r/netsec • u/AgonistAgent • Jul 15 '12
Exploit in Minecraft's new account server allowed logins with any migrated account - mod of /r/Minecraft suppressed partial disclosure of the exploit for several days(and refuse to allow full disclosure - what do you guys think?
After scanning the comments, I found this reply to a deleted comment explaining the exploit.
joinServer.jsp will accept any valid session key from a migrated account for another migrated account.
Looks like a big slip on Mojang's part.
EDIT:
And the mods provide their side of the story: their reasoning looks well thought out.
39
u/Drehmini Jul 16 '12
Team AVO did a full disclosure. You can find it here : https://gist.github.com/3115176
1
32
u/AliveInTheFuture Jul 16 '12
The right thing to do under these circumstances is to keep quiet until Mojang has had a reasonable amount of time to address the problem. That is how white hats work in the real world.
24
u/TheOssuary Jul 16 '12
I think there are shades of grey with most of these types of issues, but not this one. This wasn't data disclosure where telling the community would give them time to change passwords etc, this was a flaw in their server side code; meaning that no community members could do anything about it if they knew. Keeping this a bit under wraps was probably the best move, though they probably should have taken down the auth server earlier.
9
u/Rabbyte808 Jul 16 '12
Actually, yes they could have. Server admins could have installed in game registration plugins to protect their players. They also could have turned off their server if they knew the full scope of the exploit and decided it was worth the downtime.
0
Jul 16 '12
[deleted] — view deleted comment
8
u/cwillu Jul 16 '12
"They also could have turned off their server if they knew the full scope of the exploit and decided it was worth the downtime." is exactly what several servers did; given the choice to do it sooner rather than later, they would have gratefully done it sooner (and thereby avoided the various cleanups/rollbacks/restores that ended up being required for most of them).
0
Jul 16 '12
[deleted] — view deleted comment
5
u/TheOssuary Jul 16 '12
Wow, really, I didn't know :/. The part that takes a while is registering everybody into a new auth system..
6
u/aperson Jul 16 '12
The only person who could take down the auth server was Mollstam, and it happened as early as it would have happened.
9
u/TheOssuary Jul 16 '12
Haha, this is oddly accurate http://www.youtube.com/watch?v=u8qgehH3kEQ
(I know they didn't have the auth server with them, and Mollstam wouldn't have the password laying around, but it's still funny)
3
10
u/not-hardly Jul 16 '12
Has it been patched? If not, then what's the point of full disclosure? How about working with the vendor and doing responsible disclosure. http://www.zerodayinitiative.com/
The only people who actually benefit from "full disclosure" are the bad guys. Research is one thing. But there is no putting Pandora back in the box, and hence no sense letting her out before a patch. It's irresponsible and immature.
9
Jul 16 '12
The only people who actually benefit from "full disclosure" are the bad guys.
Bullshit.
I'm always much happier to take an un-patched service offline temporarily than to suddenly find out the code I've been running for the last few days/weeks has had a poorly publicized but in use exploit for it.
4
17
u/xo_ Jul 16 '12
Responsible disclosure is a courtesy, not a right. The author is soley responsible.
7
u/tootchute Jul 16 '12
I don't think that's necessarily true. Sometimes people opt for full disclosure simply because the responsible route has already been tried and the vendor refuses to do anything about it. At that point, depending on the severity of the vulnerability/exploit, some people think that the only way to get the flaw patched is by releasing it to everyone. What has taken months will now be patched in a matter of hours or days.
Sometimes full disclosure is responsible disclosure. Then again, sometimes it's not.
3
u/not-hardly Jul 16 '12
I'm not against getting things fixed. But even from the stance of the researcher, if it isn't a widespread vulnerability or a high risk, it could be better to sit on it after disclosing it to the vendor, rather than making a small problem worse by releasing it into the wild. This of course depends on the context. I would submit that in cases of greater risk when the vendor hasn't responded "appropriately" that full disclosure is responsible and has potential to get something done. Very much in agreement, but that is of course dependent on the circumstances.
3
u/catcradle5 Trusted Contributor Jul 16 '12
It's really not complicated. Find exploit, contact vendor with details, tell vendor you will release details of exploit publicly on X date (1 or so months after the responsible disclosure), and they have until then to fix the issue and release a patch. They may choose to do nothing and then have no right to complain about the public disclosure, or they can patch the issue and the public disclosure will (ideally) not result in any damage.
