Serious Question: How Long?

[Kiliden-bleeding-hollow]

insert mj eating popcorn GIF

[Kreed-grobbulus]

That he could basically what he is doing is taking a bunch of virused computers and running a bot programming to all log into the server / servers at once and basically making it so the server crashes. Once the server crashes the combined effort of everyone trying to get back on + the added attack of the ddoser makes it so the servers cant be ran stable.

[Widdly-burning-legion]

I’m a professional by trade. I read documentation like this when I evaluate software. It’s pretty standard.

I don’t know how to make this easier for you. If it were so easy to prevent, this functionality would have been abstracted away (such that it can be used by any system) and there would be no such thing as a DDOS threat.

Try. Again.

Your a professional in a different field telling someone whose profession it is to do exactly these things that you know more about it?

I’m done dude you’re a complete moron. Have fun being wrong.

[Algolagnist-mankrik]

Go read the documentation. Try again.

[Widdly-burning-legion]

Go read the documentation. Try again.

Work at building databases for 5 years professionally and having a masters in data science. Try again.

[Kreed-grobbulus]

So why did twitch, which is run by amazon. Get knocked out for most of the day on the 6th? Guess money cant buy everything.

[Crazdor-moon-guard (Crazdor)]

So technically speaking, no matter how far fetched it is, if he never got bored of this, and managed to avoid authorities, he could stop us from playing WoW forever?

Well, no, not really. If Blizzard decided to not do anything to mitigate or stop it and just tried to wait him out, then it would go on forever or until something happened like them losing internet (assuming all of the computers involved are on the same network, which is unlikely), or the botnet was taken down, or some other act of God that would cripple their ability to send massive amounts of useless data to the servers.

In reality, there are things that Blizzard and their ISPs can do. One example is something called a scrubbing center, generally a third party that your traffic is diverted to that filters out all (or at least a lot) of the attacker’s packets while then allowing safe packets (so in our case, players’) to then go on to Blizzard’s servers.

If you’re interested in how a large scale attack can be stopped, I would definitely recommend looking at the attack against GitHub in 2018. It was, at the time, the largest DDoS attack ever recorded, peaking at 1.35 Tbps (as in Terabits per second). When they identified the attack, they had Akamai Prolexic step in, having everything sent to their scrubbing centers before being redirected to GitHub if they were deemed clean.

GitHub was offline for like five minutes. The attack began at 5:21PM, traffic was redirected to Akamai at 5:26, GitHub recovered by 5:30. The attackers gave up shortly after, with only one (relatively) small spike in traffic at around 6:00 before ending entirely.

One thing to note, though: I’m not entirely certain how well something like that would work for something like WoW. I do study Computer Science but this area is not my specialty, and although I suspect that there may be some complications with using a scrubbing center on a live service game, I may be wrong, so if anyone has an actual answer to that part, I’d love to hear it.

[Celessi-turalyon]

No matter what infrastructure you use, being targeted by a DDOS attack WILL affect you and your audience. No amount of distribution and redundancy can give you complete protection, because of how the internet works. There’s no perfect world where it’s only going to affect this one physical server. No, it’s going to affect every server that gets routed to.

Now it IS preventable. As soon as this unusually high traffic gets detected, there’s systems that can immediately reroute all traffic, essentially cutting you off from the internet. That is an aweful idea in an MMOG or really any high traffic server, because that means that any unusually high volume of legitimate players, like after any times servers have to come down on a tuesday, will trigger the same result. And because WoW players, that would be over and over, indefinitely. Basically, if Blizzard took steps to prevent DDOS attacks, the entire game would still be down thanks to the initial surge of traffic 2 weeks ago. We would have never logged into classic.

All you can really do about a DDOS attack is let your ISP know so that they can reroute any new connections away from you, and then you just have to wait until its over.

Congratulations, you manage databases. Too bad a DDOS attack targets a server, which actually falls on the software development side. You might want to listen to him, he knows what he’s talking about. Database management is pretty much the entry level of IT.

