Used to admin for a medium server back in the day and the amount of script kiddies youd have to deal with every week was insane. Serious props to mconlines backend guys
You weren't prepared, and honestly who would be? Your server's really chill and doesn't typically attract creeps like that. I'm sorry y'all went through that.
Players can be crazy but you did the right thing to get the hacker banned and arrested for the crimes. Perhaps a video on destroying the builds the hacker made using backdoor access? Will be very satisfying.
The fact that they kept the server safe for 13 years is quite impressive. Given it’s notoriety and the potential cache of information available, it would’ve been a high priority target. In this day and age, hacks are inevitable, so kudos to the dev team for their efforts.
@@hedge0 Look it was a quick example. I'm aware of the difference between server and client side hacks. My only point is that they only care about what makes them money in the short term. Look at gta online, an unsecure mess but I'm sure the cash shop still works fine.
simple, security costs money, time and effort, a minecraft server exists for fun and therefore can afford to care about it, a company is run for immediate profit and growth, and therefore must cut costs everywhere that doesn't risk immediatly getting the CEO fired...
creating fake items isnt anything offensive enough to face legal charges, but he did cross the line by stealing private information (like password data) which could be used maliciously.
You should do a series of 2b2t player profiles. We always see notable players, like iTristan, Hermeticlock, Jared, Redstoner, Popbob, Offtopia, and many others recur in your videos. They always seem to be involved in major events on the server and it would be cool to hear each of there stories in there fullest. As someone who doesn’t even play, there are quite a few players who’s names I recognize from hearing mentioned in so many of your videos, and it would be really cool to see there whole history documented.
Players I can thing of off the top of my head that would be cool to see covered would be Clyde and Taylo. As well as that one player who’s name I forget, but who’s the best civil engineer on the server. There are plenty of others I’m sure you could make very compelling videos on.
@@StarOperator_ stop with the sensitivity people say things and you can't do anything about it, if you could that would be the same as playing or trying to play as God and you would ruin everything.
Both my kids play and have their own server but I really never gave the game much thought until I came across your channel. Now I'm obsessed and awestruck about it's history
One of the sentiments that they push nowadays in tech is that the biggest vulnerability a company can have will always be is its own employees. Most people don't even realize how much hackers rely on social engineering as a method to enable them to even begin the technical portion. What's the point of wasting time figuring out vulnerabilities to a system when you can circumvent it entirely?
This is especially true given that software security standards are actually pretty high these days. No reason to get complacent, mind you, but it is in fact quite difficult to accomplish anything without someone on the inside manually downloading and/or installing something.
I played MinecraftOnline actively for almost 2 years and made a town called Maltapple that was targeted by these guys. It caused me to leave the server entirely. My name is Fraccu for those wondering, and you did an AMAZING job on this video Fit, props to you!
@@draconiusultamius I barely recognized your name but on top of this being untrue you literally posted photos of people undergoing surgery in multiple places that people didn't want to see them and refused to delete them. Quit acting so perfect as if you are fighting for "justice" lmao
@@heart5021 I think ik who you are but under a slightly different name, but essentially the server has been fine for the most part outside of a few hotspots where these players would hang out. Considering fit didn't name them in the video, I won't be naming them either, but they for the most part were part of a base group called Heese69 and would get "the hacker" to distribute items to them and one of their very active members would use these items to make illegal bedrock builds and other bizarre things. They stole stuff from a lot of people echests including mine but I didn't even notice it since all my items were stored in shulkers I never checked. Eventually they used alts to grief attack my town and a few others and destroy all the chests with valuables in them, but other than that for the most part the server is unaffected and the community still stands rather strong. Just as always people come and go, and I assume MCO will make a full recovery from the incident.
In times like this it feels like it's not the server that's 13 years old, but the admins /s Jokes on their trust policies aside, I find it really hard for this to be the only incident in more than a decade...
i dont know what teacher fit used to be i think it was a math? could be i mixed up with zombie cleo or someone else who hapens to be a math teacher then quit and be a mc youtuber
Yikes. The mistake the hacker made was using it too often and leaving breadcrumbs and setting off red flags. It's for this reason that the Nocom exploit lasted as long as it did. They kept it quiet and on the down low and minimised any public action so as to keep the exploit working as long as possible. Still, mad props to the Minecraft Online team for getting this far without a breach. 13 years breach free in today's cyber world is not easy.
Gradle is not a small project, it is actively used by HALF of EVERY SINGLE program using Java, tens or maybe hundred of thousands of softwares, websites backends, etc It blows my mind a breach was introduced into it. And it blows my mind even more it was only used to hack a minecraft server.
As I understand it, the hacker didn't put their code into some core gradle repo. They created an alternate version based on gradle, on their own machine. Then compiled it into a binary, and uploaded this bad-gradle on the MCO build server. Where it then compiled the plugins with the malicious code injected into them, which were then executed on the server.
@@abamacus2030 Oh you are right I missunderstood. According to the official gradle attack repport, the gradle wrapper used by minecraftOnline was tempered with and did not match any valid official checksum. This means 2 things : - the exploit could have been avoided had MinecraftOnline verified the checksum of the wrapper before using it. - the hacker manager to replace the wrapper file on the build server and no one noticied ? This is super weird, the gradle wrapper file is typicaly something you ever set once and never touch ever. Even upgrading gradle to a newer version is only done editing a config, and not by changing the wrapper jar. ... Now that I think about it, maybe the hacker participated in the creation of a new plugin and was the one who initializated it ? maybe he has access to the build server for developpment purpose ? ... There are many ways it could have happenned, but it requires some level of trust was put in the hacker at some point, this is insane level of social engeneering.
