Slashdot Mirror
Exploit For Crashing Minecraft Servers Made Public
An anonymous reader writes "After nearly two years of waiting for Mojang to fix a security vulnerability that can be used to crash Minecraft servers, programmer Ammar Askar has released a proof of concept exploit for the flaw in the hopes that this will force them to do something about it. "Mojang is no longer a small indie company making a little indie game, their software is used by thousands of servers, hundreds of thousands people play on servers running their software at any given time. They have a responsibility to fix and properly work out problems like this," he noted." Here is Askar's own post on the exploit, and his frustration with the response he's gotten to disclosing it to the developers.
... hours before this hit /.
From TFA:
Update: With the release of this full disclosure I have actually made contact with mojang and they are working to fix the issue. Apparently the initial fix they tried failed which indicates a lack of proper testing.
Update 2: The exact problem that caused this bug to go unpatched has been identified. Mojang attempted to implement a fix for this problem, however they did not test their fix against the proof of concept I provided, which still crashed the server perfectly fine. This, in combination with ignoring me when I asked for status updates twice led me to believe that Mojang had attempted no fix. In retrospect, a final warning before this full disclosure more recently was propbably in order. A combination of mis-communication and lack of testing led to this situation today, hopefully it can be a good learning experience.
Update 3: This problem has been patched as of minecraft version 1.8.4
https://mojang.com/2015/04/minecraft-1-8-4-security-release/
I’m happy to see that multiple other security issues have also been fixed. Once again, I feel better communication would have easily alleviated this problem. Keeping me in the loop and not ignoring me, in addition to proper testing would have easily led to this exploit being fixed long ago.
As usual, by the time news hits slashdot, it's not really news anymore. RIP Martin Lawrence.
Maybe people will stop playing this waste of bandwidth.
If you can think of a better program with which to spend three hours digging then I'd like to hear it.
Help fight poverty: Punch a poor person.
If you can think of a better program with which to spend three hours digging then I'd like to hear it.
I'm going with Nethack. Although Dig Dug would be an obvious choice too.
How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?
Modders move quite slow due to the frustrating architecture. 1.6 required a major overhaul to most mods, and 1.8 is being avoided like the plague for the same reason. There's also little incentive to upgrade, since the amount of content in the mods is orders of magnitude higher than vanilla, no ones going to switch off 60 mods in a modpack to get some horses and a biome.
Try some of the mods. The gameplay gets better - and the stability gets worse.
YOU don't like Minecraft?
Why didn't anyone tell me!??!?!?!
Now that I know that YOU don't like it I will stop playing it and make my kids stop playing it!
I had NO idea it had been judged unworthy by YOU.
I am so sorry. Obviously NO ONE should play a game YOU don't like.
Clearly we both need to be back on our meds.
I spent four damn years trying to have a dialog with Mojang and Bukkit about how to write good code and have a community that wants good code. The MC community literally does not want anybody participating if they have any sense of QA or planning for the future.
Remember, these are people that wrote their own cryptographic transport *three times* and called it good after nobody could post an exploit for it within a week. MC is not even willing to use standard things like TLS.
~ C.
The guy has found a way to exploit the server code to cause denial of service via code complexity.
Further to this, depending on how the complexity managed to cause the server to crash (as opposed to just using up all server resources decoding the nested elements), it may also be possible to use his exploit to gain remote code execution (RCE).
But I haven't actually seen anything documenting a server crash -- just an exhaustion of resources, resulting in denial of service. If someone could document what actually happens on the server when this is run, that'd be useful for indicating if there's a possible RCE here or just a case of the server software using up all resources and grinding to a halt, with a possible out of resources exception thrown at the end, causing the server to exit gracefully.
I once coded for a game, Eternal Lands, where I discovered a major security bug. The game had a feature where if a person said a URL, it would turn into a clickable link. This was opened via a popen call. No input sanitization. Aka, vulnerable to injection. A person who simply speaks a malicious URL and makes it look like something interesting to click (hiding the insertion command in the path) could run it on anyone's computer who clicks to open the link.
Big problem. Simple fix. But try as I might, I couldn't get them to let me fix it. They were fine with me writing a whole new special effects graphics system for them, but one simple input sanitization, noooo, the popen works, let's not mess with it and possibly "introduce a bug"! Eventually it took me writing a sample command on the forum that would make a file in the user's home directory (which anyone who knows anything about unix commands could make far more malicious) by clicking on the URL. Suddenly they let me patch the system immediately (and deleted the forum thread... I don't blame them).
I didn't want to have to resort to that. But I didn't want a potentially dangerous exploit sitting in the system.
I never got approval to fix all of the other potential exploits in their system. Their networking protocol was terrible. I only ever saw the client code, but there was literally zero authentication that the server was who they said they were and that packets weren't malformed. Their entire security model was "let's initiate a TCP connection to a hard-coded IP and unconditionally trust everything that we receive". I can't imagine what their server code is like. But they wouldn't even let me add in trivial bounds checking to make sure that the packets weren't oversized - the most minimal of sanity checking.
The fear of changes breaking stuff often leads developers to neglect security. Changes to improve gameplay or graphics? Of course, our users will love it! Changes to the protocol? Nonono, the protocol is working, why risk breaking it?
The short of it? Don't have too much faith that that MMORPG you're playing isn't hackable in a way that could be nasty to your system.
*Kid Rock runs for Senate* Democrats: We must run Kid Scissors.