Clearing up misunderstandings about the DDOS attacks

[AstroCat♥]

(This post is edited when new information is available)

***FINAL EDIT: I’m leaving the rest of the post intact, but there was a response from Kerry/Valve that they’ve implemented server changes, explaining the lack of mass DDOS lately. Kudos to Kerry and Valve.


https://steamcommunity.com/app/550/discussions/0/4143942360096439305/?ctp=17#c4209245440571429350
***

I see that everyone is very confused so I wanted to make a thread clearing some basic things up, especially since some people are reporting playing games on Official servers without experiencing a DDOS (long story short: those people are just getting lucky, see near the bottom of this post).

There are two SEPARATE issues occurring which is causing the confusion.

1) There were Jimmy's "ban list" attacks, where, once you are put on his list, his script matches your Steam name to the server list and then DDOS's that server. This only happens if you're put on Jimmy's list (or if someone in your server is on Jimmy's list). I'm going to call these attacks "list attacks." These attacks are on a personal level and only affect a server if someone on the list is in that server. Most of you reading this were probably not on Jimmy's list (you would know if you were, most likely). So you're actually concerned about the next thing.

2) There are the blanket Official Dedicated Server DDOS's, which affect all official dedicated servers across the game. I'm going to call these attacks "mass attacks." To be clear, this does not refer to random DDOS's caused by random trolls against single servers. It's a coordinated attack against all Official Dedicated servers that happens near-simultaneously.

It's important to recognize these are separate things. LIST ATTACKS are caused by Jimmy's software and target individuals that he puts on his list. MASS ATTACKS are generalized Official Dedicated server attacks that target all official servers regardless of who's in them.

The LIST attacks might be resolved because Jimmy's website is now down according to people in the forums. If you were on his list, he is supposedly no longer doing this thanks to Valve's likely C&D. (This is the evidence that Jimmy's attacks might be done: https://i.imgur.com/sPghdq4.png)

The MASS attacks are ongoing, so regardless of whether you were on Jimmy's list or not, you will still be experiencing DDOS events in official servers. According to people that have visited Jimmy's site, Jimmy claimed not to be responsible for the mass attacks. So they may very well be caused by different bad actor(s).

As far as we know, Valve has only gone after Jimmy and thus stopped or attempted to stop the list attacks. We do not know whether Valve is working on the mass attacks, though their official post asks us for patience vaguely.

Here is information about the nature of the exploit the DDOS attacks are using:
https://github.com/ValveSoftware/Source-1-Games/issues/5141

Basically, they are very low bandwidth attacks, making it cheap for the attackers to perform: they can do this indefinitely until/unless Valve does anything about it.

Here is further information about the mass attacks and the evidence that the mass attacks are separate from any player name list attack like Jimmy’s:
https://github.com/Tsuey/L4D2-Community-Update/issues/485

The folks at GitHub in the link just above did an experiment where they used a docker to set up a couple of bait servers. For instance, one of them named "Valve Left4Dead 2 EU West Server (srcds401-fra2.271.729)", which is an exact match for a real official server. Another server looks very close to the human eye but has errors, "Valbe Left4Dead 3 SU South Server (srgds400-afro2.271.729)."

The first one with the exact match to a real official server got attacked frequently, the one with the slight name differences never got attacked.

This rules out two things:
1) It rules out that the attacks detected were based on who's in the server because it was a bait server (nobody was in it), which rules out Jimmy-style list attacks

2) It rules out that a human is manually targeting servers because for someone just going down a list to nuke servers, it'd be weird that they'd say "aha this one doesn't look right" for very minor spelling differences.

So we can conclude someone has set up an attack before this bait server was made that just occasionally DDOS's the official servers wholesale. The attacks are sporadic, so there will be some people that will say "I haven't been DDOSed and I played some games on Official servers." That leads to a belief all of the attacks are still on a personal level rather than a mass level, but I suspect those people are just getting lucky and playing between attacks.

The comments are notable for stating, "any ETA on an engine/game code fix should not be expected." It seems they do not expect Valve to give us an ETA on this (but we will see).