The hacker had a developer role for quite some time. Like you can always fault bad security, but if a bank manager takes a bundle of cash from the vault, that is not really a bad-security problem, it's a bad-human problem. Developers are supposed to be trustworthy. (that said, yes I believe they are now requiring some checksum matching; and hopefully not a literal naive "checksum"?)
@@abamacus2030 I mean, it is like the hacker had to start from bank cashier, went through years (not years in the case of minecraftonline but years in the analogy) to build skill and trust with upper management to finaly be named manager of the bank. I cant blame monecraftonline, no sane mind would see this as a serious possibility...
Gradle wasn't hacked. If someone hands you a version of Windows 11 with a virus in it and you don't check to see if it's the original copy, you can't say Microsoft was hacked.
I used to play on that server and was active when the hackers original account was. They seemed alright, not trustworthy in the slightest, but alright. I'm also kind of friends with two of the other people who were banned in conjunction with the hack. One was always a bit of a troll, but also actually isn't horrible. The other was a longtime player who was very close with the hacker on their original account, but I'm not actually fully convinced that they did anything. I did talk with the hacker for a bit after the news broke, but honestly they were a bit vague. This really isn't their first time doing this, I was one of the people who was involved in the permanent bam of their original account. I don't think MCO deserves to be hacked tbh. Sure, I've got my own grievances with the server, but I still feel bad for anyone who was negatively affected by this, especially if any passwords or sensitive info has been stolen. It is great that the admins acknowledged the hack publicly, though a friend of mine (former moderator and possibly one of the biggest reasons for the 1.12.2 update) pointed out some flaws in the response, but im just glad they took the time to at least apologize, its a step in the right direction. Please don't go and harass the server, people are just trying to play there and exist, so there's no reason to go and mess with them just bc of this. Sure, go check it out if you want, but not for some dumb reason like this. It's a unique place, if a deeply flawed place in some ways, but that's part of what makes it special. Go for that experience, not to go and bug the staff by asking about this.
This guy literally went undercover for years, developed a fake identity and stabbed people in the back just to mess around on a minecraft server... If they'd spent half that effort IRL they'd probably be a real life secret agent/spy lol
I remember logging on here and meeting a staff and some players, they all gave me gear, staff didnt spawn it im. Kinda sad that this happened to such a nice community.
What I appreciate here is the fact that the server actually came out and disclosed the issue that was going on and where things when wrong on their part. So big companies can't event get themselves to admit when they've had a security breach.
How pathetic do you have to be to do something like that? I would feel bad for the hacker facing LEGAL charges, but knowing what they did, they deserved it. Great video as always FitMC! Edit: I believe some people have misunderstood my comment, I DO NOT feel any sorrow or feel bad for the hacker, what I mean when I say “I would feel bad for the hacker facing legal charges” is that I would feel bad IF they were just a ‘regular’ hacker, just ruining someones win streak in bedwars for example, then faced legal charges FOR the hacking. Thanks for understanding and apologies for the sloppy wording by me :)
I agree that there should not be any legal charges for creating and selling in-game items. However, trying to obtain user credentials from other platforms, such as Discord does definitely deserve some legal consequences.
National security being desperate for cybersecueity/warfare experts, meanwhile minecraft servers have to deal with bordeline netrunners trying to mess with their games on a shockingly regular basis 😭
To those of you who are coming into the server, please be respectful to our rules. Don't grief, cheat or spam, and enjoy the history :) -NightSteak9, Newport Museum
1:46 I dropped my raycon in Dr Pepper... It's been over a week and I'm scared to turn it on, I was half asleep, my raycon was under me while I was lying on bed, I grabbed my Dr Pepper, had a sip, put the lid down to get the raycon from under me, thought my raycon was my lid and dropped it straight in. I laughed at it for like 2 seconds until I realised what I actually did
ayo i am the leader of newport that you mentioned - yes the guy who hacked was a city staff but any cheated builds were removed. the map slider used the wrong date it’s actually supposed to be dec 2021
Hey snakyman long time no see! Pretty funny coincidence that he also showed Benstad and my village two times in the video. Like almost a million people have seen my builds now which I think is pretty cool xD
heii @FitMC have u ever seen The Biggest Graveyard on 2b2t? i dare you to find it! if you find it, keep the coor and i'll make one special for you😉dont destroy it please :) clue : not far from spawn point but far enough to get resources
Haven't finished the video yet, but I just want to say thank you for not saying the hacker's name. There's too much glorification of these people who do stuff like this, so keeping them anonymous and not broadcasting their identity is the best way to get back at them and deprive them of the fame they were likely seeking from this in some way.
This is a prime example of the fact that most of a hacker work is just social engineering , you don't really need to have extensive knowledge of programming or stuff like that, you just need to be able to fool people
Dude I've watched so many of your vids and all I can say is thank you for the FFX music in a lot of vids. Gives me big nostalgia and makes me wanna make a new account to platinum it again
Inmate 1: What did you go to prison for Inmate 2: Murder Inmate 1: what did you go to prison for Inmate 3: Hacking a Minecraft server Inmate 1: Ohh shit better stay away from this guy Inmate 2: I thought I was bad
I played on that server once, I put down a crafting table in a griefed house, used it to craft a pickaxe, broke it, and then an Admin TP'd to me and said I griefed the house by putting the crafting table down in it, and got banned. Great server would highly recommend.
