EVE General Discussion

Happy New Year!

May yours be filled with pew pew and many explosions!

DDoS is nothing...compared to playing EVE for many hours straight, getting up and then finding yourself orbiting your kids to avoid bumping into them!

The break is actually worth it and makes one realise there is an outside world lol.

Good work CCP...pew pew them hackers!

Sal

I'm an independent security analyst and it is very difficult to "trace" someone who performs a DDoS attack, indeed, it's quite difficult to trace any hacker unless they get sloppy. Here's why.

The first D in DDoS stands for Distributed. A "Distributed Denial of Service". To explain this simply, a botnet or zombienet of infected computers all around the world sit and wait for instructions from a single command and control machine. They are given a target and then they attack. These are often personal private pc users and laptop owners who have no idea their machine is infected to begin with, so assuming that the thousands of IP addresses sending malicious traffic are the actual addresses of the hacker(s) is completely incorrect. "Distributed" means it's coming from everywhere all at once, and not directly from the hacker's command box.

It *might* be possible to trace where the command instructions came from IF an investigator's box is infected with that particular zombienet ID and recorded the incoming command instruction. Unfortunately, even that is no guarantee, as any hacker worth his weight in dogcrap will send the signal through a logless proxy chain, making "tracing" virtually impossible.

There is little that can be done against DDoS in conventional means from within the organization, especially with the way that MMO server farm infrastructure is arranged. Usually, it is the service provider which must attempt to handle the problem. Sometimes, networks will route traffic over redundant links to mitigate some of the trouble, and often, the border routers can be reconfigured with information gained from packet sniffers. A security analyst should be able to get a good idea of the attack characteristics and write a detection rule that can be applied to security devices to help mitigate the attack.

Probably the best out there, but sometimes expensive, is a method called Customer Triggered Blackholing. What this does is combines Intrusion Detection algorithms with automated scripting to detect the attacking IPs and "blackhole" them by rerouting them dynamically to a non-existent IP - making the routers on the hop ignore and drop the packets instead of pass the traffic on.

About 3/4 through Tuxford's button with the huge sign over saying "do not press this button" starts to feel more like a challenge.

Went to log into the forums at work and noticed I couldn't connect.

Thanks for providing eve-offline Chribba.

They probably just need a hug.

No SP pse. Thank you. Oh and happy new year you hard working Icelandic pixies.

DERP‏

feds seized the last few machines and now we're on the run

Hopefully it all gets seized as proceeds from crime.



I had the same issue, and couldn't even log into the forum. Flushing DNS didn't help (I assumed they got around the DDoS by re-directing or changing the IP of the login server), but that didn't fix it. For some reason it worked after a reboot though. Go figure.

Given that Twitch knowingly allowed a channel to encourage this attack - I hope CCP is dropping their integration in a patch ASAP.

Greetings!

I seem to be having problems with accessing my accounts from my home but seem to have no issues behemoth using my phone. I live on the West Coast of the USA.

Here are some more details of what is going on.

If I try and login from the launcher I get an error 101 and a super long URL link.

If I try and bypass the launcher by utilizing the execution file in my eve folder I can get to the character selection screen and select a character but as soon as I see the eve mail notification I immediately get "lost connection to socket"and thrown back to desktop or back to the bypass login screen.

I have tried the repair tool, restarting all of my equipment, checked the firewalls and as far as I can tell nothing wrong on my end. So I wonder if it has something to do with the earlier ddos attack. Because everything was working fine yesterday.