7

Is it possible to spread malware through minecraft, thus making it dangerous to join? Are any safety checks of incoming traffic made, is it necessary for the server to have malware or is it also possible for a user that joins to infect others that joined the server? I couldn't find any information about it after Googling it, which could be because it's unlikely, but why? What is done to make the multiplayer safe?

Improve this question
1
  • Install an anti-malware plugin like this one for extra security. I don't know if such software can spread onto other computers through packets but it could certainly do damage to your server.
    – MegaCrafter10
    Commented Dec 7, 2019 at 1:08

1 Answer 1

Reset to default
8

I asked an expert on this and many more Minecraft related topics (Pokechu22) and this is what they answered:

Answer: No, excluding resources downloaded (resource packs and skins), which still will not be executed without the user manually doing something stupid (in which case, you can just as easily pwn them by making them download some other malicious executable). Vague link to https://wiki.vg/Protocol.

Java makes it unlikely for buffer overflows leading to arbitrary code execution or similar issues to cause problems; if there was a problem then it would affect far more than just MC.

The link about malicious plugins is a thing, but that's more the server owner installing arbitrary plugins that do bad stuff to that server than harming clients

I can't speak for bedrock. That could have buffer overflows or similar issues for all I know.

(and, in case it matters, I give permission for you to quote these comments there and apply the needed license for stackexchange posts, etc)

Oh. And since that question was about one user spreading stuff to other users, the only venue is skins (which now have a lot of filters on them to prevent embedding files after the PNG data, but in the past didn't, leading to a scare -- though again that was NOT executed by the game. Such attacks shouldn't be possible/would be much harder now, since skins are recompressed and sanitized by Mojang)

The only other venue through which malware could spread is chat, since chat gets sent between players and is logged. So you could put something into chat, but that still wouldn't be executed. Or you could put a malicious link in chat, but that'd require naïve players anyways.

You could send the EICAR test file in a chat message, but that wouldn't be executed (and isn't considered a threat if it's a substring, only if that's the file's whole contents; after all, it's not executable as-is)

And it's not like that's limited to MC's chat; I can send it right here too: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Improve this answer
5
  • And does the client verify that the code coming in from multiplayer is not some malicious stuff to be executed? By that I mean why buffer overflows are necessary to execute other code than game related code. Otherwise I guess someone could just modify some files to send malware instead of the normal Minecraft traffic, so what prevents that from happening?
    – DaddyMike
    Commented Dec 8, 2019 at 10:38
  • All traffic except for resource packs is in specific packets for specific tasks, like block updates, player movement, etc. Those are all interpreted by the game. If there was a way to do something harmful, it would be a bug in the game. And then, sure, you can probably make a client crash for example by making it believe that there are a million entities nearby.
    – Fabian Röling
    Commented Dec 8, 2019 at 13:09
  • So I understand that the game does take measures to prevent that? This makes me think of MW2 where one could modify the game to send malicious packets and take control of someone's desktop if I remember correctly... Just wondering why it's not possible in Minecraft...
    – DaddyMike
    Commented Dec 8, 2019 at 14:09
  • I don't know what "MW2" is, but the packets that Minecraft clients receive are never executed as programs and never saved to file, so it can't execute malicious code.
    – Fabian Röling
    Commented Dec 8, 2019 at 17:04
  • Only now I fully realise what you mean with "code": No, no executable code is sent in the regular usage of Minecraft, only data that gets interpreted by the program that you have already installed. And even if an executable file was sent, Minecraft would not know how to handle it and would just discard it. I know of no program that normally receives executable files and saves them, except for those made for downloading (browsers, wget, …) and those have lots of safety measures built in. No game should ever just download and save arbitrary files without user confirmation.
    – Fabian Röling
    Commented Dec 31, 2019 at 8:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.