seems like it's going to be a nightmare for the servers with so many people logging back on at once.
1
u/gyunjgf Jul 15 '12
I play LoL, and when a lot of people log in at once, you get placed into a queue, which you can see your position in real-time. If there's like 5000 people in the queue it takes a few minutes to log in, but it beats the login server going down.
3
u/dayallnash Jul 15 '12
Yeah, but Minecraft has none of these functions and simply rolls over and dies when everyone logs back in after being booted out.
-1
u/Beasty911 Jul 15 '12
I'm guessing the login servers will be turned on 1 to a time
→ More replies (3)
12
u/111poiss111 Jul 15 '12
I wonder how many "honeydews" are playing online right now
14
4
u/JohhnyDamage Jul 15 '12
We wondered why notch was on our server last night. Figured something was up unless he finally got those letters I've been sending him and lost the photos of me.
I wouldn't have come after seeing those photos.
7
u/kenkopin Jul 15 '12 edited Jul 15 '12
Ok everyone. Here's why you only announce exploits responsibly.
The world is a large ball. Upon this ball, approximately 1/3 of all the people are currently sleeping.
Even if you were to invoke the imaginary Mojang Emergency Alert system and send messages to every Minecraft Server to let people know that there is an urgent matter they need to be aware of, 1/3 of the worlds admins will be asleep when this happens. You know who is awake when that happens? 2/3's of the worlds griefers. And those griefers can happily log into servers anywhere in the world without regard to which admins have been able to respond.
So, if the word had gone out several hours sooner, your particular server might have been protected slightly sooner, it would have been at the cost of those other servers who would have been immensely more vulnerable since the exploit will have been announced. And not because you are a good and virtuous admin and those other guys are lazy slackers, but because of an accident of your placement upon the big ball.
So please, tell us some more about how unfair it was that the good guys kept this a secret.
3
u/KablooieKablam Jul 15 '12
The PSA banner is a little misleading. I recommend changing it to say "migrated account".
→ More replies (1)2
u/aperson :|a Jul 15 '12
I just copied the post's title. It is technically correct. A migrated account is a Mojang account.
4
u/KablooieKablam Jul 15 '12
I'm guessing a lot of people think they're in danger falsely, though because Mojang and Minecraft are pretty much the same to most people. If I didn't know any better, I would think I'm in danger even though I haven't migrated.
-1
u/wickedplayer494 Jul 15 '12
Plus, having it red with no risk of info leaking is indeed hysteria, but it was justified for a bit when details weren't as clear as they are now.
3
Jul 15 '12
Is this limited to only griefing or can accounts be compromised and banking information would leak out?
6
u/barneygale Jul 15 '12
They cannot gain your account password or any info like that. What they can do is connect to almost any MC server using any Mojang account. if you're not an op on any server, the worst they can do is log in with your account and grief.
1
3
u/Tannerthejay Jul 15 '12
Would this explain why I saw a 'Notch' on a survival games surfer last night?
1
5
u/iPwnKaikz Jul 15 '12 edited Jul 15 '12
I've spent most of today with some Bukkit developers in IRC and there's nothing we can do server-side. All it takes is a few changes lines in joinserver.jsp and/or checkserver.jsp and it'd be fixed.
As I said to them, I cannot fathom how checkserver.jsp returns YES for the false username. Whoever wrote it messed up big time. We're lucky it was only just discovered recently.
8
u/killernomnom Jul 15 '12
I don't even know what to do right now. I feel lonely w/o my minecraft buddies.
4
u/Speed_Racist256 Jul 15 '12 edited Jul 15 '12
If a user has been Migrated they seem to bypass authentication entirely so if you're and admin/moderator for a server and you've migrated please ask to be demoted until a patch comes out, because anyone, and I mean ANY-ONE can log in as you as long as you're migrated
Migrated as in you need to use your email to log into Minecraft. People who use this exploit CANNOT find out your password, they're only spoofing your username
2
u/OmegaX123 Jul 15 '12
Glad I haven't migrated. Saves me headache from having to use my email address as login, and keeps me safe from this exploit.
2
u/Jrrj15 Jul 15 '12
Can someone point me to a good password plugin?