Same thing happened to me, except I only stared at a grieved build. That was it, staring is now a crime, I am the criminal responsible for *checks note* staring.
Sounds fake. From what I've seen staff are usually friendly and quite forgiving. You did break a rule though, you're not allowed to place anything in other peoples builds.
5:35 ONE OF MY BUILDS IS IN A FIT MC VIDEO!!!! i built one of the skyscrapers, I was one of the first three buildings at newport. Never saw it grow as I got busy then my hard drive died, but it is still fun to see.
Even if they have "State of the art Security" there will always be a way to hack into it via humans or social engineering (this goes for most not if everything)
I kind of want Minecraft 2b2t to update to Minecraft 1.19 but at the same time it would mean that you could hat report and that would be very bad for the server and also to many chunks are already loaded in The other thing is that it would change the game to much, because it’s many many years of updates which could make the game to crazy and ruin a lot of things already happening in 2b2t
It wouldn't be bad for the server because on the same day the update dropped the community has already written a java plugin that renders the use of the report button useless because - in layman's terms - the server withholds the direct communication to Mojang.
Don't worry about the report button. It can be disabled with just a simple plug-in... Then anything you type will appear as a server message, and thus not reportable.
Who knew that a block game can sent to the cyber security team or authoritys Every year minecraft just keeps getting crazier and crazier, bet you theres gonna be another hacked server that fitmc will talk about.
i mean most java vunerabilities were almost all discovered by minecraft, if not mojang most of them were either 2b2t playerbase(a.k.a hack client maker) or black hat who addicted to mc for some reason and minecraft forge,fabric and quilt and many less known modloaders modders who actively uses devtools such as gradle,git,maven,and log4j to name a few(not a dev but i knew my friend wo actively use that to mods minecraft)
umm I'm the builder of the mountain you see above Newport in your screenshots at 5:40 and I can assure you I did NOT build it in 1 month time lol. I been working on it for over a year now and it's still not finished x.x GOD do I wish I built it in just a month pretty sure you mean 'december 2021' instead of 'december 2022' only 1 tower got illegally built using this hack in Newport and admins already removed it like 2 weeks ago
Always remember that weakest link in any form of security systems (cybersecurity or physical security) is YOURSELF! Humans afflicted by social engineering is one of the top most common causes for security breaches. So check yourself before you wreck yourself, otherwise you will learn this lesson the hard way.
This really is super advanced for minecraft server hack. In terms of methdology it draws parallels to the solarwinds hack in 2020 (probably the worst federal data breach in US history), the uber breach (which used social engineering to gain access to pretty much everything) and a lesser known incident (unless you're a frontend dev like me :)) which involved node-ipc (short version: package used by a lot of people, dev injected a malware dependency in it that deleted files on russian/belarussian computers).
An example of this is that people used to say that there was no such thing as a mac virus, and apple even encouraged this. Then 10s of thousands of macs got hacked.
Actually from what I understood it wasn't in the code directly basically the build command was executed later . Java build tools have the nasty property to be able to load additional code or heavily transform code during build because they are for JEE environment
@@Fiercesoulking I think it’s hidden inside the build tool, not build command (if it is build command, which is usually ran by head dev, then the story would be different). The build tool they uses, Gradle, is open source on GitHub, so the hacker could simply get the source code, add the back door, then build a “Custom Gradle”, it would be difficult to detect, but any developer should know to not use custom built build tool, especially uploaded by a new developer. They probably trusted their dev team too much…
@@Fiercesoulking Updating the gradle JAR still shows up clearly as a changed file and will thus be part of the review. That should raise some questions if doing so wasn't part of the agreed changes
Damn, backdooring a important MC server, is not what people would think would get you in legal trouble. Kudos to MC online for contacting Europol to help them catch the hacker.
I wish I could meet the hacker IRL, in the jail cell, asking if it was all worth it? Spending years of their life to get revenge on a ban on a game. Years that could’ve been used to do so many things.
@@MultiSurfa it's not just the game. They stole confidential information from not only the server, but from protected software. That's probably merit for jail time.
I just can't believe this. The items going missing from chests is terrible. I remember when everyone got a golden apple for Christmas 2022, after I went along a highway and when I came back my golden apple was missing. The hackers stealing items could be the reason why my golden apple is missing. I just left it in a chest and never used it.
Him not saying it was "Minecraft's Oldest Anarchy Server" really threw me for a loop
Fr
Same
I know right!
I also thought it's 2B2T.
turns out not :(
@DontReadMyProfilePicture.6 got it, chief
Imagine being in prison and they ask what you're in for
Hacking a minecraft sever
He's gonna be the boss in the prison, the fearest prisoner i imagine!
Correction, he hacked a server that has not been hacked in over 13 years.
He's probably just gonna have to pay, i don't think he'll be staying in jail.
If he did go to jail.
It would be a big flex though.
@@razi_man nah. if you get asked what ur in for and say minecraft. u gonna get bullied badly
Just wanna let you know your the only minecraft youtuber I consistently enjoy watching despite not playing the game often
@Don't Read My Profile Picture i won't
Facts
same
same
True asf I haven’t played in years I just rlly enjoy fitmc
2b2t is like a netflix drama which is why I like your vids abt it so much. But a diversion every once in a while is nice as it keeps the channel fresh
Lets not insult the honorable players of 2b2t by comparing them to mainstream media.
