How 126,000,000 Minecraft Accounts Got Hacked
HTML-код
- Опубликовано: 27 май 2021
- Last year, 126,000,000 Minecraft accounts got hacked. This was absolutely insane.
This video explains the Minecraft Session ID exploit, one of the most dangerous bugs in Minecraft's history. I'll show you how it works, some RUclipsrs who were affected, and Mojang's response. Watch until the end, this story is unbelievable.
DISCORD ➤ / discord
TWITTER ➤ / beluga1000
MINECRAFT SERVER ➤ lucid-craft.com
clips used:
• Griefing and ruining a...
• HBtv and DeadBush (Tim...
• Mineplex Hacking: Usin...
#Minecraft 
Игры
If you like what you see, SMASH subscribe because more videos are on the way :)
L
Yes
@@andyplatosh5689 hey
Beluga
already dide
This hits hard for anyone who's had their Minecraft accounts hacked before
Hits more hard when I realize how much time you spend on RUclips via commenting
Do you have a life?
My account are getting 3 times per day by diffrent people
It was, until I got it back.
Eyy found you
Bro I see you everywhere lol
Somewhere before today, my friend abused this glitch and decided to use it just for his funny pranks while also shipping george and dream. I hated it.
Also, my friend used t-launcher to put my name in it, it actually logged me out.
Oh.
Just access his acc back it's that easy
@@StageRUclips naw, i'd ship george and drea-
/j
Lucid dreamer > minecraft documenter > discord maker
He likely still lucid dream likely of getting of getting some bitches
Downgrade
*Mojang:* Let’s make the Session ID public!
*Hackers:* Good idea!
Hacker: I'm gonna now mess up popular RUclips's server
69 YESSS
Mojang: let fix the session hack.
Hacker:NOOOOOOOoOOOOOOOOOO
*we do a little trolling*
@@iameveryoneshomie2977 not my homie 😤
Never imagine to a minecraft documeter to becoming a discord maker
Lolz same
Yeeee :)
Ikr
=T
Same
Aw man seeing this 2 years later and seeing the old mc launcher makes me feel nostalgic
i kinda wish beluga made more videos like this instead of shitposts
Same.
Some people just want the world to burn, thinking they’re fireproof
I’m gonna yoink this
10 on 10, would repost somewhere again
Didn’t the guy from Batman say that
@@paratoxicalcapybara3939 "the guy from batman"
@@lolxd7753 yeah that’s what he said.
Single player: *vibing* “LETS GO!”
I AM invincible BY THE POWER OF LONLINESS!
@@MelAegis pretty sure he means he doesn’t have an account, and is just vibing alone
@@MelAegis you got asession id when you logged in a server if you dont get session id you cant get hacked (or I may have just not understood something idk)
@@isaacanimates1890 oh lmao
@@valakivalaki5798 *Understandable, have a great day.*
I wouldn't object seeing Beluga make more videos like this
The old Beluga...
Yes
People not having a Minecraft account but still playing on crack: *you fools, i dont have such a weakness*
PLAYING ON CRACK?
weakness is a joke.
@Alejandro Huertas Téllez umm maybe I use that lol (im poor plz)
YES, LOL
Haha ez TLauncher go brrrrrrrr
Wow this isn't even like, people falling for a scam or anything, this is just hackers completely taking over a loophole in Minecraft's own code and ruining the accounts of innocent users.
1k likes soon? 4 now
" the dark side of the force is a pathway to abilities some consider.............. unnatural.."
If only one of them turned to the light side and began combating them
@@gameseeker6307 that wud be the devs
that same mesaage pop up on when i was on Hypixel
As someone who works with bug hunting daily, I'd say that;
1. No - you won't get access to someone else's sessionID by knowing their public IP address
2. I see this all the time. The part with a "legacy" or an outdated authentication process is used for authentication. Sure, blame Mojang, they could've thought of it. But in the end, it's human error to make mistakes c:
3. The last part about a "back door into every single minecraft account", does not exist. I think you refer to an account takeover and in this case, they made something called a "Session High-jacking". A backdoor is if an attacker were to be able to gain a reverse shell to a website for example. That's one back door as he didn't need to use SSH to get access to the webservers internals. Just an example :P Wish there were more technical details that i didn't know of in this xD But still, great job with the video! ^^
1:38 had me cracking up 🤣 "Change your email"... well how the f**k do I do that?
