WARNING! Backdoor Plugins!

Discussion in 'Spigot Discussion' started by tamirawad, Jun 2, 2021.


What do you most use?

Poll closed Jun 9, 2021.
  1. Worldedit

  2. Worldguard

  3. EssentialsX

  1. Hello!
    *Sorry for my bad english*
    This message is for new server owners!

    I was testing some code and then i had the idea of making a backdoor plugin so i opened eclipse and got to work on a test. i called the backdoor plugin "Zelt" it had many features like getting access to console using a GUI Application, And MORE! then i realized that people can use backdoor plugin as malicious use, Please be carful about what Plugin / Mod / Client you install because it might be backdoored...

    What people can do with a backdoor access:
    1) Greif your server
    2) Ban people
    3) Access Console
    4) ALOT MORE

    What plugins should i trust?

    Essentials: CLICK ME
    WorldEdit: CLICK ME
    WorldGuard: CLICK ME
    Alot of other plugins you can find here: CLICK ME or CLICK ME
    And if you want to use any plugin that u do not trust u can decompile the plugin by going to: https://jdec.app and uploading the .jar file.

    And again sorry for my bad english. i tried my best.

    If you need any help on picking plugins, you can ask in the discussion.
    • Like Like x 1
  2. if i posted this in the wrong catagory how can i move the post to a other catagory?
  3. You can report your post and ask mods to move it for you.
    • Agree Agree x 2
  4. Thanks
  5. Good and important message.

    Additional to the caution that server owners should take, @OpticFusion1 (who just got promoted to be a resource staff) has created the MCAntiMalware project which tries to detect backdoor code and also uses hash-based file blacklisting as well. He also automatically scans and manually looks at free spigotmc resources from time to time.

    I somewhat recently joined the automatic scanning as well to detect forbidden obfuscastion usage in free plugins, during that I found a couple obfuscated backdoor plugins as well.
    • Like Like x 1
  6. Backdoor plugins aren't very new, but a reminder of the dangers of backdoor plugins is good. There are some nasty ones that even lock out the console (only server kill function works to end it, usually hosts end or the kill button for servers).
  7. my backdoor plugin an lock the console. its just too op.

    i need to give a reminder to new server owners.
  8. Optic_Fusion1

    Resource Staff

    *coughs* @Optic_Fusion1

    as for the thread its self, as others have said malicious plugins aren't new. There have been 398 malicious plugins found since 2019. Upload dates ranging between 2016-2021
    • Funny Funny x 1
  9. I'm wondering how many malicious plugins there are on Bukkit.org :unsure:
  10. Before bukkit fell apart they had volunteers check plugins and plugin updates.
    • Informative Informative x 1
  11. Yea I know it isn't knew but new server owners probably won't know about backdoor plugins
  12. Btw I just saw you got promoted to resource staff. I don't even know who you are but congrats
  13. Strahan


    You must be new, heh. Optic is a fixture here :)
  14. Optic_Fusion1

    Resource Staff

    To an extent anyways lol
    • Funny Funny x 1
  15. Good to know the @op can't be trusted. On to the ignore list you go.
    • Agree Agree x 1
    • Funny Funny x 1
  16. Optic_Fusion1

    Resource Staff

    I mean, there's valid reasons to make malware, as long as it's not shared publicly.
    For example, I'd make one to try and bypass my own AV
  17. The bigger question is how many malicious plugins haven't been found?

    Bukkit staff would decompile every plugin. I think only two slipped by them. (And one was an attempt by someone to test the staff. He got banned even though he said it was only a test.)
  18. Optic_Fusion1

    Resource Staff

    At some point I'll go through 28k+ resources, so I'll most likely find ones that aren't being detected already ;)
    • Winner Winner x 1
  19. Just remember, undetectable backdoors are infinite in variety.
  20. Holy words, said by a true resource manager :cool: