RateMyServer Ragnarok Community

RateMyServer.Net => Server Discussion => Topic started by: PhilO on Aug 24, 2014, 10:58 AM

Title: DDOS Attacks
Post by: PhilO on Aug 24, 2014, 10:58 AM
 The reason i open this topic ,is because the 3 servers i have interest in at the moment ,have all  been under these  DDOS Attacks recently.it felt strange that , its all happening around the same time.

what are these  DDOS Attacks?why are they so successful?does this happen often ,or is it just a coincidence now ,with these 3 servers?
Title: Re: DDOS Attacks
Post by: lilsword on Aug 24, 2014, 11:29 AM
DDoS attacks are initiated by retarded people who wants to take down a server the dirty way.
Title: Re: DDOS Attacks
Post by: Ucieczka on Aug 24, 2014, 11:37 AM
I would expect any established server to have some kind of DDoS protection.

Also, isn't it suspicious if a server had no unusual lag atall before the close, and also they take the website and the game down at the same time? I would have thought there would be lag first. What do you guys think? I might have that all wrong.
Title: Re: DDOS Attacks
Post by: Fino on Aug 24, 2014, 12:56 PM
Dirty Way, that really fits.  ddos attacks happen quite often nowadays and I really wonder who has so much time to attack certain servers daily.

ddos protection is probably really useful but considering the setup and monthly prizes for a good working server are ridiculous high. Im not too fond in what protection usually costs, but I caught up a conversation about an offer for ddos protection and i nearly fell of my chair reading that. By that offer, I would have had to work 2 months nonstop without spending anything on living just for the setup. as i said, i dont know if thats normal but it really got me shocked.
Title: Re: DDOS Attacks
Post by: Playtester on Aug 24, 2014, 01:30 PM
Unfortunately the whole private server thing has become a real illegal business. Some server owners earn their living from the donations. So they have increased interest to get as many people as possible and will attack other servers that they see as rivals.

It's very common these days that servers receive DDoS attacks, especially if they have 100 players or more.
Title: Re: DDOS Attacks
Post by: dontknowright on Aug 24, 2014, 01:40 PM
Quote from: Ucieczka on Aug 24, 2014, 11:37 AM
I would expect any established server to have some kind of DDoS protection.

Also, isn't it suspicious if a server had no unusual lag atall before the close, and also they take the website and the game down at the same time? I would have thought there would be lag first. What do you guys think? I might have that all wrong.

You're wrong. You can only buy so much ddos protection. Most ddos attacks are only on websites and can be fixed with powerful hardware, scripting, and services like cloudflare. Sophisticated attacks are not on web traffic, but other ports and services. Many ddos now are over the 2gb-10gb mark. Imagine if you had 10gb of traffic hitting your ro server game ports. You have to buy bgp routing filtering for that. Prolexic is a company that does something like this and cost is $7500 setup and $22,000 a month.

Quote from: lilsword on Aug 24, 2014, 11:29 AM
DDoS attacks are initiated by retarded people who wants to take down a server the dirty way.

it is probably the same guy attacking all servers. probably a sad sexless angry kid :X

Title: Re: DDOS Attacks
Post by: aguile on Aug 24, 2014, 01:49 PM
An easy way to think is to imagine as a person with a package as a command/requisition and a house as a server
The person must enter the house using the door, leave the package, get another and go back
3 persons can manage to use the door to do this without problems
1000000000000000 cannot

This is a DOS, attack someone makes an excessive amount of requisitions from the server that slowing the traffic at the point it would be impossible to use it.
The other "D" is from distributed, it means that the traffic comes from different sources, most of time, it comes from remote infected machines, "zombie" machines.
So... we have a zombie apocalypse going throught the door, with you trying to deliver the packet...