@@henke37 some aren’t that honorable,and it’s probably best it stays that way
Watch @ish minecraft civ videos. You won't regret it.
@@spec2893 More “honorable” than the shit netflix puts out lol
Oot
I found a mega base coordinates 19830, 69, -156
surprising that it took this long for the server to get badly hacked, considering everything thats gone down tbh
Used to admin for a medium server back in the day and the amount of script kiddies youd have to deal with every week was insane. Serious props to mconlines backend guys
wasn't mojangs event server hacked on like the one day it was up for the voting? XD
@@thema8871 get anti cheat
@@literallygrass1328 amazing idea wow!!
@@thema8871 thank you, thank you, I know I'm a genius
As a member of the admin team of minecraftonline, I gotta say... great video and thanks for not giving us a hard time :)
You wouldn't destroy the weapons don't you, I mean it will be an another legend.
who was the hacker?
You weren't prepared, and honestly who would be? Your server's really chill and doesn't typically attract creeps like that. I'm sorry y'all went through that.
@@1x3x23 It's going to remain undisclosed, Probably. No point in giving them attention.
Players can be crazy but you did the right thing to get the hacker banned and arrested for the crimes. Perhaps a video on destroying the builds the hacker made using backdoor access? Will be very satisfying.
The fact that they kept the server safe for 13 years is quite impressive. Given it’s notoriety and the potential cache of information available, it would’ve been a high priority target. In this day and age, hacks are inevitable, so kudos to the dev team for their efforts.
Dev team????
@@cellwithinacell fr
Man, 13 years is crazy. Why cant big companies use this type of security for other games
because big companies are full of idiots
They need to start using a brain for a change in the first place
They do if it makes them money. Good luck trying to hack in lootboxes in some popular game, feel free to use aimbots and whatever else though.
@@hedge0 Look it was a quick example. I'm aware of the difference between server and client side hacks.
My only point is that they only care about what makes them money in the short term.
Look at gta online, an unsecure mess but I'm sure the cash shop still works fine.
simple, security costs money, time and effort, a minecraft server exists for fun and therefore can afford to care about it, a company is run for immediate profit and growth, and therefore must cut costs everywhere that doesn't risk immediatly getting the CEO fired...
Imagine being able to do anything with your coding knowledge, yet you decide to face charges for pawning items in a building blocks game
Most people don't expect it to lead something serious but in most countries committing a cybercrime is the same as a normal crime.
Prob a script kiddie
they're just narcissistic A holes who don't like that other people can have fun
creating fake items isnt anything offensive enough to face legal charges, but he did cross the line by stealing private information (like password data) which could be used maliciously.
@@doufmech4323 did you not hear how he did it? That is well outside the reach of a script kiddie
You should do a series of 2b2t player profiles. We always see notable players, like iTristan, Hermeticlock, Jared, Redstoner, Popbob, Offtopia, and many others recur in your videos. They always seem to be involved in major events on the server and it would be cool to hear each of there stories in there fullest. As someone who doesn’t even play, there are quite a few players who’s names I recognize from hearing mentioned in so many of your videos, and it would be really cool to see there whole history documented.
Players I can thing of off the top of my head that would be cool to see covered would be Clyde and Taylo. As well as that one player who’s name I forget, but who’s the best civil engineer on the server. There are plenty of others I’m sure you could make very compelling videos on.
It’s pretty surreal it’s that old already. Now it’s old enough to go through its rebellious phase.
I guess it did
@@CrateSauce what it did would be the same as trying to do self harm for the first time
@@niko5008 Was that really necessary? No one cares
@@StarOperator_ rawr XD
@@StarOperator_ stop with the sensitivity people say things and you can't do anything about it, if you could that would be the same as playing or trying to play as God and you would ruin everything.
Both my kids play and have their own server but I really never gave the game much thought until I came across your channel. Now I'm obsessed and awestruck about it's history
I would definitely like to see FitMC as my history teacher
@Don't Read My Profile Picture i won't
@DontReadMyProfilePicture.6 Don't worry I won't.
I'd be getting better grades
Fun fact: fitmc was a school teacher at point before quitting
he was a history teacher
One of the sentiments that they push nowadays in tech is that the biggest vulnerability a company can have will always be is its own employees. Most people don't even realize how much hackers rely on social engineering as a method to enable them to even begin the technical portion. What's the point of wasting time figuring out vulnerabilities to a system when you can circumvent it entirely?
In infosec, they say that the weakest link in a system is the humans operating it
and sometimes humans are the only vulnerability.
This was technically a Mojang employee doing this.
This is especially true given that software security standards are actually pretty high these days. No reason to get complacent, mind you, but it is in fact quite difficult to accomplish anything without someone on the inside manually downloading and/or installing something.
Do employees get paid to follow orders, or think independently?
I played MinecraftOnline actively for almost 2 years and made a town called Maltapple that was targeted by these guys. It caused me to leave the server entirely. My name is Fraccu for those wondering, and you did an AMAZING job on this video Fit, props to you!
