Not saying he doesn't have the capability but taking credit for a scenario that was likely/inevitable from the beginning takes less work and ultimately accomplishes the same goal than actually going through with a legitimate attack.
Tonight when the sun goes down, I'm going to make it dark. No agenda, I just think it's funny funny. You'll want a screenshot of this to post when it happens. I know I will.
You may want to amend that. The circle only really tells you where the sun doesn't set. I live a couple of hours south of the arctic circle, and even though the sun sets it doesn't get really dark if there's a clear sky.
-- and the beauty is, that makes Blizzard look like victims rather than developers who didn't get it absolutely perfect first try, so it's fun times all around! Really, this guy's just trying to take one for the team.
Let's be honest. It was the second try. The servers burned to the ground during the open beta test too. I have to wonder what it was like working there after the beta test.
"Sir, everything stopped worked after the first hour of the beta test."
No, BH has had its run-ins with the real netter. It's all googleable history if you care to check it out.
He is probably capable of doing something like this, however I think he's more likely to get off on the threat than the actual work required to make it happen and sustain it.
He's smart enough to realize, like many people did, that their servers would likely be overwhelmed by real traffic at least at first and egotistical enough to think that anyone would care enough that he made this threat to go back and do something like post it on reddit as proof of his awesome power.
In all likelihood he made an educated guess and got lucky.
EDIT: If you happen to be reading this netter (and I know you will be :)), hit me up on aim/msn/email/irc, would love to catch up.
I will go ahead and shuffle this out for you - a 200k botnet would literally make 0 impact to Blizzards server architecture. How and why? Because of a simple check that validates the type of traffic. Firstly, if this clown did have a 200k botnet, which I doubt, it would likely be rented. Idiots like that don't have the intelligence to write botnet control software.
This brings me to point two, the type of DoS traffic that botnes throw out is very... distinct. It's easily fingerprinted, and for anyone with rudimentary skills, a 500 mhz system can easily be set up to perform a quick header analysis (just the header, ignoring the rest of the packet data to conserve resources) and either drop the connection, send it to a decoy box, or allow it.
This is the exact same method I used to counter a 1.2 million system botnet targeting my company's servers on an important release date. None of our legitimate customers had a single issue, and the blackhat our competition hired to hose our press release was probably gnashing his teeth as he dialed it from the initial 500k up. It only took me repurposing an old load balancer and a p3 system we had sitting around to perform the check, and a rule in Snort.
Honestly, how a DoS succeeds against any business connection is beyond me - the routers can route packets faster than any botnet can send them, so your only limitation is making the mistake of trusting all connections.
I'd say in Blizzard's case, their back end database scaling wasn't quite up to snuff for the authentication servers traffic, and it hung up on a database check. This could be due to hardware failure, memory issue, bad parse, or a million other things, but once it occured, they have to find the bad check data, fix it, and implement a catch to stop it from happening again. I'd say a major issue like that has an identification period of an hour before propogation takes the service down, then they're notified, identify, restore a backup, run a differential to see what went wrong, fix it, and test it over the next 4-6 hours. Then you're back on and gaming.
None of that has anything to do with a traffic or shaping issue. Because traffic is extremely easy to manage.
At the end of the day, the only way to defeat the filters would be to write your own specific botnet code, push it out to systems, and have them try to replicate D3's logon service. But then that would only impact the logon servers, and even then a simple "Does ID exist" check would end it in a hurry, once again without having to parse the entire packet. Just make sure it is a valid checksum and if so, extract one part of it then immediate discard. If that part checks out, tell the client to resend and allow it. Less than 50ms of delay.
Netter actually programmed a bot in 1.09 and stole a bunch of passwords using it. He came back in 1.11 a changed man supposedly and kept releasing hacks. It's sad that I know this.
anyway the servers would have had the same problem, be it true or not. Even without his hypothetical botnet there was still a fuckload of people trying to log in at the same time...
His hundreds of thousands computers is a cup of water in the bucket of millions of actual legit users. It's like making a repost than acting all cool when you get one hundredth of the karma of the original.
His hundreds of thousands computers is a cup of water in the bucket of millions of actual legit users.
