mcbans

How Not To Treat Your Users

One of this year's first example of how not to treat your users, and how to utterly fail at public relations (PR) is courtesy of MCBans, a very popular global ban system for the viral indie hit Minecraft. Having over 1492 total (non-concurrent) installations, it is by far the most popular. Global ban systems are a useful way of discouraging griefers from vandalizing servers in multiplayer games where no other system exists, or when more control is needed over what the game creators original provided.

These systems can work, and can work very well where they do. However, these systems are fundamentally designed on trust. By you (a server owner) or you (a player) utilizing a global ban system, you're trusting the individuals that develop and run the system to remain completely impartial and to be responsible with the power they're given.

MCBans is unfortunately the perfect example of why you need to do a bit of research before putting your trust into a global, centralized service controlled by only a few individuals. One of the most damning things was the inclusion of Doridian and zidonuke as developers. Doridian became infamous in the Minecraft community when it was discovered that a popular server administration plugin he had created contained a backdoor allowing Doridian to take over a server, even banning the owner - which he did. He later apologized and released McAdmin as open source. However, he also went on to work on mods to another popular hit, Terraria, which ended fairly predictably when he went and destroyed their forum and ran off (Apologies, the event I originally mentioned appears to actually have been zidonuke, and the sources used also made the same mistake - I will clarify on this when I can contact a tMod developer).

Whoever makes the hiring decisions for MCBans was aiming to be an all-star strikeout with the (temporary) inclusion of zidonuke on the team who was also infamous in the Minecraft community for a series of videos showing him joining servers and crashing them for “the lulz” and generally being an outright dick. Sounds like an outstanding candidate to develop and manage a global ban system, right? He's also managed to single-handedly destroy several other projects, such as PWO.

To any future employers, developers, or other individuals seeking potential work with Zidonuke:
this behaviour is not an isolated event. Multiple times in the past, Zidonuke has carved out and
shut down (albeit almost always temporarily) websites, game servers, and other communities for
reasons that at the time aren’t apparent. At times he has revealed personal information about
users (this is not one of those times). I would warn you to ensure that he is someone you trust
entirely and have a friendly and warm relationship with before allowing him access into your devices.
While I don’t believe it would be fair to vilify him and declare he never find work again, I feel
obligated to issue a warning so that those seeking to work with him in the future are aware of his past.
- crenel

The users didn't think so, and voiced this loudly both on IRC and on the forums (now conveniently wiped). Predictably, this ends in him taking over the MCBans system and posting a note on the MCBans frontpage. MCBans staff still refuse to acknowledge (outside of anonymous PMs) that Zidonuke had access to the entire API, removing any bans that affected himself. This is really a shame, as from Zidonuke's professional history, he's an extremely capable individual.

[00:16:01] <NateN34> Zidonuke?!
[00:16:16] <NateN34> The guy that made a server mod and it crashed and DDOSed others servers?
[00:16:24] <Zidonuke> Yeah?

Unfortunately, it appears that Doridian and zidonuke are peas in a pod. So much so, that some users are convinced they're the same person with mental instability.

I'll say this one thing to all the above, I love Doridian and I shall protect him against
anything even if it is the truth. That is just my level of devotion to him.
- Zidonuke

These two later teamed up to produce Yiffcraft, a modified client designed to hack and crash, and sold it for commercial profit (which is illegal for an entire basket full of reasons).
Site Hacked

To put the cherry on the cake and to top off the New Year, the MCBans forum was compromised between January 6th and 7th, by parties not yet confirmed, however the domain used for the attack is run by “ARAB ( Organization of Raged Arab Bloggers )” (since shutdown by the hosting provider). By itself, this is not really that major of an issue. This happens constantly, across sites both big and small. The difference is how you resolve the issue, and how you communicate with your users. MCbans appears to have taken a leaf out of Sony's book with their 5-step process.

    First, adamantly refusing to admit any issue had occurred whatsoever.
    Then later claimed that the forum had been compromised without getting access to the database.
    Admitting that the forum database had been taken when every registered user began receiving an email from the attackers.
    Finally admitting that a backup of the forum and of the ban database had been taken when users API keys were posted in public locations.
    Closing the (new) forum once people began asking for details and an explanation.

This is my personal (unedited) log from #mcbans the afternoon of the hack. Usernames with a @ preceding them are MCBans staff. These are some of the most unprofessional individuals I've ever met, and I'm no shining example myself!

These amazing conversations are between MCBans staffers g and rakiru with envygeeks, a temporary staffer apparently hired to help with “security issues”. These are the people you've entrusted to control your server bans.

[04:58] <rakiru> how mature
[05:00] <rakiru> banning me on the website, or blocking me from accessing the website?
[05:00] <rakiru> or have you decided against it?
[05:00] <rakiru> not trolling, just curios
[05:01] <envygeeks> I'll be banning you from accessing mcbans.com period, forums an all, this will be a top level ban from the  IPS (of which I built) down
[05:01] <envygeeks> you don't piss off the one guy who controls everything now
[05:14] <envygeeks> he can't protect you, I run the servers
[05:15] <rakiru> who? firestar?
[05:15] <envygeeks> nobody can, I expect my apology or you will be banned, he can't protect you
[05:17] <envygeeks> he may say ignore me but I control the servers
[05:24] <envygeeks> I'll give you one hour, at most to decide whether you apologise before I ban you from everything
[05:25] <envygeeks> And no worries Raiku, I have no hard feelings, once I ban you, I will forget about you like the rest of the trash on the internet that I ban daily
[06:49] <envygeeks> you're all a bunch of faggots

