Clearing up misunderstandings about the DDOS attacks

[AstroCat♥]

(This post is edited when new information is available)

***FINAL EDIT: I’m leaving the rest of the post intact, but there was a response from Kerry/Valve that they’ve implemented server changes, explaining the lack of mass DDOS lately. Kudos to Kerry and Valve.


https://steamcommunity.com/app/550/discussions/0/4143942360096439305/?ctp=17#c4209245440571429350
***

I see that everyone is very confused so I wanted to make a thread clearing some basic things up, especially since some people are reporting playing games on Official servers without experiencing a DDOS (long story short: those people are just getting lucky, see near the bottom of this post).

There are two SEPARATE issues occurring which is causing the confusion.

1) There were Jimmy's "ban list" attacks, where, once you are put on his list, his script matches your Steam name to the server list and then DDOS's that server. This only happens if you're put on Jimmy's list (or if someone in your server is on Jimmy's list). I'm going to call these attacks "list attacks." These attacks are on a personal level and only affect a server if someone on the list is in that server. Most of you reading this were probably not on Jimmy's list (you would know if you were, most likely). So you're actually concerned about the next thing.

2) There are the blanket Official Dedicated Server DDOS's, which affect all official dedicated servers across the game. I'm going to call these attacks "mass attacks." To be clear, this does not refer to random DDOS's caused by random trolls against single servers. It's a coordinated attack against all Official Dedicated servers that happens near-simultaneously.

It's important to recognize these are separate things. LIST ATTACKS are caused by Jimmy's software and target individuals that he puts on his list. MASS ATTACKS are generalized Official Dedicated server attacks that target all official servers regardless of who's in them.

The LIST attacks might be resolved because Jimmy's website is now down according to people in the forums. If you were on his list, he is supposedly no longer doing this thanks to Valve's likely C&D. (This is the evidence that Jimmy's attacks might be done: https://i.imgur.com/sPghdq4.png)

The MASS attacks are ongoing, so regardless of whether you were on Jimmy's list or not, you will still be experiencing DDOS events in official servers. According to people that have visited Jimmy's site, Jimmy claimed not to be responsible for the mass attacks. So they may very well be caused by different bad actor(s).

As far as we know, Valve has only gone after Jimmy and thus stopped or attempted to stop the list attacks. We do not know whether Valve is working on the mass attacks, though their official post asks us for patience vaguely.

Here is information about the nature of the exploit the DDOS attacks are using:
https://github.com/ValveSoftware/Source-1-Games/issues/5141

Basically, they are very low bandwidth attacks, making it cheap for the attackers to perform: they can do this indefinitely until/unless Valve does anything about it.

Here is further information about the mass attacks and the evidence that the mass attacks are separate from any player name list attack like Jimmy’s:
https://github.com/Tsuey/L4D2-Community-Update/issues/485

The folks at GitHub in the link just above did an experiment where they used a docker to set up a couple of bait servers. For instance, one of them named "Valve Left4Dead 2 EU West Server (srcds401-fra2.271.729)", which is an exact match for a real official server. Another server looks very close to the human eye but has errors, "Valbe Left4Dead 3 SU South Server (srgds400-afro2.271.729)."

The first one with the exact match to a real official server got attacked frequently, the one with the slight name differences never got attacked.

This rules out two things:
1) It rules out that the attacks detected were based on who's in the server because it was a bait server (nobody was in it), which rules out Jimmy-style list attacks

2) It rules out that a human is manually targeting servers because for someone just going down a list to nuke servers, it'd be weird that they'd say "aha this one doesn't look right" for very minor spelling differences.

So we can conclude someone has set up an attack before this bait server was made that just occasionally DDOS's the official servers wholesale. The attacks are sporadic, so there will be some people that will say "I haven't been DDOSed and I played some games on Official servers." That leads to a belief all of the attacks are still on a personal level rather than a mass level, but I suspect those people are just getting lucky and playing between attacks.

The comments are notable for stating, "any ETA on an engine/game code fix should not be expected." It seems they do not expect Valve to give us an ETA on this (but we will see).

——————————

In the meantime, if you want to play online and the official servers are unplayable, see this guide about hosting and playing games with 3rd party servers. It does require some setup to make it easy:

https://steamcommunity.com/app/550/discussions/0/4143942846475463633/

[AstroCat♥]

Originally posted by MADDPIRATE75:

let me get this straight, so you can on local as long as you have VPN activated or you can play single player campaign to not get affected by the attacks?

You can play single player without needing a VPN and not get attacked, it doesn’t use official servers since it plays on your PC alone.

And to be clear, when the servers get attacked, nothing bad happens to you (it’s not like being hacked), it just makes the game unplayable during that session. It’s safe to *try* playing online. With the caveat that if you “host local server” it does broadcast your personal IP to other players in the same match. (But the attacks aren’t coming from people playing in matches. That only matters if you happen to have a bad person in that particular game).

You can play online using Best Available Dedicated Servers (3rd party servers), just have to find some that aren’t modded unless you want the mods).

[Max]

Originally posted by MADDPIRATE75:

let me get this straight, so you can on local as long as you have VPN activated or you can play single player campaign to not get affected by the attacks?

just make steam in offline mode it will disable steam cummincation inclouding p2p and steam servers, api

[AstroCat♥]

Originally posted by LegionIscariot:

Originally posted by AstroCat♥:

Convincing new people not to buy the game until they put even minimal effort like communication into it might be the way to go. I suggest leaving a bad review but having the good faith to update it back to a good review if and when they do something, anything, about it.

