DDoS attacks (GvG mAT issues?)

bursta91

Krytan Explorer

Join Date: Nov 2008

Canada

Gangsters In The [HooD]

Rt/

For people that haven't heard there is a link to an image that looks like an imageshack link which takes record of your I.P. Once the "Serbs" have that, somehow they are able to know whose IP is whose and disconnect players at their will via a DDoS attack.

With that brief overview and some wiki'ing of DDoS you are probably curious where this is taking place.
Earlier this week an unknown guild Dont Mess With The Serbian [Don] won the highly competitive American aT. The reason behind this was due to dc's. Little did anyone know the dc's were caused by those players.

I know the first round of bans have come about, however with the mAT tomorrow, they can still decide indirectly who wins what match and ultimately receives the coveted May Gold Trim.

I figured I would post this here because of known presence of Guild Wars I live team on this subforum and if/what/how they are addressing this.

deluxe

deluxe

Desert Nomad

Join Date: Feb 2006

Monkeyball Z

S.K.A.T. [Ban]

Mo/

Restart your routers, change your IP adresses. Keep fingers crossed that keeps them off your tail...

Nilator

Nilator

Jungle Guide

Join Date: Dec 2005

Mo/

That is wild...
Forcing DC's to win Tournament reward points?
People step to some pretty low levels to win stupid stuff.

And btw, these people would have much better success if they, say, I don't know, did something useful with their skills and disconnect anyone who tries to upload Justin Bieber to youtube.

Elnino

Elnino

Wilds Pathfinder

Join Date: May 2008

In a house

Proof Of A Nets Laziness[HB]

A/W

Yea I have noticed this too while watching on obs. Their mesmer is also reliably interrupting fast-casted skills.

deluxe

deluxe

Desert Nomad

Join Date: Feb 2006

Monkeyball Z

S.K.A.T. [Ban]

Mo/

This goes way beyond botting, these are illegal activities in most countries.
I hope ANET can adress these issues and perma ban everyone in this guild, and every IP adress that was in it.
These players should never ever be allowed to play guildwars again, neither on secondary accounts.
It is very dangerous to have such players messing around with other people's connections.

Aba

Aba

Wilds Pathfinder

Join Date: Dec 2006

Vancouver,Canada

This is interesting....
Im more interested as to how these people are going about getting a hold of these individual IP's
More info regarding DDOs for those who do not know about it.

http://en.wikipedia.org/wiki/Denial-of-service_attack

Elnino

Elnino

Wilds Pathfinder

Join Date: May 2008

In a house

Proof Of A Nets Laziness[HB]

A/W

From what I've heard, they got the top players IP's by sending them a URL with an image of a necro in RA.

Mesmers Are Bad

Academy Page

Join Date: Aug 2008

NJ

RoCk

Me/

Quote:
Originally Posted by deluxe View Post
This goes way beyond botting, these are illegal activities in most countries.
I hope ANET can adress these issues and perma ban everyone in this guild, and every IP adress that was in it.
These players should never ever be allowed to play guildwars again, neither on secondary accounts.
It is very dangerous to have such players messing around with other people's connections.
The only trouble with that plan is that if these guys are good enough to do the stuff cited, an IP ban would be nothing to them. :/

byteme!

byteme!

Forge Runner

Join Date: Jan 2006

On Earth

W/P

Quote:
Originally Posted by deluxe View Post
This goes way beyond botting, these are illegal activities in most countries.
I hope ANET can adress these issues and perma ban everyone in this guild, and every IP adress that was in it.
These players should never ever be allowed to play guildwars again, neither on secondary accounts.
It is very dangerous to have such players messing around with other people's connections.
Agreed with the above. These perpetrator's are probably reading this and having a blast.

Aba

Aba

Wilds Pathfinder

Join Date: Dec 2006

Vancouver,Canada

Quote:
From what I've heard, they got the top players IP's by sending them a URL with an image of a necro in RA.
I actually said this very thing in ally chat....I figured it would be how the obtain'd them.....
Either way, Cheating in a game I can careless when your doing it on ur own closed system .......but when you take it online and influence other players gaming experience You have taken it to far.

xhappy feetx

Wilds Pathfinder

Join Date: Oct 2007

Isle of the Nameless

Black Crescent [BC] / Stonebenders [sC] / The Rimmers [rR]

W/E

Quote:
Originally Posted by Elnino View Post
From what I've heard, they got the top players IP's by sending them a URL with an image of a necro in RA.
Yep, they sent it out to all of us and they would name the image after our name so they could track when we accessed it, for me it was /happy, etc.

