IMPORTANT! Books with Hacked Clients

[velo]

Something has recently come to mine, as well as some other staff's attention that needs to be dealt with. Please read this article. This applies to both Creative AND SMP, as well as any other server you play on.
So basically, since this is the second time it's occurred while I've been on, I as well as Alicia agree that you all need to be informed about this "scam," of sorts.
Basically, in both instances a new player joined the server and asked for a staff member. They both said "I found a book on the ground. Can you read it?" or something along those lines. Please heed my advice: DO NOT OPEN THE BOOK!
Hacked Clients make it possible to send you to websites, or make you execute commands in Minecraft.
In the first instance, two players read the book. Both said that their iTunes Account was opened up.
In the second instance, the player was asking for an Admin to see the book, so we assume he was trying to Force OP.
Please take precautions when dealing with players in game who do this, and try to prevent others from making this mistake as well.
Please spread the word to prevent this from becoming a problem. If you see someone in chat doing this, take a screenshot and report it to me or a staff member as soon as possible.
Thanks for your time,
-Velo

[DeeKay]

Any idea what the book will look like, like what will be written in them?

[velo]

The first time Pim said the only thing in the book was "Hi."
I'm not sure what the second one looked like as he left as soon as I told nobody to look at the book. Some might be links, some might be blank.

[SJ321987]

Someone gave me a book like this and it contained a link which I did not click, I didn't pay attention to see if opening it did anything to my computer though.

[TheWholeLoaf]

If this is accurate, and you're a staff member, collect the book by requesting to see it. Sounds like they would want to target staff. Delete it in your inventory, and ban the player. Reporting it to non staff will not help.

[TarynMai]

We dont know if theyre trying to do this unless we open the book. Try not to ban if you can help it, just mute the player and watch them. If they continue to look for ways to get people to read the book, then ban them.

[DeeKay]

Interesting, I've read some more on this exploit, and it appears to work by creating a book with 'invisible' JSON content, usually in the form of a link, like you said. I'm looking into ways to counter this, besides the obvious "don't click suspicious links in books" thing.

[100penguin.]

We bow down, O knowledgable DK...

[~pimkey5~]

wElp That worked. I got the book and opened it thinking it was just normal soooooooooo I'm dead

[Nick3306]

Might as well ban books on creative since i doubt anyone used them anyway.

[TarynMai]

Would it be possible to just make books recruit+? Or would that just be a pain? lol