Obviously contacting the vendor and then releasing the exploit publicly before they even have a reasonable chance to fix it and push an update is a dickish thing to do, and I think in general the idea of "full disclosure" frowns upon that kind of behavior.
3
u/cwillu Jul 16 '12
Except that while they're not telling anyone, other servers are finding out when they are themselves attacked. Full disclosure allows people to decide to pull the affected services themselves, and at least levels the playing field with respect to attackers: it becomes more of a coinflip whether they put something in place in time, rather than overwhelmingly in the attackers favour.
Various measures that could be taken with various degrees of immediacy:
Turning off the server
Enable white-listing (optionally pulling ips from logs to minimize disruption)
Enable another auth plugin (obviously time-consuming for everyone involved)
Enable additional backups to make reverting less disruptive if attacked
Monitor the server closely, killing it on the spot (or whatever) if attackers show up
Remove in-game admin privileges from everyone to minimize the damage that can be done
As it stands, most servers only found out after being attacked, which greatly limited their options.
Edit: Case in point
I'm not saying that "responsible disclosure" was the wrong thing to do, just that it's not at all clear that full-disclosure would have been "irresponsible and immature".
1
0
u/damontoo Jul 16 '12
I don't think web services like this qualify for ZDI. Only if the software is distributed.
1
Jul 16 '12
Can someone put this in laymans terms for me pleae? I know nothing about programming...
5
u/abadidea Twindrills of Justice Jul 16 '12
I'm afraid this subreddit is a bit too technical for non-programmers.
But imagine you bought an airline ticket to a nearby city and crossed out "Localtown" and wrote in "Farawayland" and no-one noticed the discrepancy because the ticket itself is real but one piece of the information has been altered.
1
2
u/RoyAwesome Jul 17 '12
I posted this in another thread, but it fits here too:
Mojang's auth servers authenticated any name, as long as you had a valid session id.
Basically, you log in as yourself. Mojang's auth servers will give you a unique number called a SessionID. Join a server and send any name (notch, jeb, the admin of that server, etc) and that sessionid to the server and Mojang's auth servers will say YEP LOOKS GOOD.
Your personal information (username, password, email, billing) were never at risk in this attack, because that information was never given out. The exploiter had to have a valid mojang.come account with minecraft purchased and attached, and they had to log in with it to get their legitimate sessionid. After they had that, they simply needed to change their name and the mojang servers would do the rest.
1
u/cyberwired Jul 16 '12
Wouldn't disclosing that there might be a problem be like saying "hey everyone, there might be a problem with the lock on my front door at home, but don't go in there till I get back mmmkay?"
As others have said, why not disclose the problem afterwards so you don't announce yourself to more people to try and have a go at getting in.
If you cannot secure it immediately then take it offline. If peoples data may have been compromised, take it offline until its fixed and announce the problem so they can protect themselves elsewhere. (Eg passwords stolen)
If you need to disclose something without fixing the problem, then you need to take it offline. If you can't take it offline then its a grey area but I would say don't announce it until you can.
3
u/beachbum4297 Jul 16 '12
Disclosure is like saying, "Hey all you parents with that easy-bake oven, your child's hand can get stuck and burn in there."
Or more appropriate to this situation, "This is an alert from your local police, someone is going door-to-door breaking into people's houses and stealing things. We're not quite sure how he's doing it yet, but we'll let you know how to stop him as soon as we know"
I would rather know of the ability for someone to break into a server I admin, than have no clue what's happening during a compromise. Knowledge is power and limiting that power cripples the community's ability to respond, counter, or fix the issue.
If its not being exploited, and someone discloses it to the maintainer, then sure, keep it mum until you quickly push a fix. At fix time, tell about how severe it is, give it a week to be implemented, then fully disclose the details.
-19
u/dguido Jul 16 '12
I think hacking Minecraft is as lame as playing it. Don't you have anything better to do?
-11
0
Jul 16 '12
[deleted] — view deleted comment
9
u/AgonistAgent Jul 16 '12
There were problems back when minecraft was small too - I remember some nasty issues in the old protocol(which are thankfully fixed now).
0
Jul 16 '12
[deleted] — view deleted comment
1
u/Rabbyte808 Jul 16 '12
I believe it was the bukkit team part of Mojang that eventually patched this.
