Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

DoS attacks against my online game

hookrace.net

Post reply on HN
Print view View original

41–50 of 100 posts

Re: DoS attacks against my online game

#41

Post by leath »

dividuum wrote: post #9

Not sure if this is helpful, but I remember reading about the tribes network protocol years ago. IIRC it also UDP based and essentially had a mechanism to request a proof of work depending on server load before accepting any complex packets from a client. You could probably require some proof for their source IP utilizing the HTTPS request already used during server browsing. Edit: Found it. http://opentnl.sourceforg…

The proof of work idea is cute, but at this stage it's not necessary as profiling seems to show attacks don't get too deep into the netcode before getting dropped. It's hard to know without testing but I'm fairly certain any kind of PoW would cost more to check. This reminds me of a blogpost that is at least fun to read: http://ithare.com/udp-for-games-security-encryption-and-ddos...

Regarding the HTTPS request thing, we already did this for an event and I'm currently getting it set up on all servers. The blog post forgot to mention this one :)

Re: DoS attacks against my online game

#42

Post by leath »

sapphyrus wrote: post #37
def- wrote: post #24

Earlier quoted context omitted.

I actually received a nice email from someone at Valve about this following this post and we are currently evaluating if we can use it: https://partner.steamgames.com/doc/features/multiplayer/stea...

SDR works well and the latency is decent, but this would probably force you to drop the non-steam release or make some of the servers steam-only?

Documentation seems to say that they let you use the network from any platform as long as you have a Steam release. The bigger concern is that this requires linking with a closed source library, which means the open source version of the client could no longer connect to our servers without linking to a closed source blob.

That is sort of a non starter for us without some workaround like maybe hosting our own relays for the open source clients.

Re: DoS attacks against my online game

#44

Post by leath »

willcipriano wrote: post #27
leath wrote: post #10

Earlier quoted context omitted.

We've had several servers with OVH, including their kimisufi line, So You Start GAME line, their standard GAME line and their standard servers. While I'm sure these are great for common games their DDoS protection seems to get confused by our very non-standard protocol, ending up blocking most if not all traffic from non-connected players.

A shot in the dark but maybe implement a wrapper for the protocol in something that looks more like http? Websockets perhaps? Otherwise I think you will have to build your own countermeasures specific to your protocol.

The blog post does mention this possibility. In a similar vein we can also try to mimic a protocol that is well supported by hosters, like source or minecraft but I'm fairly certain that would be the single most ugliest piece of code ever written :)

Re: DoS attacks against my online game

#45

Post by NetOpWibby »

reggieband wrote: post #40

I worked on a mid-sized online game a few years ago and we experienced several DDoS attacks. I recall one employee tracking down the specific botnet that was rented for the attack against us and we calculated the attacker probably spent a couple of hundred dollars based on the rates. IIRC, we eventually used AWS Elastic Load Balancer to just soak up the attack, which was a pretty basic SYN flood. Then we waited the a…

Fascinating that there are people out there with disposable income for the sole purpose of griefing someone’s project/product.

Re: DoS attacks against my online game

#46

Post by seiferteric »

zeta0134 wrote: post #22
seiferteric wrote: post #21

Why is ddos still possible? It is possible for isp’s to stop this. There is a proposal for isp level blocking if spoofed source addresses. Also there should be something like an api where I can tell my isp that I don’t want to receive anymore packets from a given source and it should be propagated up the chain.

The key is in the first D: "distributed." A DDoS is designed to look just like legitimate traffic, but coming from many sources all at once. The goal of a successful attack is to both overwhelm the target network by sheer volume, and to make it difficult to stop the attacker without also blocking legitimate traffic. They persist in large part because they exploit the interconnectivity that makes the internet useful i…

It depends, some attacks rely on spoofing source address.. This should not be possible and is easily detectable by ISPs as illegitimate traffic. As far as my other suggestion, it would be a user accessible API. Whomever controls an IP should be able to instruct their ISP what is/isn't legit traffic, so the ISP does not have to know anything.