“It effected every single registered account, including yours”
Me who didn’t have PC Minecraft back then: *fool*
Me, who didn't even PLAY minecraft:
XDXD
Me too
@@thishandlesucks-webcookie do you have mobile? If then I have a video that can get you free mcpe see my vid on this channel or in the channel @G F L 999
I didnt even have minecraft Java either :D I was using minecraft education edition and I still am.......
Same lol
Beluga: “Everyone’s account got hacked even yours.”
Me whos account didnt get hacked:
They can hack your account, but still they don't care so they didn't.
@@Dullification they cant hack a account that dont exist
NO one care a useless acc because you don't have coins 🤣🤣🤣🤣
@@dragondesabysse2258 lol
@@dragondesabysse2258 let me off this planet please
For anybody wanting to know the music being played at 3:25 in the name of the song is Wonderful World remix by DJ quads the very same DJ quads that made Anniversary song Aristotle which was in a Minecraft Modpack
It's a good thing I didn't know Minecraft java or servers existed when the accounts got hacked. I only played bedrock and pocket edition.
Minecraft accounts: *getting hacked*
People who pirate Minecraft: I don't have such weaknesses
Edit: changed possess to have
i don't have said weakness either
I have a friend who pirates video games, he also pirated minecraft
Same
I know this is a joke, but I couldn't resist... If you pirate Minecraft, you are "hacked" by design.
@@GrzesiekJedenastka well yes but no cuz there is no account to be stolen but you downloaded a free launcher that could have a virus
I once had that message pop up in red while I was chillin out on bedwars. Thought I was gettin hacked so I kept logging on and fighting back with the supposed hacker. Turns out, my WiFi is just so bad that it made a fuckin CLONE of myself that was 10 seconds late so I was just fighting back with myself lmao
Epic
Truly
Wait wha--
what country are you from
I also have trash wifi
Very nice video I enjoy the discord videos too but you should also do some more other types of videos
@Beluga I keep rewatching this video, I love this style of video!! please make more like this!!!!!!!!
Other Channels: “Only 1% of the viewers is suscribed”
Beluga: “Only 1% of the viewers is female”
I am a 1 percen
But the real question is... why does he know tat
SUScribed.
damn.
@@dererstaunlicheanomalefuch6861 it was a joke actually
@@sierraapples8099 Actually No , there is a option where you can see everything how many male or female and who are subsrcibed while watching the video etc...But they just edit it and make less percentage
The reason why Hypixel admins (and YT accounts) couldn’t be hacked and joined from another location was 2FA. It’s just that a lot of YT accounts didn’t have 2FA enabled
2FA was not added when the hack happened. And even if Microsoft account 2FA existed, the RUclipsrs would still be using Mojang Accounts and not Microsoft accounts , thus not allowing them to have 2FA. As far as I know, 2FA did not exist for Minecraft Java edition accounts until late last year. And even if 2FA was enabled, the hack involved session ID which was not related to the the login details. As said in the video, the hypixel admins probably just banned themselves through the console and disabled admin commands when this hack was a thing. Please watch the video before making a comment that relates to the video.
@@mrscam6173 hes talking about 2fa on hypixel some youtubers and admin gotta write a password when they join hypixel
@@mrscam6173 This 2FA is coming from Hypixel themselves, not Microsoft/Mojang. If they banned themseleves through console and disabled admin commands, there would be no server moderation.
@@Destructotz this is extremely true.
@@mrscam6173 I did watch the video all the way through. As @LoggenOut YT and @Evan Nguyen said, Hypixel had its own 2FA system. It works by tracking the IP of those who have it enabled and then not letting them join if it is different (unless they have a 2FA code). The reason why you may not have heard of this is because it is only available to YT accounts and then to staff (I’m not sure what levels of staff had access though). The Hypixel admin team has stated on countless previous occasions of players asking for 2FA that regular players don’t have access to it so that the staff team doesn’t have to spend time helping all the people who lost access to their account.
Oooofff! I think I had my MC account just a few months later...
R.I.P., 2b2t MC bases...
i would probably mess with people on servers (no severe griefing, just trolling). Like making a massive diamond block cube in bedwars out of bounds or giving people saplings in lobbies.
