Live data from Hacker News

DoS attacks against my online game

hookrace.net

81–90 of 100 posts

Re: DoS attacks against my online game

#81
>> we are a free online game and thus have no measurable economic damage, the public prosecutor left it at a sternly worded warning.

The prosecutor is a #@*&%! : your time costs money. Working outside normal office hours is costly.

Maybe you need to setup a contract between the "organization" that runs the servers and yourself that states how much time (and money) does it cost to run the game.

Re: DoS attacks against my online game

#82
post #81

>> we are a free online game and thus have no measurable economic damage, the public prosecutor left it at a sternly worded warning. The prosecutor is a #@*&%! : your time costs money. Working outside normal office hours is costly. Maybe you need to setup a contract between the "organization" that runs the servers and yourself that states how much time (and money) does it cost to run the game.

Not to mention the damage to the service providers that have their other clients affected because of this. Besides, if someone robs you, would the prosecutor handwave it away saying it's fine because they only got $20

Re: DoS attacks against my online game

#83
post #81

>> we are a free online game and thus have no measurable economic damage, the public prosecutor left it at a sternly worded warning. The prosecutor is a #@*&%! : your time costs money. Working outside normal office hours is costly. Maybe you need to setup a contract between the "organization" that runs the servers and yourself that states how much time (and money) does it cost to run the game.

Not to mention the damage to the service providers that have their other clients affected because of this. Besides, if someone robs you, would the prosecutor handwave it away saying it's fine because they only got $20

> if someone robs you, would the prosecutor handwave it away saying it's fine because they only got $20

Yes.

In fact, when my mother's grandfather was in conservatorship, his conservator (my mother's cousin) embezzled over $600,000 from his estate, and the prosecutor refused to prosecute.

We were able to get somewhere over half of the amount back through a civil suit.

Don't ever expect that the prosecutor is there to help you.

Re: DoS attacks against my online game

#84
post #81

>> we are a free online game and thus have no measurable economic damage, the public prosecutor left it at a sternly worded warning. The prosecutor is a #@*&%! : your time costs money. Working outside normal office hours is costly. Maybe you need to setup a contract between the "organization" that runs the servers and yourself that states how much time (and money) does it cost to run the game.

Not to mention the damage to the service providers that have their other clients affected because of this. Besides, if someone robs you, would the prosecutor handwave it away saying it's fine because they only got $20

Monetary boundaries are quite common in law. The "grand" in the video game titled Grand Theft Auto refers to stealing of a car worth more than $5,000. Stealing of a car worth less than that is simply theft (of an) auto. There are a lot of factors that go into a decision not to prosecute, but there are many petty crimes that go unpunished and unprosecuted. (There are also some that are prosecuted, but that doesn't disprove that some aren't.)

Re: DoS attacks against my online game

#85

I worked on a mid-sized online game a few years ago and we experienced several DDoS attacks. I recall one employee tracking down the specific botnet that was rented for the attack against us and we calculated the attacker probably spent a couple of hundred dollars based on the rates. IIRC, we eventually used AWS Elastic Load Balancer to just soak up the attack, which was a pretty basic SYN flood. Then we waited the a…

Fascinating that there are people out there with disposable income for the sole purpose of griefing someone’s project/product.

I don't know about gp's particulars, but over the years I'm pretty sure I've seen competitors do this on strategic dates to impact the userbase game perception.

Re: DoS attacks against my online game

#86

I worked on a mid-sized online game a few years ago and we experienced several DDoS attacks. I recall one employee tracking down the specific botnet that was rented for the attack against us and we calculated the attacker probably spent a couple of hundred dollars based on the rates. IIRC, we eventually used AWS Elastic Load Balancer to just soak up the attack, which was a pretty basic SYN flood. Then we waited the a…

Fascinating that there are people out there with disposable income for the sole purpose of griefing someone’s project/product.

If it's an online game, people might do it to boot other people out of the game, especially enemy groups. Kind of as a joke.

Or so I've heard

Re: DoS attacks against my online game

#87
post #8

Earlier quoted context omitted.

I don't think OVH is viable in this case, they do mitigate the attack but in my personal experience they also mitigate legit traffic during the attack. Mind you, this is a process using a single port, with only around 100 active connections. You'll easily see half if not more lose connection during a DDoS attack.

I feel like I have to throw OVH a bone here. From running a service with 50-100k concurrently active connections on a single VPS on OVH that has shrugged off a lot of attempted DOS attacks over multiple years, I have the impression that OVH handles DOS attacks exceptionally well. Specifically I've never seen it drop (a lot) of legitimate traffic. In comparison to OVH, Hetzner (which this game seems to be using), is u…

Funnily enough our experience has been much the reverse. Hetzner will let us use the 1g dedicated link they promise however we want. Most other hosters will put blanket filters that are too broad or their smart ddos filtering will kick in, which it turns out is not smart enough to learn an arbitrary protocol :)

OVH has consistently been filtering legitimate traffic for us each time we tried them and we’ve tried almost every tier of service they offer.

Re: DoS attacks against my online game

#90
I'am a Developer of an larger custom modded GTA Server (Roleplay Server), with 500-700 online users in peak hours. The community is very toxic. In the beginning, we received several DDoS Attacks daily, so we decided to build our own protection. We are working with IPtables and IPSets, as you are. But we dont bother ispecting the contents of a packet: Our users are logging in to the Server over HTTPS to a dedicated Server, which is protected by Cloudflare. Once they verified their identify, the Server sends a Request to the Main Game-Server, which then adds the User's IP (from which the Login Request came) to an IPSet. We setup IPTables to only accept packets from IP Adresses in this IPSet. When the IPSet is updated, the Login requests finishes and the User is connecting to the Main Gameserver. Also we are unsing UDP only for Game related traffic, so we completly blocked SYN and TCP related packets in our Hardware Firewall on the Gameserver Port (its a Hetzner Feature). Since then, we had no more major outage, besides sometimes some clients are dropping, because an attacker clogs our 10GB line. Of corse, this can't hold against every attack, but so far this is enought to protect us.
Post reply on HN