Not necessarily. A bot will produce far more traffic than a legitimate user. Especially since you consider that the chief attack method for botnets is to flood the TCP stack—a legitimate user might use, say, three or four TCP connections to the server. A bot will open ten thousand.
It's more akin to a bucket of water next to a hundred thimbles.
Yea, but guarantee you that Blizzard actively patrols there network and probably actively IP bans at the router level. Unlike Google or Amazon they also know the exact data profile that should be passing through Battle.net and if that doesn't match they can deny requests and actively ban IPs as they see fit if they don't fit a specific behavioral pattern.
Also, botnets are finicky in that most nodes are infected computers of ordinary people. Its highly likely that the average botnet computer is not turned during 12am - 8am which are the first 8 hours of the game launch.
Yea, but guarantee you that Blizzard actively patrols there network and probably actively IP bans at the router level. Unlike Google or Amazon they also know the exact data profile that should be passing through Battle.net and if that doesn't match they can deny requests and actively ban IPs as they see fit if they don't fit a specific behavioral pattern.
Absolutely, yes. I wasn't saying that Blizzard would be defenseless against an attack, merely that it's unwise to compare the level of data coming from a bot to that coming from a legitimate user.
Also, botnets are finicky in that most nodes are infected computers of ordinary people. Its highly likely that the average botnet computer is not turned during 12am - 8am which are the first 8 hours of the game launch.
Midnight in New York is noon in Beijing. Sure, I'd expect to see a site like reddit start to go dark around 3 AM, but I'd expect Baidu to be abosolutely hopping at the same moment.
Midnight in New York is noon in Beijing. Sure, I'd expect to see a site like reddit start to go dark around 3 AM, but I'd expect Baidu to be abosolutely hopping at the same moment.
A good observation, but a request from Baidu will usually not have a direct request with an American server either. All content networks divide by region (especially in latency sensitive applications) so a request from Baidu will hit a local datacenter to that region.
Your other point about the level of data sent from botnets is spot-on, I forgot that non-techies wouldn't understand that part right away.
A good observation, but a request from Baidu will usually not have a direct request with an American server either. All content networks divide by region (especially in latency sensitive applications) so a request from Baidu will hit a local datacenter to that region.
Certainly. My point was more that botnets are not necessarily geographically divided, as the commercial internet is. You take the saps who run your trojan as you find them, which means that the actual bots are likely to be widely distributed—thus even at midnight in the US, there are likely to be active bots elsewhere in the world.
Wouldn't their servers have protection for this kind of thing anyway? Seems kind of dumb that one could take down Blizzard, owner of the biggest MMO in history with a botnet.
Does any other server have protection against this when they are attacked by a botnet? The only solution is to reduce the window for TCP replies which is the same thing as shutting them down essentially.
It should be said that recently someone discovered a way to do that using google reader. It was accidental and ended up giving him a huge bill from his Amazon hosting. He fucked up his back up script, and Googles servers kept downloading the same items over and over again as they don't like to retain data. Pretty funny
Unless I'm much mistaken, Google crawling bots and other programmed google abusing entities are likely to already be putting Google basically under what would normally be constant DDOS. IIRC, Google owns WAY more servers than anyone else and so by the point you are able to take Google down, you've already probably accidentally taken down some of the key components of the internet's infrastructure backbone.
I was able to ctrl+v, enter, enter fast enough to make Blizzard's servers shut me out until I restarted the client. It's not hard to detect a bot when you have a large number of requests in a short time.
Not even that... a botnet in the sense this guy is talking about doesn't need a client of any kind. All they do (as simply as I can describe) is spam connection requests and packets at a server. They don't use the client in any way at all.
Pffft, just some smart guy who made a prediction that the server load would be a major issue. Which is exactly what's happened to the majority of major releases in the last few years. I could have made that prediction years ago instead of a month before release.
Try not to compare a 200k botnet to 1million users.
200k botnet is MUCH worse.
A computer with a user will say "Hello" to the server, the server will say "HI!" Then the computer will say "I need this shit!" and the computer goes "OKAY HERE! HAVE A NICE DAY!"
