Latest News Article

[Neath]

Notch was actually on our server, but when we /whois Notch 'd him, his IP was from America. We are puzzled, and wondering if it was actually him. Here are some screenshots. No we don't have any plugins allowing players to make themselves Notch. Trust me, I wouldn't get any gain from this if I was lying.

First Picture

-----

This picture proves that we have no plugins that can allow admins to make players into others (such as citizens, and other various plugins)



----


----
What he left. That bottom line says "Good Day" in German.



So, is he joining servers from America or was he hacked? What happened? He never once said anything in chat.

[SgtStrikerX]

Yeah, how is this possible, if it isn't him?

[iVizzy]

Lots and lots of people recently are reporting "Notch" has logged into their server. You might find the following link an interesting read. All I would suggest it to shut down your server before any permanent damage is done

http://forums.bukkit...ogged-in.86241/

[The_Waza_Man]

I have heard from the evolution gaming server that minecraft.net was hacked. This might explain why EVERYONE is seeing him.

[PandaNinja223]

In the server settings, is online-mode true or false? If it's false, then it's probably fake.

[iTates]

PandaNinja223, on 15 July 2012 - 05:41 AM, said:

In the server settings, is online-mode true or false? If it's false, then it's probably fake.

Everyone reporting it has been in online mode, as far as I've seen.

[Neath]

PandaNinja223, on 15 July 2012 - 05:41 AM, said:

In the server settings, is online-mode true or false? If it's false, then it's probably fake.

Online-mode.

[mistercrtaz]

Happened to another server I was on, but his name shouldve been yellow if it was the real notch.

[Hellow]

It's a legitimate hack, and it's apparently only affecting people that migrated from Minecraft.net to Mojang accounts.

http://forums.bukkit...ogged-in.86241/
https://gist.github.com/3115176

Advising all server administrators to shut down or use a second-level authentication method, such as X-Auth for Bukkit. Use this tool to see if your account is vulnerable to this exploit:
http://www.teamavoli...es&folder=&id=7

[PandaNinja223]

Well then, you might want to check out iVizzy's post.

[Neath]

Hellow, on 15 July 2012 - 05:47 AM, said:

It's a legitimate hack, and it's apparently only affecting people that migrated from Minecraft.net to Mojang accounts.

http://forums.bukkit...ogged-in.86241/
https://gist.github.com/3115176

Advising all server administrators to shut down or use a second-level authentication method, such as X-Auth for Bukkit. Use this tool to see if your account is vulnerable to this exploit:
http://www.teamavoli...es&folder=&id=7

Thank you, and I will install X-Auth. My other admin is vulnerable. I'm glad so many people know about this exploit. Notch is vulnerable. I am not. Great info! Will get crackin' on it now.

iVizzy, on 15 July 2012 - 05:39 AM, said:

Lots and lots of people recently are reporting "Notch" has logged into their server. You might find the following link an interesting read. All I would suggest it to shut down your server before any permanent damage is done

http://forums.bukkit...ogged-in.86241/

Noted, read, and posted there. Thanks.

[Yoshi]

Same thing happened to us



We had Notch, Antvenom and Citricsquid on our server.

Hope the Mojang team can fix it soon.

- Ladida

[DarkAngelor]

If online mode is set to off..he probably is fake..he may have a cracked launcher for minecraft which basically allows you to use any name..but only in single player..u try multiplayer with fake name..it says bad login..but if your online mide is false..he can enter..notch is swedish..and currently he has nothing to do with minecraft as he is working on Scrolls..mc is under jeb

[Hellow]

This has now hit reddit. Yay. http://www.reddit.co...er_hackers_can/

[iToast]

That's nodus griefing! They didn't get his login but spoofed him

[Jdembo]

This vulnerability seems to be caused by a failure to authenticate usernames with session IDs for migrated accounts. joinServer.jsp will accept any valid session key from a migrated account for another migrated account.

[terra_ff6]

Im glad that my account isnt vulnerable.

On a server I play on, one of the admins got hacked, the hacked admin banned a couple people and blew up the Spleef Arena. Then the Owner Banned him. :S

[Neath]

terra_ff6, on 15 July 2012 - 07:24 AM, said:

Im glad that my account isnt vulnerable.

On a server I play on, one of the admins got hacked, the hacked admin banned a couple people and blew up the Spleef Arena. Then the Owner Banned him. :S

Yes, I de-oped my Developer because he was also vulnerable, just for safety reasons since my server is getting pretty big. Always better to be safe than sorry.

Hellow, on 15 July 2012 - 06:41 AM, said:

This has now hit reddit. Yay. http://www.reddit.co...er_hackers_can/

Glad Good news always comes from there.

[KoolerTheFirst]

Yeah, this is just a hacker trying to get new accounts with the man-in-the-middle exploit, form what I understand.

Just take some extra risks and if any famous people get on your server, ban their IP.

[Raytious20]

I think it's just an NPC there is a plugin on Bukkit.