I build Azure databases, I don’t just ‘manage’ them. You also have no idea what the hell you are talking about.

Any idiot with google and 20 minutes can build an Azure database. The complexity is in management of them. In simple terms, you’re the guy who makes layering in classic work. You do absolutely NOTHING about handling incoming requests from the internet. That’s your network administrator who 9/10 is a software developer.

I have 5 years of managing entirety IT and social media/advertising for a business where sensitive information has to be kept in constant potential reach. I think I would know that Algolagnist knows what he’s talking about. My job is to understand enough to know which of the 2 of you I’d hire to be responsible for the security of our servers. I’d also look into what a master’s in data science actually entails. Your degree does nothing for me. I need someone who understands what’s going on on my system when people connect to it and potentially attempt something like this. You work internally. I need someone who understands what makes security threats possible. I need someone who KNOWS networking. The software developer is more likely to actually be certified in network administration, or be able to obtain it NOW, than someone who studied data, which doesn’t even require a background in IT, which is why I’m kind of doubting your claims.

I do study Computer Science but this area is not my specialty, and although I suspect that there may be some complications with using a scrubbing center on a live service game, I may be wrong, so if anyone has an actual answer to that part, I’d love to hear it.

The biggest issue with this is that they don’t typically work on waiting for humans to get involved. It’s automated. What triggers it is sudden massive spikes in requests. WoW is full of those from just legitimate players logging into the game.

[Algolagnist-mankrik]

I stand by my statement. If DDOS were easy to stop, it wouldn’t be a global threat.

I want to point something out though: I’m not here to attack you. I really don’t care about you or your credentials. I’ve spent the better part of my adult life building various systems, and I can say that I’ve had the good fortune of a userbase that has been extremely positive. I can’t say the same for video games; there is an unreal amount of toxicity being spewed out in forums like this one and it’s disgusting. Try to remember: this game was built by a group of people that wanted to build something that you would love. I can promise you that this game is not trivial, and that they probably spent the better part of 5 years building it.

Try to show some respect and understand that the service provider is the victim. That’s the point of a DDOS.

[Patti-kirtonos]

continues munching popcorn

[Widdly-burning-legion]

Any idiot with google and 20 minutes can build an Azure database. The complexity is in management of them. In simple terms, you’re the guy who makes layering in classic work. You do absolutely NOTHING about handling incoming requests from the internet. That’s your network administrator who 9/10 is a software developer.

I have 5 years of managing entirety IT and social media/advertising for a business where sensitive information has to be kept in constant potential reach. I think I would know that Algolagnist knows what he’s talking about. My job is to understand enough to know which of the 2 of you I’d hire to be responsible for the security of our servers. I’d also look into what a master’s in data science actually entails. Your degree does nothing for me. I need someone who understands what’s going on on my system when people connect to it and potentially attempt something like this. You work internally. I need someone who understands what makes security threats possible. I need someone who KNOWS networking. The software developer is more likely to actually be certified in network administration, or be able to obtain it NOW, than someone who studied data, which doesn’t even require a background in IT, which is why I’m kind of doubting your claims.

I not only design the databases, I migrate, and manage them. I am also responsible for the data that these databases store. I am at an executive level and manage people under me. You have no idea what I do. You have no clue. You don’t even know what data sciences entail from you’re statement about it. It’s focused mainly on engineering data structures (databases) and how they work.

If you think this is a ‘secutiry issue’ you doubly have no idea what you’re talking about. You’re some network manager who has no idea how databasing works. Software developers are clueless in this kind of thing unless specifically learned in it too.

The whole point of distributed virtual servers is that Blizzard wouldn’t need IT sec, they are paying a third party to virtually host their servers who also handle the ‘security’ end, which by the way doesn’t need any people as it’s a baked in feature of the virtual operating systems running the server. IT is a joke, they are the people I go to and help them fix stuff they don’t understand, and people who write software too.

The field I specifically work in requires me to work with the US Army Corps of Engineers on a regular basis and I handle a ton of their data requests as well. You think your ‘social media/ad’ business is sensitive and now you know everything about security by being in that field? Cute.

