Slashdot Mirror
DoS Attack Forces EVE Online Offline
Resorting to the out-of-band messaging that is Facebook, CCP Games has announced that "At 02:05 GMT June 2nd, CCP became aware of a significant and sustained distributed denial-of-service attack (DDoS) against the Tranquility cluster (which houses EVE Online and DUST 514) and web servers."
I was just wondering why I couldn't log in! I criticize you guys a lot, gotta give you props this time.
I swear to God...I swear to God! That is NOT how you treat your human!
That is all.
Stories are late all the time because editors play EVE and can't be arsed to edit or publish!
I wonder how worldwide productivity would jump if WoW went offline.
They need to get this sorted ASAP. I have important Internet spaceship business to tend to and it really can't wait any longer.
Will rejoice
What kind of intricate in-game machinations will this turn out to be connected to?
Why would anyone launch a DoS attack on EVE online servers?!" :P
Nerds should not attack other nerds.
Why do the gaming servers respond to requests from non-players?
I assume that there is, at very least, some sort of authentication service that has to evaluate a request to determine whether or not it comes from a player...
For those hopelessly addicted, there are two solutions:
1) practice on the singularity server (aka test server)
2) play the flash version.
Why do the gaming servers respond to requests from non-players?
Ahhh, this question is unanswerable as it is one of the few true mysteries of the universe, like magnets ( wtf, how do they work!), velcro, and the location of the proverbial "other sock".
Why do gaming servers respond to requests from non-players? Well dude, the answer might as well be 42, nobody knows.
*sigh*
You need to log in to the game at some point.
Presumably they left a gaping whole in it.
It's standard practice to test critical code, make that all new code, in live deployments ... only after a failure do they appear to look at the test server bug reports.
*sigh*
You need to log in to the game at some point.
But only once, unless you are the sort of coward who logs out!
Are we sure it was DDoS and wasn't the Goons all trying to log on en masse.
All generalizations are false, including this one. Mark Twain
It's not Facebook that they're updating from; It's Twitter. Their Facebook account is linked to Twitter.
Anyway, this isn't the first time the servers have been DDoS'd; This happens about every 4 months or so on average. And unfortunately, they've handled it about as well each time as you're seeing now: They tend not to announce the DDoS until hours after the news is all over the forums that people are experiencing mass disconnects and instability. And once the problem has been identified (late), their response is usually to kill all the servers, remove the BGP routing table entry for their network, and wait it out.
They don't have the capability of weathering DDoS attacks; Though they claim otherwise, history tells another story. It has to do with the fact that their game depends on a cluster architecture that is not adaptable to something like Amazon cloud, or any kind of scalability. I don't really want to get into details here because it gets really technical, but basically it comes down to data syncronization within the cluster requiring very low latency between nodes. And that means you can't locate the nodes off-site, and proxying is only of limited utility.
They tried proxying the front-end for accepting connections and authenticating users, because that's what has been targetted in the past and is one of the few components that can be moved. The current DDoS attack though is generating large numbers of connections that look the same as legitimate connections, so the proxies are allowing them. Rather than just throwing as much bandwidth as they can at the network as in the past, they're now crafting their traffic.
I suspect the reason the attack is being launched now is because in a few days they're releasing a new patch of the game which will change the network protocols used by the client... their hack might not work then, so they probably decided to launch it now before it becomes useless. They are hitting people on the weekend because it's when the most users are on... so it's most likely to be noticed.
#fuckbeta #iamslashdot #dicemustdie
Must be Goonswarm, protesting about the upcoming patch. It's all player generated content.
Because in networking, every new connection comes from a "non-player" until you're authenticated as otherwise.
I swear to God...I swear to God! That is NOT how you treat your human!
Because someone clever enough can send a request that can't be distinguished easily from a real player?
Seriously, this is Slashdot, a little critical thinking would at the bare MINIMUM be an asset.
Where's the HOSTS file guy to post his 10 pages of spam on hosts file
and blame a bad hosts file for the reason eve is offline
har har
Usually I would expect DDoS extortion to come FROM Russia. Now I wonder how all those hardcore Russian EVE players are going to react if this wasn't their idea....
Theory 1 They want to drive down the stock price by sullying them before the big release this week
Theory 2 They are butt sore over their podding by Goonswarm, or Test, or some noob named 5t@rTw33rp
Theory 3 Collect Underpants
Theory 4 ????.
Theory 5 PROFIT
Sorry about the writing. Robot fingers, you know? Cliff Steele in DOOM PATROL #23
Initially it looked to me like an attack on their DNS servers, not the game itself.
A dig would work or not depending on which name server you were randomly allocated.
If you managed to resolve the required names you could get in and play just fine. Was fun having NPC null almost to myself.
They've brought the lot down now of course, but don't just assume that it's a problem with the game code.
