[EMAIL PROTECTED] wrote: > Subject: RE: [hlds_linux] [OT] Multi-vendor Game Server DDoS > Vulnerability > > > [EMAIL PROTECTED] wrote: >> To: [EMAIL PROTECTED] >> Subject: Re: [hlds_linux] [OT] Multi-vendor Game Server DDoS >> Vulnerability >> >> >> I read this a few days ago on the newside of the >> german c't magazine. I >> am a bit shocked that no gamedeveloper ever thought about such a >> common vulnerability for DDOS attacks. >> A very easy solution would be to limit the number of respons per IP. >> >> I think about no more than 2-5 responses to requests of a specific IP >> (which is spoofed in this case) are allowed in one >> second. More requests >> get dropped and no victim-server will be harmed this way. >> Furthermore I believe in practical 'Gamespy' requests there are no >> more than this 2-5 requests per seconds needed. If there are more >> requests you can be sure this is a application going harakiri or a >> DDOS smurf attack. >> >> Yesterday we got massiv attacked with a similiar DOS and we are >> planning to drop the server offline if valve will not patch this >> behavior to a level like descriped above. >> >> >> Frank >> >>
> The IP can be spoofed, so they could just pake it query from an > inifinite number of IPs. > > --------- > Tyler "[TASF]Overkill" Schwend > "Semper facere bonum, an a amare odium, vita mors." > The idea is the target IP is the same, so you overload that target, but even if you make each server only reply to 5 every second, its still amped up by the thousands of cs/other game servers on the net. The concept, as I can see, and have studied in the past many many months ago, is not to overload the servers, but to overload "a victim". Hence, the spoofed ip is always that of "the victim". So, even if every hlds only replied to each ip 2 times a second, multiply that by how ever many hlds there are live atm, add other games on, that victim is being flooded by tens of thousand of ips:ports and can do little about it. Also the point of gamespy issuing a patch is total crap, gamespy can do nothing to stop it. Its an "issue" with the game servers/isps not checking sources on packets leaving their networks. -- Ginga _______________________________________________ To unsubscribe, edit your list preferences, or view the list archives, please visit: http://list.valvesoftware.com/mailman/listinfo/hlds_linux