Anet is dealing with the guild but I would recommend all affected to take the needed precautions.

Chthon

Grotto Attendant

Join Date: Apr 2007

Quote:
Originally Posted by Aba View Post
This is interesting....
Im more interested as to how these people are going about getting a hold of these individual IP's
More info regarding DDOs for those who do not know about it.

http://en.wikipedia.org/wiki/Denial-of-service_attack
OP explained it. The image is on a server that they own/control. When someone views it, they have to download it first, and that leaves a record in the server logs. The tricky part is getting the person to view the image in the first place. Just posting it on forums or something will not tell you if the desired person saw it. You'd have to do a forum PM or e-mail directed to the one person whose IP you want to learn. So, there's a clue as to who's doing it and how to protect yourself: personal communications from unknown Serbians should be deleted unread (and possibly reported to a-net and/or local authorities if they care about minor cybercrime).

(Now if only I could convince Taurun that this situation is marginally but unequivocally better than simply telling the Serbian your IP, that would settle a different, slightly related, argument...)

Spiritz

Forge Runner

Join Date: Apr 2007

DMFC

Quote:
Originally Posted by Chthon View Post
OP explained it. The image is on a server that they own/control. When someone views it, they have to download it first, and that leaves a record in the server logs. The tricky part is getting the person to view the image in the first place. Just posting it on forums or something will not tell you if the desired person saw it. You'd have to do a forum PM or e-mail directed to the one person whose IP you want to learn. So, there's a clue as to who's doing it and how to protect yourself: personal communications from unknown Serbians should be deleted unread (and possibly reported to a-net and/or local authorities if they care about minor cybercrime).

(Now if only I could convince Taurun that this situation is marginally but unequivocally better than simply telling the Serbian your IP, that would settle a different, slightly related, argument...)
Actually in webhosting ( or to say having your own website ) a visitor doesnt even have to download anything - when a person visits the website their ip can be found so easily via cpanel etc.
Im not going into details but anyone who have done thier on website , used cpanel etc will follow what i mean and if you look at me all i am in comparison to a hacker is im nothing - i only know a lil bit of webhosting etc and thats the end of what i know.But getting the ips is even possible for me because theres so many simple ways without going into the realms of hackers and ip sniffers etc.

Its sad where theres a game for enjoyment and theres people who seem to have the intelligence to hack but seem to lack intelligence to be able to play the game at all without hacking.

hattara

Academy Page

Join Date: May 2009

Finland

Blinkie Ponie Armie [BPA]

R/

Quote:
Originally Posted by Spiritz View Post
Actually in webhosting ( or to say having your own website ) a visitor doesnt even have to download anything - when a person visits the website their ip can be found so easily via cpanel etc.
When someone visits a website, that means they ARE downloading something - that is, the website itself. That's the reason cpanel etc. have a record of them: because they downloaded the HTML (or other) file of the website to their computer.

kedde

kedde

Wilds Pathfinder

Join Date: May 2007

Kaons Banned Fecal Super Team [Ban]

Mo/A

The logical step is for someone with thourough knowledge of this to set up a stickied thread on how to possibly protect yourself against it. Change IP etc.

Killed u man

Forge Runner

Join Date: Feb 2006

There are alot more interesting ways to get people's IP's than through some image link. QQ forums, for example, would be an enormous database containing pretty much every top GvG player's IP from their latest posting.

The fact they're using the image method makes me believe they themselves haven't got a clue what they're doing, and just followed the first "How to DDoS someone" guide on the internet.

As for protecting yourself against it:

There is some protection you can take (afaik) by shutting down certain microsoft service and closing ports, but if it were that easy, major websites wouldn't get ddos'd.

In other words: there isn't a waterproof protection against ddos'ing, if there were it wouldn't be such a widely known phenomena.

