Crafting a Minecraft 0day...

In this video I show off my new XRay mod, we go mining, almost die in the Nether and discover a vulnerability in the Minecraft Protocol. Just another normal Minecraft:HACKED episode!
Checkout ilmango: / ilmango
SciCraft: / scicraft_
XRay Mod Inspriation: github.com/ate47/Xray
Minecraft Protocol: wiki.vg/Protocol_Encryption
AES CFB: en.wikipedia.org/wiki/Block_c...)
The Bug Report MC-249235: bugs.mojang.com/browse/MC-249235
Episode 05:
00:00 - Intro: ilmango/SciCraft shoutout
01:16 - XRay Mod
02:12 - Let's Play: Mining & Enchantments
05:16 - Mojang to Microsoft Account Migration
11:15 - Let's Play: The Nether
13:42 - Auditing Minecraft Encryption Protocol
16:14 - Attacker Observes Traffic
16:51 - Attacker Controls Malicious Server
21:07 - Auditing AES/CFB8 Encryption
24:00 - Proof of Concept Attack
26:00 - Reporting to Mojang
27:19 - Let's Play: Herobrine
Copyright Music:
C418 - Minecraft Soundtrack
=[ ❤️ Support ]=
→ per Video: / liveoverflow
→ per Month: / @liveoverflow
=[ 🐕 Social ]=
→ Twitter: / liveoverflow
→ Instagram: / liveoverflow
→ Blog: liveoverflow.com/
→ Subreddit: / liveoverflow
→ Facebook: / liveoverflow

[@LiveOverflow]

Just in case anybody wonders about disclosure timelines. Since reporting my issue, I have heard about a related issue reported in November. So there was plenty of time. But even if that wouldn’t have been the case, I still believe the issue is not really exploitable in practice. As I said in the video, even I wouldn’t prioritize fixing this issue :)

[@-..._-.]

alright

[@tenredstonetypek1076]

That ilmango intro 😂

[@yy6u]

good point, makes for a nice clickbait title through

[@Marenthyu]

The newest Snapshots have added "encrypted chat" - perchance that was in response to these reports?

[@nikohegeheiskanen]

Interesting enough I noticed the vulnerability when you showed the the picture because I remember exploiting the same vulnerability in CTR mode for AES :D

[@itskdog]

Laughed my head off and I'm not even 10 seconds in. The ilmango intro parody was AMAZING.

[@recrucity]

I love how you divide these videos up with gameplay, hacking and programming! Keep up the good work!

[@arcowo]

This would be a great opportunity to create a "nuker" hack!

[@fledermaus7061]

4:47 You can't obtain mending from an enchantment table as it is considered a treasure enchantment. 13:15 Abuse the 3 second invulnerbility after connecting to a server

[@natew4724]

I thought the invulnerability was "fixed", at least with fall damage.

[@fabriperoconalgomasytodojunto]

I thought that only worked in singleplayer, does it really work in multiplayer too?

[@tabletkatabletkova1107]

Also, whe he is testing the proof of concent attack, he joind the game with main account(he has correct tools and is on lets play world, then switched to creative and tested it. So he has already escaped, by any way :)

[@fledermaus7061]

@@natew4724 It's intentional

[@stekeblad]

I wonder if the 3 seconds can be increased. It takes minutes to join worlds when playing modded...

[@tr7zw]

THANK YOU for explaining the implications of the account migration correctly. I've worked on the anticheat/antibot end in ~2016-18, and the amount of hacked accounts used for cheating and botting are way up in the multiple of millions. Bots auto joining the server, walking to some predetermined spots and spamming private messages to all online users with links/serverips, running for 24/7, while you are banning them every 30-60 second. Hackers just throwing tens or hundreds of accounts against the anticheat to try to figure out settings that it won't detect. The account migration came WAY too late IMO, looking at the madness from the peak times of Minecraft.

[@jlle5289]

FYI it’s still possible to use non migrated accounts

[@JoaBro]

@@jlle5289i think it's actually mandatory as of roughly a week ago

[@Bluepaccao]

Sounds great for you! I unfortunately lost access to my 10 year old minecraft account

[@Koroistro]

@@Bluepaccao I had a friend which lost access to theirs, if you have proof of payment (ideally the mail they sent you when you opened your account) they can get your account reinstated, he was successful in doing so. This was a couple of years ago.

