A Player Named Notch logged In

So, I woke up today to something interesting. I log on skype, and all my staff start asking if "that was me". I have no clue what they're talking about. They send me some screenshots.

Ones in which LB logged "Notch" breaking blocks:


Ones where he is walking around:




At this point, I thought one of my admins was pulling an elaborate hoax. I ask them in a group chat which one it was, and I need to know. They all say it was me, because I logged on skype when Notch logged in. Now, I know for a fact it wasn't me. I started to wonder "What if this is the real thing?"

So, I go to the server logs. grep "Notch" server.log.

Code:

2012-07-13 10:38:24 [INFO] [Architect] Super_6: Lets do Notch.
2012-07-13 10:38:54 [INFO] [Architect] Super_6: Lets do Notch
2012-07-13 10:39:23 [INFO] [Architect] Super_6: Can you place a Notch NPC for us?
2012-07-13 10:39:52 [INFO] [Architect] Super_6: D: But we're making a Notch...
2012-07-13 10:42:10 [INFO] [Architect] Super_6: Notch*
2012-07-13 10:42:42 [INFO] [Architect] Super_6: Its a Notch XD
2012-07-13 10:49:24 [INFO] [Architect] Super_6: Notch ftw.
2012-07-13 10:50:22 [INFO] [Architect] Super_6: How big is Notch's mouth? >_>
2012-07-13 10:54:42 [INFO] [Architect] Super_6: Fucking Notch with your confuzing face...
2012-07-13 11:19:23 [INFO] [Architect] Super_6: Notch ftw.
2012-07-13 14:40:11 [INFO] [MCBans] Notch has connected!
2012-07-13 14:40:11 [INFO] Notch [/50.71.134.191:53730] logged in with entity id 116111 at ([flat] -195.5, 78.62000000476837, -16.5)
2012-07-13 14:40:23 [INFO] [Outsider] Notch: hello
2012-07-13 14:40:34 [INFO] [||Moderator||]  PatriotUSA: Notch?! :O
2012-07-13 14:40:48 [INFO] [Outsider] Notch: hi
2012-07-13 14:40:57 [INFO] [Architect] Super_6: Notch
2012-07-13 14:40:58 [INFO] [Architect] Addnan: Notch joined. xD :L
2012-07-13 14:41:13 [INFO] [Outsider] PoppyToppy: Hi Notch, are you the creator of minecraft?
2012-07-13 14:41:16 [INFO] [Architect] Super_6: Notch! >_>
2012-07-13 14:41:18 [INFO] [boosLogger] Jozzbo used command /call Notch
2012-07-13 14:41:23 [INFO] [||Moderator||]  PatriotUSA: Notch!
2012-07-13 14:41:27 [INFO] [Outsider] Notch: yes
2012-07-13 14:41:29 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:41:30 [INFO] [Outsider] D_Man52: Notch!!
2012-07-13 14:41:48 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:41:50 [INFO] [boosLogger] eviledrick used command /call Notch
2012-07-13 14:41:52 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:41:53 [INFO] [Architect] Addnan: Wait, if that is Notch, why isn't his name yellow? >.>
2012-07-13 14:41:54 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:41:54 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:41:55 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:42:00 [INFO] [Outsider] Notch: hi
2012-07-13 14:42:06 [INFO] [Outsider] Notch: yes
2012-07-13 14:42:08 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:42:17 [INFO] [Outsider] leMisterMike: Notch?
2012-07-13 14:42:22 [INFO] [boosLogger] eviledrick used command /call Notch
2012-07-13 14:42:28 [INFO] [Outsider] Notch: nope its me:D
2012-07-13 14:42:31 [INFO] [||Moderator||]  PatriotUSA: Notch I have a test for you
2012-07-13 14:42:31 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:42:58 [INFO] [||Moderator||]  PatriotUSA: If you are Notch then tell me what color Jebs hair is
2012-07-13 14:43:06 [INFO] [Outsider] Notch: guys who do u really think can hack my account think about it
2012-07-13 14:43:11 [INFO] [boosLogger] Jitch94 used command /call Notch
2012-07-13 14:43:20 [INFO] [Outsider] leMisterMike: Notch, no one can hack it.
2012-07-13 14:43:30 [INFO] [Outsider] Notch: uhuh
2012-07-13 14:43:34 [INFO] [Citizen] Jozzbo: someone could have the cracked version and named themselves Notch
2012-07-13 14:43:35 [INFO] [boosLogger] PatriotUSA used command /mb I dare you to make you tags Notch
2012-07-13 14:43:35 [INFO] [boosLogger] eviledrick used command /call Notch
2012-07-13 14:43:36 [INFO] [Architect] Super_6: If you are Notch, what is Programmo?
2012-07-13 14:44:20 [INFO] [||Moderator||]  PatriotUSA: Notch what brings you to us?
2012-07-13 14:44:21 [INFO] [Architect] Super_6: If you are Notch, what is Programmo?
2012-07-13 14:44:29 [INFO] [||Moderator||]  PatriotUSA: Notch what brings you to us?
2012-07-13 14:44:36 [INFO] [Outsider] PoppyToppy: Notch, Get Jeb to join.
2012-07-13 14:44:39 [INFO] [Outsider] codguycallum141: who else has the name Notch? Eh?
2012-07-13 14:44:47 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:44:52 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:44:59 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:45:01 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:45:02 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:45:02 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:45:07 [INFO] [Outsider] TheShoxter: Notch where u at
2012-07-13 14:45:18 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:45:19 [INFO] [boosLogger] leMisterMike used command /call Notch
2012-07-13 14:45:24 [INFO] [Outsider] Notch: halla min flaktar dess min skara
2012-07-13 14:45:25 [INFO] [Outsider] comoasi19801: Notch doesn't play minecraft i believe
2012-07-13 14:45:36 [INFO] [Outsider] ThePixelatedMan: noobs, Notch's name is purple
2012-07-13 14:45:49 [INFO] [Architect] Super_6: Notch does play Minecraft
2012-07-13 14:45:51 [INFO] [Citizen] Jozzbo: guys you know Notches nameplate is gold
2012-07-13 14:46:13 [INFO] [Outsider] leMisterMike: Notch, if you are real, tweet about BeastsMC
2012-07-13 14:46:35 [INFO] [Citizen] Jozzbo: so the word Notch would be gold
2012-07-13 14:46:48 [INFO] [||Moderator||]  PatriotUSA: Notch om det är man då berätta för mig vad min favoritfärg är!
2012-07-13 14:47:07 [INFO] Notch lost connection: disconnect.quitting
2012-07-13 14:47:07 [INFO] [MCBans] Notch has disconnected!
2012-07-13 14:47:43 [INFO] [Outsider] comoasi19801: lol "give me money notch" Notch: RAGEQUIT
2012-07-13 14:47:48 [INFO] [boosLogger] Addnan used command /msg jort tp me to Notch. >:) :L
2012-07-13 14:47:48 [INFO] [CommandBook] (PM) Addnan -> jortgutter: tp me to Notch. >:) :L
2012-07-13 14:48:46 [INFO] [boosLogger] leMisterMike used command /who Notch
2012-07-13 14:48:53 [INFO] [Outsider] leMisterMike: is Notch still here?
2012-07-13 14:53:26 [INFO] [boosLogger] PatriotUSA used command /mb :o I griefed Notchs hole :(
2012-07-13 14:56:38 [INFO] [boosLogger] eviledrick used command /call Notch