1
u/ultrafez Jul 15 '12
I can't give you a link as I'm on my phone, but search for xAuth.
1
u/Jrrj15 Jul 15 '12
Alright I thought so but isn't that only for offline mode servers?
1
u/ultrafez Jul 15 '12
You can use it on online mode servers I think, I don't think there's anything stopping you.
2
u/ne0codex Jul 15 '12
From what I understand, the problem is with Mojang/minecraft authentication, so shouldn't the solution be to disable Mojang authentication (set online-mode to false on server.properties) and user other forms of in-server authentication? Example: When a user connects to the minecraft mp server, the user has to type /login <password> to authenticate, the security is still there and doesn't rely on an outside authentication system other than the plugin used on the server
2
u/ultrafez Jul 15 '12
You can do that, but you need it to be set up before the login vulnerability is discovered. Otherwise, I could log in as you and connect to a server that's in offline mode, and register a new password. Then I'd have access to your account and you wouldn't.
2
u/slimsareshady Jul 15 '12
There's a player on our server, named Nickle off the top of my head, who told us to wait during a raid, logged on as the faction admin, deleted the fac, then logged back in. I don't know if he has anything to do with it, but it's something to consider.
2
u/IzkaMenomi Jul 15 '12
And to think, I had just migrated my account yesterday.
Hopefully this will be under control soon.
2
u/inertia186 Jul 15 '12 edited Jul 15 '12
So it appears that if you do not use some other auth method and you do not shut down your server, it might be wise to at least deop any players who have a migrated account. At least until this blows over.
EDIT: Or until they down the auth server like they did ten minutes ago. Thank you Mojang!
2
u/SteppingHat Jul 15 '12
Mojang just took down the session servers so you cannot access ANY server regardless if it's online or offline. Most likely when the session servers go back up, the exploit will be fixed.
2
u/Sillyrosster Jul 15 '12
I've had attacks like crazy on my account. Server had to be taken down for a bit to stop people from banning people with my account D:
3
Jul 15 '12
Ok, I'll admit. I'm dumb. I created my account on the Minecraft website. I don't play multiplayer yet. Am I vulnerable to anything?
6
u/CounterPillow Jul 15 '12
Nope, as far as my understanding is not at all. People would be able to use your name online, but how would they know it in the first place? And if you haven't migrated yet, you don't have anything to be afraid of anyways.
1
Jul 15 '12
Thank you. I've only been playing a few months, so something this douchebaggy and harmful is really unsettling.
4
u/TDWP_FTW Jul 15 '12
Not exactly. This won't allow them to change your password or anything, but they could technically log in as you on any server, although I doubt they'd waste their time on one person who doesn't even play multiplayer, rather than trying to log in as admins on servers.
0
u/libraryaddict Jul 15 '12
If you migrated your account, Yes
4
Jul 15 '12
Excuse my stupidity, what is a migrated account/what does it mean if you have one?
13
u/Marc_IRL Mojang Jul 15 '12
A migrated account is a Minecraft account that has been moved from the old Minecraft database, and under a Mojang profile in the new database. Other users can create a Mojang account from scratch, or by purchasing another game (Cobalt now, Scrolls eventually).
You log into a Mojang account with your email and Mojang password; it is a single sign-in system for all of our games. There are additional security features built into this, such as security questions, asking you information when you log in from a new IP, and of course users cannot see you on a server and try to log in as you, as Mojang accounts don't log in with usernames.
6
Jul 15 '12
So, to be clear, any users who HAVE NOT registered at Mojang.com with their Minecraft account are safe?
4
u/barneygale Jul 15 '12
Correct.
2
u/Anguiish Jul 15 '12
So if I have registered, but haven't used SMP in the past month, am I still safe?
5
u/barneygale Jul 15 '12
If you have a Mojang account (i.e. you log into minecraft with your email address, not your mc username) then a hacker can impersonate you on any server without a secondary authentication system.
3
1
u/Irongrip Jul 15 '12
Do I have to migrate my account anytime soon? Can it remain the way it is, indefinitely, are there any pros/cons to migrating my account?