[@Bluepaccao]

@@Koroistro Thank you for the information. Unfortunately the only thing I have lost access to is my google account which has been removed because of inactivity. And I wasn't able to change the email adress associated with my minecraft account because of the migrations. :P

[@eleos5]

"I almost got killed" *loses half a heart

[@computerdores]

A tip for the future: If you find your self farming ancient debris DON'T use TNT, use beds instead! Beds are way cheaper

[@BooleanDev]

unless you have a gunpowder farm, then use tnt

[@cscback1318]

bed wasnt efficient tho, and cause a lot of fire

[@KLEY_]

beds are not stack and not destroyed in one time

[@Skelyvelocirap]

The reason tnt is usually used is because you can stack it. Last time i checked you can’t stack beds anymore, but I honestly have no clue because im still behind slightly on the versions...

[@bwjclego]

I've done both, and if you have any sort of gunpowder farm, TNT is *vastly* superior. But I am actually partial to just straight strip mining at y=15, seems to be just as fast with a good pick, and much more mindless and resource light.

[@EnZaXD]

In Minecraft 1.8 there really was a bug in the login system, Spigot had tracked the socket address of the connection in the login handler without checking whether the address is zero, you could then reset the IP to "zero" with a TCP reset and trigger a NullPointer in the main thread, this then led to the server closing immediately with "Server closed".

[@itsxunlight]

Love seeing ilmango in the description, since I was asking if you know him under your last video. Grüße gehen raus!

[@1Hippo]

@Haze Ja, aus Berlin :)

[@justanormalperson]

gotta say, the xray mod reminds me of good old TeamAvolition griefing videos back in 2011-2012 :) if i remember correctly they were one of the first ones to use/create hacked clients (correct me if im wrong)

[@0xGRIDRUNR]

my cryptography teacher focused too much on math and I lost interest real quick due to the sheer complexity of all of the math AES uses, but the explanation for ECB and CFB was incredible! I never understood what my teacher was getting at and the diagrams didnt make sense to me (yet somehow I graduated this past spring lmao) but it now is clear. This series is awesome!

[@0x225]

Amazing that you also found the same AES vulnerabilities that we found over the years just reading random game code, we don't believe this to be significantly exploitable as you have stated as sure you can modify packets but if you cause any malformed packet your basically done and it only lets you manipulate the stream but they do technically reuse IV and key (they also use the key as IV) between the server and client but in our limited experience with AES CFB you can probably only decrypt the first block but we are not entirely sure because we are not cryptographers but we determined this as something not exploitable in a significant way so we never reported it.

[@aweloop6248]

If you can change a part of the message cant you just exchange the whole message? Like changing a simple "hello" to the text you desire?

[@aiyaonishi3282]

Didn't expect to see the Future client developer here. Hallo!

[@meilihr3982]

:o 0x22 watches LiveOverflow!

[@0x225]

@@mattmurphy7030 I mean it is not entirely the same comparison but in the case of Minecraft this is not serious at all for what can be done but from what actual cryptographers have said what is being done here is bad and bad practice but is probably fine :) If they used a much better cipher they would actually have much more of a problem then what they have right now if everything else was the same. The cryptographic usage in Minecraft is held together with a thin string that just happens to be secure enough for the threat model unless it is possible to recover the key/iv or the internal AES state.

[@0x225]

@@aweloop6248 You should be able to change up to 128 bits then the next AES block will be out of sync and will probally fail to decrypt due to the internal AES state no longer being in-sync.

[@ChakaHamilton]

This was a great one! I love the though process and theory , implementation.

[@BooleanDev]

4:40 you cant get mending at the enchantment table anyways, you must find it in a loot chest or trade with a villager, or fish in open water (no blocks around, nothing above the water)

[@InDieTasten]

I think fishing in areas with treasure loot also works

[@BooleanDev]

@@InDieTasten oh yea that too, I forgot since it's somewhat new

[@NatoBoram]

Fishing it is very impractical, though. It's better to enslave a village to get all the best enchantments before you craft your Netherite armour.