If that was just a DOS attack, you could just block the informaton coming from the identified source. As a DDOS, sometimes you cannot effectively track the multiple sources of this attack.
DDOS protection is expensive as hell. Remember that we are not talking about big companies who can afford this, we are talking about small servers who struggle to survive through donations.
Title: Re: DDOS Attacks
Post by: eKoh on Aug 24, 2014, 04:50 PM
that's s***...

i've been trough holding a server and it is not easy, you need to struggle how to atleast run it up, and after months of hardworking, you finally make it real, and seeing that it can be screwed because from some angry sexless kid (haha) it can be destroyed... this it what it is, i think as new server owner we should ask for some ppl that had been server owners, so we can know how to face these problems.
Title: Re: DDOS Attacks
Post by: Ucieczka on Aug 24, 2014, 06:13 PM
Thanks for clearing that up dontknowright
Title: Re: DDOS Attacks
Post by: Triper on Aug 24, 2014, 06:45 PM
DDoS protection nowadays is a must have seeing how easy is to do it nowadays [yes, it's easy as google->download->run an exe->click here and there, let's go and no, I won't tell you the magic words to do it].

If you want to do it the real way, check how the best work - http://www.prolexic.com/services-dos-and-ddos-mitigation.html (http://www.prolexic.com/services-dos-and-ddos-mitigation.html)
That's the number #1 Anti-DDoS company used by many of your favourites big companies/websites like Facebook, for example. Check their prices and think with me, if they offer their services for that price, it's because there is a ton of DDoS around.

Yep, it's a **** move but life isn't fair either.
Title: Re: DDOS Attacks
Post by: dontknowright on Aug 24, 2014, 10:16 PM
http://www.shacknews.com/article/85951/blizzard-playstation-network-and-more-under-wide-ddos-attack-update-fbi-now-investigating (http://www.shacknews.com/article/85951/blizzard-playstation-network-and-more-under-wide-ddos-attack-update-fbi-now-investigating)

this happened today.
Title: Re: DDOS Attacks
Post by: Bue on Aug 24, 2014, 10:18 PM
This is what happens when you run your server on a potato hosted by yet another potato who in turn employ potato support and offers potato features.

Source: I know a potato who runs a potato business.

It might not even be a DDoS.
Title: Re: DDOS Attacks
Post by: pusanginamoy on Aug 25, 2014, 12:16 AM
Quote from: Bue on Aug 24, 2014, 10:18 PM
This is what happens when you run your server on a potato hosted by yet another potato who in turn employ potato support and offers potato features.

Source: I know a potato who runs a potato business.

It might not even be a DDoS.

yes and in the end you'll ended up getting their costly "protection"
Title: Re: DDOS Attacks
Post by: Triper on Aug 25, 2014, 12:47 AM
Quote from: dontknowright on Aug 24, 2014, 10:16 PM
http://www.shacknews.com/article/85951/blizzard-playstation-network-and-more-under-wide-ddos-attack-update-fbi-now-investigating (http://www.shacknews.com/article/85951/blizzard-playstation-network-and-more-under-wide-ddos-attack-update-fbi-now-investigating)

this happened today.
That's just what is shared public, tons of companies get them on a daily-basis and that's why companies, like the one I shared, ask for that much to protect against those things. Anyone may still use their websites/services but in the background, they're being DDoS non-stop.
Title: Re: DDOS Attacks
Post by: PhilO on Aug 25, 2014, 03:59 AM
 And the people behind the DDOS Attacks ,are never caught?
Title: Re: DDOS Attacks
Post by: aguile on Aug 25, 2014, 05:12 AM
Quote from: PhilO on Aug 25, 2014, 03:59 AM
And the people behind the DDOS Attacks ,are never caught?

It's hard to tell... in theory, you can track the source of the attack, but when this source is just a trigger, hiding behind a number of infected zombie machines, it makes all the work much, much more complicated.
Title: Re: DDOS Attacks
Post by: Blinzer on Aug 25, 2014, 06:48 AM
no good can come from trying to bring other people down

you're only going against yourself
Title: Re: DDOS Attacks
Post by: pusanginamoy on Aug 25, 2014, 07:07 AM
Quote from: aguile on Aug 25, 2014, 05:12 AM
It's hard to tell... in theory, you can track the source of the attack, but when this source is just a trigger, hiding behind a number of infected zombie machines, it makes all the work much, much more complicated.

