DoS attacks against my online game • Hacker News Board

Re: DoS attacks against my online game

#61

Post by Matheus28 » Tue, Sep 28, 2021, 2:17 AM UTC

def- wrote: post #24

Shadonototra wrote: post #23

i thought valve offered protection against DDoS attacks, or it's not available for free titles?

I actually received a nice email from someone at Valve about this following this post and we are currently evaluating if we can use it: https://partner.steamgames.com/doc/features/multiplayer/stea...

Their approach is quite simple and effective, it is what I suggest game developers do. For reference, it goes somewhat like this:

The clients connect to a relay server that just forwards the packets back and forth between the client and the real server. The client never gets to know the real server IP, preventing attackers from DDoSing the servers. If the connection to the relay server drops (which can easily happen if the attacker DDoSes the relay server instead), it can easily resume the connection with any other relay server, and the real server never notices it dropped.

This relies on the fact that there are too many relay servers to DDoS at once, and attackers never get to know the real server running the game code, so they can't make it unreachable.

Re: DoS attacks against my online game

#62

Post by Thaxll » Tue, Sep 28, 2021, 2:32 AM UTC

Player should be authenticated first to be able to to talk to the gameserver ( I'm talking about the accept() syscall ).

1h timeout is way too long, you should not have more than a couple of minutes max.

I worked on some popular online games and it was a combination of 1) + some IP tables rules ( to allow the traffic ).

Too many login would block the IP etc ...

With proper auth ( based on TCP ), IPtables, kernel tuning you can get a lot of good results without doing some complicated things like UDP proxy / relay / load balancing.

Re: DoS attacks against my online game

#63

Post by paulgb » Tue, Sep 28, 2021, 3:01 AM UTC

Thaxll wrote: post #62

Player should be authenticated first to be able to to talk to the gameserver ( I'm talking about the accept() syscall ). 1h timeout is way too long, you should not have more than a couple of minutes max. I worked on some popular online games and it was a combination of 1) + some IP tables rules ( to allow the traffic ). Too many login would block the IP etc ... With proper auth ( based on TCP ), IPtables, kernel tuni…

Have you found any good resources/write-ups on the best practices for this sort of thing?

Re: DoS attacks against my online game

#64

Post by stormcode » Tue, Sep 28, 2021, 3:08 AM UTC

jimmaswell wrote: post #58

reggieband wrote: post #40

I worked on a mid-sized online game a few years ago and we experienced several DDoS attacks. I recall one employee tracking down the specific botnet that was rented for the attack against us and we calculated the attacker probably spent a couple of hundred dollars based on the rates. IIRC, we eventually used AWS Elastic Load Balancer to just soak up the attack, which was a pretty basic SYN flood. Then we waited the a…

Why was no attempt at legal action taken?

They mention attempting it in the post. It didn't go anywhere one time, as it was a minor, and the other they don't have anything to tie the attack to a person. This is a pretty common problem for small games/services that experience outsized problems like this. It's incredibly time consuming to deal with and legal action typically costs money. If you want to go after someone and you think you know who it is you need a lawyer and you need to get a case into discovery so you can get a lawyer subpoena power to contact ISPs and such. Even if you have their real IP-- reporting to police, or ISP can result in no action, even if you put in a lot of work.

Re: DoS attacks against my online game

#65

Post by Thaxll » Tue, Sep 28, 2021, 3:13 AM UTC

paulgb wrote: post #63

Thaxll wrote: post #62

Player should be authenticated first to be able to to talk to the gameserver ( I'm talking about the accept() syscall ). 1h timeout is way too long, you should not have more than a couple of minutes max. I worked on some popular online games and it was a combination of 1) + some IP tables rules ( to allow the traffic ). Too many login would block the IP etc ... With proper auth ( based on TCP ), IPtables, kernel tuni…

Have you found any good resources/write-ups on the best practices for this sort of thing?

Unfortunatly like a lot of things in video games it's a lot in-house r&d, public doc for those kind of problems is non existent.

The idea from my original post is that your gameserver should allow traffic only if the player is authenticated.

Re: DoS attacks against my online game

#66

Post by stormcode » Tue, Sep 28, 2021, 3:14 AM UTC

api wrote: post #26

Why would someone DoS a small free game?

Some people are just not great. It sucks. This kind of thing saps the energy from the devs and makes it a job instead of a hobby.

Re: DoS attacks against my online game

#67

Post by stickfigure » Tue, Sep 28, 2021, 3:25 AM UTC

Have you tried reaching out to the kid's parents?

Re: DoS attacks against my online game

#68

Post by da_big_ghey » Tue, Sep 28, 2021, 3:45 AM UTC

Cpoll wrote: post #50

leath wrote: post #41

Earlier quoted context omitted.

The proof of work idea is cute, but at this stage it's not necessary as profiling seems to show attacks don't get too deep into the netcode before getting dropped. It's hard to know without testing but I'm fairly certain any kind of PoW would cost more to check. This reminds me of a blogpost that is at least fun to read: http://ithare.com/udp-for-games-security-encryption-and-ddos... Regarding the HTTPS request thing…

> any kind of PoW would cost more to check Cost more to check than it would for the attacker to generate an _incorrect_ proof. I'm sure that's what you mean, but my brain first went to NP problems. And actually, now that I think of it, maybe, maybe not. A PoW can be pre-calculated (possibly using off-peak cloud resources for very cheap) and then stored in a lookup table. It can be reused until the attacker actually s…

[removed]

Re: DoS attacks against my online game

#69

Post by bdonlan » Tue, Sep 28, 2021, 4:00 AM UTC

da_big_ghey wrote: post #68

Cpoll wrote: post #50

Earlier quoted context omitted.

> any kind of PoW would cost more to check Cost more to check than it would for the attacker to generate an _incorrect_ proof. I'm sure that's what you mean, but my brain first went to NP problems. And actually, now that I think of it, maybe, maybe not. A PoW can be pre-calculated (possibly using off-peak cloud resources for very cheap) and then stored in a lookup table. It can be reused until the attacker actually s…

[removed]

Prime numbers are expensive to generate and writing a reasonably efficient factorization algorithm isn't that easy either. It's far faster on the server side to just spit out a nonce and have the client generate a partial hash collision up to an arbitrary number of bits (ie, the same proof of work many cryptocurrencies use)

Re: DoS attacks against my online game

#70

Post by [deleted] » Tue, Sep 28, 2021, 4:29 AM UTC

leath wrote: post #14

plasma wrote: post #5

A few suggestions: 1. Cloudflare offer TCP based DDoS protection too, see their Magic Transit or Spectrum product 2. This sucks, but put your servers behind WireGuard or Tailscale VPN so that in order to connect you need to have authenticated

As the blogpost mentions TCP is not exactly desirable for our project. Moreover, if you contact Cloudflare about those products you'll get a monthly quote that is far beyond what an open source project run by donations can sustain :)

[deleted]