“There is no way to stop them”
Hack and log onto their mine craft account and screw it up severely too, if I’m going down I’m taking that person with me
LOL that’s smart
They just acrew you up even more
You don’t know their account
It’s a joke “stupid”
@@hikafallen1306 rude
Funfact: It was Hecker all along
😮
Worst part is that he didin't even remind the people what thier passwords were
Yes…
@@Marlin123 lol
THE LORE 😯😯😯
i've watched this like back in 2021 and never thought it was from Beluga :)
Bro I didn think that beluga could post such a serious video
not exactly sure why this was in my recommended, but i think you're about to get a huge spike in views due to the algorithim
SAME LOL
Too true, this will probably get 1 Million+ views
same and since hypixel is getting ddos attacked
@@porknchops26 yeah
Yup
Beluga: “Everyone’s account got hacked, even yours”
Me who never had a Minecraft account:
This is underrated
Same lol but I have a tlauncher accouny
@@billionairexd4977 Me too
@@ariel.notsane ye imagine working hard making money buying minecraft but it gets hacked the other day :/
@@billionairexd4977 :0 that would we awful and waste but imagine getting that money from your parents after begging them till 2 hours! You'll get 5 hours lecture plus no Minecraft
This never happened in my Minecraft worlds before. But one other world of mine glitched of terror
hmmm there was a similar situation in Poland, two RUclipsrs were involved in situations with keyloggers.
“It effected every single registered account, including yours”
Me who wasn't even playing Minecraft that day: lol
as he said they had to know only your nick and you didn't have to be online
True
I wasn’t playing it that year :)
Me :doesnt even have minecraft…
My account is not hacked
"Everyone was hacked"
Me who made my account after the attack: I have no such weakness
i had the same problem around 4 months ago
so true
i have my account since 2014
Me who never had java:
@@overlyaverage1 same lol
This is so different to a normal Beluga video on Discord.
Man I wish he made videos like this, these were cool
I think they cracked the way session ids are generated. As an ethical hacker, sometimes "random" is not really random. It's just "chaotic". And knowing how session ids are generated in the backend you can just predict any valid session id for any users
Wait,what??
I want to be you
True, knowing the "logic" At the backend you can generate them and a few might be vaild and looking at the big numbers of accounts out there alot of them must have been. The more the accounts the more chances of getting a valid id.
And yes you could predict them too just have to reverse engineer the backend "logic" Abit or you can randomly generate them with help of a automated tool and check them.
definitely a possible answer, just find the pattern really at that point
THIS IS WHY MY FRIEND MET MRBEAST IN DUELS!!!! IT MAKES SENSE NOW
edit: for people saying it was a nick, we checked a website, his last login was the day he met him lol
ohhh
oh gosh
Wait wahhhh, whenn
Or they did /nick
@@Teegste thats not how /nick works
I remember this, my mom wanted to learn how to play Minecraft because she said it looked fun, so I was teaching her on my server ( a small smp with my friends, and then a hacker got on blew everything up, and then banned everyone
I remember watching this, I thought it was made by a popular youtuber, amazing editing skills.
I remember watching this without knowing it was Beluga or even who he was.
me too lol
yessssssss
SAME
Same
Me too
I never thought I'd see the day where Beluga makes a serious video lol
this was an old vid.
When i watched this i didn’t even know it was from beluga
lol
@@calebfv ME 2!
old video
beluga: makes meme videos
also beluga: finally makes a normal video
i wasn't your biggest fans when you were uploading discord videos but i really love this type of content keep it up
i could literally imagine those same exploiters raging because they couldnt play on a certain persons account because others were trying to do the same
All thanks to @hack_types on instagram who helped me to recover my discord account, I recommend all of you to him is the best I've ever seen
dont believe guy above me
@@eric_toolz9865 LMAOOOO
“Yeah sorry I’m getting hacked can I call you back?” Got me 😭
You're not that youtuber-
Silly brett
Yea he was just excited like that one time when I played mw2 and everyone got everything in the game
timestamp?
@@robrit5301 like 1:45
Im sure all big servers have backup worlds so if this happens after it gets fixed they can just swap it out
There was a live youtube stream of a very popular youtuber. He was playing with his friends when this infamous tragedy had happened. However due to his excellent security system, which was revealed during this period and he had to make it more better, he wasnt hacked. It basically gave us a hint that no one could ever hack him...
As a cyber security student, I would literally yell at microsoft's security team and maybe get to publish a CVE, to put into perspective its basically accessing your RUclips, Twitter or Google account without a Username or Password, granted I think the people that got affected either got phised or the hackers pseudo-gussed the hash for getting session ID.
Either way, it's really, really, really bad that it happened. Glad its at least fixed or deprecated.
Yes!
This is before the Microsoft Account migration, blame Mojang Studios
I wonder how many people hacked servers with insecure admin commands, if it happened at all. Possibly some DOS attacks came of this.
@@itdepends604 it really isnt insecure admin commands more like admin credentials, and given that there bots/script that scan the internet, there is the occasional hit. If your curious look up: "how do botnets work?" or "how do C2 servers work?"