Bruh, you literally got banned on discord for harassing women, shut up please
@@draconiusultamius I barely recognized your name but on top of this being untrue you literally posted photos of people undergoing surgery in multiple places that people didn't want to see them and refused to delete them. Quit acting so perfect as if you are fighting for "justice" lmao
@@draconiusultamius Fraccu based then?
@@heart5021 I think ik who you are but under a slightly different name, but essentially the server has been fine for the most part outside of a few hotspots where these players would hang out. Considering fit didn't name them in the video, I won't be naming them either, but they for the most part were part of a base group called Heese69 and would get "the hacker" to distribute items to them and one of their very active members would use these items to make illegal bedrock builds and other bizarre things. They stole stuff from a lot of people echests including mine but I didn't even notice it since all my items were stored in shulkers I never checked. Eventually they used alts to grief attack my town and a few others and destroy all the chests with valuables in them, but other than that for the most part the server is unaffected and the community still stands rather strong. Just as always people come and go, and I assume MCO will make a full recovery from the incident.
u gae
"The hacker social engineered the admin, and gained total control by using an exploit" i think ive heard this somewhere before...
i heard it a bunch but not in Minecraft there has cases it in steam, roblox, ect.
its always social engineering
In times like this it feels like it's not the server that's 13 years old, but the admins /s
Jokes on their trust policies aside, I find it really hard for this to be the only incident in more than a decade...
@@aarongamerph I meant the nocom exploit
@@rekto5781 clearly didn't watch the vid
If only my history teacher was as interesting as fit
idk if you already know this but fit used to be a teacher
Your history teacher is stupid. I'm a better one.
History is awesome and you are wrong if you think it's boring
@@Screecher_can_screech There isn't a joke, whats the joke here? He's just making a statement
i dont know what teacher fit used to be i think it was a math? could be i mixed up with zombie cleo or someone else who hapens to be a math teacher then quit and be a mc youtuber
@@Rafael_VDS buddy, the comment wasnt a joke, it was a statement.
Yikes. The mistake the hacker made was using it too often and leaving breadcrumbs and setting off red flags.
It's for this reason that the Nocom exploit lasted as long as it did. They kept it quiet and on the down low and minimised any public action so as to keep the exploit working as long as possible.
Still, mad props to the Minecraft Online team for getting this far without a breach. 13 years breach free in today's cyber world is not easy.
Nocom was honestly pretty damn good opsec for kids playing Minecraft. They didn’t do everything right but it really worked for quite a while
I would love an update video on this subject later down the line. thanks Fit, literally the only Minecraft channel I watch.
whenever fit says "real world money" it's always the same exact stock footage used and, honestly, I admire that type of loyalty.
Gradle is not a small project, it is actively used by HALF of EVERY SINGLE program using Java, tens or maybe hundred of thousands of softwares, websites backends, etc
It blows my mind a breach was introduced into it.
And it blows my mind even more it was only used to hack a minecraft server.
As I understand it, the hacker didn't put their code into some core gradle repo. They created an alternate version based on gradle, on their own machine. Then compiled it into a binary, and uploaded this bad-gradle on the MCO build server. Where it then compiled the plugins with the malicious code injected into them, which were then executed on the server.
@@abamacus2030 Oh you are right I missunderstood.
According to the official gradle attack repport, the gradle wrapper used by minecraftOnline was tempered with and did not match any valid official checksum.
This means 2 things :
- the exploit could have been avoided had MinecraftOnline verified the checksum of the wrapper before using it.
- the hacker manager to replace the wrapper file on the build server and no one noticied ? This is super weird, the gradle wrapper file is typicaly something you ever set once and never touch ever. Even upgrading gradle to a newer version is only done editing a config, and not by changing the wrapper jar.
...
Now that I think about it, maybe the hacker participated in the creation of a new plugin and was the one who initializated it ? maybe he has access to the build server for developpment purpose ? ...
There are many ways it could have happenned, but it requires some level of trust was put in the hacker at some point, this is insane level of social engeneering.
The hacker had a developer role for quite some time. Like you can always fault bad security, but if a bank manager takes a bundle of cash from the vault, that is not really a bad-security problem, it's a bad-human problem. Developers are supposed to be trustworthy.
(that said, yes I believe they are now requiring some checksum matching; and hopefully not a literal naive "checksum"?)
@@abamacus2030 I mean, it is like the hacker had to start from bank cashier, went through years (not years in the case of minecraftonline but years in the analogy) to build skill and trust with upper management to finaly be named manager of the bank.
I cant blame monecraftonline, no sane mind would see this as a serious possibility...
Gradle wasn't hacked. If someone hands you a version of Windows 11 with a virus in it and you don't check to see if it's the original copy, you can't say Microsoft was hacked.
I used to play on that server and was active when the hackers original account was. They seemed alright, not trustworthy in the slightest, but alright. I'm also kind of friends with two of the other people who were banned in conjunction with the hack. One was always a bit of a troll, but also actually isn't horrible. The other was a longtime player who was very close with the hacker on their original account, but I'm not actually fully convinced that they did anything. I did talk with the hacker for a bit after the news broke, but honestly they were a bit vague. This really isn't their first time doing this, I was one of the people who was involved in the permanent bam of their original account.
I don't think MCO deserves to be hacked tbh. Sure, I've got my own grievances with the server, but I still feel bad for anyone who was negatively affected by this, especially if any passwords or sensitive info has been stolen. It is great that the admins acknowledged the hack publicly, though a friend of mine (former moderator and possibly one of the biggest reasons for the 1.12.2 update) pointed out some flaws in the response, but im just glad they took the time to at least apologize, its a step in the right direction.