It's enough to do authentication once, after which just remember the IP. You don't have to authenticate every request.
You should be in charge of the whole internet. You got it all figured out.
Invaders must die
Comment removed based on user account deletion
aka Spreadsheet Simulator 2013?
unless you are the sort of coward who logs out!
Pfft, I'm the sort of coward who doesn't even log in!
You should probably learn how networking actually works. It will avoid making posts that are this bad.
The way the server knows what IP the packet came from is by the IP layer of the stack processing the packet. Which means the packet triggered work by the server, and the DDoS can do it's job.
Your "solution" requires the server to predict that a non-player IP will be sending a packet and reject it before examining the packet at all. But that's assuming the DDoS is sending random packets.
If the person behind the DDoS doesn't have enough nodes to carry out the attack above, then they can send bad "login" requests. The server will have to process them completely in order to reject the login.
If you are a sysadmin, please find new work. If you are a coder, please find new work.
I don't care. I am gov't sysadmin employee, my job is to bring the check home. Not going to waste my brain power to improve my knowledge, find new work or something that stupid.
As a gov't IT guy that has to fight uphill battles to implement simple shit like $TNS_ADMIN or create f'ing standards in the first please because of asshats like yourself...please sodomize yourself with something sharp and rippy as soon as possible. Thank you.
Yours is a singular and rapier whit sir. *golf clap*
Haha. ^ mod up.
Some have speculated that this may be related to some russian based player corporations. I find it interesting that as most US players would be getting ready to go to bed and it is prime time (6:30pm ish) in russia, that the DDOS would subside. while it may be a possible coincidence, it is about 2:30am eastern in the US and the servers are about to be restarted.
There's a membership drive right now on SA... You might be on to something.
Actually, even if you can distinguish, is no way to prevent any host of the Internet from sending traffic to you. If you gather enough upstream bandwidth, you can clog any pipe you want. Some research works have proposed ways to amend this, for example this.
Because in networking, every new connection attempt is completely unrelated to previous ones. Logs are forbidden black magic, and actually blocking any IP addresses requires approval from the council of internet elders. So, it's easier to just wait it out.
This isn't the Goons' style, honestly. They're capable of many things, but they're not lawbreakers.
Couldn't have happened to a more wretched hive of scum and villainy in all the virtual worlds!
(obviously, that comment excludes carebears & all non-sociopath gamers :)
Re your sig: if you think that belief in a monotheistic, infinite, possibly personal, possibly triune, deity is a popular choice these days...then I find your lack of faith stupefying! Just sayin...
Why do the gaming servers respond to requests from non-players?
I doubt they respond.
But the packet coming in as request get routed through the game servers network _until_ one part of the network decides to drop the packet(s) because they are illegit.
DDoS attacks basically always flood your network, consider it like a traffic jam in a city. You delete cars from the road as you recognize them as part of the DDoS but new cars coming into the city all the time cause more jams at the entrances to the city.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Don't you know? Most upstream providers have Layer7 firewalls that can drop non-player EvE logins. The secret is the magic pixie dust.
Mod parent funny, I haven't laughed this hard in a long time.
I host for a small, indie, open-source, free-to-play multiplayer game project. I get ddos-ed about once or twice a month.
It seems like it has become much easier in the past few months for skids to get ahold of a botnet. Maybe it's time to start pushing for vuln scanning by residential ISPs and simply cutting off infected people totally. Hell, the greedy ISPs could continue to charge the account holder after disconnection and even try to charge for on-site disinfection services.
The days of clever DDOS mitigation through firewalling and inspection are over. It now requires vast and increasing amounts of resources (bandwidth, packets per second capability for the DDOS scrubbing) to combat a level 1 skid's botnet.
There are two ways to fix this. One - force the asshole users to protect their machines and not allow attacks to originate from their nodes. Two - force the asshole providers to be responsible for removing the asshole infected zombie nodes from their networks, or limit the attack ability of the zombie nodes.
I don't have the money to fight off a ddos. If skids keep upgrading their ddos capability, you're going to see the monetization of the internet gain speed. Hobbyist servers and pages will increasingly get ddosed by machines that had some vulnerability exploited. We don't really have the money for ddos mitigation, even if we are vigilant about patching vulernabilities and following best practices to keep our stuff from being rooted.
It doesn't help that those infected hosts now can get 150mbit/sec upload speeds... Verizon only charges an extra $10 a month for 50/25mbit service. It wouldn't take many of them to kill a lot of decent sized sites.
It was the North Koreans. Supreme Leader Kim kept getting boned within a few minutes of logging in and, being the most awesomest gamer in the world, instructed his people to take down the whole nest of conspiring cheaters.
Ironically, I'm reading this story from EVE's In-Game Browser. :)
Pfft ...
What nonsense are you talking about?
How should an ISP know wheather a package you snt upstream is legit or ot?
Go smoke something else ...
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.