[@tissuepaper9962]

@@NatoBoram "afk fishing is too easy we want players to use _S L A V E R Y_ instead" - Mojang, probably

[@arturoleveau2897]

Thanks for this videos! i've been really enjoying this playlist. i stayed HOURS yesterday setting thequarry Proxy. and i learned a lot in the process . thanks again man!

[@tristanmacc]

once again another amazing vid, loving this series and cant wait to see what else is down the line

[@payzuni6484]

I absolutely love this series.

[@MrPokemon7777]

By the way, when you load the world back up, you have a small invincibility window.

[@ursupator3606]

Very good job on those videos, learning a lot from them and they motivated me to keep learning programming for a project I would like to do. Thank you very much!

[@UYNiko]

I basically did the “Evil Server” thing a while ago to track stats and do other cool things like creating replays by recording the packets, I got around the Mojang auth server issue by creating a server that dosn’t auth with mojang and I did the auth server side (obviously I used my own account), alternatively you could use two accounts which was what I ended up doing after a while (mostly to get my skin although I discovered a way to get any skin by messing around with the respawn packet), by doing this I was able to read and modify packets, I even wrote some stuff to manipulate packets in python that was stupidly easy to use, basically you could use a decorator to filter packets (including the info inside the packet), I kinda want to revive the project now, it was a lot of fun and now I’m sure I can get around some of the issues I had at the time, the filter chugged if I had to deal with a lot of packages because I basically had no idea about data structures and big O lol.

[@Bluscream]

Can you please send me a link to your repo?

[@UYNiko]

@@Bluscream I never made it public, it was for personal use to track stats on a mini game called Dwarves vs Zombies (not cheating although I could’ve cheated if I really wanted, that’s why I never made it public), the server had a way to track stats but they removed them when they changed hosts that’s why I created the project, eventually I did other cool stuff with it which was the reason why I was able to modify packets (I need to modify them for the replays, some of the packets needed to be modified before sending them to the client, I had other ideas to do some crowd control stuff and I created a bot to notify me when a game was about to start, etc), I remember I was writing something to create plugins for it, eventually I abandoned the project when the server started dying and I started getting serious with university.

[@fizzdev]

That's awesome, if you do revive the project it'd be cool if it could be open source

[@eyeborg3148]

Does this mean all “offline mode” servers are vulnearable to the MITM attack described?

[@germankerman984]

@@eyeborg3148 Yes, they are not protected against any MITM attacks

[@TwurtleX]

I can't speak to the similarity of the exploit, but there was a similar attack used by Nodus Session Stealer almost 10 years ago. It doesn't work anymore of course, but this made me remember it :)

[@TwurtleX]

@DownloadPizza It involved an admin/op logging into your server to hijack their session to op yourself on the server they're op on. You can lookup how it worked here on KZbin, but I don't recall there being anything relating to logs.

[@0x225]

indeed the session stealer was patched by protocol encryption.

[@kitlith]

I'm pretty sure the first attack described that is foiled by the server hash check *is* the attack that was used by session stealer. The vulnerability that is still present (known plaintext, manipulating the encrypted packets) has potential to do similar things, but with much less flexibility (i.e. if the world/chat loads in it may be immediately recognisable as *server they're admin on*, there's no possibility of throwing up a real server that is just a front for stealing the player sessions.

[@aidan7913]

patched since minecraft snapshot 12w17a

[@Pritam252]

I love how the start is IlmangoOverflow! Love these videos keep up the good work!

[@gam_lol]

for a second i though i clicked on a ilmango video lol

[@hl2mukkel]

I love this series, that intro is awesome hahaha

[@anand_bhasme]

This series keeps getting better and better

[@LucaDornseifer]

This series inspired me to learn java. :) Keep up the amazing Videos!

[@provokateurin-dp6br]

really good episode! i love the series. the ending was truly minecraft youtuber cliche

[@simonkhouryAU]

haha immediately got the ilmango reference... loving the series.