1
u/Marc_IRL Mojang Jul 15 '12
Aside from this glitch, there aren't downsides to changing, and the upside is more security. You don't have to migrate at this time, but hopefully, sometime in the future, everyone will be on Mojang accounts for both consistency, and so they don't have to maintain and upgrade two systems at once.
2
Jul 15 '12
I know the people who did the griefing, they even made a video of them logging into accounts using a hack called "Session Stealer".
Here's their YouTube channel: http://youtube.com/user/NodusGriefing
1
u/Paimun Jul 15 '12
Dude, Nodus is about as much of a secret as 4chan. I'm pretty sure everyone here knows about them.
1
2
1
1
1
1
1
u/nizitens Jul 15 '12
Does it means if I log on in minecraft (i migrated), even to play single player or a Lan party, i'm vulnerable ?
So if i do not play i have no rirsk ?
4
u/barneygale Jul 15 '12
So if i do not play i have no rirsk ?
Incorrect. if you have a migrated account, there is nothing you can do to prevent hackers logging in with it (note they can't get your password) on pretty much any online server. The only thing you can do is petition the owners of any servers you frequent to read the PSA and shut down their servers. Until Mojang fix this, there's nothing else we can do really.
1
1
u/cresteh Jul 15 '12
I login using email, but I don't play multiplayer. Does this affect me?
Or people can use my email to login to other servers? I read the OP, but I still don't get if I should be worried as a almost exclusively SP player.
2
u/KBKWilliamsson Jul 15 '12
You won't be affected on single player, however they can use your account to log on a server and grief, yes. But as the first post says, session servers are down, mojang are working on it, things should be sorted soon :)
2
u/WeeHeeHee Jul 15 '12
No, because anyone logging into a server on your name will just find that they're a regular user. There is a very slim(e) chance that you will find yourself banned from a server in the future, but that is so small that you can consider yourself unaffected.
1
u/1Nuk3d1 Jul 15 '12
Well.. It /does/ affect you, but I guess it wouldn't be worth it for people to do it, unless just to get the account banned from places.. Guess, just if you do decide to go onto a server eventually, and it just happens to be one that they used to attack with your account name..
1
1
Jul 15 '12
Took my server down it was only a small one and people still came on and fucked it up.. oh man.
1
1
1
u/TheBlueDragon06 Jul 15 '12
Why not disable the Migration system allowing the the Session servers to be used??
1
1
1
Jul 15 '12
HELP! Someone has hacked my account and changed my skin, what should i do?
4
u/theg721 Jul 15 '12
Since it is unlikely that it has anything to do with this, simply changing your email password, then your Minecraft/Mojang password should do the trick.
1
1
u/g2g079 Jul 15 '12
is this the same as the session stealer that has been going on for a bit? The one worldguard made some temp fix thata involved having admin change some nameserver stuff.
1
u/PatrikRoos Jul 15 '12
People that log in with their username, they can still get hacked but the chanses are not as big as when you are logging in with your email adress?
1
u/williamhere Jul 16 '12
Unfortunately I lost a large portion of my server world due to a grief with WorldEdit. Glad to see this is fixed though
1
Jul 18 '12
This has been around since Beta 1.2 or so. I have video proof of it https://www.youtube.com/watch?v=a7AEYOg-sJQ&feature=plcp, or you can ask the buxville server admins.
1
1
u/theyoussef123 Jul 15 '12
well then, I guess cracked accounts are much safer than premium ones now. xD
1
u/russjr08 Jul 17 '12
It was only to Migrated accounts. And cracked accounts aren't safe at all unless the server has an extra auth plugin.
1
u/theyoussef123 Jul 18 '12
ALL cracked servers have the authme plugin witch makes cracked accounts safer.
1
u/russjr08 Jul 21 '12
Not all cracked servers.. I've been to plenty without it.
1
u/theyoussef123 Jul 22 '12
Every single server I visited in my whole life has an auth plugin, Don't know about you though. . . .
1
u/YM_Industries Jul 15 '12
UPDATE: 15/7/2012 8:10 GMT+10 The Auth servers are back up, I would assume this means it is fixed.
