Uploaded May 2022 | Updated September 2026, 1 week ago
In this video I show off my new XRay mod, we go mining, almost die in the Nether and discover a vulnerability in the Minecraft Protocol. Just another normal Minecraft:HACKED episode!
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Watch this video and more on Hextree: app.hextree.io/courses/yt-minecraft/technical-minecraft-projects
Join the Hextree Discord: discord.gg/xgQpCQCpvy
Checkout ilmango: youtube.com/c/ilmango
SciCraft: twitter.com/scicraft_
XRay Mod Inspriation: github.com/ate47/Xray
Minecraft Protocol: https://wiki.vg/Protocol_Encryption
AES CFB: en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_feedback_(CFB)
The Bug Report MC-249235: bugs.mojang.com/browse/MC-249235
Episode 05:
CHAPTERS
00:00 - Intro: ilmango/SciCraft shoutout
01:16 - XRay Mod
02:12 - Let's Play: Mining & Enchantments
05:16 - Mojang to Microsoft Account Migration
11:15 - Let's Play: The Nether
13:42 - Auditing Minecraft Encryption Protocol
16:14 - Attacker Observes Traffic
16:51 - Attacker Controls Malicious Server
21:07 - Auditing AES/CFB8 Encryption
24:00 - Proof of Concept Attack
26:00 - Reporting to Mojang
27:19 - Let's Play: Herobrine
Copyright Music:
C418 - Minecraft Soundtrack
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#GameHacking #NetworkSecurity #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.
In this video I show off my new XRay mod, we go mining, almost die in the Nether and discover a vulnerability in the Minecraft Protocol. Just another normal Minecraft:HACKED episode!
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: hextree.io
Watch this video and more on Hextree: app.hextree.io/courses/yt-minecraft/technical-minecraft-projects
Join the Hextree Discord: discord.gg/xgQpCQCpvy
Checkout ilmango: youtube.com/c/ilmango
SciCraft: twitter.com/scicraft_
XRay Mod Inspriation: github.com/ate47/Xray
Minecraft Protocol: https://wiki.vg/Protocol_Encryption
AES CFB: en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Cipher_feedback_(CFB)
The Bug Report MC-249235: bugs.mojang.com/browse/MC-249235
Episode 05:
CHAPTERS
00:00 - Intro: ilmango/SciCraft shoutout
01:16 - XRay Mod
02:12 - Let's Play: Mining & Enchantments
05:16 - Mojang to Microsoft Account Migration
11:15 - Let's Play: The Nether
13:42 - Auditing Minecraft Encryption Protocol
16:14 - Attacker Observes Traffic
16:51 - Attacker Controls Malicious Server
21:07 - Auditing AES/CFB8 Encryption
24:00 - Proof of Concept Attack
26:00 - Reporting to Mojang
27:19 - Let's Play: Herobrine
Copyright Music:
C418 - Minecraft Soundtrack
SUPPORT
Per video: patreon.com/join/liveoverflow
Per month: youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): shop.liveoverflow.com
WATCH, FOLLOW & READ
Second channel: youtube.com/LiveUnderflow
Twitch: twitch.tv/LiveOverflow
Twitter: twitter.com/LiveOverflow
Instagram: instagram.com/LiveOverflow
TikTok: tiktok.com/@liveoverflow_
LiveOverflow blog: liveoverflow.com
Hextree blog (ad): hextree.io/blog
#GameHacking #NetworkSecurity #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement.










![A Vulnerability to Hack The World - CVE-2023-4863
Citizenlab discovered BLASTPASS, a 0day being actively exploited in the image format WebP. Known as CVE-2023-4863 and CVE-2023-41064, an issue in webps build huffman table function can lead to a heap buffer overflow. This vulnerability is very interesting and Im excited to share with you what I learned.
LEARN ON HEXTREE (ad)
Learn hacking on Hextree: https://www.hextree.io/
Join the Hextree Discord: https://discord.gg/xgQpCQCpvy
WebP Fix Commit: https://chromium.googlesource.com/webm/libwebp/+/902bc9190331343b2017211debcec8d2ab87e17a
Citizenlab: https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/
Ben Hawkes: https://blog.isosceles.com/the-webp-0day/
Software Updates
Apple https://support.apple.com/en-gb/106361
Chrome https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html
Firefox https://www.mozilla.org/en-US/security/advisories/mfsa2023-40/
Android https://source.android.com/docs/security/bulletin/2023-10-01
Whose CVE is it Anyway? https://adamcaudill.com/2023/09/14/whose-cve-is-it-anyway/
References:
2014 bug introduction https://github.com/webmproject/libwebp/commit/f75dfbf23d1df1be52350b1a6fc5cfa6c2194499
https://www.youtube.com/watch?v=JsTptu56GM8
https://www.youtube.com/watch?v=B3y0RsVCyrw
https://www.youtube.com/watch?v=EFUYNoFRHQI
https://www.youtube.com/watch?v=iEm1NRyEe5c
https://stackoverflow.com/questions/13804629/huffman-code-with-lookup-table
https://web.archive.org/web/20230204211844/https://commandlinefanatic.com/cgi-bin/showarticle.cgi?article=art007
enough.c https://github.com/madler/zlib/blob/develop/examples/enough.c
Thanks to:
https://twitter.com/mistymntncop
https://twitter.com/benhawkes
CHAPTERS
00:00 - Intro to CVE-2023-4863
01:32 - Most Valuable Vulnerability?
03:02 - Heap Overflow Related to Huffman Trees
03:58 - Learning about Huffman Codes
06:24 - What are Huffman Tables?
10:24 - Hardcoded Table Sizes (enough.c)
12:21 - Code Walkthrough - BuildHuffmanTable()
13:04 - The code_lengths[] and count[] Arrays
15:14 - Difference Between Compression and Decompression!
17:04 - Outro
SUPPORT
Per video: https://www.patreon.com/join/liveoverflow
Per month: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w/join
Buy my handwriting font (ad): https://shop.liveoverflow.com/
WATCH, FOLLOW & READ
Second channel: https://www.youtube.com/LiveUnderflow
Twitch: https://twitch.tv/LiveOverflow/
Twitter: https://twitter.com/LiveOverflow/
Instagram: https://instagram.com/LiveOverflow/
TikTok: https://www.tiktok.com/@liveoverflow_
LiveOverflow blog: https://liveoverflow.com/
Hextree blog (ad): https://www.hextree.io/blog
#BufferOverflow #SecurityResearch #LiveOverflow
(ad) LiveOverflow YouTube channel is supported by advertisement and product placement. A Vulnerability to Hack The World - CVE-2023-4863](https://i.ytimg.com/vi/lAyhKaclsPM/mqdefault.jpg)