[@ripplerxeon]

Love this kinda explaining ... So easy to understand ... Thanks you I really mean it

[@TheFerdi265]

That intro was the best crossover I've ever seen

[@sanderbos4243]

Before watching this video I watched two of ilmango's videos and I had another one I was planning to watch later, so I was very confused when I clicked this video's tab, haha!

[@1918]

dude i love you. just handing out free education to anyone and including your non-biased views. thank you!!

[@drkwrk5229]

Had a lot of fun watching this :)

[@nyuh]

that ilmango intro caught me off guard. great video as always lol

[@DanteDeRuwe]

Love the ilmango-inspired intro!

[@superzolosolo]

I love these videos because they are exactly at my level while being entertaining too!

[@pvic6959]

LOL tat intro! gota love ilmango :)

[@IannoOfAlgodoo]

LOVING these videos!

[@drgabi18]

the ilmango intro, lmao

[@luqdude]

7:14 On the topic of botting servers and using throwaway accounts, it's a pretty big issue for smaller servers (i would argue an even bigger issue) as well. I used to mod a minecraft server that has now shut down, and there were at least 10 different times where the server got botted that I know of (only played on the server for around a year, but there were definitely more than 10 from before). Our discord server also got botted multiple times (either accounts spamming channels or DMing everyone on the server with advertisements for other servers) because of how easy it is to make a discord account. It used to be pretty major, and I believe that migrating to Microsoft accounts would help a lot, but of course that wouldn't get rid of it entirely. EDIT: we also had a lot of cases where people would be hacking on throwaway accounts, on bigger servers like Hypixel there's a pretty big chance that the account is already banned since someone else already used it, but on smaller servers that chance is way lowered. Our rules were that you could have up to 5 different accounts linked (accounts get linked if their on the same ip) before you got IP banned, but only sr. mods could IP ban so us normal mods would end up having to ban people 10+ times until a sr mod got on.

[@luqdude]

​@Ryan We had a custom plugin that would tell us what accounts were linked to a specific IP and track that automatically, but IP banning them was a manual thing. There are cases where if someone logged on with a VPN their accounts would then be linked to 10+ other accounts, so we would be able to leave a note for other moderators to not ban them. If the bans were automatic then it wouldn't be able to check the notes. There's a bunch of other cases like this where we wouldn't want the IP bans to be automatic.

[@luqdude]

​@@mattmurphy7030 I'm confused by what you mean? I know what a whitelist is, and I'm pretty familiar with java, but I'm confused as to how that's related

[@programorprogrammed]

Great series! 10/10

[@afunkymonk7107]

I got so confused at the intro, wasn't expecting an ilmango intro. But i guess you found technical minecraft, ill just say welcome

[@spicybaguette7706]

I actually got banned from hypixel because someone hijacked my account, they also changed the password. Luckily I could reset it with my email. Definitely taught me a lesson😁

[@TheoVonMiscClips]

wasnt hypixel hacked recently through a godaddy domain hack?

[@TheoVonMiscClips]

@@antonio32a yea lmao, i did some research they tried to get donations for hypixel "shutting down" and their blockchain address's only received 14 bucks USD 😂. Plus the dude that did the thing started shit talking the hypixel admins like he got root to their servers. everyday we stray further away from God...

[@volka2199]

Same happened to me but I wasn't banned. My account was compromised for a period when I didn't play. I changed my password upon discovering someone else used my account and changed my username and skin and then years later when I decided to play hypixel with a friend I found I already had former scores and game history for some of the minigames despite never playing on the server.

[@aaaa-fi1dm]

Not sure if you fixed this or not but with your Xray code you showed in your video it looks like you are rendering block faces that are occluded by other Xray blocks. Probably should check for that to increase performance, even though it shouldn't be super noticeable due to ore being infrequent, but its something to keep in mind.

[@0x225]

Blocks are rendered in a VBO multi-threaded so it won't hurt that much but he is actually having some issues with block culling already and that is why he is unable to see the portal while in the nether. I honestly think how he is comparing the blocks causes more a performance hit then anything else here.