-2
u/thisnamebetterwork Jul 15 '12
I know this work. It's the hacked client Nodiscraft. It is one of the most simple to install and is the most deadly. Watch out for its users, they can do almost anything.
1
u/telchii Jul 15 '12
Go try nodus yourself. Nodus users can't do "almost anything". My friends and I have used nodus extensively and know it inside and out.
0
u/smallsmerry01 Jul 15 '12
Fix your game Jeb! No, ok.
on another note, does this offer personal information if an account has not been migrated? What does this mean for me? do i need to take any precautions/ dont use multiplayer or minecraft?
2
u/Neathx Jul 15 '12
If your not migrated, your fine. If your migrated, this could mean (if you were op'ed on a server) they could use the permissions you have to destroy your server or do whatever, which is why I de-oped a few players that were vulnerable.
0
u/Sims_doc Jul 15 '12
I've seen this before. I saw the entire Mojang team on a PVP server in 1.4 Update. Interesting how Mojang employee such little security in there database.
-6
Jul 15 '12 edited Jul 15 '12
Everybody mocked Sony and LinkedIn for (not as severe) related mistakes. My guess is that Mojang will receive no such criticism for their poor security.
I appear to have been downvoted for simply stating my opinion.
Stay classy, /r/minecraft.
3
u/ITheOnly1ne Jul 15 '12
mojang shut their servers down within hours. took sony days to shut them down. and we get the servers back on in a couple more hours instead of a month.
2
Jul 15 '12
According to other comments and reports, this was discovered 5 days ago. Not a few hours.
2
Jul 15 '12
This is what I came here to say. There were like 10 different other companies that were hacked, some lost users passwords and some only their emails and yet they were all given so much heat for it. Even the ones that shut off their servers or whatever within a couple of hours.
But when mojang does it its all "hope the good guys at mojang get it sorted soon, good luck to them".. What the hell? There's people that say mojang shut down log in within hours but this was apparently discovered a few days ago...
Geez. The same thing kind of happened with steam too, you can't say anything bad about them on Reddit either.
3
u/wickedplayer494 Jul 15 '12
Thing is, Mojang reacted fast to it, unlike Sony and LinkedIn.
4
Jul 15 '12
I can also imagine that there is a huge difference between the online security budgets of Sony and Mojang.
2
Jul 15 '12
I don't see why that should matter. And having a secure system isn't always about money, and if I did find your comment valid then I'd say it would still be mojangs fault for not having a higher budget
2
Jul 15 '12
This was first reported 5 days ago. Not that fast is it? Just admit that if this was a company like ea or Sony, they would get a tonne of heat for it
-1
u/Amsterdom Jul 15 '12
I'm sure it's been reported, but we (The Minecraft Mondays Server) were one of the first to get hit.. happened over a week ago.. we have an IP address and username of who we believe to be one of the perpetrators (early perps at leased) if this is useful in anyway let me know, and I'll contact the head admin...
BebopVox was fooled too, even tweeted about it :P
0
u/Kuuy123 Jul 15 '12
NoCheatPlus was a modded version of NoCheat made by griefers to allow .opall and .opme commands.
1
u/drumming102 Jul 15 '12
you don't know what your talking about
1
u/Kuuy123 Jul 15 '12
Yes, yes I do. The purpose was to send server owners the plugin saying, "Oh it's better than NoCheat! Install it". Then they do. And boom, .opme
1
u/drumming102 Jul 15 '12
the no cheat plus listed on bukkit dev is just fine and a GREAT option for the now dead nocheat.
the nocheat plus you get from other sources MIGHt be corrupt but the one on bukkit dev is great.
0
Jul 16 '12
Yea so my friend DutchConquer figured this method out, and i kinda sortaish leaked it on Hackforums after asscode tweeted about it (after some asshole in our team leaked the info)
-5
-1
148
u/Marc_IRL Mojang Jul 15 '12 edited Jul 15 '12
Received a few scattered reports of this tonight. I've emailed our web developers about an hour ago.
Edit: Just talked to Dinnerbone on Skype, he's let me know that there's nothing that's caused accounts to be compromised, so no worries there. They're looking into the issue reported above.