One of the GM of official server in PH DDoS'd BalikRO few months back..he even posted a screenshot and mocked out of it.
Title: Re: DDOS Attacks
Post by: Triper on Aug 25, 2014, 08:36 AM
Some are some not. The big guys doing the big ones are on the level of good hackers so they hide behind tons of IPs, fale addresses and other stuff so isn't really easy to find people who know how to cover their traces.
Title: Re: DDOS Attacks
Post by: PhilO on Aug 27, 2014, 09:25 AM
  I found this topic..
http://forum.ragezone.com/f248/discussion-ddos-attacks-illegal-punishable-907473/ (http://forum.ragezone.com/f248/discussion-ddos-attacks-illegal-punishable-907473/)

is there any topic on this forum,where Server Admins can share information, on how to deal with this sort of thing?(am i asking something dumb?)

Title: Re: DDOS Attacks
Post by: Fantastik on Aug 28, 2014, 12:46 AM
Currently my server is under attack and the Attacker Pm'ed me that he will stop if I send a money to his account.

Title: Re: DDOS Attacks
Post by: gmchrono on Aug 28, 2014, 01:50 AM
^ this attacker reminds me of someone. He-Who-Must-Not-Be-Named. xD

Who knows? maybe he's not even the same attacker. maybe he's taking advantage of the attack and trying to make money.
Title: Re: DDOS Attacks
Post by: Fantastik on Aug 28, 2014, 02:10 AM
Definitely indeed he's making money of this.
Title: Re: DDOS Attacks
Post by: dontknowright on Aug 28, 2014, 02:47 AM
It's the same guy attacking everyone. He's renting botnets to ddos servers.
Title: Re: DDOS Attacks
Post by: Fantastik on Aug 28, 2014, 02:49 AM
Yeah, he said that his ddos is 120gbps/sec. Kinda awesome. :)

Title: Re: DDOS Attacks
Post by: dontknowright on Aug 28, 2014, 03:04 AM
Quote from: Fantastik on Aug 28, 2014, 02:49 AM
Yeah, he said that his ddos is 120gbps/sec. Kinda awesome. :)

Not really. It's pretty cheap to rent. Each time he does it, he loses money.
Title: Re: DDOS Attacks
Post by: PhilO on Aug 28, 2014, 04:19 AM
 Why did you remove the screenshots?

Fantastik could you put that screenshot back?
never mind..if you dont want,dont put it.its confirmed anyway.

what Fantastik said is true,i have confirmed it.this thing going by the name "Angela Lizet Martinez" on Facebook ,really is the thing behind the DDOS Attacks.
Title: Re: DDOS Attacks
Post by: dontknowright on Aug 28, 2014, 10:47 AM
I also think the screenshot should stay up, but is Fantastiks choice.

Never pay the attacker.
Never negotiate with the attacker.
Never respond to the attacker.

Title: Re: DDOS Attacks
Post by: Inochi on Aug 29, 2014, 12:42 PM
I used to be a staff member on Lumina RO before it closed down and this was a DDoS attempt some user kindly sent us before attacking.... Thought I would share. I don't remember what we did as it was over 2 years old but we have been DDoS'd and threatened many times. It just happens when you own a server I guess. But yeah, 'dontknowright' is spot on with ignoring him/her

Stay strong!!!

(http://i40.tinypic.com/4udzdf.jpg)

Title: Re: DDOS Attacks
Post by: PhilO on Aug 29, 2014, 07:00 PM
 I had no idea that these DDOS Attacks ,were this bad.so...filthy.

the FBI cant help with this sort of thing?.is it because these are private servers?
Title: Re: DDOS Attacks
Post by: TabooRo on Aug 29, 2014, 07:09 PM
Just like the US government, do not make deals with terrorists. Once you give in once they know they got you and they'll continue screwing with you until they are bored of you. Most of these people already lack a social life..  they have a lot of anger and free time to attack you.

