Demystifying the BR DDOS/DOS Issue

[NBAGreen]

[This is the original text of a post on the MLB The Show Reddit page about Battle Royale disconnection issues.]

The original post is here: http://www.reddit.com/r/MLBTheShow/c...ddosdos_issue/


I’ve seen a lot of posts about this over the last couple weeks, and most folks don’t seem to understand the issue here with these Denial of Service (DOS) attacks. As someone who works in software architecture for a living, I thought I would make this post to hopefully clear some things up.

What is the issue? In Battle Royale (BR), cheaters are making their opponents sign out of PSN by resetting their opponent’s internet through a DOS attack. This results in them getting a win. Repeated use of this is an easy 20-0 for great rewards.

How are they doing this? They are doing this by first getting your IP. Then, they are using their PC or some other 3rd party service to flood your IP with packets, causing the DOS. Distributed DOS or DDOS is the case where the 3rd party service is using multiple IPs to attack your IP with. Once they have your IP, they can DOS/DDOS you.

How are they getting my IP? They are getting your IP because MLB the Show 16 (just like many sports and other PS4 games) uses peer to peer architecture for gameplay. For more clarity on this, see the below set of diagrams I’ve made to illustrate this. The first is a state diagram to establish the different phases of an online game. This is necessary because the architecture changes depending on the phase.

Diagrams located here: http://imgur.com/a/ECcvB

No central server exists during the gameplay phase of a match, making it peer to peer and exposing your IP to an attacker. The diagram shows the attacker can PS4 network traffic through a PC that has a packet sniffer installed on it. Using this tool, your IP is discovered.

Why doesn’t SDS fix this? Now that we understand the architecture behind the game, it is clear that the only solution for SDS to actually fix this is to rip out the peer to peer architecture and route gameplay through their servers. Think about that for a minute. You mean those same servers who can barely handle just menu traffic? Some complain about peer to peer lag in games, can you imagine???

What else can I do? In theory, you can mask your IP by using a VPN. The VPN has to be able to withstand attacks, and that is why a good one isn’t normally free. I haven’t set this up myself because I’m still working on my skill level before I can compete for 12 win rewards, much less 20. Look into companies like STRONGVPN or unblock-us that can provide this service.
Hope this helps some of you!

[baseballsim]

Re: Demystifying the BR DDOS/DOS Issue

I'd like to see a video of this happening. Is the user actually signed out of PSN and prompted as such or is it the well known game freeze followed by connection lost by opponent message?

Also, when you are attacked is your router some how shut down? Do your other devices and PCs lose connection to the internet or is it only specific to PS4's IP address?

[Roonster]

Re: Demystifying the BR DDOS/DOS Issue

Think someone just did this to CB5 during a stream. People take this way too seriously

[cardinalbird5]

Re: Demystifying the BR DDOS/DOS Issue

Yep happens alot to streamers too. I usually use a vpn too. Whats the best way to set one up thru ur console tho?


Sent from my iPhone using Tapatalk

[half-fast]

Re: Demystifying the BR DDOS/DOS Issue

I can't believe people would want to cheat in any game. Sadly, I know pros that love to blowout the CPU in any sports game, and would probably gladly use cheats and e points to win in a regular basis. I just can't wrap my head around how it's fun for anyone.

[ph33]

Re: Demystifying the BR DDOS/DOS Issue

I wish I had read this thread more thoroughly and taken it seriously...

14-0 in BR, Jose Altuve and undefeated record in sight. Ran into same guy twice in a row who I have seen went 20-0 doing the same thing to everyone.

[cardinalbird5]

Re: Demystifying the BR DDOS/DOS Issue

I wish I had read this thread more thoroughly and taken it seriously...

14-0 in BR, Jose Altuve and undefeated record in sight. Ran into same guy twice in a row who I have seen went 20-0 doing the same thing to everyone.

Who is it?? We can forward it to the devs...pm me if u want

[eltk13]

Re: Demystifying the BR DDOS/DOS Issue

Who is it?? We can forward it to the devs...pm me if u want

Yinzer_Steve did it to me yesterday afternoon

[ph33]

Re: Demystifying the BR DDOS/DOS Issue

Who is it?? We can forward it to the devs...pm me if u want

I made another thread about it --- check the "Battle Royale Cheater" thread.

I tweeted Ramone and he told me to go email The Show's support team, which I did. I hope it doesn't fall on deaf ears but there's no way this guy doesn't get banned...he got his 20-0 without swinging a bat once.

http://www.operationsports.com/forum...-cheaters.html

Yinzer_Steve did it to me yesterday afternoon

How is this guy still on this game? Even I remember him from last year and if I remember your username that's pretty bad...