I'm glad that they apparently did something about Jimmy's list, don't get me wrong. But the real problem is the inability to play on official servers regardless of that list because someone (whether it's still Jimmy or if it's someone else) is DDOSing all official servers. It can and will destroy the ability to just play pub games.

Valve is as much a victim here as any of us. Leaving a negative review on the game just means the trolls win...

The exploit the DDOSers are using has been pointed out to Valve on Github and HackerOne. The nature of the exploit means they don’t have to spend a lot of money to do the attacks, so they can continue indefinitely. If Valve were to patch the exploit, the DDOSers would have to spend real money to DDOS, so they couldn’t continue forever.

That’s Valve’s fault for not patching the exploit.

[amkibb]

Haven't played this game in years, just now coming back and noticing the huge ping spikes. Is there some drama I missed? I don't know this Jimmy guy, and I have no clue if there is some beef making people want to send out a Mass Attack. I'm just trying to shoot a few zombies and chat.

[AstroCat♥]

Originally posted by amkibb:

Haven't played this game in years, just now coming back and noticing the huge ping spikes. Is there some drama I missed? I don't know this Jimmy guy, and I have no clue if there is some beef making people want to send out a Mass Attack. I'm just trying to shoot a few zombies and chat.

Jimmy doesn’t claim the mass attacks. It’s unknown who’s doing that.

My recommendation is playing on third party servers (“best available dedicated server”) but you will have to join and leave them until you find one that isn’t a garbage modded server.

I have a post not far down titled something like “how to play during DDOS” with more info. Basically you can use a session to just join a bunch, write down the IPs of the good ones, and save that IP to join them at your leisure later to host. (That’s if you want to host).

Edit: here it is
https://steamcommunity.com/app/550/discussions/0/4143942619993567648/

[Cursed Hawkins]

Originally posted by LegionIscariot:

Originally posted by MateAndMead:

I wish TF2 could be treated with the same urgency by Valve, but oh well. At least they did something for once.

TF2 is a 2007 game that still gets updates in 2024. It gets more updates than newer games.

Patches don't count, when people want UPDATES they mean major updates and the last one was in 2022!

[Ditzy Femboy]

Originally posted by LegionIscariot:

Originally posted by MateAndMead:

I wish TF2 could be treated with the same urgency by Valve, but oh well. At least they did something for once.

TF2 is a 2007 game that still gets updates in 2024. It gets more updates than newer games.

It doesn't. Those "updates" are just new cosmetics. That are not even made by Valve. That's it. The game has a massive bot problem that makes a majority of matches unplayable. Have you been sleeping under a rock the last 6 years? Even some of the voice actors have openly complained about Valve not fixing the game.

[Cray]

It's simple:

1) None of this was happening until jimmynigs started doing his lame skid attacks.
2) His dumb operation got shut down.
3) Suddenly all servers are getting attacked.

It's all jimmynig's doing, lame kid lashing out with childish retaliation because someone dared give him consequences for being an idiot.

ps: jimmynigs, if you're reading this, your penchant for wasting time on dumb grudges over a silly game is well known by now, and it's been confirmed that you've 'listed' people over the stupidest things (not even cheating), so I can only assume you feel like proving my point about you by adding me too. Feel free, it'll just underline the fact that you're still a child.

[Jaffar Face]

Can't we order a whole bunch a pizzas to his address?

[AstroCat♥]

Originally posted by Cray:

It's simple:

1) None of this was happening until jimmynigs started doing his lame skid attacks.
2) His dumb operation got shut down.
3) Suddenly all servers are getting attacked.

It's all jimmynig's doing, lame kid lashing out with childish retaliation because someone dared give him consequences for being an idiot.

ps: jimmynigs, if you're reading this, your penchant for wasting time on dumb grudges over a silly game is well known by now, and it's been confirmed that you've 'listed' people over the stupidest things (not even cheating), so I can only assume you feel like proving my point about you by adding me too. Feel free, it'll just underline the fact that you're still a child.

The mass attacks started before Jimmy got a C&D, and he was claiming it wasn’t him doing that then too.

I’m not convinced Jimmy is doing the mass official server attacks. And why wouldn’t he have claimed credit for it when he was brazen about his list? Also, it prevents him from playing and wielding power with his list (though that’s taken down now, that wasn’t the case before Valve’s presumed C&D).

There is an unknown person or group responsible for the mass attacks, and it’s not going to stop unless Valve patches the exploit. Which is to say, it’s probably not going to stop, and the community is going to have to learn to use 3rd party servers most likely.

[***********]

https://steamcommunity.com/id/fdhbsjakfha/ is behind the ddos attack

[GS:Juicy1s]

I didn't notice any issues at all(people been saying this blanket attack has been going on for a few days?) It only started for me after I got added to JNJ list after a random encounter on a server with him last night, unplayable since that moment and still is.

Even saying in game chat he was going to attack all of l4d2

[FROYO Rando Blueberry King Jesus]

Originally posted by Whiterun Guard:

https://steamcommunity.com/id/fdhbsjakfha/ is behind the ddos attack

This guy has been around for months

[***********]

he ddoser

[Vedris]

So basically, some guy named "Jimmy" was DDOSing servers targetting specific people, and because of that, several others got the idea and blanketed their mass DDOS attacks on ALL major servers under them so they can take the blame?
Who even is "Jimmy"? What's the story behind any of this, and how do you know?
Also, why do you, or anyone here expect Valve to respond to or fix any of the issues? TF2 has been having minor DDOS attacks and bot hackers since August 2017, and practically nothing has been done to mitigate the issue (along with several other problems that have killed the community in most ends).
How can such a major DDOS attack occur for nearly a week on ALL servers and even community servers for this game? It seems less like a DDOS and more like the servers are just super unstable.