The best choice is the ignore the attacker, try not to instigate him further and act professional. But in the end you will still be vulnerable to DDoS attacks so the ultimate solution is to get a good DDoS protected server and take measures to hide your IP from the public.

I will not list the ways to hide the IP or links to affordable/quality DDOS protected hosting companies, as I believe any good admin should solve this issue on their own. (Listing this information here would help future e-terrorists attack the servers they want)

I would suggest everyone else who knows how to DDoS a server ~ do not share it on this topic or mention "how easy" it is to take down a server, as that would also encourage new angry players to find the way to do it.

For the e-terrorists reading this: It costs 1,000$ US dollars per 15 min attack and you need a PhD in Computer Science to figure it out. /heh
Title: Re: DDOS Attacks
Post by: PhilO on Aug 29, 2014, 07:19 PM
 If anyone comes posting ways to DDOS servers here,those posts should be deleted right away ,and he/she should receive a warning.

i imagine that giving these terrorists what they want(money),would be like funding future DDOS Attacks.
Title: Re: DDOS Attacks
Post by: dontknowright on Aug 30, 2014, 06:06 PM
PhilO, yes, you are absolutely correct. Seems like this guy has been attacking servers for a while. I see through other forums that he is still attacking servers. Funny how other servers do not get attacked...
Title: Re: DDOS Attacks
Post by: dontknowright on Sep 05, 2014, 02:41 AM
Tervist, Woon, True and Talon have all been under DDoS attacks today.
Did I miss any?

Speculate.
Title: Re: DDOS Attacks
Post by: ElariaRO on Sep 05, 2014, 04:00 AM
Yeah, looks like ElariaRO had the same problems. :l
But thanks to our protection I guess people just had some lags and/or a dc.
Jesus Christ, can't those people just go and put their effort into something useful?
Title: Re: DDOS Attacks
Post by: pusanginamoy on Sep 05, 2014, 08:19 AM
Its Fappening..wait what?!  /heh
Title: Re: DDOS Attacks
Post by: Fantastik on Sep 05, 2014, 09:30 AM
Same here. Players getting DC'ed and Lagging.
Title: Re: DDOS Attacks
Post by: Dazzu on Sep 05, 2014, 09:59 AM
So other servers are being attacked recently as well. Interesting.
Title: Re: DDOS Attacks
Post by: dontknowright on Sep 05, 2014, 11:31 AM
So the list is now Tervist, Woon, True, Talon, Elaria, Fantastik, and Dark.
From what we know on this thread, the attacker is demanding money.

Someone hates RO!
Title: Re: DDOS Attacks
Post by: Lili on Sep 05, 2014, 12:47 PM
This reminds me of the old days. Same story repeats over and over again for every game server at some point. But fear not, patience is a key factor in such battle. There are only two things you must never do:
- Fulfill their demands. (A true Captain never surrenders even until the very end.)
In the end if nobody pays them, their business won't be running successful and they won't bother with it. The only DDoS left would be out of jealousy, hatred and ofc competitive DDoS migration companies.
But those cases can't be considered DDoS at all. We talk about now, where professionals who can rent botnets or even
make such gather and try to make some profit out of the blue (Out of what is successful).
- Try to reason with them. (Some people just want to watch the world burn).
Those things continue to happen because there were actually fools who paid their imaginary "freedom".
In the long term it's cheaper for both money and nerves to ignore those demands.

How to deal with this problem?
Communicate with the owners of the most successful game servers (like WoW) and ask them how they deal with it.
Keep on updating and informing your community.
Merge resources/playerbase/servers and help each other.

The DDoS migration services have even trickier ways to attack back, so ask them how you can smash/block/jam down the attacking PCs.
Because they can be many, but in the end - limited and static.


