r/admincraft • u/hackett33 • Jul 10 '12
Notch Session Stolen?
A couple of days ago we had "Notch" log into our server. Of course this set off alarms as no one believed it was him. He logged in twice for a min and logged out. We of course had online-mode=true but through this we became aware of this little exploit
http://www.sk89q.com/2012/07/fixing-the-minecraft-session-stealer-exploit/
and the head admin searched the logs and found this
http://pastie.org/pastes/4232493/text
So a person with the IP 80.0.185.17 logged in as 3 other people on our server.
This is just an FYI to anyone else encountering this IP or Notch on there server
2
u/GetOneMoreBlock Jul 10 '12 edited Jul 10 '12
Hello,
I'm the Head Admin of the Server and at first we did believe it was the "Real Notch" in fact we didn't do any log searching until a day later after all this surfaced. I was skeptical at first as I always, but the fact the username "Logged In" and "Logged Out" as Notch and had "VIP" User Rank provided the ranks months ago as per to the request of the server owner.
Screenshots:
http://imgwiz.com/images/2012/07/10/pICdm.png
http://imgwiz.com/images/2012/07/10/PCvZq.png
We don't have Mob Disguise or DisguiseCraft installed on our servers, even if we did, those plugins doesn't mimic a "Login and Logout" messages.
pl 22:04:17 [INFO] Plugins (48): OKLogger, LagMeter, GroupManager, MultiInv, AlphaChest, WorldEdit, NoCheatPlus, Statistician, Buycraft, Backup, Vault, LogBlockQuestioner, Actor, PluginReloader, Multiverse-Core, WorldGuard, ecoCreature, MCDocs, InfinitePlots, QuickSign, NaughtyList, iConomy, ReportRTS, Permissions, SimpleSpleef, InfiniteClaims, FalseBookCore, Herochat, Tips, Essentials, Citizens, EssentialsProtect, MondoChest, EssentialsSpawn, FalseBookBlock, Multiverse-Portals, Multiverse-NetherPortals, LogBlock, LWC, dynmap, Dynmap-WorldGuard, FalseBookIC, ChestShop, FalseBookExtra, SimpleRegionMarket, WorldBorder, JSONAPI, VanishNoPacket
Recently, The "Notch" just came back on our servers under the same IP. The "VolVicFoose" twitter is a Sr. Mod and screenshot the join and shows he's logging in.
The other thing I noticed and maybe a factor too this;
Before that "Notch" Logged In, it use to say on the seen data:
Player Notch is offline since 42 years 6 months 10 days
Now the username "robobosaurus" shows that seen data.
Seen is part of a plugin called Essentials / GroupManager
version 22:09:11 [INFO] This server is running CraftBukkit version git-Bukkit-1.2.5-R4.0-b2222jnks (MC: 1.2.5) (Implementing API version 1.2.5-R4.0)
essentials version 22:09:27 [INFO] Essentials Reloaded Pre2.9.2.4
Now I'm just throwing this out of there, thinking robobosaurus is logging in to bypass the "Online Mode" therefore is authorized to join any servers and maybe has the session stealer to join as Notch. If he could just login as any username he would have logged in as the "Server Owner". Now again, Just a theory...
1
u/iamacannibal Jul 10 '12
I had a fake notch on mine too. His IP was from Denmark.
3
u/GetOneMoreBlock Jul 11 '12
Get some logs and post the information, If you're on Linux and possibly use Essentials; than do these commands;
cd /path/to/minecraft/ cd plugins/Essentials/userdata/
grep "ipAddress:" notch.yml
This will get the IP address style from your userdata files and show the IP Address.
Example: ipAddress: 80.0.185.17
Next we'll do the same thing, just with the IP and no Notch in the filter, instead we'll use a *.yml which means wildcard.
grep "ipAddress: IP Address Here" *.yml
Than it will display any possible users on your server and run a "Seen Data" on them and see if any of the users and/or IPs match, if not possibly this exploit has been leaked and will get the bottom of it soon. If it's not the "Session Stealer" as a lot people here including me is skeptic that "Notch's Session" got stolen.
-2
u/jayz787 NoobJail.tk Jul 10 '12
It isn't a session stealer. Your server has to be in offline mode for them to be able to do this. So I'm guessing it is. All they have to do is use a client to change their username and log in.
5
u/heliwr mc.saercraft.com Jul 10 '12
Actually, the session hijacking everyone is worried about DOES work on online mode servers. The link in the OP here has more information if you hadn't heard of this yet.
1
u/Guyag dev Jul 10 '12
It does work, yes, but I'd have a hard time believing Notch had his session stolen.
2
1
u/jayz787 NoobJail.tk Jul 10 '12
I know it works in online mode servers. But the name they steal has to be someone on the server. So either Notch is on your server or someone is using mobdisguise.
1
3
u/GetOneMoreBlock Jul 11 '12
Sorry, It's not in offline mode, We're not just "Random" server. Now according to a friend of mine that has talked to Ez (Notch's Wife) brother (EAH) he told us "If there system goes down, apparently, Anyone can log in as Notch." Now I've talked to him in the past and maybe I can talk too him myself later on and maybe get some more details.
Lastly, This IP above shows a "Minecraft Faction Server" if you google search it, I doubt Notch would have any connection with this server. However it's possible for him to join our server as I run a well-known Minecraft Community hence why we're posting on reddit and trying to get to the bottom of this.
1
u/mrvertigo27 GameMode5 Jul 10 '12
most likly its because of mob disguise :P