[mikeq672]

Re: Demystifying the BR DDOS/DOS Issue

I made another thread about it --- check the "Battle Royale Cheater" thread.

I tweeted Ramone and he told me to go email The Show's support team, which I did. I hope it doesn't fall on deaf ears but there's no way this guy doesn't get banned...he got his 20-0 without swinging a bat once.

http://www.operationsports.com/forum...-cheaters.html



How is this guy still on this game? Even I remember him from last year and if I remember your username that's pretty bad...

You cant have game modes like this that require some form of payment to join(especially when you allow people to buy stubs, because it places a dollar value to stubs) and then allow rampant cheating like that.

[PSimp21]

Re: Demystifying the BR DDOS/DOS Issue

As originally stated, the games are P2P, which not server in between. SDS servers have a hard enough time with handling basic traffic, and could not handle game traffic. They would have to drastically upgrade their servers and equipment to be able to keep up.

I am not sure why SDS hasn't started monitoring this, and permanently banning those who do it. It baffles me that I can monitor my works internet traffic, both stateside and overseas, and can tell who is torrenting or streaming on our C-band network, and impose restrictions on them, yet SDS can't even make efforts into curbing these guys who are ruining a game for others.

[srdclark]

Re: Demystifying the BR DDOS/DOS Issue

As originally stated, the games are P2P, which not server in between. SDS servers have a hard enough time with handling basic traffic, and could not handle game traffic. They would have to drastically upgrade their servers and equipment to be able to keep up.

I am not sure why SDS hasn't started monitoring this, and permanently banning those who do it. It baffles me that I can monitor my works internet traffic, both stateside and overseas, and can tell who is torrenting or streaming on our C-band network, and impose restrictions on them, yet SDS can't even make efforts into curbing these guys who are ruining a game for others.

In their defence, the answer is in your comment. You can see your work's network traffic from within your work's network. SDS matchmaking is just setting up P2P links after which point, SDS has no visibility. The choices come down to a) host the game on SDS servers, so your IP address isn't exposed to your opponent, or b) connect two users and then release them, waiting to hear back from the clients messages of "I disconnected" and "the other guy disconnected". There's no way for SDS to poll the victim's consumer-grade router for diagnostic information and use that to forensically prove a DoS attack, invalidating the results.

Instead, SDS needs to look at game statistics. I can look at the game logs posted above and see that clearly that dude is cheating. Why wouldn't they swing the ban hammer once they saw that pattern? Well, maybe they're going to - they'll investigate, get a list of offenders, and ban a bunch of users at once.

That's a fair amount of work, depending on how their database is set up. It's clear to you and to me that the dude is cheating, but can they do a search that finds this behaviour automagically without false positives? That's probably the bottleneck here. And even then! You're punishing the behaviour, but not preventing it. What happens to the victims? They've already been awarded losses and received their payouts. Do they quietly get refunded 1500 stubs? Do they get a message saying their loss has been reversed from a BR they played several weeks ago and that their streak has been restored? What happens if they are in the middle of an active BR and the system can't restore them? I don't envy SDS having to try to figure out how to resolve this.

[PSimp21]

Re: Demystifying the BR DDOS/DOS Issue

In their defence, the answer is in your comment. You can see your work's network traffic from within your work's network. SDS matchmaking is just setting up P2P links after which point, SDS has no visibility. They would have to handle the game traffic themselves in order to view it which, as you point out, is crazypants.

Instead, SDS would need to look at game statistics. I can look at the game logs posted above and see that clearly that dude is cheating. Why wouldn't they swing the ban hammer once they saw that pattern? Well, maybe they're going to - they'll investigate, get a list of offenders, and ban a bunch of users at once.

That's a fair amount of work, depending on how their database is set up. It's clear to you and to me that the dude is cheating, but can they do a search that finds this behaviour automagically without false positives? That's probably the bottleneck here.

I completely understand and know the answer was in my comment, and that at this point nothing can be done about it until they spend the $$ and get upgraded servers.

[Hoosierdaddy76]

Re: Demystifying the BR DDOS/DOS Issue

So...pretty much no point in playing this mode anymore then?

[ph33]

Re: Demystifying the BR DDOS/DOS Issue

So...pretty much no point in playing this mode anymore then?

Nope. I got my stubs refunded when they saw my opponent was cheating, but it doesn't take the time I spent getting to 14-0 (Should be 15 but someone else cheated and it didn't count), and doesn't make up for how peeved I was that I was this close to 20.

Once you get past win 12, some of the characters up there are shady. Most people you match up with are in your range (Unless you're playing at a time of day no one else does) and those games can be really intense and great, but half the time you're running into someone with an all-speed lineup and all they do is show bunt and bunt all game, play it in the most annoying manner.