OpVerify
OpVerify
Verification System for Operators
Stop Session Stealing
The other day I had a player join my server and explained to me that he had had a player advertising my server on his server. I had a clue about what was going on so I joined to investigate. The server had several players but it said that it was whitelisted. When I rejoined I had the console in the background and noticed that players were being given operator, and when I checked the ops.txt quite a few of these joining players were being given op. After researching this I already had an idea of what was going on. Session Hijacking. With this in mind I could not rest until some sort of system was in place. Which I bring you OpVerify.
Curious How it works Github
Server Session Info Here
Video Showing The Session Hack Here
OpVerify's Features Include
- All joining players will be removed from operator status
- When a player joins and is already set to op all currently authenticated user will be notified and Op is removed.
- Authentication Levels Adds Ip Address Logging, Password Protection with SHA512Hash.
- Incorrect Password Attempts Kicks Players
- Master Operator Ability Account.
- Does Not Conflict with Permission Systems
- Easy to use interface
Commands
If any of these commands are used on a semi authenticated level notifications will be sent to all Verified Operators and the Master Account.
- From the master account or verified operator
- /op {username}
- This will enable the user as operator however a password must be set
- If the user is online this will store the operators Ip
- From temporary operator or as a Password change for verified operators
- /oppw {password}
- This will store a password as a SHA512 hash
- From Ip Verified Operators
- /oplogin {password}
- Unnecessary if the Operators Ip Address has been verified when logging in
- This will enable full operator access
- From verified operators or master account
- /deop {username}
- This will remove the verification items of the player and remove operator
Overridden Vannila Commands
/stop
/gamemode
ChangeLog
v0.1
Initial Release
v0.2
Adjusted Digest for SHA512 instead of MD5
v0.3
Resolved a small issue with ip verification.
TODO
Removed additional vanila commands however considering implementing them again
Comments
-
_ForgeUser7037478 Owner
-
View User Profile
-
Send Message
Posted May 7, 2012It would be great if this could be expanded to permission groups.
I have no Ops on my server, only permission groups. I think many servers run this way.
-
View User Profile
-
Send Message
Posted May 4, 2012@Death_marine
I am not overly familiar with SecurityDragon. Though I have briefly glanced over.
I was talking about plugins for Joomla, this could apply to ANY website, with badly coded server-side scripting. I was just creating a scenario. Your plugin directly interfaces with the SQL server I believe?
Of course, but offering your own protection on top doesn't hurt. I don't trust some of these hosting providers, and there are a lot of .. "noobs" who run these MC servers also, who are unlikely to keep on top of updating their website amongst other things.
-
View User Profile
-
Send Message
Posted May 4, 2012@ProjectNarna
SecurityDragon just verified the password to return a boolean output... it never stored anything.
This plugin stores information but its not in a database format it's stored as a file and similar to SecurityDragon the plugin pulls the information for a boolean output. I mean I can salt it no problem. But at this point its all up to the user on what they do with the files on they're server and what access they allow players to have. Proper server protection, or protection offered from your hosting provider along with this plugin is the real idea.
-
View User Profile
-
Send Message
Posted May 4, 2012@Death_marine
Yeah, exactly. It is more than likely that people will use the same pass in more than one place. You wouldn't necessarily need root access for this, MySQL security isn't taken very seriously. If, for example, somebody had an out-of-date Joomla plugin, that allowed somebody to do SQL Injection, and return a list of Hashed Usernames + Passwords. OR if it is stored in plaintext, there is a type of vuln that allows you to basically "cat" files on the OS. So you could cat the flat file db, and save it as the flat-file. SHA512 Rainbow tables aren't so common at the moment, so you may be able to get away with not using salts. But I am seriously security conscious, you will slow them down by using random salts in your db.
-
View User Profile
-
Send Message
Posted May 4, 2012@ProjectNarna
Its alright I got to thinking that if by the stroke of chance they were able to pull an md5 hash from whatever end, that the if the operator is using the same pass for they're operator account that they use for minecraft itself they could possibly use the hash to attempt to login to that players account itself considering minecraft simply uses md5. Although highly unlikely you would still have to gain root access by some means to pull the information or develop a bukkit plugin that will steal the information from this configuration which even in the same aspect unsecured/unsalted/unhashed passwords reside in most configurations requiring an external connection example: mysql. This situation its really up to moderators verifying plugins at that point. So to get back on track to defeat this plugin to gain operator status is either by deleting the plugin and putting the names back into the op.txt(root access), from the console opping yourself (telnet, queryport{which requires login information from the server.properties}), by pulling the configuration from the backend (trojan), or building a bukkit plugin to steal the configuration, all of which are more harmful, intensive, and require extensive tools to gain access. If there is a method of telepathy that I'm unaware of let me know cause I'm missing out.
Yah I have worked with salting, (SecurityDragon{inactive} uses md5 with salt to login to joomla), but do you really think its necessary? I mean the method of this type of security is to simply remove the operator status from a player in minecraft and authenticate themselves as being who they are in game, if I was able to pull the mac address of the player logging in I would use this for verification instead.
The way the plugin works is that if your given operator then you set a password for yourself or the plugin will not recognize you when you re log back in, once the password is set it is saved in the configuration and flushed, when the player leaves and rejoins the configuration information is pulled and IF they're ip is does not match then it will require your password which is then pulled and compared.
