Server Login Servers Temporarily Offline; Fix For Exploit In Progress

By Sacheverell Jul 15, 2012
Category Icon News
86

A recent exploit was discovered in the Minecraft authorization servers, which allowed players to log in to SMP servers as any account they wished. Mojang temporarily took down the login servers, and have successfully eliminated this exploit.

Minecraft Chick had the following to say on the matter:

Quote from Lydia Winters »
Hi Guys,

We are aware of the security issues involved with the Minecraft authorization servers and are currently working to fix it.

Right now the authorization servers have been taken offline and will be down until further notice. The Mojangstas are working hard to make sure we get everything back to perfect working order.

We’ll keep you updated as we have a more clear timeline. We really are sorry about this and are working as fast as we can!

Happy Sunday

UPDATE: Authorization servers are back online, and the login exploit should no longer be possible.

It is not believed at this time that any account information - such as passwords, security info or any other sensitive information - was compromised. Players are, as in any similar situation, encouraged to change their password when the authorization servers come online, if they feel their information was compromised.

Redditor "barneygale" gave a very detailed breakdown of the process, which you can read by clicking here.

Comments

Randomizer1666
- Carpenter
- Join Date: 9/13/2011
- Posts: 68
- Member Details
#28 Randomizer1666

View User Profile

Send Message

Posted Jul 15, 2012
Quote from Submachiner

I was wondering why I kept getting the 503 error. Its bothersome to hear that having my account migrated makes it vulnerable. I just changed my password a few days ago, guess it won't hurt to do it again. Glad to know they caught it and are fixing it.

Under the circumstances this should not strictly speaking be necessary. As I understand the situation the exploit does not give them access to anything other than the account name. Password should still be secure, as they are just spoofing the username. It is still good practice to change the password often, but strictly speaking should be unnecessary this time.

Rollback Post to Revision RollBack
Missing_Pixels
- Tree Puncher
- Location: Honolulu, Hawaii
- Join Date: 6/9/2012
- Posts: 17
- Xbox: Gift Dimples
- Member Details
#29 Missing_Pixels

View User Profile

Send Message

Posted Jul 15, 2012
I just bought silver status for MineZ and the servers shutting down basically erased it. I know I can't get on the servers but I went to the MineZ site and it said that I haven't bought silver or anything! What the heck that was my good $!

Rollback Post to Revision RollBack
FUZZYBUNNYSAXZ
- Tree Puncher
- Join Date: 7/19/2011
- Posts: 22
- Minecraft: FUZZYBUNNYSAXZ
- Member Details
#30 FUZZYBUNNYSAXZ

View User Profile

Send Message

Posted Jul 15, 2012
You can also run your server without using the minecraft.net verification.

But then anyone can log in as you, like in the exploit. So put up a temp world, client base stays, actual world stays safe.

This allows people with 'hacked' or 'non-paid-for' accounts to connect to smp. But when things like this happen, there are solutions....

Rollback Post to Revision RollBack
shadowshaded
- Tree Puncher
- Join Date: 7/15/2012
- Posts: 12
- Member Details
#31 shadowshaded

View User Profile

Send Message

Posted Jul 15, 2012
I was planning on playing on my Alpha 1.2.6 server with my friends...

Rollback Post to Revision RollBack
paxio5922
- Diamond Miner
- Location: 41°52′55″N 87°37′40″W
- Join Date: 4/11/2011
- Posts: 807
- Minecraft: paxio5922
- Member Details
#32 paxio5922

View User Profile

Send Message

Posted Jul 15, 2012
This morning we had a player named "Notch" join our server, almost have me a heart attack reading about this now...

Rollback Post to Revision RollBack
tin2001
- Full Stack
- Join Date: 3/4/2012
- Posts: 64
- Member Details
#35 tin2001

View User Profile

Send Message

Posted Jul 15, 2012
Quote from 2_friends_mod_minecraft

Ahh, man! This happened just when I finally got to port-forward my server! REALLY hope it's fixed soon...

That sort of thing happens to me regularly. Really annoying. Like the hours I wasted trying to sort out why our firewall was blocking traffic from a wireless site-to-site link, only to discover it was not the firewall but the computer I was targetting to test things was broken.... Doh!

Quote from TristanMrH

any thoughts on how long it would take before we can log in again?

Don't ask that sort of thing with computers. No one knows the answer.
Any answer would be a guess, and probably not a very good one. The only time they'd be able to give a close guess would be after it's fixed.

Glad this happened now though, and not a few hours later. I was able to take my server off the net - would hate to have it vandalised by some jerk.

Rollback Post to Revision RollBack
bee7932
- Stone Miner
- Join Date: 6/9/2012
- Posts: 72
- Minecraft: bee2397
- Member Details
#38 bee7932

View User Profile

Send Message

Posted Jul 15, 2012
o thats what happend i was on a server and i laged out and me and my friend thort that our minecrafts had a bug XD
well i hope it gets fixed

Rollback Post to Revision RollBack
ihaveamac
- Coal Miner
- Location: In a cave with Diamonds
- Join Date: 8/10/2011
- Posts: 235
- Minecraft: ihaveamac
- Xbox: ihaveamac
- Member Details
#40 ihaveamac

View User Profile

Send Message

Posted Jul 15, 2012
As far as I know, the login servers for the launcher still work, just not logging into servers.

