Server Login Servers Temporarily Offline; Fix For Exploit In Progress

A recent exploit was discovered in the Minecraft authorization servers, which allowed players to log in to SMP servers as any account they wished. Mojang temporarily took down the login servers, and have successfully eliminated this exploit.

Minecraft Chick had the following to say on the matter:

Quote from Lydia Winters »
Hi Guys,

We are aware of the security issues involved with the Minecraft authorization servers and are currently working to fix it.

Right now the authorization servers have been taken offline and will be down until further notice. The Mojangstas are working hard to make sure we get everything back to perfect working order.

We’ll keep you updated as we have a more clear timeline. We really are sorry about this and are working as fast as we can!

Happy Sunday

UPDATE: Authorization servers are back online, and the login exploit should no longer be possible.

It is not believed at this time that any account information - such as passwords, security info or any other sensitive information - was compromised. Players are, as in any similar situation, encouraged to change their password when the authorization servers come online, if they feel their information was compromised.

Redditor "barneygale" gave a very detailed breakdown of the process, which you can read by clicking here.

Comments

The_Waza_Man
- Zombie Killer
- Location: Taking defibrillators to good to
- Join Date: 5/3/2012
- Posts: 213
- Minecraft: waza_man
- Member Details
#1 The_Waza_Man

View User Profile

Send Message

Posted Jul 15, 2012
I hope this exploit gets fixed fast. I really want to play MP and not to worry about people greifing with it. I'm more worried about the greifing though. Also from what I've read, all they do is use your username, no info is stolen, though you may be banned on some servers or reputation tainted.

Last edited by The_Waza_Man: Jul 15, 2012

Rollback Post to Revision RollBack
WARxTERROR
- Gold Miner
- Location: its red and dark...i see fire...
- Join Date: 7/16/2011
- Posts: 418
- Minecraft: WARxTERROR
- Member Details
#2 WARxTERROR

View User Profile

Send Message

Posted Jul 15, 2012
i was recording for my youtube channel and when i crashed i wasnt able to get back in....

Rollback Post to Revision RollBack
BushBacon
- Out of the Water
- Join Date: 3/10/2012
- Posts: 8
- Member Details
#5 BushBacon

View User Profile

Send Message

Posted Jul 15, 2012
*phew* I thought there was something wrong with my account.

Rollback Post to Revision RollBack
never2nv
Curse Premium
- Coal Miner
- Join Date: 9/6/2011
- Posts: 135
- Location: United States
- Minecraft: never2nv
- Member Details
#6 never2nv

View User Profile

Send Message

Posted Jul 15, 2012
You can still login so far and you can even change your password now on Minecraft.net but yeah, just can't authorize when connecting to a server.... glad they're taking care of the problem, especially as a server admin.

Rollback Post to Revision RollBack
Chicken16198998
- Carpenter
- Join Date: 3/2/2012
- Posts: 45
- Minecraft: thatchick1998
- Member Details
#7 Chicken16198998

View User Profile

Send Message

Posted Jul 15, 2012
Omg this happened on as server I was on it fully got griefed D:

Rollback Post to Revision RollBack
1337Chicken
- Iron Miner
- Join Date: 8/21/2011
- Posts: 306
- Minecraft: 1337_CH1CK3N
- Member Details
#8 1337Chicken

View User Profile

Send Message

Posted Jul 15, 2012
So this made somebody able to log into my account then go onto the server i am a staff on, then banned everybody in the server. Screw this exploit.

Rollback Post to Revision RollBack
zamorak789
- Mark of the Beast
- Join Date: 12/22/2010
- Posts: 1,076
- Minecraft: zamorak789
- Xbox: the unknown bei
- Member Details
#10 zamorak789

View User Profile

Send Message

Posted Jul 15, 2012
I can't even login to my own server. That sucks.

Rollback Post to Revision RollBack
Mcdumsuker
- Gold Miner
- Join Date: 2/23/2011
- Posts: 434
- Minecraft: Mcdumsuker
- Xbox: Sinister Dezz
- Member Details
#11 Mcdumsuker

View User Profile

Send Message

Posted Jul 15, 2012
Huh, I was trying to authenticate an account on a website then it showed the error, and I couldn't login to any servers. I thought my account was hacked. Thank god it wasn't :3

Rollback Post to Revision RollBack
The_Waza_Man
- Zombie Killer
- Location: Taking defibrillators to good to
- Join Date: 5/3/2012
- Posts: 213
- Minecraft: waza_man
- Member Details
#12 The_Waza_Man

View User Profile

Send Message

Posted Jul 15, 2012
Quote from Dr_Crazy_Mii

One question that's bugging me:
Do we have to migrate our minecraft accounts to play now?
I would hate that....

The doc

No, this problem is affecting everyone, though people with a migrated account may have people playing with their USERNAME, they have not used your password to log in. They are using an exploit to appear as you.