Please don't go and harass the server, people are just trying to play there and exist, so there's no reason to go and mess with them just bc of this. Sure, go check it out if you want, but not for some dumb reason like this. It's a unique place, if a deeply flawed place in some ways, but that's part of what makes it special. Go for that experience, not to go and bug the staff by asking about this.
based as always :)
I simply cannot imagine how chronicly online one has to be, just to steal some discord credentials and mess around on a minecraft server
This guy literally went undercover for years, developed a fake identity and stabbed people in the back just to mess around on a minecraft server... If they'd spent half that effort IRL they'd probably be a real life secret agent/spy lol
The weakest link is always the wetware. You can do bulletproof security with hardware and software but people are people.
"When I wasn't investigating money laundering in Minecraft, I was at the gym" is the most FitMC sentence I have ever heard
He's called 'FIT' MC for a reason, I guess.
I love how even in a non 2B2T video Fit still manages to say "The oldest anarchy server in minecraft" what a chad
i mean MCOnline and 2b2t is hanf in hand as the oldest servers
once was civil and the later were anarchy
I remember logging on here and meeting a staff and some players, they all gave me gear, staff didnt spawn it im. Kinda sad that this happened to such a nice community.
its rare not to hear you say ''the oldest anarchy server in minecraft'' anyways, love your content.
"What're you in for?"
"I committed a crime to get items on a minecraft server."
*scoots to the other side of the bench*
jumps though metal bared window and falls 40ft into the asphalt*
@@theperfectbotsteve4916 lol
It always makes me giggle how cool he try’s to make himself look in the raycon ads
This is like planning years for a heist on a vending machine to scam like 8 or 9 people of their 5 dollars.
What a waste of time.
One of the only TH-camrs that I can actually watch the whole video without getting bored. Yo stories interesting ash🤣
What I appreciate here is the fact that the server actually came out and disclosed the issue that was going on and where things when wrong on their part. So big companies can't event get themselves to admit when they've had a security breach.
Fit be like “when I wasn’t committing war crimes on 2b2t and real life, I was in the gym.”
It feels so weird hearing him say "oldest server in Minecraft" without "anarchy"
Hey I love when you're doing stories about Minecraft drama. It's amazing.
How pathetic do you have to be to do something like that? I would feel bad for the hacker facing LEGAL charges, but knowing what they did, they deserved it. Great video as always FitMC!
Edit: I believe some people have misunderstood my comment, I DO NOT feel any sorrow or feel bad for the hacker, what I mean when I say “I would feel bad for the hacker facing legal charges” is that I would feel bad IF they were just a ‘regular’ hacker, just ruining someones win streak in bedwars for example, then faced legal charges FOR the hacking. Thanks for understanding and apologies for the sloppy wording by me :)
Feel bad for getting caught?
How boring does your life has to be for someone to do this?
I agree that there should not be any legal charges for creating and selling in-game items. However, trying to obtain user credentials from other platforms, such as Discord does definitely deserve some legal consequences.
Bro u feel bad for the hacker what kinda degenerate are you lmao 🤡😂😆
@@MarkBiesheuvel selling in game items is against Minecrafts EULA
Weirdly enough, I imagined this happening a couple days ago.
National security being desperate for cybersecueity/warfare experts, meanwhile minecraft servers have to deal with bordeline netrunners trying to mess with their games on a shockingly regular basis 😭
To those of you who are coming into the server, please be respectful to our rules. Don't grief, cheat or spam, and enjoy the history :)
-NightSteak9, Newport Museum
for real
Daaamn they made a whole ass museum for newports?
I'm gonna go in there and grief the sauna >:)
smh another invasion
quick question, was the town Newport on MinecraftOnline named after the Melbourne suburb of Newport? Asking as it seems like it can't be a coincidence
1:46 I dropped my raycon in Dr Pepper... It's been over a week and I'm scared to turn it on, I was half asleep, my raycon was under me while I was lying on bed, I grabbed my Dr Pepper, had a sip, put the lid down to get the raycon from under me, thought my raycon was my lid and dropped it straight in. I laughed at it for like 2 seconds until I realised what I actually did
ayo i am the leader of newport that you mentioned - yes the guy who hacked was a city staff but any cheated builds were removed. the map slider used the wrong date it’s actually supposed to be dec 2021
shut up who cares
@@selimbits salty u got banned
Helo Snaky
@@snaky1580 lmfao
Hey snakyman long time no see! Pretty funny coincidence that he also showed Benstad and my village two times in the video. Like almost a million people have seen my builds now which I think is pretty cool xD
the transition from the video to the sponsorship is godly
heii @FitMC have u ever seen The Biggest Graveyard on 2b2t? i dare you to find it!
if you find it, keep the coor and i'll make one special for you😉dont destroy it please :)
clue : not far from spawn point but far enough to get resources
Up
UP
Uppp
Pppp
Up
i was banned from minecraft online permanantly for opening a door
How did you do that
not possible
@@devin_does_itby opening a door
imagine you and your cell mate talking and you got asked how you got arrested and you said: "I got arrested by hacking a Minecraft server"
I was freaking out cause I thought the title said "Oldest Anarchy Server" and I was terrified of what could have happened
Baby Fit: Da-
His dad: Is he trying to say dad?