——————————

In the meantime, if you want to play online and the official servers are unplayable, see this guide about hosting and playing games with 3rd party servers. It does require some setup to make it easy:

https://steamcommunity.com/app/550/discussions/0/4143942846475463633/

[Skavien]

AstroCat♥님이 먼저 게시:

Skavien님이 먼저 게시:

As long as you don't connect to a online official Valve server you won't be at risk for an attack. Local, Lan, and other unofficial servers are the only way you can play without being DDOSED (mostly)

Local Servers uses the host's personal IP address that other players use to connect to. So if a "hacker" joins your local server then he can DDOS your personal network which will affect more than just Left 4 Dead2. The best way to prevent that is to create an alternating IP address or use a VPN. (VPN is simpler)

Lan is perfectly safe because the only people who can connect to you are people on the same network

The only real problem with unofficial valve servers is finding one that's not completely modded garbage.

As far as i'm aware the list has been taken down since Jimmy received that cease and desist letter from Valve. However the blanket DDOS attacks are still going on but those just attack official valve servers rather than specific people.

However I still find myself wondering whether the list is still in effect or not because every official server that I join gets DDOSED within a few minutes of me connecting and along side with that I have friends who have not experienced a DDOS attack let alone not even knowing what one is.

Of course all of that can all be coincidential and is just a thought based on personal experience.

For more information I highly recommend you checking out the posts made by Astrocat. She's done a great job in researching and providing all of us with very detailed information in regards to this issue.

EDIT - Didn't notice this comment was made under one of her post lol

I've heard people saying they haven't experienced DDOS on Official servers as well, so I think it comes down to the attacks being sporadic and some people are getting lucky.

The folks at GitHub did an experiment where they used a docker to set up a couple of bait servers. For instance, one of them named "Valve Left4Dead 2 EU West Server (srcds401-fra2.271.729)", which is an exact match for a real official server. Another server looks very close to the human eye but has errors, "Valbe Left4Dead 3 SU South Server (srgds400-afro2.271.729)."

The first one with the exact match to a real official server got attacked frequently, the one with the slight name differences never got attacked.

This rules out two things:
1) It rules out that the attacks detected were based on who's in the server because it was a bait server (nobody was in it), which rules out Jimmy-style list attacks

2) It rules out that a human is manually targeting servers because for someone just going down a list to nuke servers, it'd be weird that they'd say "aha this one doesn't look right" for very minor spelling differences. So we can conclude someone has set up an attack before this bait server was made that just occasionally DDOS's the official servers wholesale

It is nice to read that we can confirm that the "Jimmy-style" list attacks is not what is happening now especially since I was on that list from what it appeared.

so since these are basic UDP DDOS attacks, all valve really needs to do to mitigate is find a way to drop all UDP traffic not relating to player or server operations?

If that is the case this doesn't sound too difficult to stop just gonna take a lot of work on Valve's end.

[AstroCat♥]

Skavien님이 먼저 게시:

It is nice to read that we can confirm that the "Jimmy-style" list attacks is not what is happening now especially since I was on that list from what it appeared.

so since these are basic UDP DDOS attacks, all valve really needs to do to mitigate is find a way to drop all UDP traffic not relating to player or server operations?

If that is the case this doesn't sound too difficult to stop just gonna take a lot of work on Valve's end.

This seems to be what needs to be fixed:
https://github.com/ValveSoftware/Source-1-Games/issues/5141

It's that the servers accept low bandwidth packets, making it practically free for DDOSers. Close that exploit and DDOSers have to spend real world money to do it, which would probably stop lists and wide scale attacks

[Skavien]

AstroCat♥님이 먼저 게시:

Skavien님이 먼저 게시:

It is nice to read that we can confirm that the "Jimmy-style" list attacks is not what is happening now especially since I was on that list from what it appeared.

so since these are basic UDP DDOS attacks, all valve really needs to do to mitigate is find a way to drop all UDP traffic not relating to player or server operations?

If that is the case this doesn't sound too difficult to stop just gonna take a lot of work on Valve's end.

This seems to be what needs to be fixed:
https://github.com/ValveSoftware/Source-1-Games/issues/5141

It's that the servers accept low bandwidth packets, making it practically free for DDOSers. Close that exploit and DDOSers have to spend real world money to do it, which would probably stop lists and wide scale attacks

At this point all we can do is hope Valve does something

Hopefully with all this great information laying the great detectives of valve can figure out how to fix it LOL

[SantasClaws666]

So would playing a friends only campaign on a local server with a vpn be a safe way to play?