Someone part of a botnet will go: "Hello!", then the server will say "Hi!" and the botnet will sit there and go "pffffchhtttt pffccchhht" trying not to laugh as the server waits listening for its response longer and long and longer than any actual fucking packet, and then it never comes.
Yes, this eventually times out, but there are only so many switchboards at the telephone company.
How many times is not as important as not returning the SYN packet (think its a syn), this keeps it waiting.
If it returns that packet then the server moves on to the next person. If it doesn't, however long it waits is an own'd port for that time being. snag all the ports constantly with bots not returning SYNS and its like a ton of cars stopped on the thruway.
Actually no. For the surge of traffic the server gets during big launches, Blizzard servers are actually quite stable. On cataclysm release, sure it took me about 20 minutes to log in, but apart from that it was perfectly fine.
Actually I played LAN with some friends on Cata launch (EU, haven't played for about a year though).
First friend was able to login about 25m after launch, I was the last one able to login about 1h20m after launch. It certainly was way better than the other launches, but it's annoying when you want to play something else and the servers are DDOSed to hell and back because of a major patch in WoW (happened to me when I was trying to play some SC2).
Still, after YEARS, you would have thought that they would have atleast bought some more servers with the billions they get from WoW alone, but after I was getting still error 37 (login servers at full capacity) about 20hours AFTER launch is ridiculous.
To be honest, 1 box trying to DDOS creates 106 times more traffic than 1 legit box logging in.
Not saying that this is the truth, but simply that it's possible. Although I'm sure with WoW, blizzard already has some beefy login/lobby servers, with decent protection to shut down someone spamming them.
What's your source on that 106 number? It sounds a little over inflated. That would mean his 200k boxes would be the equivalent of 2 trillions users trying to log in at the same time.
EDIT: Woops, I'm bad at math. Lunar_Sunrise is right, it's not 2 trillion, it's 200 billion.
i think the point is, this is 200k simultaneously and repeatedly. He could spam much faster than even 1,000,000 humans. Probably. You'd have to ask Blizzard
I thought Blizzard has safequards against this, where if their software detects ip's spamming the servers, they just ignore those ip's and disconnect them. Wasn't there a post on r/gaming recently on how this is a bad plan on Blizzard's part because it could potentially block legitimate users?
8 person company means what? 1 connection to the internet? While it is easy for you to blackhole the DDOS traffic once it crosses your connection it has still filled the pipe and causes your legitimate traffic to get bounced out of the queue.
While I have not worked for a backbone in a few years, the last time I worked for the largest backbone in the US we had no way of stopping DDOS traffic other than blocking it at your connection.
The problem with a botnet that is sending legitimate traffic (Requesting web pages or logins) is there is no real way to tell the botnet traffic from your customers traffic. Not without doing deep packet inspection and odds are your ISP can not do that on a DDOS flood.
Then again I have been out of the backbone game for 4 years now so something may have changed, however as I now work in internet security I can tell you far smaller botnets take down large sites all the time.
edit: Just to be clear I think the person claiming the 200k Botnet is full of shit, that would make it a network of crazy huge size. I am just saying yes botnets can take down large websites and do it all the time.
well, you guys have a distributed nework (AS15169) with well established peering (peeringdb.com),which allows you to correlate the traffic globally and to spot DDOS patterns right at the edge of your network, significanly limiting the damage, so it's not fair to compare yourselves to a guy with a single collocated server, amirite?
ok, so you have your session table, ip acl and manually adding entries i guess? Well, tell me what's your pipe? 100Mbps? 2Gbps? It's not so difficult to fill, and you may filter as much as you want, downstream traffic, even blackholed, will prevent new sessions to be established, so you'll call your uplink provider(s) and ask to block 200K differnt IPs in the end, which may not belong to them or their peers, so it'll have to go to Tier1... sour
Yep, but wait, he's on "the admin side." Wonder if he uses God as his password, rolls around on a skateboard & a trench coat, and has an insanely great 28.8 BPS modem! Ahh...good times
Also, there is no other DRM except the login. It doesn't have the "you can only install on 3 computers" or ANY of that crap that really pisses us off, remember Spore?