Fit: Da oldest anarchy server in minecraft
I was expecting 2b2t to be the aforementioned hacked server, so i almost had a heart attack.
“What are you in for”
“I committed a cybercrime for minecraft items”
"No video game in existence is worth criminal charges"
Nice quote
Say that to Billie Mitchel and Todd Howard. They should be behind bars for life
Maybe,, but this is Minecraft and anything can happen.
1:26 "when I wasn't investigating money laundering in Minecraft, i spent time at the gym."
FitMC
Former FBI agent
2023
Haven't finished the video yet, but I just want to say thank you for not saying the hacker's name. There's too much glorification of these people who do stuff like this, so keeping them anonymous and not broadcasting their identity is the best way to get back at them and deprive them of the fame they were likely seeking from this in some way.
This is a prime example of the fact that most of a hacker work is just social engineering , you don't really need to have extensive knowledge of programming or stuff like that, you just need to be able to fool people
Ok nerd you do it then
@@Judge_0f_Everything nah, while I do have some coding knowledge I actually suck at interacting with people
@@salasy wdym you can't speak English?
@@salasy He needs some milk 🥛
Never expected one of my lunar log blogs to end up in a video this successful. Holy shit.
Timestamp of Lunar log blog?
@@mastermenthe 5:22
Dude I've watched so many of your vids and all I can say is thank you for the FFX music in a lot of vids. Gives me big nostalgia and makes me wanna make a new account to platinum it again
Fun fact : Minecraft online is not the oldest, technically the oldest server with the same map is Novylen!
As a Novylen player: Yeah kinda. But who cares.
@@gandalf_thegrey who asked
@@Judge_0f_Everything you must be under the age of 13 if you have to say "who asked"
@@gandalf_thegrey I'm also a Novylen player, and I was just stating a fact.
Yeah but Novylen is only older due to the map being used in solo before, MinecraftOnline started as a server before Novylen
Inmate 1: What did you go to prison for
Inmate 2: Murder
Inmate 1: what did you go to prison for
Inmate 3: Hacking a Minecraft server
Inmate 1: Ohh shit better stay away from this guy
Inmate 2: I thought I was bad
9:34 This message caught me off guard
This guy is such a gigachad he works out when he’s not cranking 90s in minecraft
I played on that server once, I put down a crafting table in a griefed house, used it to craft a pickaxe, broke it, and then an Admin TP'd to me and said I griefed the house by putting the crafting table down in it, and got banned.
Great server would highly recommend.
Same thing happened to me, except I only stared at a grieved build.
That was it, staring is now a crime, I am the criminal responsible for *checks note* staring.
Sounds fake. From what I've seen staff are usually friendly and quite forgiving. You did break a rule though, you're not allowed to place anything in other peoples builds.
What is your in game name?
@@ballzhimersalert This was like 7 or 8 years ago now, so I think it may have been either SgtSpacePotato or RekItRetz
@@razi_man definitely lying there
5:35 ONE OF MY BUILDS IS IN A FIT MC VIDEO!!!!
i built one of the skyscrapers, I was one of the first three buildings at newport. Never saw it grow as I got busy then my hard drive died, but it is still fun to see.
What’s your ingame username?
"State of the art Security"
The hackers meanwhile:
Even if they have "State of the art Security" there will always be a way to hack into it via humans or social engineering (this goes for most not if everything)
Kyle-"Oh my God they didn't kill Kenny this time"
Butters-"well at least he gets to live one more day"
**me sweating, trying to remember if I've ever played on this server**
i actually used to play this server so it took me by surprise that they got hacked
I kind of want Minecraft 2b2t to update to Minecraft 1.19 but at the same time it would mean that you could hat report and that would be very bad for the server and also to many chunks are already loaded in
The other thing is that it would change the game to much, because it’s many many years of updates which could make the game to crazy and ruin a lot of things already happening in 2b2t
It wouldn't be bad for the server because on the same day the update dropped the community has already written a java plugin that renders the use of the report button useless because - in layman's terms - the server withholds the direct communication to Mojang.
Don't worry about the report button.
It can be disabled with just a simple plug-in...
Then anything you type will appear as a server message, and thus not reportable.
1.18 would be good because you get all of the big things without the cringe ass chat report shit
@@vermski why does this comment sound ai generated
@@freevipservers or you could just update to 1.19 and not bother with 1.19.1, which is the version that adds it.
Was that Yakuza music I was hearing during this video? FitMC just gained a ton of kudos from me.
Who knew that a block game can sent to the cyber security team or authoritys
Every year minecraft just keeps getting crazier and crazier, bet you theres gonna be another hacked server that fitmc will talk about.
i mean most java vunerabilities were almost all discovered by minecraft, if not mojang most of them were either 2b2t playerbase(a.k.a hack client maker) or black hat who addicted to mc for some reason and minecraft forge,fabric and quilt and many less known modloaders modders who actively uses devtools such as gradle,git,maven,and log4j to name a few(not a dev but i knew my friend wo actively use that to mods minecraft)
@@ShiroCh_ID Well yeah but they wont stop any time soon by the looks of it
Me: Oh, the ad this time will probably be related to online security.
Fit: My RAYCONS.
That raycon part got me thinking
He shaved?!