@@WeatherWX but there must of been at least one server plugin that trusts the server admin more then they should?
Beluga: “Everyone’s account got hacked even yours.”
Me who got Minecraft on pc 1 year later: *happiness and sadness noises*
people who never play online: happiness
Like the minecraft piano music happy and sad (:
@@bryanbrathwaite couldn’t they destroy their single player world?
@@chippedtile no
@@jessveness oh ok
This may be my favorite video of yours! If I had the chance to log into any account I would log into the account of the Dutch Minecraft RUclipsr Dodo and walk through the maps of his survival roleplay's he did over the years. And I would leave a sign with some nice text. I wouldn't make any serious damage.
Beluga has changed so much channel-wise
“Every single Minecraft account in existence”
Me who plays bedrock : INFINTIE POWER
Also you who plays bedrock: NO PC
@@springlio6441 bro you can get bedrock on a pc
@@springlio6441 bedrock is on pc also
@@FishyExists yea and the PCs who get Java edition is specific
Same
I think I'd log into Technoblade's account and farm potatoes for him
eDiT: tHaNkS fOr 3 LiKeS
Lol
Lol
Lol
I would steal them
The war of s over
Beluga we need more of these vids
This is so much better than his new content
Beluga: talks about how horrible the exploit was and how tragic
Also Beluga: Explaining what he would do if the exploit was still available
HAAHHHAHAHHAHAH
yes
I would do the same but instead of messing around I will chat with the others as dream, I’m just lonely lol
1:00 FitMC is actually just SalC1 confirmed
Funny
lol
I was about to say bro that caught me off guard 💀
@aRctic they have such different voices mannnn
ngl, I feel like everyone (including me) misses these videos
Honestly, I'm pretty lucky i didn't get affected by this, and it's pretty shocking to see a lot of people being affected by this though back in 2020.
when salc1 becomes fitmc
I was tripping lmao
Lololololololololololol🙃
“The earliest lawless server in cave game”
- HealthyCaveGame
yeah fitmc hacked salc1
It's like using the Death Note, but you actually only need to know the name.
So the Death Note plus the Shinigami eyes
so... you would kill everyone with the name "Pop" instead of a certain person?
@@yoral no, it would know which one you want to kill
@@palachu yes but with the shinigami eyes you still need to know the name and face, and actually have seen the face once to know their name
Good example of why you should backup your server regularly.
I never realized Beluga has made a video of this while speaking
I feel like there should have been a way to temporarily disable an account and it can only be reactivated by entering username and password
oh yeah like how discord does it
@@cardi1783 except without the phone number, I’ve been locked out of 2 accounts already because I don’t have a phone and phone is required for verification in discord
your picture is off of google images...
nice profile picture
“tell me what you would do if it happened again”
Sorry bro, but I wouldn’t do anything because I have a sense of morals
Why the hell do you have Nord VPN as pfp?!
@@Saikmuu he's a living sponsor, leave him be
Well i dont really play minecraft anymore soo
@@GiammiTheBest it’s how I get my cash ( ͡° ͜ʖ ͡°)
Same
i forgot this was a beluga video lol
I would use it to login to a famous server like hypixel and just see behind the screens admin/owner chats and anything out of bounds and just see how things were constructed/put together
Beluga: "There is no way to stop them.
Me: Go onto single-player
Play on Bedrock
Me: has a slow wifi
Happy when I saw the upload date cause I just downloaded Java Edition!
@@zakem the hack is still working
@@terrainiyw1546 wait wut
"Everyone's Minecraft got hacked, even yours."
Me who has Minecraft PS3:
*I have no such weaknesses*
Me who had Xbox but didnt hacked
X2 i play minecraft in ps3
Me chilling on Minecraft Education Edition 😎😎
Me who plays with ipad single player
I have ps4 no psn network lol so Im basicly only playing in single player mode lol
i wonder if thats when i logged in to see all my worlds deleted.... All of them
I must say, I would log into my friend's account and start messing around with his worlds, but nothing too devastating.
Plot twist: The people who started all this are watching this video and having a good laugh
Maybe its true edit: no its not me
Another plot twist: your the hacker and your just laughing
"Why you did you do it? Now we both will surely drown" Said the turtle
"Lol" said the scorpion "lmao"
Yeah
Wheres the twist. This is likely just a fact
"Only 1% of my viewers are female"
I suddenly feel personally attacked for being a female watching this lol
don't worry, 1% of the views currently as I am writing now are 16362.62 females, not bad..
You and me both
Me suddenly: Why am I here?
