TOXIKK Server Attacks

[.Girz0r]

This is my call to Reakktor & Sharkster to update the networking code to prevent constant mass IP joins. My server eventually runs out of called resources and the exe pops.

It's essentially a game engine exploit and can be squashed through a game update. Apparently MOST unreal engine games suffer from this exploit if it's not handled in the game's code.

I have a large number of logs saved of the exploits, help me help you.

[Sharkster]

Attacks like these are a pest. Squish one, next two pop up. Not sure what to do against that in the long run.

As it sits right now, it's not planned to allocate resources to counter these. Plus, it should be something handled by Steam, if I understand the issue correctly.

[.Girz0r]

Understood.

Below is a small snippet example of what happens when the server does down. There is also much more discussion in the discord.

[205956.30] NetComeGo: Open TheWorld 06/06/22 03:34:11 1.2.3.0
[205956.30] NetComeGo: Open TheWorld 06/06/22 03:34:11 1.2.3.1
[205956.30] NetComeGo: Open TheWorld 06/06/22 03:34:11 1.2.3.2
[205956.31] NetComeGo: Open TheWorld 06/06/22 03:34:11 1.2.3.3
[205956.31] NetComeGo: Open TheWorld 06/06/22 03:34:11 1.2.3.4
[205956.31] NetComeGo: Open TheWorld 06/06/22 03:34:11 000.111.222.5
[205956.31] NetComeGo: Open TheWorld 06/06/22 03:34:11 000.111.222.4
[205956.31] NetComeGo: Open TheWorld 06/06/22 03:34:11 000.111.222.3
[205956.31] NetComeGo: Open TheWorld 06/06/22 03:34:11 000.111.222.2
[205956.32] Critical: appError called: Ran out of virtual memory. To prevent this condition, you must free up more space on your primary hard disk.
[205956.32] Critical: Windows GetLastError:  (2)
[205956.34] Log: === Critical error: ===
Ran out of virtual memory. To prevent this condition, you must free up more space on your primary hard disk.

Address = 0x000000 (filename not found) 
Address = 0x000000   (filename not found) 
Address = 0x000000   (filename not found) 
Address = 0x000000   (filename not found) 
Address = 0x000000   (filename not found) 
Address = 0x000000   (filename not found) 

[PredatH0r]

For now it is quiet on the EU game servers, but in case the DoS starts again, I made a tool to protect TOXIKK (and theoretically most other game servers) from the currently known attacks.
The ToxikkFirewall is currently running on the "MOD All Maps+Mods" and the "Testlab" servers.

Source code is available on https://github.com/ToxikkModdingTeam/ToxikkFirewall

[.Girz0r]

This is good news

[Sharkster]

That's awesome, Pred. Thanks!