I love the random, not connected stock footage in the beginning.
umm I'm the builder of the mountain you see above Newport in your screenshots at 5:40 and I can assure you I did NOT build it in 1 month time lol. I been working on it for over a year now and it's still not finished x.x GOD do I wish I built it in just a month
pretty sure you mean 'december 2021' instead of 'december 2022'
only 1 tower got illegally built using this hack in Newport and admins already removed it like 2 weeks ago
Hiii Frisoutt :o
Tbh, kinda funny seeing how they implemented a Javascript vm and like a crap ton of method wrappers
ad ends in 2:19
"no video game is worth criminal charges"
*_Cyber-Zoo_** is requesting your location*
Always remember that weakest link in any form of security systems (cybersecurity or physical security) is YOURSELF! Humans afflicted by social engineering is one of the top most common causes for security breaches. So check yourself before you wreck yourself, otherwise you will learn this lesson the hard way.
0:21 That old world generation is just so gigachad, massive oceans
This really is super advanced for minecraft server hack.
In terms of methdology it draws parallels to the solarwinds hack in 2020 (probably the worst federal data breach in US history), the uber breach (which used social engineering to gain access to pretty much everything) and a lesser known incident (unless you're a frontend dev like me :)) which involved node-ipc (short version: package used by a lot of people, dev injected a malware dependency in it that deleted files on russian/belarussian computers).
lmao, im a MCO player and some random dude joined and gave me a load of diamond blocks. had no clue this was happening
Lesson is: Security is an illusion
An example of this is that people used to say that there was no such thing as a mac virus, and apple even encouraged this.
Then 10s of thousands of macs got hacked.
Everything can be broken there isn't an unbreakable system
Not really, though security is waaay too hyped by some people.
@@razi_man every secyrity can be broken
Imagine telling your cellmate that you got locked up because you hacked a minecraft server lol
I just wanna let you know, your videos make me very excited to play minecraft and give me lots of joy
2b2t needs a national peace day on the server I'd love to see how much chaos people would cause to rebel against the holiday 🤣
"When I'm not investigating money laundering in minecraft, I'm at the game"
A sentence you would only hear from FitMC
This is what happens when head developer doesn't do code review before allowing it to be uploaded to the server
They DID review the code, I assume they probably didn't think of running it on a private server since they ran it offline.
@@razi_man running it in a vm doesn't count as "reviewing" a code, actually reading what they changed is reviewing
Actually from what I understood it wasn't in the code directly basically the build command was executed later . Java build tools have the nasty property to be able to load additional code or heavily transform code during build because they are for JEE environment
@@Fiercesoulking I think it’s hidden inside the build tool, not build command (if it is build command, which is usually ran by head dev, then the story would be different). The build tool they uses, Gradle, is open source on GitHub, so the hacker could simply get the source code, add the back door, then build a “Custom Gradle”, it would be difficult to detect, but any developer should know to not use custom built build tool, especially uploaded by a new developer. They probably trusted their dev team too much…
@@Fiercesoulking Updating the gradle JAR still shows up clearly as a changed file and will thus be part of the review. That should raise some questions if doing so wasn't part of the agreed changes
Damn, backdooring a important MC server, is not what people would think would get you in legal trouble. Kudos to MC online for contacting Europol to help them catch the hacker.
Honestly I got banned on minecraft online like a year or two ago for breaking a glass block
I was warned for breaking wool.
@@Bananaking8990 lol looks like I got the short end of the stick.
@@Bob-og3xv LOL.
I wish I could meet the hacker IRL, in the jail cell, asking if it was all worth it? Spending years of their life to get revenge on a ban on a game. Years that could’ve been used to do so many things.
Bro he 100% wont get prison time maybe he needs to pay fines but not prison lmao its just a game
@@MultiSurfa it's not just the game. They stole confidential information from not only the server, but from protected software. That's probably merit for jail time.
@@MultiSurfa Bro he got email idiot 🤡 don't write 40 IQ comments and also you're adopted
@@MultiSurfa ignorance is bliss
@@person8064 so? who cares? move on
"Stay alive out there" becoming more and more of a necessary and relevant phrase at this point lol
0:01 "Minecraft's oldest server"!? BLASPHEMY.
This is ALMOST as bad as war thunder players leaking classified documents
They could have kept this for way longer if they kept it a secret. They literally announced to the world "here, I'm hacking".
yeah the hacker was lacking common sense..
they're not hacking to make the game easier they just want to piss people off
@@theperfectbotsteve4916 they were making money from it, they could have continued to make money for longer if they weren't so explicit
@@figloalds that's a point I didn't consider
@@figloalds I can see the logic they're coming from. "I was born, and its gonna be EVERYONE'S DAMNED PROBLEM"
No one:
Literally no one:
The sponser's for like every FitMC video: Honey and Raycon
I'm surprised it never got hacked earlier, knowing how the playerbase is.
Just recently started watching your video's few months back, it's actually inspired me to play it again
Hope my 2011 base is ok :c
Bro went to rock climbing for a few second sponsor video💀
I just can't believe this. The items going missing from chests is terrible. I remember when everyone got a golden apple for Christmas 2022, after I went along a highway and when I came back my golden apple was missing. The hackers stealing items could be the reason why my golden apple is missing. I just left it in a chest and never used it.
Did you lock your chest?
@@My_Old_YT_Account No, I don't know how to lock chests.
@@samtheepic9433 place a wool block on top of it when you want it locked
@@My_Old_YT_Account Okay
I got banned from this server years ago. Very surprised to see it pop back up like this