[Hydaelyn-mankrik]

Just my opinion but any engineer making 6 figures probably wouldnt act like a child on a video game forum. Also if you are who you say why does every major company get hit with DDOS attacks every year if they are so easy to protect against.

[Zort-mankrik]

How long can this person/s prevent us from playing this game? A couple of days? A week? Longer? Can they put an end to WoW? Am I being over-dramatic (if I am, it is due to my lack of knowledge on this subject)?

How long can one person, or a group of people, inconvenience hundreds of thousands and get away with it?

Usually these attacks eventually peter out, and in the interim can be filtered somewhat upstream although with a lot of attacks, filtering becomes a cat-and-mouse game.

In the event that it continues for an excessively long period of time there are options for mitigation. However, cost and complexity become issues depending on the implementation. The most robust systems also aren’t exactly something that can be rolled out overnight either: by the time it’s all set up the attacker will have likely moved on to other targets anyway.

[Celessi-turalyon]

You don’t even know what data sciences entail from you’re statement about it. It’s focused mainly on engineering data structures (databases) and how they work.

Wrong. That’s database administration. Data science is what most people think a statistician does.

[Crazdor-moon-guard (Crazdor)]

The biggest issue with this is that they don’t typically work on waiting for humans to get involved. It’s automated. What triggers it is sudden massive spikes in requests. WoW is full of those from just legitimate players logging into the game.

Right, that makes sense. Although I thought that I had read the command to divert traffic to Akamai was manual, but I could have misinterpreted it or perhaps they’re just one of the few to have not automated it at that point.

What about any impact on players, though? I mean I know that not doing it would probably be worse for the players anyway, but would redirecting traffic to those centers potentially result in things like increased latency or misidentify legitimate packets as being part of the attack, resulting in more issues for the players?

[Ecobeast-area-52]

World of Warcraft Player Sentenced to Jail for DDoS Attacks Against Blizzard

[Celessi-turalyon]

The biggest issue with this is that they don’t typically work on waiting for humans to get involved. It’s automated. What triggers it is sudden massive spikes in requests. WoW is full of those from just legitimate players logging into the game.

Right, that makes sense. Although I thought that I had read the command to divert traffic to Akamai was manual, but I could have misinterpreted it or perhaps they’re just one of the few to have not automated it at that point.

What about any impact on players, though? I mean I know that not doing it would probably be worse for the players anyway, but would redirecting traffic to those centers potentially result in things like increased latency or misidentify legitimate packets as being part of the attack, resulting in more issues for the players?

I’m guessing GitHub dealt directly with their ISP on it. Most complete systems automatically redirect, but are risky for a game like this.

Basically, either you call your ISP to make them aware, or you use a company who you route the connection to your server through their server. So your .com would point to their server, and then they’d redirect users to yours.

[Widdly-burning-legion]

Wrong. That’s database administration. Data science is what most people think a statistician does.

Wrong.

Why do people feel so compelled to talk about things with authority that they have no idea about?

I am not a database administrator. The fact you think what I said describes a database admin is laughable.

Data science does have some statistics involved, but nothing to do with databases, it’s more for data analysis using languages like python and R.

What makes you so compelled to keep saying stuff off the cuff when you don’t have any idea what it is you’re talking about?

[Algolagnist-mankrik]

Wait, you’re attacking the victim and you’re a data scientist?

Dude. Give it a rest.

[Celessi-turalyon]

Data science does have some statistics involved, but nothing to do with databases, it’s more for data analysis using languages like python and R.

No. That’s database programming.

You understand that data science does not require digital data, right? It has absolutely nothing to do with the internet or computers. They’re just the most common medium for data scientists.

Again, data science is what most people think a statistician does. You know, collecting and analyzing data. Programming systems to analyze that data for you, is called database programming. Implementing those systems to organize and analyze DIGITAL data for an end-user, is called database administration.

You’re mixing 3 entirely different jobs into one.