Every guy is watching you
@@gal-vz2ej I used to have like, 99% male now it's all female due to a single vid I made
i forgot this was beluga thought it was sunny v2 suddenly
I would go on Mumbo Jumbo’s account since he’s not playing much at the moment and I would log on to the hermitcraft amp
Wait, this is the funny "Discord Mod" meme guy? Damn this is some good content
i just noticed, too
What a genre change
omg i just realized!
Hes also the lucid dream guy
This isn’t even his main channel!
This is scary, glad it's over now.
Wtf feels So wierd beluga making this lol
I would go into my friends account CAUSE HE STOLE MY STRONG DRAGON ARMOR
YIKES
):
Oof
do it no mercy
That's sad
Beluga: “Everyone’s account got hacked even yours.”
Me happy to have a friend
Hello! How are you? If you need someone to listen, someone to talk to, or a friend. I am here to talk, listen, and be a friend. I hope you are safe and well. Know that you are amazing and have rights as a human. I am very sorry for anything that seems bad that may have happened in your life. I want you to know that you are incredible and are capable of wonders. What matters is your inside, not your exterior. Love yourself and cherish yourself. Words cannot explain how astonishing you are. You deserve care, love, and happiness, don't let anything make you feel otherwise. Please have appropriate action for anything that you know is wrong. Anything that seems bad or wrong in your life right now will get better. Please don't do what is wrong, fighting back and harming others will not solve the problem. Please understand that and do the good thing. It will one day come back to you. The people in the world are so much more than what we know about them, not everyone opens up about the beautiful things and acts they have witnessed, not all those amazing doings are acknowledged. Please understand that and know that. If you feel like no one cares about you, know that I care about you. Keep your head up high and never give up! Together, we can be a better community! Stay safe, healthy, happy, kind, understanding, positive and strong!
@@emaanahsansarfraz1940 e
Bruh me uses tlauncher
@@emaanahsansarfraz1940 Internet commenters have started writing digital novels now?
I dont have a minecraft account
How to protect your server:
Step 1. Disable any Cracked minecraft access from your server.
Step 2. Just incase step 1 gets bypassed, set up a password plugin on your server. (If you are planning to make your server have cracked access, this step is important.)
Step 3. Add an anticheat and appeal system so if step 1 and 2 gets bypassed, or just incase, people that get hacked by hackers can appeal their ban if they get banned.
Step 4. Your done now! Remember to keep your safety on the internet.
I had the same situation, it said login from another location, before that it sent me back to the lobby and in the end I took a new account
Meanwhile, the 3rd world country players who use pirate Minecraft: They called me a madman.jpg
wheeze
@@misty6950 Slash wheeze?
@@octavio675 that was meant to be just wheeze lol
@@octavio675 who tf is dat
Yeaaa,i dont even have a mc account (but somehow someone shared his with me lol)
Imagine someone joined hypixel with notches account
E
You coudnt because the user needed to be on Minecraft for the session id to generate lol
@@faisal7pro723 "Imagine"
I’m sure they did
@@faisal7pro723 they said *IMAGINE*
a way to stop this is to add a login plugin or thing so you would need a password to access that server
that make sense I always thought my password was found out again. I never heard of this before
If I could log into anyone’s Minecraft account I would log into my account.
bigger brain
how could you
imagine logging into your account
Wish i would have one
lmao
7:10 F
F
Hello person with checkmark
F
@@jedskiee it’s a verified account
ok
I joined the Minecraft club right around this time whem the hack occured. About one week before it initially occured
I never knew you can make such a good video and by the way thanks for the info!
I feel so honored that this happened on my birthday
Ay our birthdays are 5 days apart
Edit: nevermind i though it was just the 7th not the 27th
We have close b-d’s, mine is on March 1st
@@esrilune he was the start you were the end
Lmao same
I’m happy I made my account 8 months later
Hypixel have said before that they use 2fa for their staff, so that's why they'd have all been safe as even with account access, they wouldn't have the 2fa code generator
cos that’s helping now
Nintendo Switch: Bro what about me?
POV: you’re on bedrock edition
U mean bugrock
Bugrock
@@BurritoDude73your 10 months late from this comment
@@Egg_14your 11 months late from this comment
So beluga:
Really funny discord memes, and,
Actually really well put together docos
Edit: wow 400 likes thanks guys
Yeah this guys a legend
Fun fact nobody even knows my username because I've never been online in 2020 or now also I have nothing also also yes
Yes but i hate beluga pfps thinking they are funny
Can you gift mc account on my birthday
As well he gets like now around 40,000 new subs in a day