According to the logs, Notch did login! Now, I'm not gullible, so I immediately start believing that it's some hack. I begin to look deeper. I believe I was right. First, I use geoip to discover the "Notch"'s IP is actually from Canada. Now, I search the server log for his IP.

grep '50.71.134.191' server.log

Code:

2012-07-05 22:17:29 [INFO] chatty10 [/50.71.134.191:50787] logged in with entity id 22148 at ([flat] -494.173781414632, 74.0, 742.9165568106432)
2012-07-05 22:21:04 [INFO] chatty10 [/50.71.134.191:50814] logged in with entity id 22356 at ([flat] -489.50836392326966, 61.0, 731.3022350571713)
2012-07-06 12:35:32 [INFO] thingizzy [/50.71.134.191:49762] logged in with entity id 57111 at ([flat] -498.88174917147563, 65.0, 738.4837741477785)
2012-07-06 12:35:37 [INFO] chatty10 [/50.71.134.191:49313] logged in with entity id 57150 at ([flat] -495.56232290184306, 78.37380380545858, 751.5426045115777)
2012-07-06 12:40:01 [INFO] chatty10 [/50.71.134.191:49334] logged in with entity id 58941 at ([flat] -229.32355170818474, 64.0, 20.94373495851093)
2012-07-06 12:41:41 [INFO] Disconnecting chatty10 [/50.71.134.191:49384]: griefing
2012-07-06 12:42:02 [INFO] Disconnecting chatty10 [/50.71.134.191:49436]: griefing
2012-07-06 12:42:08 [INFO] Disconnecting chatty10 [/50.71.134.191:49443]: griefing
2012-07-06 12:42:17 [INFO] /50.71.134.191:49391 lost connection
2012-07-06 12:42:24 [INFO] Disconnecting chatty10 [/50.71.134.191:49451]: griefing
2012-07-06 13:57:44 [INFO] /50.71.134.191:49717 lost connection
2012-07-06 16:15:53 [INFO] Disconnecting thingizzy [/50.71.134.191:50095]: griefing; logblock proof.
2012-07-06 16:15:53 [INFO] thingizzy [/50.71.134.191:50095] lost connection
2012-07-13 14:40:11 [INFO] Notch [/50.71.134.191:53730] logged in with entity id 116111 at ([flat] -195.5, 78.62000000476837, -16.5)