[05:27] <g> Hey, Fire and Stracci are too stressed out to explain, so I decided to ask directly what it is you're doing for us
[05:27] <g> so.. what're you doing for us?
[06:52] <envygeeks> Who is "us"?
[06:52] <envygeeks> I don't work for "us" I work for firestar
[06:52] <g> Okay, then what're you doing for Fire?
[06:54] <envygeeks> Who are you to ask again?
[06:57] <g> I'm on the team
[06:57] <envygeeks> You are not on my team though, and I do not answer to any of you
[06:58] <g> Class-A troll, I'll give you that.
[06:59] <envygeeks> No, I'm no troll
[06:59] <envygeeks> You are below my paygrade
[06:59] <envygeeks> I do not answer to you
[06:59] <envygeeks> I will not
[06:59] <envygeeks> it is not your business and it will never be
[06:59] <g> lol
[06:59] <g> Fire himself tells me you're a troll
[06:59] <envygeeks> do not approach me as if you are close to my paygrade or my boss
[07:00] <envygeeks> He can say what he wants, doesn't matter, I am still above your paygrade and I decide whether you stay or not unless he leaves my IPS which I doubt he will since I am the one who single handedly brought it back up
[07:00] <envygeeks> When you can do my job, I'll answer to you, until then, you are trash to me
[07:01] <g> Uhhuh. Until Firestar fires you, yeah
[07:01] <g> you're not the only one providing services to him, y'know.
[07:01] <envygeeks> Yes "services"
[07:02] <envygeeks> and he won't fire me son
[07:02] <g> haha
[07:02] <g> wanna bet?
[07:02] <envygeeks> yes I do, I suggest you learn who I am to him and the only reason I helped him
[07:03] <envygeeks> I could do all your jobs, at once, while masturbating
[07:04] <g> Masturbating? I'm sure that's the job you excel at. :>

MCBans Account List

(This is an amendment to the original article.)

The evening after the attack, I was contacted by an anonymous individual with access to the files taken from the year-old backup who has allowed me to release some very worrying information. Keep in mind that the backup stolen was around a year old.

There is a page (still active on the recent site) that when viewed presents nothing but a blank page. However, the source for this page contains the usernames and passwords for 2757 Minecraft accounts. Why does a ban site need or have a list of so many of its users usernames and passwords? The passwords will not be disclosed (by me, at least), however I have included a full list of the compromised usernames so that you may check to see if your account has been cracked. It is suggested you immediately change your password, as I have verified several at random and many of them are indeed valid passwords.

Edit: It has been brought to my attention that this file in question is equivalent to database on Dinnerbone's compromised account page. Having noted that, why do they feel the need to keep the full list of not just the usernames, but the passwords as well?

Edit: The full list of names is now available here.
MCBans Legal Threat

Ah, this was a lovely site in my inbox this morning. Forwarded to me by Amazon, this was to me on behalf of MCBans, and is effectively an attempt at forcing the article to disappear. Obviously, this won't happen.

Many of the statements about MCBans.com on the offending wiki are untrue and defamatory. You made them maliciously to injure MCBans in its trade, office and profession. As such, they are defamatory per se. Under Communications Decency Act of 1996, this letter constitutes a demand for immediate retraction in writing of these false and libelous statements. In accordance with the Communications Decency Act of 1996, MCBans demands that your retraction and correction be accompanied by an editorial in which you specifically repudiated your libelous statements.

Below, we have noted some of the more patent, malicious, and libelious comments made by you in your postings; some of them also evidence your tortuous
interference.

1. In your postings, you repeatedly stated that David Brown, also known as Zidonuke, is/was a member of the MCBans development and/or administration team, this is untrue.

2. In your postings, you repeatedly involve the activity of David Brown with malicious intent towards MCBans when he has never been directly or officially involved in the management of MCBans or it's development.

3. You also defame our staff by implying that we intentionally kept information from the public regarding the recent intrusions on our service, this is untrue as at the time of the postings by our staff we were unaware of the severity of the intrusion.

4. You have updated the article since it's creation also framing MCBans and it's staff for holding user data for malicious intent which is also untrue.

Your spreading of this information barring the attempt to contact our staff regarding in incident and attempt to check the information you gathered or obtained from unknown sources to verify your postings also confirms your malicious intent.


If you do not immediately publish the requested retraction, and cease and desist from tortuous interference and making false and malicious comments about MCBans, it's staff, and its services, we will be forced to take further action against you. This email also constitutes a request to the ISP for the content (amazon.com) for immediate suspension of access to the offending content and/or it's removal until such a time that a resolution is achieved by both parties within 5 working days of this notice being received.

I hereby state, under penalty of perjury, that I am authorized to act on the behalf of MCBans and it's staff.

Sources

I try to source as much as I can, however not everything can be publicly sourced. Many facts are double checked against current MCBans staff, public and private IRC logs, and forum postings. Here are a few additional sources for people interested in researching it:

    Old #mcbans channel logs are available from here,
    tMod warning thread on the Terraria forums,
    My personal log from #mcbans the afternoon of the attack,
    A damning reddit thread (with sources and logs),
    Dozens of Minecraft Forum posts (just search for Doridian).