3 ms·

What confuses me about this is that no one else found it? Being somewhat experienced at game networking and writing server code with this type of exploit(e.g.

by meibo 5y ago

What confuses me about this is that no one else found it? Being somewhat experienced at game networking and writing server code with this type of exploit(e.g. sending a packet to do something at the other end of the map and processing the result) in mind, this would be something I either would have checked for in the first place if performance would have allowed for it, or would have kept in the back of my mind in case I hear about a possible exploit that takes advantage of it.

leijurv 5y ago
One reason might be that this only existed in Paper, which is a downstream fork of Spigot, which is (sort of) a downstream fork of CraftBukkit, which is a set of patches to the official minecraft server. Another reason might be that this only does anything if there are many players on the server, and you hit a region loaded by someone else. Might be difficult to think of that. You'd never come across it if testing in singleplayer. But in essence I agree, it's surprising that no one else found and reported this years ago!
Sesse__ 5y ago
What confuses _me_ about this is that nothing seems to say what it _is_. It's like there's some giant practical joke I'm not a part of, and the README.md just throws off heatmaps and wants me to watch a 24-minute YouTube video. Is everybody supposed to be a Minecraft expert? Is a simple paragraph of what this is all about (at the very beginning of the file) too much? :-)
- leijurv 5y ago
  There's a section called "The entire thing summed up in three sentences" in the linked GitHub README.
- bobsmooth 5y ago
  "You could punch any block coordinate in the entire map, and 2b2t would either: -Tell you what block is placed there, if the chunk is currently loaded -Or ignore you, if the chunk is not currently loaded. 2b2t would immediately reveal whether or not any chunk coordinate that you ask about is currently loaded. If it is currently loaded, it tells you which specific block is there at the coordinate you asked about." This allowed the hackers to find every player's coordinates and where their bases were.
- rasz 5y ago
  Its a typical case of Software developer not validating player input 'because thats too taxing on the server'. Minecraft server was programmed to reply to all, even stupid or impossible queries.
itronitron 5y ago
For most multiplayer MC servers, this sort of exploit isn't worth the time because there are commands available to players to find nearby players and their bases (so they can check out each other's builds or participate in the local economy.)

by meibo 5y ago

leijurv 5y ago

One reason might be that this only existed in Paper, which is a downstream fork of Spigot, which is (sort of) a downstream fork of CraftBukkit, which is a set of patches to the official minecraft server. Another reason might be that this only does anything if there are many players on the server, and you hit a region loaded by someone else. Might be difficult to think of that. You'd never come across it if testing in singleplayer. But in essence I agree, it's surprising that no one else found and reported this years ago!

Sesse__ 5y ago

What confuses _me_ about this is that nothing seems to say what it _is_. It's like there's some giant practical joke I'm not a part of, and the README.md just throws off heatmaps and wants me to watch a 24-minute YouTube video. Is everybody supposed to be a Minecraft expert? Is a simple paragraph of what this is all about (at the very beginning of the file) too much? :-)

leijurv 5y ago
There's a section called "The entire thing summed up in three sentences" in the linked GitHub README.
bobsmooth 5y ago
"You could punch any block coordinate in the entire map, and 2b2t would either: -Tell you what block is placed there, if the chunk is currently loaded -Or ignore you, if the chunk is not currently loaded. 2b2t would immediately reveal whether or not any chunk coordinate that you ask about is currently loaded. If it is currently loaded, it tells you which specific block is there at the coordinate you asked about." This allowed the hackers to find every player's coordinates and where their bases were.
rasz 5y ago
Its a typical case of Software developer not validating player input 'because thats too taxing on the server'. Minecraft server was programmed to reply to all, even stupid or impossible queries.

itronitron 5y ago

For most multiplayer MC servers, this sort of exploit isn't worth the time because there are commands available to players to find nearby players and their bases (so they can check out each other's builds or participate in the local economy.)