So, it appears "Notch" has logged into to my server before using different usernames. What a coincidence, they also all got banned!


Now, I know what you're all thinking: 'Dumbass must be in offline mode. Of course a player can login as Notch!' I understand why you believe this. I've seen others post about this happening to their servers on reddit, and I thought the same thing. I thought that somehow, they were wrong. Now I know, they weren't. I hope believe this. This needs to be investigated and patched before it gets big.

How do I know I'm not in offline mode?
1. I tried to login with a non-premium account myself to test it. It didn't work.
2. My config says the server is in online mode
3. I use McBans. If the server was in offline mode, McBans would disabled itself and none of my bans would work. Yet, they all still work.

This is a real hack. Somebody out there has either hacked Notch's account or has found a way to bypass the Minecraft login servers.

Mod Edit (c0mp): Removed exploit

 

Someone has found a way to bypass the login servers, for sure.

There was a post about this in offtopic that was locked about this too, and it happened to LegendaryCraft:
https://twitter.com/Legendary_Craft/status/222937836104581120
https://twitter.com/Legendary_Craft/status/222937911329427456

I just found a post on HackForums and apparently it's happened to other people too:
http://www.hackforums.net/showthread.php?tid=2665992

A Reddit post on the same topic with some discussion around it:
http://www.reddit.com/r/admincraft/comments/wc2ey/notch_session_stolen/

It happened to a server I'm very familiar with yesterday.

Something's up.. we've yet to find it though. I'll be editing this post as I find more information.

 

I'm sure we will if we get enough eyes on this problem. Currently, it seems many people just believe the server admins made some mistake and accidently put the server in offline mode.

 

Correct me if im wrong, but the TRUE Notch's name tag over his head is yellow

 

I think we've already established it's not the real Notch, but rather some kind of exploit that allows people to log in using any username on online-mode servers.

 

This is entirely possible to do with a plugin. Any reports I've seen from this we've checked over the plugin list. If its an exploit, its happening outside of CraftBukkit or dev.bukkit.org plugins.

 

An IP look up resolved to Canada, I doubt it is Notch. We could really do with a plugin list from all the effected servers to see which plugins they have in common...

 

I'm fairly certain it's to do with the vanilla Minecraft authentication.

 

Try login in offline mode with the username Notch, it could be that a plugin has been compromised and is allowing players to login with the username Notch, even if it's in online mode?

Clarification: You login with your client in offline mode with the server on online mode.

 

The MITM exploit requires Notch to be logging in to a malicious server.

 

Just tried. Did not work. If you want to confirm it yourself, the IP is c.beastsmc.com.

Would giving you our plugins list help at all?

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

Yes. If you do not want to release it publicly, PM mbaxter and myself with it please.

 

I just had this happen to me too, Came from a guy in new york. his alternate account i had previously banned was FreakyFalse at the ip 66.65.117.42.

 

It happened to me too,

The only thing I'm using that doesn't come from bukkitdev is CraftBukkit++. Is everyone here that had this happen use it too?

happened again just now

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

I just got hit with a fake Notch myself. Apparently he didn't stay online long though.

Code:

2012-07-14 21:56:53 [INFO] Notch [/69.125.98.120:64701] logged in with entity id 977267 at ([world] -715.5, 112.62000000476837, 37.5)
2012-07-14 21:57:07 [INFO] Online (5/75): airsoftman11, epicgreg2369, JaredMcArthur, Notch, doczsoo
2012-07-14 21:57:30 [INFO] Connection reset
2012-07-14 21:57:30 [INFO] Notch lost connection: disconnect.quitting

From a separate log that logs chat:

Code:

7/14/2012 9:57 PM | [CHAT] <Notch(69.125.98.120)>@world(-718,67,29) : Hallo.
7/14/2012 9:57 PM | [CHAT] <Notch(69.125.98.120)>@world(-719,67,30) : I am Notch.

I don't use Craftbukkit++.

EDIT by Moderator: merged posts, please use the edit button instead of double posting.

