Bungee-spoofing attack: Difference between revisions
Add page |
Add some more information to the Velocity section |
||
| (One intermediate revision by the same user not shown) | |||
| Line 5: | Line 5: | ||
[https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data. | [https://github.com/lucko/BungeeGuard BungeeGuard] is a BungeeCord, [https://spigotmc.org/ Spigot] and [https://spongepowered.org/ Sponge] plugin developed by [https://github.com/lucko/ lucko] which attempts to solve this problem by adding a secret token to the end of the player forwarding data. | ||
This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet|Internet]], it can be intercepted | This works for most setups, but if the backend and frontend (the proxy) servers communicate over the [[Wikipedia:Internet|Internet]], it can be intercepted with a [[Wikipedia:Sniffing_attack|sniffing attack]] as the Handshake packet is not [[Wikipedia:Encryption|encrypted]] and the token is sent in plaintext. It may additionally be possible to perform a [[Wikipedia:Timing_attack|timing-based side-channel attack]], as the function responsible for checking the token may not always execute in constant time. | ||
As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)|firewall]] is configured for every backend server that listens on a public | As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a [[Wikipedia:Firewall_(computing)|firewall]] is configured for every backend server that listens on a public | ||
[[Wikipedia:Virtual_network_interface|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network|virtual private network]] providing encryption. | [[Wikipedia:Virtual_network_interface|network interface]], or communications are done exclusively [[Wikipedia:Virtual_private_network|virtual private network]] providing encryption. | ||
Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, | ==Velocity== | ||
Another possible solution is to use [https://papermc.io/software/paper/ Velocity]'s modern forwarding, which uses a [[Wikipedia:HMAC|HMAC]] to verify player data sent in a [https://minecraft.wiki/w/Java_Edition_protocol/Packets#Plugin_Message_(clientbound) Login Plugin Message]. | |||
On offline-mode servers communicating across the Internet, it may be vulnerable to a [[Wikipedia:Replay attack|replay attack]] as the Login Plugin Message packet is only encrypted on online mode servers. As HMACs only serve to verify the authenticity of the attached data, the data they verify is not encrypted in any way and can be inspected by a network attacker. | |||
Offline mode servers with encryption enabled are susceptible to having their encryption effectively disabled with a [[Wikipedia:Man-in-the-middle attack|man-in-the-middle-attack]]. | |||
It is most secure to use a virtual private network or local network to facilitate communication between frontend and backend servers, and to configure a firewall rule if you cannot bind backend servers on a private address. | |||
[[Category:Exploits]] | [[Category:Exploits]] | ||
Latest revision as of 08:42, 4 August 2026
Bungee spoofing is an attack against unfirewalled Bungeecord in which a player sends falsified player forwarding data (sent as part of the host field in the Handshake packet) to the backend server. Common targets for falsification are server owners, staff members and others with special permissions.
Solutions[edit]
BungeeGuard is a BungeeCord, Spigot and Sponge plugin developed by lucko which attempts to solve this problem by adding a secret token to the end of the player forwarding data.
This works for most setups, but if the backend and frontend (the proxy) servers communicate over the Internet, it can be intercepted with a sniffing attack as the Handshake packet is not encrypted and the token is sent in plaintext. It may additionally be possible to perform a timing-based side-channel attack, as the function responsible for checking the token may not always execute in constant time.
As such, for backend and frontend servers which may only communicate over the Internet, it is recommended that a firewall is configured for every backend server that listens on a public network interface, or communications are done exclusively virtual private network providing encryption.
Velocity[edit]
Another possible solution is to use Velocity's modern forwarding, which uses a HMAC to verify player data sent in a Login Plugin Message.
On offline-mode servers communicating across the Internet, it may be vulnerable to a replay attack as the Login Plugin Message packet is only encrypted on online mode servers. As HMACs only serve to verify the authenticity of the attached data, the data they verify is not encrypted in any way and can be inspected by a network attacker.
Offline mode servers with encryption enabled are susceptible to having their encryption effectively disabled with a man-in-the-middle-attack.
It is most secure to use a virtual private network or local network to facilitate communication between frontend and backend servers, and to configure a firewall rule if you cannot bind backend servers on a private address.