[@AMaplestoryFan]

A lot of liveoverflow's code in his hacking videos is unoptimized; and intentionally so. He's just writing code to perform a hack, not to develop a fully-fledged feature

[@JayJay-ly4er]

i love this series

[@techtheguy5180]

Just seeing that il mango intro is a quality warranty

[@juanp5308]

One lil thing: in TheAltening, nfa or non full access normally get blocked in a very short time, while with full control accounts it is basically impossible to find your account blocked. The price increase was not because of the migration, but because of reliability

[@Sakrosankt-Bierstube]

Du hast dir bei dem Intronachbau sogar so viel Mühe gegeben, dass die Mini-Logos exakt gleich sind xD I love it.

[@Reichstaubenminister]

iloverflow

[@Matt0x00]

Haha love the mango intro!!!

[@MaximusMuleti]

I wish computer programming classes were taught like this when I went to school for networking. It would hsve made things a LOT more interesting. And practical, as you'd see the results from what you ve done in a real world example

[@theremyyoutube5431]

6:17, the chats are not from botting at all ! Just plugins on a Minecraft server !

[@glitchtime404]

You got me with the ilmango in show you evil evil man

Now THIS is the kind of hacking I was expecting from LiveOverflow! Great!

[@LiamDennehy]

Last episode was a lovely credit for LogicalGeekBoy, now a beautiful tribute to Ilmango - which of my other favourite Minecraft content creators are you also a fan of?

[@itskdog]

He also featured clips from Bdubs showing off Litematica in an earlier episode

[@zworx5236]

6:15 if anyone was confused those are messages the server is sending not actual accounts (that's why they're colored, the server plugins are their origin)

[@PolyRocketMatt]

I see that LiveOverflow has met IlMango, very nice :D

[@katjastrand3955]

I love this series

[@sodiumz7161]

Love the intro lmao

[@destru8633]

the intro had me so confused I thought I was watching ilmango for a sec

[@kezzyhko]

That is one really great thumbnail!

[@Plyrs]

damn i thought i watched the wrong channel since i also a fan of ilmango for their amazing farm build and the explanation on how it works

[@relt_]

i liked this video with all my alts just because of the intro

[@estrobedaaxios2329]

The Mojang account was really security through obscurity. I lost my email for my Mojang account 3 times, one time I got my account back through some back and forth with the support. The other two times the support sent a link for email recovery, like password recovery but for the email so you could change the email for the account. So you changed the email to a known email and then did a regular password reset. That email change thingy were quite difficult to find on your own though but like... Geeeze

[@wiger_]

cool video, didn't watch it yet but the title suggests it's gonna be awesome

[@Leo-sx9jz]

love the intro hah

[@Jinado1]

Just 6 minutes left! It will be the longest 6 minutes of my life

[@user-lz2oh9zz4y]

Nice intro :)

[@bloootz]

God i love these videos!

[@seesoftware]

Woud it be possible to bruteforce a series of bytes one byte at a time which encrypted happens to match the xor of the previous byte so you get the desired result? im sure its not possible to get every combination of bytes via this method (if it is even possible, i dont have much clue about innerworkings of encryption algorithms) but there might be some things that are possible?

[@labrosmatsas]

I laughed so hard with the intro. LOL

[@AS-hs4xk]

Let’s friking goooooo

[@Psychopatz]

That intro almost made question if I even clicked the right thumbnail lol

[@solider444]

you should add a fast mine mudule for your hacked client. since it makes it much easier to mine/collect new blocks such as obsidian

[@retzerR]

At the beginning I thought that KZbin stuffed up the id, and I was watching another subscriber XD

[@Rakesh37187]

I remember session stealers back in beta. Awesome times honestly lol

[@fdbhiroshima8979]

when you log in a world, you have a few seconds of invulnerability, even if you felt in lava, you'd have ample time to fly away and just take fire damage once the invulnerability worn off

[@spacenoodles5570]

Haha that intro!

[@sungodmoth]

You have NO IDEA how off-guard that intro caught me

[@KaseCami]

I was really confused, I thought I clicked on a LiveOverflow video and then the ilmango intro plays xDD

[@trexake]

Have you tried any fuzzer (e.g. Jazzer) to see if you can find any evil packages that could cause ”fun” behaviour? Been thinking of this but haven’t taken any time do dig in the code for where to jack in the fuzz data.