Rollback Post to Revision RollBack
Hunter
Retired Staff
- 404: Member Not Found
- Location: New Zealand
- Join Date: 9/13/2011
- Posts: 1,828
- Location: New Zealand
- Minecraft: Hunterr
- Member Details
#13 Hunter

View User Profile

Send Message

Posted Jul 15, 2012
Is there any way for us players. To see if our accounts had been used recently. Like a login session log? I want to know if I have been comprimised. I read on the reddit post it targets migrated accounts. I just migrated yesterday!

Rollback Post to Revision RollBack
CruciatusCurse
- Redstone Miner
- Join Date: 11/20/2011
- Posts: 587
- Member Details
#14 CruciatusCurse

View User Profile

Send Message

Posted Jul 15, 2012
Team Avo posted this (how to do it (not detailed, just the simple things, not really how to do it), how to avoid it, how to check your vulnerability, etc. Ironically, they are literally the 'good' guys here)
https://gist.github.com/3115176

Rollback Post to Revision RollBack
UnoJohnP
- Newly Spawned
- Join Date: 7/15/2012
- Posts: 2
- Member Details
#15 UnoJohnP

View User Profile

Send Message

Posted Jul 15, 2012
when could we expect this to be done? so we can go onto servers again

Rollback Post to Revision RollBack
Pika
Retired Staff
- Retired Staff
- Join Date: 12/26/2011
- Posts: 985
- Member Details
#17 Pika

View User Profile

Send Message

Posted Jul 15, 2012
Hopefully they fix this fast. It'd be a shame if someone lost their account from this.

Rollback Post to Revision RollBack
2_friends_mod_minecraft
- Carpenter
- Join Date: 4/30/2012
- Posts: 61
- Minecraft: penbob3/ben101010
- Member Details
#18 2_friends_mod_minecraft

View User Profile

Send Message

Posted Jul 15, 2012
Ahh, man! This happened just when I finally got to port-forward my server! REALLY hope it's fixed soon...

Rollback Post to Revision RollBack
The_Waza_Man
- Zombie Killer
- Location: Taking defibrillators to good to
- Join Date: 5/3/2012
- Posts: 213
- Minecraft: waza_man
- Member Details
#19 The_Waza_Man

View User Profile

Send Message

Posted Jul 15, 2012
Quote from CruciatusCurse

Team Avo posted this (how to do it (not detailed, just the simple things, not really how to do it), how to avoid it, how to check your vulnerability, etc. Ironically, they are literally the 'good' guys here)
https://gist.github.com/3115176

Wow, never thought I would see the day.

Rollback Post to Revision RollBack
The_Waza_Man
- Zombie Killer
- Location: Taking defibrillators to good to
- Join Date: 5/3/2012
- Posts: 213
- Minecraft: waza_man
- Member Details
#21 The_Waza_Man

View User Profile

Send Message

Posted Jul 15, 2012
Quote from Dr_Crazy_Mii

In reply to The_Waza_Man;
I meant do we have to migrate our minecraft account so that we (the actual users) can log in?
An example of this is that only the Mojang user accounts would work with minecraft.
Plz tell me if this is so.

The doc

No, Mojang turned off the servers that authenticate the accounts, no one can play multiplayer, but single player is fine. Anyone can log in, just not play multiplayer.

Last edited by The_Waza_Man: Jul 15, 2012

Rollback Post to Revision RollBack
Sarah_Craft
- Carpenter
- Join Date: 7/15/2012
- Posts: 41
- Minecraft: thehcted
- Member Details
#23 Sarah_Craft

View User Profile

Send Message

Posted Jul 15, 2012
Can't wait till it's back!

Rollback Post to Revision RollBack
Submachiner
- Zombie Killer
- Join Date: 9/6/2010
- Posts: 155
- Location: Albion
- Minecraft: Recolada
- PMC: RecoladaMC
- Member Details
#24 Submachiner

View User Profile

Send Message

Posted Jul 15, 2012
I was wondering why I kept getting the 503 error. Its bothersome to hear that having my account migrated makes it vulnerable. I just changed my password a few days ago, guess it won't hurt to do it again. Glad to know they caught it and are fixing it.

Rollback Post to Revision RollBack
shadowshaded
- Tree Puncher
- Join Date: 7/15/2012
- Posts: 12
- Member Details
#25 shadowshaded

View User Profile

Send Message

Posted Jul 15, 2012
Wow, I hope this gets fixed soon. Real soon.

Rollback Post to Revision RollBack
Raytious20
- Tree Puncher
- Location: Philippines
- Join Date: 6/30/2012
- Posts: 15
- Minecraft: Raytious20
- Member Details
#27 Raytious20

View User Profile

Send Message

Posted Jul 15, 2012
Quote from The_Waza_Man

Wow, never thought I would see the day.

Yeah, and I even thought Team Avolition were the bad guys and steal all our accounts.

Rollback Post to Revision RollBack
To post a comment, please login.

Minecraft Forums

Server Login Servers Temporarily Offline; Fix For Exploit In Progress

Comments

Social Media

Services

Resources

Our Communities