• Please make sure you are familiar with the forum rules. You can find them here: https://forums.tripwireinteractive.com/index.php?threads/forum-rules.2334636/

Two weeks of DDOS attacks in Asia, 5 servers down to 1

international-law

FNG / Fresh Meat
Jun 14, 2019
1
1
35
Over the past two weeks, most of the popular servers in Asia have suffered daily DDOS attacks, and in one case hourly DDOS attacks. The current wave of cyber attacks started on the anniversary of the Tiananmen Square massacre and increased in severity since then. While we have experienced this before, usually around sales, events, or updates, these recent attacks have been much more devastating and continuous. We used to have over five full servers in Asia, but now only one full server remains. The attacks target servers that are full or maintaining significant player numbers. The main victims are three of the most popular communities in the area:
  1. SAK-CN servers of Shenzhen, China
  2. Bento servers of Japan
  3. SEA servers of Southeast Asia, Hong Kong

SGS's motive and evidence
During these two weeks of attacks, only one server group, SGS/MX servers of Hangzhou, China, remained unaffected. This, combined with evidence in the image gallery link, tell us that SGS/MX is behind the ddos attacks. Why do they do this? By shutting down "competing" servers with cyber attacks, players in Asia have no choice but to join SGS/MX servers, keeping their server full. They are also infamous for doing this in RO2/RS1, and they still dominate the Asian servers today, and have done so for years.

SGS/MX servers are located furthest North. Their distant location, combined with the great firewall of communist China, means that players in Japan and SEA will have worse ping in SGS/MX servers. The maps in the gallery link illustrate the affected countries and their respective ping when connecting to SGS/MX and SEA servers. These maps only show the data for SEA and SGS because SAK-CN has the same data as SGS/MX minus 50 to 80 ping as they are in the southernmost part of China, and Japan has a ping limit so their servers are mostly local. SEA servers have a central location so they can draw in a large and diverse community. In SEA discord and steam chat we have over 200 members from over 10 countries.

AVZxTBB.png


We have further evidence that SGS/MX is behind the attacks. A friend on the inside has sent us a shot of this conversation where they ask about shutting down SAK and Hong Kong servers (SEA). The SGS admin replied that they will indeed hit Hong Kong, and regularly clean out Japan and Hong Kong servers.
5NKe9uS.png

















Death of SAK-CN, Bento-Jp, SEA-HK
The attacks increased in frequency on Sunday 6/9, shutting down SAK-CN, Bento-JP, and SEA servers, leaving only SGS/MX servers online, and the same thing happened on Tuesday. The main SEA servers, SEA1 and SEA2, were hit over 20 times from Sunday 6/9 until Wednesday 6/12. Since SEA1 and 2 could not survive the attacks, on Wednesday we set up SEA3, a new server with DDOS protection that's also slightly further away from China. Immediately after we set up and joined the server, DDOS attacks began. The DDOS protection sort of worked, but every hour on the hour ping would spike up by 100-200 for three to five minutes. So while the server wasn't crashing, the hourly lag spikes would clear out a lot of players anyway. After holding out against the hourly attacks for two days, SEA 3 was eventually hit with a stronger attack, not on the same schedule as the hourly attacks, and finally crashed at 9:45pm 6/13.

qRVOASU.png


Now in the evening here in Asia when I look at my server browser, there is only one SGS/MX server. This time three weeks ago, you'd easily find five full servers in Asia. If the situation isn't solved soon, there very likely won't be anyone regularly playing this game in Asia. Considering all the time, money, and energy that we in the SEA community have invested in setting up these servers for ourselves, this is really damn frustrating. We've spoken to Molly but unfortunately that didn't go anywhere, and we continue to sit here looking at these empty servers, while all the 200 people in the rs2v SEA community, as well as all the other players in Asia, have no choice but to play different games. Looks like it will be a second weekend in a row we can't play. You've helped us with one toxic server, we need help again. In the past two week's the player count in Asia has gone down by some 70% because of another toxic server.
 
  • Like
Reactions: Atomskytten