Still Number One

Wilds Pathfinder

Join Date: Jun 2008

W/

Apparently some people affected by this have changed their IP's and still have been getting DoS. Also, A.Net apparently banned them but they came back with a new guild, and new accounts. Also, some players who clicked their link claim to have been banned as well. So apparently changing your IP address doesn't work, banning them hasn't kept them away, and A.Net has been consistent with banning innocent players who were victims to this attack.

Do people really have this terrible of a social life that they have to attack other people just to win in a 6 year old game?

God Amongst Many Mortals

Ascalonian Squire

Join Date: Feb 2011

WHAT

Rt/A

This is BS i have played them manny times and beat them a few. They have a mes bot but this DC seems to go a bit far, it was very common for teams to not make it into AT's because there is a very short connection time out to aviod cheating. sorry but this is just you sulking after being beating or losing...

deluxe

deluxe

Desert Nomad

Join Date: Feb 2006

Monkeyball Z

S.K.A.T. [Ban]

Mo/

Quote:
Originally Posted by God Amongst Many Mortals View Post
This is BS i have played them manny times and beat them a few. They have a mes bot but this DC seems to go a bit far, it was very common for teams to not make it into AT's because there is a very short connection time out to aviod cheating. sorry but this is just you sulking after being beating or losing...
If it was all nonsense, then why would arenanet ban them all?
I'm sure anet went trough chatlogs etc to see what was going on.
They won't just randomly perma people.

Yes, I know there were some innocents hit with the ban because they linked the url to others.

Artisan Archer

Artisan Archer

Wilds Pathfinder

Join Date: May 2007

Free Wind

R/

Ddos attacks during the mAT continued. At least 2 players were dc'ed in the first round due to it.

ErrantVenture

Krytan Explorer

Join Date: Nov 2010

Social Darwinism [SaD]

A/W

Quote:
Originally Posted by Artisan Archer View Post
Ddos attacks during the mAT continued. At least 2 players were dc'ed in the first round due to it.
Far more than that, it's happening to most all of the american guilds. Looks like mAT = down at this point =\

Killed u man

Forge Runner

Join Date: Feb 2006

People have been DC'ing during mAT's since the start. It's amazing how only recently the GvG community smelled something was off.

Divine Slaya

Frost Gate Guardian

Join Date: Sep 2005

Young Money Merger [YM]

Mo/

Quote:
Originally Posted by Killed u man View Post
People have been DC'ing during mAT's since the start. It's amazing how only recently the GvG community smelled something was off.
Regardless of whether or not DoS attacks have been used in the past, the current attacks are much more aggressive, occur more frequently and will be used during AT's whether or not they are fighting you.

Like many people posting in this thread, I was very skeptical myself when it started happening to my guild. After a week of dealing with the same reoccurring internet connectivity issues at "convenient" times during AT's, it became obvious that foul play was involved.

I was able to change my IP and have not been targeted since then. Whether or not it has worked, it's unfortunate that there are many people that live on campuses or apartment complexes that are unable to change their IP.

Quote:
Originally Posted by oscarmk View Post
This applies for a class action law suit.
Would love to see something happen but I frankly don't believe it would be possible. We are dealing with people living in another country without any hard evidence. I installed a network protocol analyzer on my machine but I highly doubt they are dumb enough to use their normal IP's.

CE Devilman

CE Devilman

Wilds Pathfinder

Join Date: Jul 2006

hell

Do U Trust Anet

N/Mo

anybody got a link to the official statement..!

are U sure its not just the pvp+event its making the lag spike..!

9 rings afk´s and cupcake farmers..oh and 6th years tonic

hell..got 2 007 kicks in rata sum a day ago..and all D1 rata sum..and alliance.
to play high end pvp is just a bad ide right now.

even now it takes time to map out.

UnicornStampede

Frost Gate Guardian

Join Date: Mar 2011

Quote:
Originally Posted by CE Devilman View Post
anybody got a link to the official statement..!

are U sure its not just the pvp+event its making the lag spike..!