If I was unclear in my post I'll rewrite it so users can understand what I'm offering. I'm not able to create a bukkit plugin to protect they're minecraft account, or personal information any more so then they could do themselves. This is simply a plugin to fix an issue like the video posted above. This plugin provides a means of authenticating operators on your server, keeping your authorized users legit considering that you can't always control how each individual admin will approach a situation.
Also I was still scrubbing the source and forgot to change the description consider I have another update coming.
-
View User Profile
-
Send Message
Posted May 4, 2012@mholmes3038
This is barely trolling. My programming does not go into Java. I am a C/ASM/Perl developer. I have done a few simple plugins, that satisfy the few needs other plugins have not filled. I disagreed with the methodology the developer was used, it is a common mistake. I have a background in security, so I am more aware. So I, instead said to the developer that MD5 has been proven insecure for many reasons. I do not believe there is anything wrong with me raising a point about a particular system being inherently insecure in the storing of data. If I did not raise this point, the dev may never become aware (or for a long time) about the weaknesses in MD5, and not using salts.
@Death_marine Great work on shifting to SHA512 so quickly. Sorry if I came across as rude, I have been very tired for the past few days, lots of coursework + exams at the moment. Are you familiar with salting passes? It would be worth looking into for added security to the passes. Also, have you taken into account that switching to SHA512 will make the MD5 hashes "wrong" ?
-
View User Profile
-
Send Message
Posted May 4, 2012Some one actually attempted this recently on my server as well, thanks for the plugin!
-
View User Profile
-
Send Message
Posted May 3, 2012I went ahead and adjusted the digest to SHA512. Keep in mind that this password isn't even used if verification is made via ip.
-
View User Profile
-
Send Message
Posted May 3, 2012Project I don’t know you but Troll much? The great thing about programming is if you don’t agree with someone’s idea, you can make your own. So I suggest you take your trolling some where else or post a better/working version. Two keys words would be better and working version. If you can do that, I’m sure we will respect you as a programmer and not just a stupid high school kid trolling the internet.
-
View User Profile
-
Send Message
Posted May 3, 2012@Death_marine
This is true, You did not claim that it would provide security. But when you are storing passwords, you should always always always always use a recommended hashing system (MD5 has various flaws, making SHA512 much better) and salts.
Don't be the next gawker.
-
View User Profile
-
Send Message
Posted May 3, 2012@ProjectNarna
"You should instead assume everything else is INSECURE, and that you are offering the only protection."
Agreed, however I never made a claim that this would provide any other security then for the minecraft game server itself. Proper firewalls, Website creation with regards to php/mysql injection and other security options should always be take seriously as well as all passwords should be secured never given out.
The only claim that this plugin has is to provide game server protection from unauthorized users gaining operator from a hijacked minecraft session and provide security for those that are operator on a minecraft server.
-
View User Profile
-
Send Message
Posted May 3, 2012So should I download it or not? Do u think you can crack a password like this?
DvR3FBnMd9 (I could admins have a random password that is hard to crack?)
MD5 = e2fa2579e1ed6c77297dfabf22535139
I might say something really stupid but I thought you needed a database to see what the hash means? Or did that change?
-
View User Profile
-
Send Message
Posted May 3, 2012@Death_marine
Nobody would attempt to brute force through the online server. That would be a stupid idea. It's not such a stupid idea that it may be pulled from the backend, many Minecraft servers also operate websites, they may not use proper URL cleaning. If your excuse is that if they can be pulled from the backend, then you're already done for, then why even bother hashing them with MD5? It's pointless.
Also, LM hashes take about 5m to crack. If instead you are on about NTLM, then yes, this takes longer. But for pre-W7 systems (Perhaps Vista as well, I am unsure) You are able to pull the LM hash, crack it, and then use that to create a dictionary file to crack the NTLM hash.
Don't assume that everything else will be secure. You do not want to be at the centre of a password leak. You should instead assume everything else is INSECURE, and that you are offering the only protection.
-
View User Profile
-
Send Message
Posted May 3, 2012The weakest point of the system is the passwords that the players are going to pick. The password storage mechanism is almost irrelevant. That only matters if someone gets some sort of physical access to the machine to download the passwords. At that point, players getting OP is really the least of your worries.
I was typing this up while Death_Marine was posting. More or less 'what Death_marine said'.
-
View User Profile
-
Send Message
Posted May 3, 2012@ProjectNarna lol.. If by any means a player can run even attempt to run a bruteforce through an online server without crashing it I'd be impressed. If they set a timer and ran it, It would take... years of perfect conditions even attempting to resolve the hash online from the server, which you get kicked after a default 3 bad logins. Which even after that you'd have to be able to emulate the operators original Ip Address and Username along with stealing the session. So I'd say its GOOD for now. Either way your right MD5 is verified by comparison and is not necessarily a form encryption.
MD5 with a bruteforce attack with simply the raw data can take hours on simply a plain text 5 character password when running rainbow tables it all depends on processing ability. (My friend forgot his windows password LM hash takes forever) ;)
But hell if we need to go that far for a small login system that's more secure then most web verification systems with the added variables lets go RSA BSAFE with a SecureID Token Randomly generating oplogin codes every 60 secs, its unnecessary. But if your talking about getting the password from the backend... well you were already screw'd from the beginning. :)
-
View User Profile
-
Send Message
Posted May 2, 2012MD5 isn't encryption. Encryption suggests it can be directly reversed. If this uses straight MD5, then the security is simply, NOT GOOD ENOUGH. MD5 can be easily cracked using rainbow tables, even MD5 with a salt isn't much stronger. You should be using something like SHA512 to hash the password with a salt.