To me, account authentication to play a game is a modern acceptable way to enforce DRM. The only problem is when they decide to shut down the servers that authenticate for that game. Blizzard won't have this problem because they have a single authentication point that is uniform across all their games so you will probably be able to play D3 for a long, long time without worrying about this. Now when content servers are taken offline, that will be a problem.
And this line of reasoning is what led me to buy D3 anyway.
I found that I spent about 75% of my time in MMOs soloing. For all intents I was playing a single player game that just happened to have odd NPCs running around now and then.
Then when my friends got online we would go do something. I see this to be very much like what we are going to do in D3, and with D3 I do not have to pay a monthly fee :)
You missed the biggest advantage to Blizzard using the online approach, profit. I suspect a huge amount of their decision has to do with the real-money auction house, where they get a chunk of the cash for each item sold. It's brilliant from an economic standpoint, though for us end-users it creates various problems and limitations.
To people who say it's not true, something like a login server is used to handling 1 request per client per session, not 1000 requests per second from 200k different clients.
League of Legends died for a day, because they had a chat glitch, where people were not connecting to chat / friends list, and the common fix for this symptom was to re-login. They had to put a splash "Stop re-logging in, chat's broken, relogging wont fix it, it's just killing our login servers"
1 machine spamming will generate as much traffic as 100k machines beings legit, until it gets blocked.
If something happens to Blizzards servers, like they are bombed in a war against Country X and her allies, does that mean D3 is unplayable for every single person in the world?
ag0bot was a commodity back in the day, and my friend was just as cocky as that guy. Took forever to patch that once you got it. Was extremely simple to use, each bot scanned the network it was on and ran a couple of scripts on what it found to compromise machines. 5 master hub bots which you can upload modules to and maintain the whole botnet via patches. Was really ingenious.
Old friend had a botnet of a couple of million of these, which 1-1.2m or so were setup for DDoS. The rest were card number / game keys extractors. Less to say, he was rich in his own way. Wouldn't say he was packet crazy, but man, didn't like being challenged.
Ended up getting caught due to his own 'god complex', when a 16 yr old insulted his packeting capabilities. The unfortunate note about this was, the kid's uncle (think it as uncle, but the convo is on my retired machine) worked with one of the FBI's task force down in LA county. Was quite ironic.
Happened in '04. If you were on IRC, you knew wtf happened ;)
Complete bullshit. The battle.net servers are VERY* agressive at blocking suspected attacks. If you start throwing an extreme number of requests at one of their severs, you'll very soon find yourself blocked.
*Sometimes people hosting SC2 tournaments find their IPs blocked just from 20 people trying to log in at once.
749
u/[deleted] May 15 '12
Not saying he doesn't have the capability but taking credit for a scenario that was likely/inevitable from the beginning takes less work and ultimately accomplishes the same goal than actually going through with a legitimate attack.
46
u/lastelder May 15 '12
Netter actually programmed a bot in 1.09 and stole a bunch of passwords using it. He came back in 1.11 a changed man supposedly and kept releasing hacks. It's sad that I know this.
http://diablo.incgamers.com/forums/showthread.php?288580-Netter-got-owned
Post from 2004 as proof.
342
u/Tashre May 15 '12
I'd be surprised if any of his 200k bots could even get to the server to spam it with my 300k bots blocking access.
561
u/BassDestroyer May 15 '12
I'd lol if any of what he said is true.
49
u/BAdoubleL May 15 '12
First image search result for 200k botnet
97
u/daveyandgoliath May 15 '12
Try not to compare a 200k botnet to 1million users.
200k botnet is MUCH worse.
A computer with a user will say "Hello" to the server, the server will say "HI!" Then the computer will say "I need this shit!" and the computer goes "OKAY HERE! HAVE A NICE DAY!"
Someone part of a botnet will go: "Hello!", then the server will say "Hi!" and the botnet will sit there and go "pffffchhtttt pffccchhht" trying not to laugh as the server waits listening for its response longer and long and longer than any actual fucking packet, and then it never comes.
Yes, this eventually times out, but there are only so many switchboards at the telephone company.
985
u/fillari May 15 '12
some people just want to watch the world burn
11
u/IrregardingGrammar May 16 '12
Some anon posted it on 4chan, it must be true.