9 rings afk´s and cupcake farmers..oh and 6th years tonic

hell..got 2 007 kicks in rata sum a day ago..and all D1 rata sum..and alliance.
to play high end pvp is just a bad ide right now.
When you have a pattern of guilds dcing vs one particular guild and that particular guild isn't dcing. you have ddosing.

Divine Slaya

Frost Gate Guardian

Join Date: Sep 2005

Young Money Merger [YM]

Mo/

Quote:
Originally Posted by CE Devilman View Post
anybody got a link to the official statement..!

are U sure its not just the pvp+event its making the lag spike..!

9 rings afk´s and cupcake farmers..oh and 6th years tonic

hell..got 2 007 kicks in rata sum a day ago..and all D1 rata sum..and alliance.
to play high end pvp is just a bad ide right now.

even now it takes time to map out.
There is a big difference between erroring out of Guildwars and your internet connectivity taking a crap.

CE Devilman

CE Devilman

Wilds Pathfinder

Join Date: Jul 2006

hell

Do U Trust Anet

N/Mo

link to the official statement that GW got a Ddos.

If all of your friends jumped off the Brooklyn Bridge, would you? If you happen to be a lemming, unfortunately, the answer is a resounding "YES."

Divine Slaya

Frost Gate Guardian

Join Date: Sep 2005

Young Money Merger [YM]

Mo/

Quote:
Originally Posted by CE Devilman View Post
link to the official statement that GW got a Ddos.

If all of your friends jumped off the Brooklyn Bridge, would you? If you happen to be a lemming, unfortunately, the answer is a resounding "YES."
There will be no "official statement". These attacks have little to do with Anet outside of people spreading bad links in game. Not sure where you are trying to go with the Brooklyn Bridge thing...

LifeInfusion

LifeInfusion

Grotto Attendant

Join Date: May 2005

in the midline

E/Mo

I don't know if the DDOS is based off static IPs (cable), but if you reset your router and your ISP uses PPPoE (FiOS, DSL) your IP changes.

It's a big problem for comcast users.

Divine Slaya

Frost Gate Guardian

Join Date: Sep 2005

Young Money Merger [YM]

Mo/

Quote:
Originally Posted by LifeInfusion View Post
I don't know if the DDOS is based off static IPs (cable), but if you reset your router and your ISP uses PPPoE (FiOS, DSL) your IP changes.

It's a big problem for comcast users.
Every person that I have played with that has been attacked has had a static IP address that cannot be changed with a simple modem/router reset.

jamal555

Frost Gate Guardian

Join Date: Sep 2005

and as always if u really want to be safe from ddos attacks... get some proper router that can sense and ban addresses attacks are coming from...

its really common sense in todays world...

and lets face it, before u tell me that u cannot defend against every ddos attack out there...

true, but think who is attacking you and at what lvl of knowhow...

kids that play gw dont have skills to pull of sophisticated attacks like the ones cnn or sony etc are getting hit by...

so... any moderate 40$ firewall or old unused pc that can run linux can be setup to defend u against those kinds of attacks...

so if its really true what u say about ddos taking place atm at mat... not really that i noticed but ok... well wait for the finals and find out...

u must agree with me that if no1 dc's in the top 8 final matches that theory has no ground and its a empty qq...

and btw... ppl dc every day in HA... every day i get atleast 7-8 dc's from ppl in my party... random ppl, random countries, random times... mostly at the start at zaishen...

omg... zaishen are ddos-ing us... anet doesnt want anyone else to get r15... what do e do... what do we do... its the end we are all doomed... qq more...

Nekodesu

Nekodesu

Wilds Pathfinder

Join Date: Oct 2009

Quote:
Originally Posted by jamal555 View Post
and as always if u really want to be safe from ddos attacks... get some proper router that can sense and ban addresses attacks are coming from...

its really common sense in todays world...

and lets face it, before u tell me that u cannot defend against every ddos attack out there...

true, but think who is attacking you and at what lvl of knowhow...

kids that play gw dont have skills to pull of sophisticated attacks like the ones cnn or sony etc are getting hit by...

so... any moderate 40$ firewall or old unused pc that can run linux can be setup to defend u against those kinds of attacks...

so if its really true what u say about ddos taking place atm at mat... not really that i noticed but ok... well wait for the finals and find out...

u must agree with me that if no1 dc's in the top 8 final matches that theory has no ground and its a empty qq...

and btw... ppl dc every day in HA... every day i get atleast 7-8 dc's from ppl in my party... random ppl, random countries, random times... mostly at the start at zaishen...

omg... zaishen are ddos-ing us... anet doesnt want anyone else to get r15... what do e do... what do we do... its the end we are all doomed... qq more...
Honestly you sound like a one of the Serbian trying to make the topic go, off topic. x) Or a troll. I dunno. Either way, I know a couple of people who could easly hack others account if they wish to use their knowledge for that, that play Guild Wars.