Re: DoS attacks against my online game

#47

Post by seiferteric »

leath wrote: post #36
seiferteric wrote: post #21

Why is ddos still possible? It is possible for isp’s to stop this. There is a proposal for isp level blocking if spoofed source addresses. Also there should be something like an api where I can tell my isp that I don’t want to receive anymore packets from a given source and it should be propagated up the chain.

This is a nice read https://blog.cloudflare.com/the-root-cause-of-large-ddos-ip-... It is indeed possible for ISPs to stop this, but my guess is that it's cheaper not to :) Large ISPs could require egress filtering for peering with them.

I could see this argument maybe 10+ years ago, but we are almost at a crises level with internet security with all the stuff happening. Legislation should be passed if needed to mandate this technology.

Re: DoS attacks against my online game

#48

Post by leath »

seiferteric wrote: post #47
leath wrote: post #36

Earlier quoted context omitted.

This is a nice read https://blog.cloudflare.com/the-root-cause-of-large-ddos-ip-... It is indeed possible for ISPs to stop this, but my guess is that it's cheaper not to :) Large ISPs could require egress filtering for peering with them.

I could see this argument maybe 10+ years ago, but we are almost at a crises level with internet security with all the stuff happening. Legislation should be passed if needed to mandate this technology.

100% agree with you. We gave the ISPs more than enough time to get this under control, yet they don't seem to want to bear any cost in preventing what are essentially crimes (though as shown in the blog post cybercrimes are seen as a bit of a joke unless they cause monetary damages) taking place on their networks. If they are not willing to self-regulate it's the governments job to regulate them.

Re: DoS attacks against my online game

#49

Post by seiferteric »

leath wrote: post #48
seiferteric wrote: post #47

Earlier quoted context omitted.

I could see this argument maybe 10+ years ago, but we are almost at a crises level with internet security with all the stuff happening. Legislation should be passed if needed to mandate this technology.

100% agree with you. We gave the ISPs more than enough time to get this under control, yet they don't seem to want to bear any cost in preventing what are essentially crimes (though as shown in the blog post cybercrimes are seen as a bit of a joke unless they cause monetary damages) taking place on their networks. If they are not willing to self-regulate it's the governments job to regulate them.

It's also telling that ISP's are fine with charging you per GB data you consume but apparently don't care about multi 10's GBS+ attacks that presumable consume tremendous amounts of bandwidth? I guess it says something about the true cost of data...

Re: DoS attacks against my online game

#50

Post by Cpoll »

leath wrote: post #41
dividuum wrote: post #9

Not sure if this is helpful, but I remember reading about the tribes network protocol years ago. IIRC it also UDP based and essentially had a mechanism to request a proof of work depending on server load before accepting any complex packets from a client. You could probably require some proof for their source IP utilizing the HTTPS request already used during server browsing. Edit: Found it. http://opentnl.sourceforg…

The proof of work idea is cute, but at this stage it's not necessary as profiling seems to show attacks don't get too deep into the netcode before getting dropped. It's hard to know without testing but I'm fairly certain any kind of PoW would cost more to check. This reminds me of a blogpost that is at least fun to read: http://ithare.com/udp-for-games-security-encryption-and-ddos... Regarding the HTTPS request thing…

> any kind of PoW would cost more to check

Cost more to check than it would for the attacker to generate an _incorrect_ proof. I'm sure that's what you mean, but my brain first went to NP problems.

And actually, now that I think of it, maybe, maybe not. A PoW can be pre-calculated (possibly using off-peak cloud resources for very cheap) and then stored in a lookup table. It can be reused until the attacker actually solves the problem. Then _maybe_ you could offload that verification to a cheaper, harder to DDoS service, like a cloud function that won't charge you for SYN flooding.

But then the hard part is letting legitimate users bypass the check after doing their PoW, but not letting an attacker through.

Post reply on HN