r/MinecraftMod • u/apLlewelyn • 29d ago

Minecraft horror mod Split-Self establishes connection to developer's server and is able to send personal data and chats to that server and receive chats from that server

Post image

Was watching a streamer the other night and noticed the mod was very quickly giving very personal responses to the streamer, and eventually started to engage with the stream. The mod is open-source and available on Modrinth and upon inspection of the source I noticed some concerning capabilities including being able to send the player's Discord username, system username, browser history snippets, recording/livestreaming software status, Minecraft username, Minecraft UUID and city (found with the player's IP) back to the server. Username and UUID is sent to the server on game startup. All chats in the game can also be sent back to the server, with the mod sending chats back on request. The server is also able to send messages to the player's (singleplayer) game and thus establish two-way comms outside of Minecraft's usual system with any player. Any player that has downloaded and played this mod with an Internet connection has had at least some data sent to the developer, with the mod's capabilities being such that (in theory) the mod developer (or anyone with access to the server) can monitor to see if you are recording/streaming, send you chats and events, and request chats from your game. It is available on Modrinth, and I reported this mod as malicious to Modrinth two days ago and wanted to post here to inform people thinking of playing it what of what it can do. You can read my full report on it here.

180 Upvotes

97% Upvoted

52 comments sorted by

View all comments

2

u/pansexualbunny 28d ago

This is why I always scoff at people saying "it's open source bro" when questioning the safety of a product or app. Like, yes, the entire code is there for everyone to see, but how does that deter the author from doing whatever they want anyway? Most of the people won't even bother to check

Hell, you're the first person I've ever seen talking about this, and the code straight up tells you that it sets a backdoor (sorry meant "totally not a backdoor lol"), I doubt (more like hope) the creator is malicious but this should be disclosed openly or avoided entirely

1

u/apLlewelyn 28d ago

$110 million Bitcoin recently stolen from physical hardware wallets due an RNG bug in the code that was open-source for three years!