I think it's pretty serious, you obviously don't? Well, I hope this gets sorted out. And I agree on banning them all, perma bann. Don't mess with dhuum?

FoxBat

Furnace Stoker

Join Date: Apr 2006

Amazon Basin [AB]

Mo/Me

Quote:
Originally Posted by God Amongst Many Mortals View Post
This is BS i have played them manny times and beat them a few.
They only bother to collect IPs from people they would otherwise expect to lose to.

LifeInfusion

LifeInfusion

Grotto Attendant

Join Date: May 2005

in the midline

E/Mo

Quote:
Originally Posted by Divine Slaya View Post
Every person that I have played with that has been attacked has had a static IP address that cannot be changed with a simple modem/router reset.
A lot of cable users then

TheGizzy

TheGizzy

Krytan Explorer

Join Date: Oct 2010

A giant mitten

TeAe

E/R

Quote:
Originally Posted by LifeInfusion View Post
A lot of cable users then
One thing players with router/modem setups can do is to change the MAC address on their router (or their computer if hooked directly into the company-provided modem). This will force the ISP to automatically assign a new IP address to that router/computer. That's one work-around for those who are with cable companies who seem to issue eternal leases (like mine). I had to roll my MAC address three times to get around the ongoing connectivity issue across the AT&T hop in Dallas that's blocking connections to NCSoft servers.

It's obviously not going to work for those on external networks like colleges, apartment complexes, etc. but anyone running on a home network with admin access to the router should be able to do it.

Hells Fury

Hells Fury

Krytan Explorer

Join Date: Aug 2009

W/D

Quote:
Originally Posted by Still Number One View Post

Do people really have this terrible of a social life that they have to attack other people just to win in a 6 year old game?
And with this statement the idea of law suit goes down the drain.
I wouldn't expect any legal action to be taken vs this event.

Quote:
Originally Posted by TheGizzy View Post
One thing players with router/modem setups can do is to change the MAC address on their router (or their computer if hooked directly into the company-provided modem). This will force the ISP to automatically assign a new IP address to that router/computer.
Also this.

don richardos

Academy Page

Join Date: Jun 2007

The Netherlands

De Snowball Boot[HoHo] / Two Thousand Eleven[Pzz]

R/Me

Quote:
Originally Posted by deluxe View Post
Yes, I know there were some innocents hit with the ban because they linked the url to others.
Well, im 1 of those

i link the url into ally chat to check if others had the same, i say'd do not go to this site, still got perma'd..

lets hope they unban the people who got it just by showing a ally/friend what he got, and that they ofc ban/ip ban those people who are trying to DDoS in 2k11 to try and win ladder/at matches (LOL)

xhappy feetx

Wilds Pathfinder

Join Date: Oct 2007

Isle of the Nameless

Black Crescent [BC] / Stonebenders [sC] / The Rimmers [rR]

W/E

Don the banned accounts are being looked into don't worry.

Chthon

Grotto Attendant

Join Date: Apr 2007

Quote:
Originally Posted by jamal555 View Post
and as always if u really want to be safe from ddos attacks... get some proper router that can sense and ban addresses attacks are coming from...
Unfortunately, no. The attack works regardless of what your router does with the packets. Whether it forwards them to your PC or simply drops them, it is spending processor cycles deciding what to do with them in the first place. Send enough packets to it and the router won't be able to sort them in real time, and the packets from the game server will be lost in the shuffle.

refer

refer

Jungle Guide

Join Date: Jan 2009

US

Can't they just take way the trim and give it to the runner up?

Or, if this is such a problem, will it see widespread use?