Minecraft exploit is allowing attackers to get any Xbox/MS account banned | Hacker News Reader

Minecraft exploit is allowing attackers to get any Xbox/MS account banned

windowscentral.com

24 pointsjosephcsible6 comments

In Minecraft Java 1.19.1, a new chat mode was introduced that allowed chat messages in private servers to be reported. Supposedly, the messages were cryptographically signed by the sender and only signed messages could be reported.

My guess is someone figured out a clever way to bypass the signature and automated reporting the messages in a way that triggers an automated ban.

the important takeaway is that in Minecraft you can do an exploit that allows you to "fill in somebody's GamerTag, then just spam a bunch of slurs, and then report said slurs to Microsoft."

Yeah, it seems like it relies on some external tool to make it appear like the language came from another gamer tag. That seems like the root cause to me - how is it possible to emit messages under an account you're not logged into?

In Minecraft Java everything is tied to a UUID that's unique to each account, so it shouldn't be possible to do a simple spoof of a nickname.

It's easy to find the UUID associated to a nickname. For example, here's [0] the one for `accrual`

[0] https://namemc.com/profile/Accrual.1

I follow the YouTuber in question that got hit with this exploit. In some of the replies on Twitter where this was being discussed, this Github repo was discussed. I have no idea if it's related to what's currently happening, but seems possible based on the description.

https://github.com/MrDiamond64/EliteElixir

That would be for bedrock rather than Java.

Which honestly, would be the one I'd expect an Xbox account compromise to come form as Java edition doesn't really touch xbox/MS accounts outside of the initial launcher using them to check your entitlements for game, multiplayer access (parental controls).

Bedrock however ties much more directly to Xbox et al. due to needing features like joining friends games directly etc.

The only exploit chain I can imagine for Java is compromising the chat report system (which honestly, given the initial implementation they attempted to rush out the door signed *only the message you sent* and *zero context around it*, allowing easy spoofing of context to change the meaning of a message; isn't too far fetched that the backend side of it is similarly scuffed.) and then coercing a ban from the game into a wider account ban.

Reply on news.ycombinator.com