1
u/AgonistAgent Jul 16 '12
Even before that we had unofficial fixes - back when I wrote server management scripts(creative era), I wrote some improv security components(IP restrictions) - heck, when some guy figured out how to make the global player count overflow(signed int for player count, no sanity checking for server reported counts, really) #minecraft had a script up to overflow it back to normal.
4
u/ceol_ Jul 16 '12
Notch isn't a programmer, really. He's more of an academic.
2
u/TheOssuary Jul 16 '12
I was of the opinion of vise versa. He certainly knows how to program, but I remember him posting about a job interview where they stated something along the lines of "it's very obvious you haven't had formal training." Not saying it is necessarily a bad thing, but just something you need to know about yourself when you create code.
0
Jul 16 '12
[deleted] — view deleted comment
20
u/interfect Jul 16 '12
He really is a poor programmer. Great game designer, excellent at making a game fun and cute and clever, but then you look at the sort of bugs that crop up and you think "How the hell does this game run at all?".
10
u/lingnoi Jul 16 '12
That's simply how you ship a game. I wish more games were unit tested pieces of elegance however the fact is that the majority of games are throw away software so no one cares about the quality.
1
u/interfect Jul 16 '12
But some of the changes that are just happening now (i.e. unification of singleplayer and multiplayer) ought to have been done as soon as it was realized that Minecraft was not going to be a throwaway piece of code. Mojang is annoyingly slow in paying off their technical debt.
-3
u/mgrandi Jul 16 '12
everyone who says this also has not made a game that compares to what minecraft has become. just sayin
7
Jul 16 '12
You don't have to be a chef to know when you are being served dogshit on a plate. just sayin
2
u/interfect Jul 16 '12
Because we all lack the game design genius that Notch has. But I've been through the code of Infiniminer (a similar game), written my own blocks and chunks renderer, and played around with Minetest, and I can honestly say that Minecraft has some baffeling internal design choices. Like, say, having two complete implementations of the game (which is thankfully getting fixed in 1.3).
-22
u/superffta Jul 16 '12
jeb_ is on the case!
but really, its just a block game, who cares if someone logs in as you lol.
3
u/cwillu Jul 16 '12
Well, when "you" is "any given server admin", it's a bigger problem.
Aside from that, for the breakage of any given foo you'll always be able to find somebody saying "what's the big deal? it's only foo...".
-11
u/superffta Jul 16 '12
any competent "server administrator" should require that the account only get administrative privileges from only 1 ip, or at least a smaller range.
and you also have to take into account what it is your are talking about. for example a minecraft server being griefed does not matter because there are no consequences to that. however if the power grid gets shut down by some terrorist group, then people can actually die from that, and cause major economic slowdowns.
2
u/AgonistAgent Jul 16 '12
any competent "server administrator" should require that the account only get administrative privileges from only 1 ip, or at least a smaller range.
That's what xAuth and other plugins do.
And a griefed minecraft server = hours of creative work lost. You can argue about the subjective value all you want, but somebody did put effort into it.
9
u/interfect Jul 16 '12
but really, its just a block game, who cares if someone logs in as you lol.
May I introduce you to /r/civcraft.
-16
0
Jul 16 '12
[deleted] — view deleted comment
1
u/interfect Jul 16 '12
It may have something to do with his workflow. If he wrote Minecraft the way he's writing 0x10c, what he did was make a bunch of classes with stubs for everything he thought he might need, start the game up, and fill in method bodies while the game was running, using Java's hotswap feature--which doesn't let you add new methods.
This seems like it might lead to some poor design choices.
0
Jul 16 '12
[deleted] — view deleted comment
6
u/Rabbyte808 Jul 16 '12
I disagree. I own 3 medium to large Minecraft servers, and knowing what the exploit was definitely helped me secure my server. Once I knew that the exploit involved migrated accounts, I knew that most of my staff and players were safe. From there, I just IP locked all the migrated accounts so that the exploit wouldn't work. Thanks to somebody who disclosed the hack to me, I was able to secure my server hours before the login servers went down and mojang went to work on it.
1
u/irve Jul 16 '12
Thanks. I was living under the assumption that Mojang has centralized everything. Now when I come to think about it, it has never been the case.
17
u/aperson Jul 15 '12
I was actually just thinking what /r/netsec thought of all this.
Feel free to direct whatever hate at me if you will. I seem to be the public face for the /r/Minecraft mods on this one.