Good luck guys, and remember - you are not the first nor the last to experience the actions of some rich imbeciles.
Title: Re: DDOS Attacks
Post by: leokimah on Sep 05, 2014, 06:28 PM
It happens often because it's really freakin easy to do. You just need to know how to read.
Title: Re: DDOS Attacks
Post by: eesti on Sep 07, 2014, 12:46 AM
Maybe create a topic where you can share verified services and reviews?

Against most DDoS attacks, you will be protected dedicated server, hosted in:
- OVH.com / SoYouStart.com (EU France/Canada)
- StormWall.Pro (Russian service based on OVH). Most popular EU/RU Lineage2 servers use them.
- BlackLotus.net (US, California)
- staminus.net (US)
- seflow.net (EU Italy)
- x4b.net (EU/US) Tunnel/Proxy for your server. On the test I got unstable Ping through NL.
This will help the majority of attacks from small botnets and networks

Do not pay money to the attacker, they will require them to you again and again...
Title: Re: DDOS Attacks
Post by: dontknowright on Sep 07, 2014, 01:30 AM
It is not true that DDoS "are freaking easy to do".

If you're talking about loading up an app and pointing your proverbial lasers - that's not a DDoS attack. Those are laughable attacks that would barely touch your bandwidth and can be filtered with a single firewall rule.

Most DDoS attacks that make the news (and can take down large servers) are much more complicated and could utilize spoofing, reflection, and amplification techniques, and usually across many attack vectors simultaneously.

In order to block these, you seriously need to know what you are doing, and you will need the services listed by eesti above.

In the world of DDoS extortion - word gets around quickly. Most attackers usually demand a small fee at first. This is a TEST. If you pay that, you are tagged as giving in to extortion. The next demands are MUCH higher. This is why - NEVER pay extortionists. Not only will it not turn out well for you, but it will also fund them for future attacks.

Ignore them completely.


Title: Re: DDOS Attacks
Post by: flyingheo on Sep 07, 2014, 03:43 AM
I noticed that all the server that are listed in the attack are actually pretty popular. Wonder if this is how the attackers are picking their victims.

Also, I wonder if this is done by an attacker that just want money? Or maybe a server that wants to get rid of their competition? Actually, the attack posted on the Facebook that they do not hate the server that they are attacking, it's just another server want them to do this.

Maybe we will have another Drama thread about DDoS attacks.
Title: Re: DDOS Attacks
Post by: eesti on Sep 07, 2014, 04:25 AM
All types:
Extortionists (just wanted the money, usually used the test services - about 5-10 minutes)
Competitors and "schoolchildren", who thought that the server has been down, but really got into the filter :D
Title: Re: DDOS Attacks
Post by: PhilO on Sep 07, 2014, 10:02 AM
 Requesting deletion of    leokimah's last post.and a portion of Triper's first post.

and this post to afterwards.
Title: Re: DDOS Attacks
Post by: leokimah on Sep 07, 2014, 11:46 AM
EDIT: Tiper's post sums it up pretty well.
Title: Re: DDOS Attacks
Post by: Triper on Sep 07, 2014, 11:49 AM
@PhilO: I still don't see any problem about this. I already told stuff like this before in the forum and there are tons of places with info related to this [prevent and secure your server against them, etc]. This isn't physics, it's a simple thing that can be done by anyone that knows how to turn on a computer.

If you're scared that anyone can start doing them more times after this, you're wrong.

Anyone that wants to start a "business" around this won't get far because they're only doing what any 4th grade can do and those things are lame DDoS that any normal decent host can hold [a ton of ro servers nowadays are lame vps that can't hold s***]. The real ones, if anything, will only help the enterprises that develop anti-DDoS stuff be richer because the real ones are expensive to do to last a lot of time since it asks time and money to be something considered bad and if you're paying anything, it's to the ones that prevent them because paying once to the enemy is the same as saying "my pocket is full of gold, bring it on!" and they will come back for more.