[@peacefulexistence_]

That ilmango intro killed me

[@Omena0]

OMG THE ILMANGO INTRO 🤣🤣🤣😆🤣

[@playerguy2]

12:54 for as interesting as this dive into the network protocol is and as good as the plot device your fly hack failing over lava is,.. .. as some experienced Minecraft players know: upon connecting to a world, local or remote, the player is given a brief period of invincibility. ~~ This can be abused. ~~ You could repeatedly connect and disconnect, swimming fractions of a block at a time between disconnections and get to safety.

[@kpk1171]

I was so confused by the ilmango intro that I had to make sure I clicked the right video

[@stacklysm]

That intro caught me off guard lmao

[@aprilnya]

i dont know why but the shot at 0:35 is SO funny to me

[@AlexDicy]

This intro destroyed me. I burst out laughing HAHAHA

[@gazehound]

Woah, the intro on this video SERIOUSLY short circuited my brain.

[@tw11tube]

Well, I think you missed out on crypto education on this video. This is a perfect example for two basic crypto issue: - You don't only want confidentality, you also want authenticity. (For the audience: Authenticity works by sending a value that binds the message to a shared secret. As the MITM attacker wouldn't have the shared secret, it can change the message, but it can't know how to update the authenticity information.) - You don't roll your own crypto, you use an established protocol. As this is about securing stream connections, you shouldn't roll your own AES-CFB8 based encryption protocol, but just use TLS. And guess what: TLS didn't forget about authenticity, and after years of exploits and fixes, TLS finally got authenticity right.

[@jfb-]

Interesting; I used the same AES trick in a recent CTF-like challenge

[@0x225]

probably close but the Minecraft one is less exploitable than most unless there is something I am missing but afaik it should only be possible to modify 1 AES block before the state will be wrong and even though Mojang has bad practice with iv and key usage that is also probably fine.

[@xdMatthewbx]

a little bit disappointed you didnt do something fancy to escape the lava, very interesting vulnerability though. funnily enough there were attacks with similar difficulty pulled off rather frequently back in minecrafts infancy so i honestly wouldnt be surprised if it couldve been used back then actually now that i think about it if one were to register typo domains for big servers they _could_ actually have a shot at pulling this off. not to say you shouldnt have included it though, as you said theyve had time to look at it. just think we might actually see (or not see) this used especially since minecraft to the best of my knowledge doesnt use SSL (mojang should implement that along with the enhanced cryptography theyre adding in 1.19) on the topic of the 1.19 cryptography stuff, i would like to see a regular style video going over how that works. nobodys really said anything about how thats implemented yet, just that "chat messages are signed now" and "this is good for security" (which it probably is assuming theyve done it well, but maybe you might find something if you look in to it like you did here)

[@LiEnby]

this can easily be fixed if mojang simply used AES-CBC instead.

[@xdMatthewbx]

@@LiEnby wonder how easy of a fix that is

[@adiopot]

Very good video. Your x-ray mod reminded me of other old hacked client mods that might be fun to replicate. 1- Waypoints, like your base. Old mods seemed to use a line drawn on screen towards that waypoint. 2 - minimap There are a bunch of old things that could be fun to reproduce.

[@FennecTECH]

“Turns out they were all empty”. We’ve all had this letdown Each and every minecrafter has had this letdown

[@Decommissioned]

Haha the ilmango intro

[@wizardkashy3133]

people do build hacked clients for hypixel specifically, to bypass its anticheat. so not only do the fake hackers have access to several accounts, they can cheat for much longer than you'd expect. so thank gosh for the migration.

[@SinanAkkoyun]

YES

[@ChillerDragon]

27:33 the most unimpressed herobrine encounter in the history of minecraft

[@Lim95]

Man, if Java wasn’t so finicky with compilation i would attempt to do this. Great job, and it’s cool that you’re making your own hacked client.

[@samuelhulme8347]

Using maven or gradle can help you easily compile java

[@ErikUden]

The intro got me LMAO

[@billy-cg1qq]

Herobrine looking down on you at the end like a God can only make me feel a big awe towards him

[@kenzostaelens1688]

how about trying to make/modify items (like you said you wanted mending)