Rollback Post to Revision RollBack
TheGodEmperor
- Stone Miner
- Join Date: 10/2/2010
- Posts: 72
- Member Details
#41 TheGodEmperor

View User Profile

Send Message

Posted Jul 15, 2012
Is this why I'm getting Internal client error: java.io.IOException: Server returned HTTP response code: 503 for URL: (long ass crap here) atm? I mean it was working a little while ago

Rollback Post to Revision RollBack
tin2001
- Full Stack
- Join Date: 3/4/2012
- Posts: 64
- Member Details
#42 tin2001

View User Profile

Send Message

Posted Jul 15, 2012
Quote from TheGodEmperor

Is this why I'm getting Internal client error: java.io.IOException: Server returned HTTP response code: 503 for URL: (long ass crap here) atm? I mean it was working a little while ago

Yes. They disabled logons.

Also, good news apparently. Just spotted on xlson's Twitter that they've got it back online...

Rollback Post to Revision RollBack
sploder99999
- Iron Miner
- Location: Newcastle, Australia
- Join Date: 9/24/2011
- Posts: 266
- Minecraft: sploder99999
- Member Details
#43 sploder99999

View User Profile

Send Message

Posted Jul 15, 2012
Yeah it's back up.

Rollback Post to Revision RollBack
Skippy509
- Diamond Miner
- Join Date: 7/29/2011
- Posts: 766
- Minecraft: Skippy50351
- Member Details
#44 Skippy509

View User Profile

Send Message

Posted Jul 15, 2012
Quote from tin2001

Yes. They disabled logons.

Also, good news apparently. Just spotted on xlson's Twitter that they've got it back online...

Good to hear, glad someone is keeping us updated.

Rollback Post to Revision RollBack
Joshua8799
- Out of the Water
- Join Date: 7/15/2012
- Posts: 7
- Member Details
#46 Joshua8799

View User Profile

Send Message

Posted Jul 15, 2012
Quote from bee7932

o thats what happend i was on a server and i laged out and me and my friend thort that our minecrafts had a bug XD
well i hope it gets fixed

hi

Rollback Post to Revision RollBack
TheGodEmperor
- Stone Miner
- Join Date: 10/2/2010
- Posts: 72
- Member Details
#49 TheGodEmperor

View User Profile

Send Message

Posted Jul 15, 2012
awesome

Rollback Post to Revision RollBack
Sonickyle27
- Stone Miner
- Join Date: 11/13/2011
- Posts: 85
- Member Details
#50 Sonickyle27

View User Profile

Send Message

Posted Jul 15, 2012
Quote from ihaveamac

As far as I know, the login servers for the launcher still work, just not logging into servers.

Wha? I can still log on to servers with no errors...

Rollback Post to Revision RollBack
OverClockedWil
- Tree Puncher
- Join Date: 5/28/2012
- Posts: 37
- Location: Australia
- Minecraft: Blacksworn
- Member Details
#51 OverClockedWil

View User Profile

Send Message

Posted Jul 15, 2012
They're back up, I'm on my favourite server right now.

Rollback Post to Revision RollBack
Sacheverell
Retired Staff
- Silver Voicemin
- Join Date: 12/9/2010
- Posts: 2,222
- Minecraft: Sacheverell
- Member Details
#52 Sacheverell

View User Profile

Send Message

Posted Jul 15, 2012
As noted above (and in the edited OP), session servers are back up, you can play SMP normally again. Thanks for being patient, guys.

Rollback Post to Revision RollBack
cricket490
- Tree Puncher
- Location: Australia
- Join Date: 5/24/2012
- Posts: 23
- Minecraft: cricket490
- Member Details
#53 cricket490

View User Profile

Send Message

Posted Jul 15, 2012
This happened when I was on my friends server where I am a admin and a hole heap of people started joining with the same kind of names and used our accounts to ban us and use world edit to crash the server

Rollback Post to Revision RollBack
Sodisna
- Lapis Lazuli Collector
- Location: Decatur
- Join Date: 7/24/2009
- Posts: 1,184
- Minecraft: Sodisna
- Member Details
#54 Sodisna

View User Profile

Send Message

Posted Jul 15, 2012
So, was this only affecting people who played online?

Rollback Post to Revision RollBack
skeemogreeve
- Newly Spawned
- Join Date: 7/15/2012
- Posts: 2
- Member Details
#55 skeemogreeve

View User Profile

Send Message

Posted Jul 15, 2012
is this why i cant play minecraft classic on the site??? because i get this error org.lwjgl.lwjglexception could not create context

Rollback Post to Revision RollBack
To post a comment, please login.

Minecraft Forums

Server Login Servers Temporarily Offline; Fix For Exploit In Progress

Comments

Social Media

Services

Resources

Our Communities