 

I'd like to contribute :
You can see him failing at hacking me with "EricRB", but the second time he got it right. (Same IP) Cleaned the log, with random OMG NOTCH. Easier to read.

Code:

2012-07-15 13:44:12 [INFO] Notch [/70.73.166.149:62092] logged in with entity id 18501 at ([AITM] -291.5, 187.62000000476837, 59.5)
 
2012-07-15 13:44:48 [INFO] [TownyChat] [G][]Notch: Who is the owner of this server?
 
2012-07-15 13:45:06 [INFO] [TownyChat] [G][]Notch: I'm giving out capes
 
2012-07-15 13:45:17 [INFO] [TownyChat] [G][SSGC]Ericrb: I am
 
2012-07-15 13:45:31 [INFO] [TownyChat] [G][]Notch: Have you migrated to a Mojang account?
 
2012-07-15 13:45:35 [INFO] [TownyChat] [G][SSGC]Ericrb: Yep
 
2012-07-15 13:45:50 [INFO] Notch lost connection: disconnect.quitting
 
2012-07-15 13:45:58 [INFO] EricRB [/70.73.166.149:62152] logged in with entity id 19936 at ([AITM] -285.5, 187.62000000476837, 52.5)
 
2012-07-15 13:46:06 [INFO] EricRB lost connection: disconnect.quitting
 
2012-07-15 13:46:33 [INFO] Notch [/70.73.166.149:62165] lost connection
 
2012-07-15 13:46:43 [INFO] Notch [/70.73.166.149:62173] logged in with entity id 20920 at ([AITM] -264.2088999175959, 60.0, 50.71008426062165)
 
2012-07-15 13:47:32 [INFO] [TownyChat] [G][]Notch: Is Ericrb your Mojang account name?
 
2012-07-15 13:48:02 [INFO] [TownyChat] [G][SSGC]Ericrb: Yes
 
2012-07-15 13:48:14 [INFO] Notch lost connection: disconnect.quitting
 
2012-07-15 13:48:29 [INFO] Ericrb [/70.73.166.149:62185] logged in with entity id 21676 at ([AITM] -258.49454044227707, 69.28826918367736, 22.19577419853288)
 
2012-07-15 13:49:09 [INFO] [PLAYER_COMMAND] Ericrb: /help 
2012-07-15 13:49:16 [INFO] [PLAYER_COMMAND] Ericrb: /help  2
2012-07-15 13:49:20 [INFO] [PLAYER_COMMAND] Ericrb: /help  3
2012-07-15 13:49:25 [INFO] [PLAYER_COMMAND] Ericrb: /help  4
2012-07-15 13:49:31 [INFO] [PLAYER_COMMAND] Ericrb: /help  5
2012-07-15 13:49:45 [INFO] [PLAYER_COMMAND] Ericrb: /help  6
2012-07-15 13:50:10 [INFO] [PLAYER_COMMAND] Ericrb: /ban applefreak197

After that I banned his IP and name with the console. Here's more attempts :

Code:

2012-07-15 13:50:21 [INFO] Disconnecting Ericrb [/70.73.166.149:62197]: The Ban Hammer has spoken!
2012-07-15 13:50:22 [INFO] Player logged in in world AITM
2012-07-15 13:50:26 [INFO] Player logged in in world AITM
2012-07-15 13:50:26 [INFO] Disconnecting Ericrb [/70.73.166.149:62199]: The Ban Hammer has spoken!
2012-07-15 13:50:31 [INFO] Player logged in in world AITM
2012-07-15 13:50:31 [INFO] Disconnecting Ericrb [/70.73.166.149:62200]: The Ban Hammer has spoken!
2012-07-15 13:58:23 [INFO] Notch [/184.10.179.33:61639] logged in with entity id 30022 at ([AITM] -274.12462085573804, 70.0, 21.151696146024797)

 

i know exactly how the exploit is done and someone made a fix with a plugin but hasn't released it.
If a mod/admin of bukkit wants to know the exploit let me know.

TnT
md_5
Dinnerbone

 

It's already very well known and the auth servers were taken down because of it.

https://twitter.com/notch/status/224409514428989440
http://www.mojang.com/2012/07/houston-we-have-a-problem/

 

I think that about ends the discussion. For now.

 

Thank you everyone who warned us about the exploit.

We needed to ensure Mojang had time to respond to the threat due to the nature of the issue. The Bukkit team worked hard to find any exploits in plugins and CraftBukkit itself that could have caused these problems. When we could not find any, we looked for ways to reduce the impact of this exploit until Mojang could respond.

I will miss having Notch on my server though. That cape is fantastic.