[Tatts87]

dead game. move on ya boomers LMAO

[AstroCat♥]

SantasClaws666님이 먼저 게시:

So would playing a friends only campaign on a local server with a vpn be a safe way to play?

Yes.

You can also play on VAC secured 3rd party servers. The link at the bottom of the OP talks about how to do that.

[Skavien]

SantasClaws666님이 먼저 게시:

So would playing a friends only campaign on a local server with a vpn be a safe way to play?

Yes. if its a trusted friend, neither of you will really need a VPN. the VPN is to protect your real IP from hackers who can get access to it from the console.

If you host a public local server then 100% use a VPN unless you have a dynamic IP (IP that changes every so often) but even then, you should still use a VPN because its safer and the time it takes your dynamic IP to change varies. (Use a VPN)

Keep in mind though a VPN can make your internet slower due to the time it takes to encrypt and decrypt data and the distance you set your VPN to.

Hope this helps.

[Cursed Hawkins]

Tatts87님이 먼저 게시:

dead game. move on ya boomers LMAO

The only boomer here is the individual that has nothing better to do than calling other people boomers!

[Inflated_chair]

SNUFF님이 먼저 게시:

Razorsonedge님이 먼저 게시:

Not sure if I trust anything JNJ says tbh, he very well could be doing both and trying to pin it on somebody else but I don't know; after all how could I not trust the man who has a history of stream sniping streamers and micspamming the nword to get them banned, and made 5+ alts just to keep ♥♥♥♥♥♥♥ with darksyn3's stream once, who also coincidentally started ddosing servers at the same time as some mysterious unnamed group.

Darksyn3 is the streamer I was referring to in my post yesterday. He deserved what he got because of how toxic he was in online games. Then if it happened to him or he ♥♥♥♥♥♥ up he would complain and rage at the game. He claimed to have all this knowledge of the game, but over time watching him play, it was obvious he didn't. It was far funnier watching him rage or get trolled by other players. Then Jimmy came along and now Darksyn3 doesn't stream on Twitch anymore. He tried to do the same on DBD and was even worse at playing that game with some of the best rage outs.

guys look its jimmy

[Max]

Tatts87님이 먼저 게시:

dead game. move on ya boomers LMAO

Agree let's be real this game full of trollers and toxic players before this hacker Jimmy.

[DimTheEnderman]

'"{`@xMaxrayx%n%:{code:Reborn}"'님이 먼저 게시:

Tatts87님이 먼저 게시:

dead game. move on ya boomers LMAO

Agree let's be real this game full of trollers and toxic players before this hacker Jimmy.

Is the game dead or full of trolls and toxic players.
Make up your mind.

[Max]

DimTheEnderman님이 먼저 게시:

'"{`@xMaxrayx%n%:{code:Reborn}"'님이 먼저 게시:

Agree let's be real this game full of trollers and toxic players before this hacker Jimmy.

Is the game dead or full of trolls and toxic players.
Make up your mind.

I remember in old days the game only shows 2-8 lobbies official on expert if we didn't count they play that mercy map.

So it's not that great kind meh unless you Want play adv or normal deffcoilty

[MADDPIRATE75]

Skavien님이 먼저 게시:

SantasClaws666님이 먼저 게시:

So would playing a friends only campaign on a local server with a vpn be a safe way to play?

Yes. if its a trusted friend, neither of you will really need a VPN. the VPN is to protect your real IP from hackers who can get access to it from the console.

If you host a public local server then 100% use a VPN unless you have a dynamic IP (IP that changes every so often) but even then, you should still use a VPN because its safer and the time it takes your dynamic IP to change varies. (Use a VPN)

Keep in mind though a VPN can make your internet slower due to the time it takes to encrypt and decrypt data and the distance you set your VPN to.

Hope this helps.

which vpn do you suggest?

[MADDPIRATE75]

AstroCat♥님이 먼저 게시:

SantasClaws666님이 먼저 게시:

So would playing a friends only campaign on a local server with a vpn be a safe way to play?

Yes.

You can also play on VAC secured 3rd party servers. The link at the bottom of the OP talks about how to do that.

wheres the link to it?

[bluefalcon74.ttv]

30k concurrent players on Steam, and all seemingly unaffected by the DDOS. Never mind that I regularly see the same few faces online when I join random matches. Why do I have a feeling that fixing these issues might mean Valve also having to lose 15k bot accounts and spiraling L4D down the ranks of active player base?