I’ve talked about disgruntled customers in the past, and once or twice about how occasionally those people happen to have access to say intimate knowledge of SQL database exploits or how to launch denial of service attacks, not that the latter requires much technical prowess. To make matters worse, while large businesses require denial of service attacks on an equally large scale, for smaller developers it often doesn’t take much to knock the website/game offline or to at least put a dent in the service’s stability.
Here at MMO Fallout, we love Perpetuum Online and most indie MMOs for that matter. So when an alleged disgruntled ex-player allegedly starts a denial of service attack against the game servers, we take notice. Dev Gargaj posted the following on Perpetuum’s forums:
Now, I’ll say this first that I’m not a network expert so my conclusions might be wrong but here’s how I saw the situation: Every now and then the login-server would get a huge (sometimes up to 80MB/s, though I suppose this includes TCP/IP overhead) burst of external traffic for about 15 minutes or so, and then it would go back to normal. I did some testing with a variety of network tools, and found out that the traffic is mostly aimed at port 139 (NetBIOS) which we have firewalled out, but still it would cause such a network congestion that it’d cause some connections to time out. This traffic came from thousands of endpoints all over the world, including countries where we have no (awareness of) players from (Peru, Egypt, etc.).
In short, from what I can deduce with my fairly modest knowledge about networks, we just got DDOS’d. Because our cluster works with a login server (which is a single point of failure), we were sitting ducks. Our firewall, on inspection (and contrary what I may have been saying earlier) was configured just fine, but the network itself became a bottleneck for the incoming traffic, something we couldn’t do anything about.
The announcement was posted on the 19th of January, but reportedly the attacks have been ongoing since then. Again, it’s worth noting that there isn’t any hard evidence that this is the work of a disgruntled player, but that the theory is merely speculation considering how targeted the attacks are (attacking specifically the login server rather than the cluster as a whole). Players are reporting instances of not being able to log in, and several Perpetuum traffic tracking services have been disabled without explanation (that I have found).
Still, one of the benefits of a game like Perpetuum is the community’s ability to stand together and draw swords against a common threat, against the attacker rather than the victim. Take for instance from another thread on the Perpetuum forums, Lupus Aurelius.
Also, if indeed this is due to a disgruntled player/explayer, we also need to send a clear message that no matter what they do, we will not waiver in support of Perpetuum and the DEVs, and that NO EXTERNAL ACTION BY ANYONE WILL CAUSE US TO EITHER CEASE PLAYING OR CAUSE US NOT TO RESUB!
NO ONE, WHATEVER THEIR GRIEVANCE, HAS THE RIGHT TO DENY US OUR RIGHT TO CONTINUE TO ENJOY PERPETUUM!
They may take our bandwidth, but they’ll never take our freedom! As Lupus points out in the thread, any information regarding who might be behind these attacks should be reported directly to the development team at Perpetuum Online.
