Spoofing Users, have you guys seen this?

Discussion in 'Spigot Discussion' started by fffizzz, Sep 7, 2013.

  1. So yesterday while I was at work, someone managed to login AS me, but my account was not compromised. They managed to OP 4 of their friends and completely ravage the server.

    Code (Text):
    2013-09-06 14:34:01 [INFO] markkearney[/86.145.197.170:52188] logged in with entity id 2075837 at ([hub] 270.5, 254.0, -284.5)
    2013-09-06 14:34:32 [INFO] fffizzz[/86.145.197.170:52272] logged in with entity id 2091857 at ([hub] 266.30706098509285, 179.66552038974027, -291.16335836038166)
    2013-09-06 14:55:57 [INFO] Disconnecting fffizzz [/86.145.197.170:52478]: Invalid client reply
    2013-09-06 14:56:18 [INFO] fffizzz[/86.145.197.170:52488] logged in with entity id 2227180 at ([hub] 239.30000001192093, 166.20000004768372, -313.69999998807907)
    2013-09-06 15:06:28 [INFO] Disconnecting fffizzz [/86.145.197.170:52609]: Invalid client reply
    2013-09-06 15:06:35 [INFO] fffizzz[/86.145.197.170:52616] logged in with entity id 2317571 at ([hub] 266.5, 72.0, -280.5)
    2013-09-06 15:10:21 [INFO] fffizzz [/86.145.197.170:52684] lost connection
    You can see every 10 minutes the session servers (im assuming) would force disconnect this person, but they could log back in. I was not using one of the builds with the exploitable code (unless it went back further than the post said). I took some extra precautions yesterday after the event, but I still dont know how this occured and was hoping you guys had some insight into this.

    I was on build 1083, but read that anything below 1088 was fine.
     
  2. Puremin0rez

    Moderator

    1083 is one of the builds effected by the little exploit that went around. Please make sure to update to the latest one or downgrade further. You'll notice all affected builds have been removed from our jenkins.
     
  3. Dmck2b

    Services Staff

    Only upgrade up. All previous builds I have tried are vulnerable.

    [​IMG]

