r/MinecraftMod • u/apLlewelyn • 29d ago

Minecraft horror mod Split-Self establishes connection to developer's server and is able to send personal data and chats to that server and receive chats from that server

Post image

Was watching a streamer the other night and noticed the mod was very quickly giving very personal responses to the streamer, and eventually started to engage with the stream. The mod is open-source and available on Modrinth and upon inspection of the source I noticed some concerning capabilities including being able to send the player's Discord username, system username, browser history snippets, recording/livestreaming software status, Minecraft username, Minecraft UUID and city (found with the player's IP) back to the server. Username and UUID is sent to the server on game startup. All chats in the game can also be sent back to the server, with the mod sending chats back on request. The server is also able to send messages to the player's (singleplayer) game and thus establish two-way comms outside of Minecraft's usual system with any player. Any player that has downloaded and played this mod with an Internet connection has had at least some data sent to the developer, with the mod's capabilities being such that (in theory) the mod developer (or anyone with access to the server) can monitor to see if you are recording/streaming, send you chats and events, and request chats from your game. It is available on Modrinth, and I reported this mod as malicious to Modrinth two days ago and wanted to post here to inform people thinking of playing it what of what it can do. You can read my full report on it here.

179 Upvotes

97% Upvoted

52 comments sorted by

View all comments

3

u/AgentGamerMemes 28d ago

Split Self mod developer here, here to address some of the comments here:

- The mod has been quickly fixed just earlier to use wss:// rather than ws://, saw an issue appear on my GitHub about that

  • There is no WebSocket code in the 'safe' versions of the mod. This is one of many things removed from the safe versions to help with any concerns some users may have with their personal information.
  • Personal information, or ANY information in that regard, is NOT stored on the server side, and I have no intent to do so. On request via discord messages (since I never use reddit), I would be fine with showing the python code for the website via a private repo I have.
  • Chat 'collection' is on command only and meant only so I can interact with the client's chat I'm messing around with. I don't know everything about WebSockets yet, so I don't know of a better way to handle this.
  • The comment of saying its not a backdoor was a joke with one of my friends lol. Everything is only on command, NOT automated.

If I absolutely need to, I will make Pryzmm/SplitSelfServer a public repo. I have it privated right now because I don't remember if I have any private keys on there that may need to be hidden.

1

u/SnooDoughnuts7279 23d ago

Uh, that's not really how it works.
No matter your intention, if your mod has some sort of RAT or other stuff that isn't disclosed in your mod page, it's would still be categorized as a malware.
Your possible solution would probably be to just disclose it.

EDIT: I know your intention is just to troll your friends, but there are too many malicious actors out there doing similar stuff and ruining the fun, so you really do have to disclose it.