I spun up a Minecraft 1.8.1 server on a Debian Linux machine for my kids to play on with their friends. Up until yesterday the server was responding on an open port on my network and I had no white-list defined in my server.properties. One of my son's friends logged in yesterday and claims he saw a user in the world who was killing all of the animals (my 6 year old daughter has been obsessively spawning and creating farms with horses, dogs, sheep etc). My daughter was in tears when she found out.
I immediately created a white-list for the world and enforced it in server.properties. However, when I went to check in the activity logs, there was no other user who had logged in yesterday. Is it fair to assume the animal killer was my son's friend?
I have limited sys admin knowledge but I am wondering there exists minecraft hackers who IP & port scan to find worlds to hijack like ours. It wouldn't surprise me. But it would surprise me if there was a way to do this completely undetected. And what purpose would it serve? But mainly I just want to know if it is possible.
Best Answer
Every attempted player connection, even failed ones that never create a record in the world's save data, will show up in the logs. That's something that the server does autonomously of the client, so nothing a normal connecting client can do will prevent that.
So yeah, you can assume that someone is not being forthright.
There are people who dedicate their "fun" to finding unguarded personal servers and "griefing" them. There are a variety of ways they find them, but port scanning the whole Internet isn't the likely means, simply because that tends to attract widespread unwanted attention from IP and network administrators (not to mention national security spooks' domestic intelligence databases). More often they find it via "social" security flaws — overhearing or encouraging trusted players to reveal the location of the server. They don't really care if they're discovered, because they will just move on to the next target, and Mojang, as a matter of policy, does not get involved with the moderation of privately-run servers.
Whitelisting is de-rigeur and the right step to take.