@dontknowright: There is actually an easy way to do them that is available to anyone. While many doesn't know about it, there is enough knowledge about his existence and if you know the basics of how things work, you can get actually quite far with it. It's not a big DDoS but enough to do some damage if you've a poor DDoS protection or don't have any at all.
Title: Re: DDOS Attacks
Post by: PhilO on Sep 07, 2014, 01:26 PM
 I am learning with this topic about DDOS Attacks.i believe that what you say its true,because it makes sense.but then again ,whats the use of revealing such information anyway?does it help the cause?.i just dont see how saying its easy to DDOS Attack servers, could be helpful.you say that the ignorant easy ones are to weak to do anything,but behind those weak attacks are thinking people.meaning they could improve from there.so you could by a very small chance ,end up giving the initial encouragement needed, for these people to initiate.a very small chance.

i just dont like the idea that this topic, may become something negative.i didnt start it for that purpose.but i could be wrong, since i lack knowledge about this.


if possible ,delete this post after it as served its purpose.
Title: Re: DDOS Attacks
Post by: dontknowright on Sep 07, 2014, 01:28 PM
Triper, agreed.

Small attacks are simple, and easily blocked. Medium attacks are not that difficult to dish out, and can be stopped with some knowledge. Large attacks are much more rare, requires some resources, money, and underground connections to pull off.

Then you have the really smart bad guys - people who hit you with +40GB/s at over +5M pps on various protocols while blind sighting you from lowkey specialized layer 7 attacks that go unnoticed.

There's a lot of crap going on constantly
http://www.digitalattackmap.com/ (http://www.digitalattackmap.com/)
Title: Re: DDOS Attacks
Post by: PhilO on Sep 07, 2014, 04:04 PM
 I would rather keep that in the shadows,but if you guys who know more about this than me think its ok, than i suppose..
Title: Re: DDOS Attacks
Post by: Triper on Sep 08, 2014, 02:53 PM
What he shared is just a statistics map and some good extra info to anyone new about this problem.
It's better to know how those things work than to just say "F***, DDoS!".
Title: Re: DDOS Attacks
Post by: leokimah on Sep 08, 2014, 05:53 PM
Quote from: PhilO on Sep 07, 2014, 04:04 PM
I would rather keep that in the shadows,but if you guys who know more about this than me think its ok, than i suppose..

Anyone who is even remotely interested in issuing a DDoS attack isn't going to come to these forums to learn how to do it. Lets just leave it at that.

Quote from: dontknowright on Sep 07, 2014, 01:28 PM
Triper, agreed.

Small attacks are simple, and easily blocked. Medium attacks are not that difficult to dish out, and can be stopped with some knowledge. Large attacks are much more rare, requires some resources, money, and underground connections to pull off.

Then you have the really smart bad guys - people who hit you with +40GB/s at over +5M pps on various protocols while blind sighting you from lowkey specialized layer 7 attacks that go unnoticed.

There's a lot of crap going on constantly
http://www.digitalattackmap.com/ (http://www.digitalattackmap.com/)

Large attacks happen quite often, just not on RO. No one is going to spend a bunch of resources (possibly even money) and time to DDoS a 300 population server.

Large gaming companies like Riot, Valve, and Blizzard get taken down all the time. Riot has been getting shut down almost every night for the past 6 months by some heavy DDoS.

Here is a more interesting map for those who liked the previous one that was posted. http://map.ipviking.com/ (http://map.ipviking.com/)
Title: Re: DDOS Attacks
Post by: Triper on Sep 08, 2014, 06:22 PM
That map is cool, I wish I could play a game like that :c
Title: Re: DDOS Attacks
Post by: boxlunch on Sep 08, 2014, 11:41 PM
DDOS attacks happen to everyone, and servers usually end up hurt by them when their host is attacked; like others have said, only an idiot with no life would attack a single RO server. When the host goes down, everything including the server is taken down too. Basically, if you have an unreliable host, you're just asking for trouble.

The best thing you can do to mitigate your losses is hire/recruit a specialist on your end. It can be expensive, but it's an investment that pays off in the long-run.