    2013-09-07 18:41:21 [INFO] Starting minecraft server version 1.6.2
    2013-09-07 18:41:21 [INFO] Loading properties
    2013-09-07 18:41:21 [INFO] Default game type: SURVIVAL
    2013-09-07 18:41:21 [INFO] This server is running CraftBukkit version git-Spigot-1020 (MC: 1.6.2) (Implementing API version 1.6.2-R0.1-SNAPSHOT)
    2013-09-07 18:41:22 [INFO] Generating keypair
    2013-09-07 18:41:22 [INFO] Starting Minecraft server on *:25565
    2013-09-07 18:41:23 [INFO] [mcMMO] Loading mcMMO v1.4.06-beta5-b2062
    2013-09-07 18:41:23 [INFO] [mcMMO] Enabling mcMMO v1.4.06-beta5-b2062
    2013-09-07 18:41:24 [INFO] [mcMMO] You are using an outdated version of mcMMO!
    2013-09-07 18:41:24 [INFO] [mcMMO] There is a new version available on BukkitDev.
    2013-09-07 18:41:24 [INFO] Preparing level "world"
    2013-09-07 18:41:24 [INFO] -------- World Settings For [world] --------
    2013-09-07 18:41:24 [INFO] Chunks to Grow per Tick: 650
    2013-09-07 18:41:24 [INFO] View Distance: 10
    2013-09-07 18:41:24 [INFO] Experience Merge Radius: 3.0
    2013-09-07 18:41:24 [INFO] Item Merge Radius: 2.5
    2013-09-07 18:41:24 [INFO] Anti X-Ray: true
    2013-09-07 18:41:24 [INFO]Engine Mode: 2
    2013-09-07 18:41:24 [INFO]Blocks: [1, 5, 14, 15, 16, 21, 48, 49, 54, 56, 73, 74, 82, 129, 130]
    2013-09-07 18:41:24 [INFO] Random Lighting Updates: false
    2013-09-07 18:41:24 [INFO] Hopper Transfer: 8 Hopper Check: 8
    2013-09-07 18:41:24 [INFO] Mob Spawn Range: 4
    2013-09-07 18:41:24 [INFO] Cactus Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Cane Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Melon Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Mushroom Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Pumpkin Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Sapling Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Wheat Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Entity Activation Range: An 32 / Mo 32 / Mi 16
    2013-09-07 18:41:24 [INFO] Entity Tracking Range: Pl 48 / An 48 / Mo 48 / Mi 32 / Other 64
    2013-09-07 18:41:24 [INFO] -------- World Settings For [world_nether] --------
    2013-09-07 18:41:24 [INFO] Chunks to Grow per Tick: 650
    2013-09-07 18:41:24 [INFO] View Distance: 10
    2013-09-07 18:41:24 [INFO] Experience Merge Radius: 3.0
    2013-09-07 18:41:24 [INFO] Item Merge Radius: 2.5
    2013-09-07 18:41:24 [INFO] Anti X-Ray: true
    2013-09-07 18:41:24 [INFO]Engine Mode: 2
    2013-09-07 18:41:24 [INFO]Blocks: [1, 5, 14, 15, 16, 21, 48, 49, 54, 56, 73, 74, 82, 129, 130]
    2013-09-07 18:41:24 [INFO] Random Lighting Updates: false
    2013-09-07 18:41:24 [INFO] Hopper Transfer: 8 Hopper Check: 8
    2013-09-07 18:41:24 [INFO] Mob Spawn Range: 4
    2013-09-07 18:41:24 [INFO] Cactus Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Cane Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Melon Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Mushroom Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Pumpkin Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Sapling Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Wheat Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Entity Activation Range: An 32 / Mo 32 / Mi 16
    2013-09-07 18:41:24 [INFO] Entity Tracking Range: Pl 48 / An 48 / Mo 48 / Mi 32 / Other 64
    2013-09-07 18:41:24 [INFO] -------- World Settings For [world_the_end] --------
    2013-09-07 18:41:24 [INFO] Chunks to Grow per Tick: 650
    2013-09-07 18:41:24 [INFO] View Distance: 10
    2013-09-07 18:41:24 [INFO] Experience Merge Radius: 3.0
    2013-09-07 18:41:24 [INFO] Item Merge Radius: 2.5
    2013-09-07 18:41:24 [INFO] Anti X-Ray: true
    2013-09-07 18:41:24 [INFO]Engine Mode: 2
    2013-09-07 18:41:24 [INFO]Blocks: [1, 5, 14, 15, 16, 21, 48, 49, 54, 56, 73, 74, 82, 129, 130]
    2013-09-07 18:41:24 [INFO] Random Lighting Updates: false
    2013-09-07 18:41:24 [INFO] Hopper Transfer: 8 Hopper Check: 8
    2013-09-07 18:41:24 [INFO] Mob Spawn Range: 4
    2013-09-07 18:41:24 [INFO] Cactus Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Cane Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Melon Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Mushroom Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Pumpkin Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Sapling Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Wheat Growth Modifier: 100%
    2013-09-07 18:41:24 [INFO] Entity Activation Range: An 32 / Mo 32 / Mi 16
    2013-09-07 18:41:24 [INFO] Entity Tracking Range: Pl 48 / An 48 / Mo 48 / Mi 32 / Other 64
    2013-09-07 18:41:24 [INFO] Preparing start region for level 0 (Seed: 2284078332294273811)
    2013-09-07 18:41:25 [INFO] Preparing start region for level 1 (Seed: 2284078332294273811)
    2013-09-07 18:41:26 [INFO] Preparing start region for level 2 (Seed: 2284078332294273811)
    2013-09-07 18:41:26 [INFO] Server permissions file permissions.yml is empty, ignoring it
    2013-09-07 18:41:26 [INFO] Done (2.005s)! For help, type "help" or "?"
    2013-09-07 18:41:26 [INFO] Dinnerbone [/127.0.0.1:52854] lost connection
    2013-09-07 18:41:33 [INFO] Dinnerbone [/127.0.0.1:52879] lost connection
    2013-09-07 18:41:39 [INFO] Dinnerbone [/127.0.0.1:52895] lost connection
    2013-09-07 18:41:54 [INFO] Dinnerbone [/127.0.0.1:52941] lost connection
    2013-09-07 18:42:15 [INFO] Disconnecting Dinnerbone [/127.0.0.1:53009]: Invalid client reply
    2013-09-07 18:42:16 [INFO] Noooooob [/127.0.0.1:52917] lost connection
    2013-09-07 18:42:25 [INFO] Disconnecting Dinnerbone [/127.0.0.1:53041]: Invalid client reply
    2013-09-07 18:42:31 [INFO] Disconnecting Dinnerbone [/127.0.0.1:53076]: Invalid client reply
    2013-09-07 18:43:14 [INFO] Disconnecting Dinnerbone [/127.0.0.1:53278]: Invalid client reply
    2013-09-07 18:43:20 [INFO] Dinnerbone[/127.0.0.1:53310] logged in with entity id 562 at ([world] 201.19618149502588, 61.0, -185.4438116619625)
    2013-09-07 18:43:37 [INFO] CONSOLE: Opped dinnerbone
    2013-09-07 18:43:37 [INFO] Dinnerbone suffocated in a wall
    2013-09-07 18:44:04 [INFO] <Dinnerbone> I am not dinnerbone. THis is spiot 1020. All previous builds I have tried have the vuln.
    2013-09-07 18:44:06 [INFO] Dinnerbone issued server command: /ver

    (Log for online mode proof)
     
  4. andrewkm

    Patron ⭐⭐⭐

    Update to 1091.
     
  5. Was running build 1086 when this exploit hit me just about 10 minutes ago.
     
  6. TitanicFreak

    Patron

    You better update asap. I'm fairly sure that is an affected build so yeah, better update as soon as you can.