Slashdot Mirror
Exploit For Crashing Minecraft Servers Made Public
An anonymous reader writes "After nearly two years of waiting for Mojang to fix a security vulnerability that can be used to crash Minecraft servers, programmer Ammar Askar has released a proof of concept exploit for the flaw in the hopes that this will force them to do something about it. "Mojang is no longer a small indie company making a little indie game, their software is used by thousands of servers, hundreds of thousands people play on servers running their software at any given time. They have a responsibility to fix and properly work out problems like this," he noted." Here is Askar's own post on the exploit, and his frustration with the response he's gotten to disclosing it to the developers.
... hours before this hit /.
It's like the beloved classic '42.zip'; but can be delivered directly over the minecraft server protocol and will be naively parsed by the server, no social engineering required... Never trust the client.
Maybe people will stop playing this waste of bandwidth.
Support my political activism on Patreon.
There are tons of servers running relatively ancient versions at this point due to massive amounts of custom mods (Herocraft and places like that). It sounds like they're screwed now unless they get caught up to the current version.
From TFA:
Update: With the release of this full disclosure I have actually made contact with mojang and they are working to fix the issue. Apparently the initial fix they tried failed which indicates a lack of proper testing.
Update 2: The exact problem that caused this bug to go unpatched has been identified. Mojang attempted to implement a fix for this problem, however they did not test their fix against the proof of concept I provided, which still crashed the server perfectly fine. This, in combination with ignoring me when I asked for status updates twice led me to believe that Mojang had attempted no fix. In retrospect, a final warning before this full disclosure more recently was propbably in order. A combination of mis-communication and lack of testing led to this situation today, hopefully it can be a good learning experience.
Update 3: This problem has been patched as of minecraft version 1.8.4
https://mojang.com/2015/04/minecraft-1-8-4-security-release/
I’m happy to see that multiple other security issues have also been fixed. Once again, I feel better communication would have easily alleviated this problem. Keeping me in the loop and not ignoring me, in addition to proper testing would have easily led to this exploit being fixed long ago.
As usual, by the time news hits slashdot, it's not really news anymore. RIP Martin Lawrence.
Addressed in vanilla by the 1.8.4 update: https://mojang.com/2015/04/min... And for the modded community, here's the Forge discussion: https://github.com/MinecraftFo...
I don't think that guy understands what an exploit is. If you can crash the server, you haven't "owned" or "exploited" it. You've simply found a way to remotely crash it.
Both parties admit that it could have been handled better.
I specifically asked Nathan Adams (Dinnerbone) about it on Twitter; he said that it would've been handled better if the exploit was logged with the bug tracker to begin with, instead of trying to talk directly to people.
It's like if Facebook went down due to a bug. Nothing actually valuable would be impacted.
I spent four damn years trying to have a dialog with Mojang and Bukkit about how to write good code and have a community that wants good code. The MC community literally does not want anybody participating if they have any sense of QA or planning for the future.
Remember, these are people that wrote their own cryptographic transport *three times* and called it good after nobody could post an exploit for it within a week. MC is not even willing to use standard things like TLS.
~ C.
lagged behind, Wash off hands Let's keep to you join today! Create, manufacture operating systems, look at the Par/anoid conspiracy Creek, abysmal
What does it take to fix the zombie pathfinding bug in 1.6.4? The game is unplayable and i finally gave in to the last 1.7.x. Again, billions of dollars to go around. They spend more hours on twitter than just sitting down and fixing that damn bug.
Is there an exploit for the New Google Maps that just makes it work properly like the old one does?
Friends don't let friends put Turing complete languages in communication protocols.
This cannot be fixed in general. The behavior of a Turing complete language executor is formally undecidable over all inputs.
Minecraft (and X.509 certs and HTML 5.0 and SQL and, and, and...) all need to switch to non Turing complete languages if they are to have the option of secureable implementations.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
It's just a DOS attack. Shouldn't really even be called an exploit, no information is gathered, nothing is lost.
I count this under developer arrogance. There we, the quality and security minded people, hand developers all the information they need to fix a flaw and they outright reject it. The Mojangs could not even be bothered testing their 'fix' just ONCE using the example provided to them!! Sadly, they are not alone. How many times did I report bugs, get the note that it was 'fixed', then find out that absolutely nothing changed (best case) or that it is now worse than before? Way too many times. Dear developers, we, the QA folks, are there to have your back. We are there to keep you from pulling all nighters to fix that important issue that crept up in the release branch. In 90% of the cases we pointed you to that very same flaw during development, but you poo-pooed it as a non-issue and marked it as 'won't fix'. Dear developers, give the QA and security folks more credit. We do know what we are talking about, many of us do this stuff for decades having one ear on the customer's side and one ear on the design and development side. We know what is going to work out for users. Stop ignoring us!