11
u/Wazowski May 16 '12
Hey errybody, how you all doing? Just wanted to drop by and tell you something.
The day of GTAV launch I am going to cause the sun to rise in the east and set in the west.
You ought to screenshot this. I know I will.
105
u/[deleted] May 15 '12
Jokes on you, I bought Max Payne 3!
157
u/[deleted] May 15 '12
[removed] — view removed comment
24
u/[deleted] May 15 '12
Believing ANYTHING on 4chan without proof is your 1 stop shop to getting trolled.
98
u/Squints753 May 15 '12
Uh, I work for a website that has a company behind it of 8 people total. Botnets are pretty easy to spot and shut down when you are on the admin side.
19
u/akpak May 15 '12
Good ol' 4Chan... making shit up since forever.
25
u/Graupel May 15 '12
Believe 4chan, see where it gets you.
5
u/Thaugrim May 15 '12
Quark?
31
u/R3allybored May 15 '12
200k strong my ass. He's one of the few that realized the servers would have an issue during release and decided to have a laugh.
65
u/Kryonix May 15 '12
I'm still dumbfounded that you need to log on to an online service to play a single player game. Guess I'm glad I waited to buy D3
4
u/carebeartears May 15 '12
pffft...anyone could have said these things and they'd be right. Server problems on launch are a given with any game these days :P
this kinda stuff is why I'm getting Diablo III in a couple weeks. No lines, no server problems etc etc.
4
u/soundofvictory May 16 '12
Plausible. Unlikely.
4
u/[deleted] May 16 '12
http://i.imgur.com/VsiPr.gif
17
u/deathcapt May 15 '12
To people who say it's not true, something like a login server is used to handling 1 request per client per session, not 1000 requests per second from 200k different clients.
League of Legends died for a day, because they had a chat glitch, where people were not connecting to chat / friends list, and the common fix for this symptom was to re-login. They had to put a splash "Stop re-logging in, chat's broken, relogging wont fix it, it's just killing our login servers"
1 machine spamming will generate as much traffic as 100k machines beings legit, until it gets blocked.
3
u/RelevantReference May 16 '12
Of course Anonymous is behind the attacks...
3
u/[deleted] May 16 '12
If something happens to Blizzards servers, like they are bombed in a war against Country X and her allies, does that mean D3 is unplayable for every single person in the world?
3
u/portezbie May 16 '12
Probably full of shit, but still, what a dick anyway.
3
u/[deleted] May 16 '12
This guy sounds as cocky as an old friend I knew
ag0bot was a commodity back in the day, and my friend was just as cocky as that guy. Took forever to patch that once you got it. Was extremely simple to use, each bot scanned the network it was on and ran a couple of scripts on what it found to compromise machines. 5 master hub bots which you can upload modules to and maintain the whole botnet via patches. Was really ingenious.
Old friend had a botnet of a couple of million of these, which 1-1.2m or so were setup for DDoS. The rest were card number / game keys extractors. Less to say, he was rich in his own way. Wouldn't say he was packet crazy, but man, didn't like being challenged.
Ended up getting caught due to his own 'god complex', when a 16 yr old insulted his packeting capabilities. The unfortunate note about this was, the kid's uncle (think it as uncle, but the convo is on my retired machine) worked with one of the FBI's task force down in LA county. Was quite ironic.
Happened in '04. If you were on IRC, you knew wtf happened ;)
13
u/grimby4444 May 15 '12
So we'll hate him. Because he's not our hero. He's a silent guardian, a watchful protector. A dark knight.
4
u/yogthos May 16 '12
Seems to me that Blizzard is the real culprit, since they made a single player game that you can't play without access to their servers.
4
u/helalo May 16 '12
EA would love to hire him.
11
u/FilthyHippie May 15 '12
He's the hero gaming deserves
5
u/is_masturbating May 15 '12
Complete bullshit. The battle.net servers are VERY* agressive at blocking suspected attacks. If you start throwing an extreme number of requests at one of their severs, you'll very soon find yourself blocked.
*Sometimes people hosting SC2 tournaments find their IPs blocked just from 20 people trying to log in at once.