This exploit crash service showcases our experience being crashed!
We are being CRIPPLED by these attacks happening over the past few weeks now, please do something to protect our experiences!
Experiences devastated by these attacks:
( ✦ ) De Pride Isle Sanatorium - Roblox
( ✦ ) Les Beyond East - Roblox
Expected behavior
An advanced form of protection given to us as respite for these merciless crash attacks!
A private message is associated with this bug report
You should provide links to the experiences in question for engineers; either in the private message or publicly
I hate how not only do they show you how to ruin players experience they use the worst beat ever
But in all seriousness, this thing sucks
Yeah.. Kaddins have been doing this on Roblox for a decade, Roblox doesn’t do much about them though. There’s quite a few groups of people like that and they’ve done even more evil/illegal things in the past.
I will not accept this kind of defeatist resignation any longer!!! This isn’t just about our community! it’s about countless smaller creators whose work is being destroyed by malicious actors like these!
If Roblox is truly a platform that champions innovation, imagination, and user driven worlds, then this cannot be allowed to continue!
Carnage Services and similar crash networks must be stopped. Not “eventually” but NOW!
The culprits have intensified their crash attacks after I made this post! Here are more crash logs as proof!
I refuse to be a helpless victim here and will use my voice to stand up for others as well! Ah!
From what I can see from these screenshots, this is a vulnerability on your end, there’s not a whole lot that Roblox can do.
There are a few things you can do to try and stop this, mainly sanity checks on your remotes
local CheckHandler = function(Player, ...)
local Args = {...}
local Success, Error = pcall(function()
local ArgSize = #HttpService:JSONEncode(Args)
if ArgSize >= 5000 then
Player:Kick("Remote Crash Attempt")
end
end)
if not Success then
Player:Kick("Invalid UTF8")
end
end
local OnRemoteAdded = function(Remote)
if Remote:IsA("RemoteEvent") then
Remote.OnServerEvent:Connect(CheckHandler)
end
end
for _, inst in ReplicatedStorage:GetDescendants() do
OnRemoteAdded(inst)
end
ReplicatedStorage.DescendantAdded:Connect(OnRemoteAdded)
This code connects to all your remote events and checks if the remote has been sent alot of data, which happens in game specific ddos’s. Although for any remote functions you’ll have to check this manually since they use OnServerInvoke
local CheckHandler = function(Player, ...)
local Args = {...}
local Success, Error = pcall(function()
local ArgSize = #HttpService:JSONEncode(Args)
if ArgSize >= 5000 then
Player:Kick("Remote Crash Attempt")
end
end)
if not Success then
Player:Kick("Invalid UTF8")
end
end
RemoteFunction.OnServerInvoke = function(Player, ...)
if not CheckHandler(Player, ...) then
return
end
end
You should also have a rate limit for all your remotes like this and validate everything you expect to be sent using Rules. Finally you can use DataSendKbps to see how much data a player is sending anything above 500 is suspicious (client side).
If none of this helps then you’ll need to try and get UDMUX servers which have built in ddos protection done by Roblox.
I would advise against using JSONEncode to check the size of arguments, as it’s much slower than using the respective __len operator of the type (or buffer.len in the case of buffers), and could potentially be a crash/lag vulnerability itself if encoding a large value.
I don’t know what arguments they’d be sending or the amount but yes it would be better to use something like
local function ValidatedRemote(Callback, Validator)
return function(Player: Player, ...)
local Success, Message = Validator(...)
if not Success then
return Player:Kick("Bad parse")
end
return Callback(Player, ...)
end
end
RemoteEvent.OnServerEvent:Connect(ValidatedRemote(function(Player, String)
print(String)
end, Rules.Set(
Rules.All(
Rules.String, -- Check if it's a string
Rules.ValidUTF8, -- Check if it's valid UTF-8
Rules.StringLength(256) -- Check if string length is <= 256 characters
)
)))
task.spawn(function()
while task.wait() do
for _, v in game.ReplicatedStorage:GetDescendants() do
task.spawn(function()
if v:IsA("RemoteFunction") then
v:InvokeServer()
elseif v:IsA("RemoteEvent") then
v:FireServer()
end
end)
end
end
end)
it wont be a issue when the server receiving this, its just because doing bad practice on remotes
claim of DDoS attacks
look inside
games with tons of vulnerabilities
Every single time.
Not a bug, not a Roblox issue, this is just lazy Devs.
(De Pride has had an uncountable amount of vulnerabilities for years now. Even multiple years before Byfron was a rumour De Pride has had tons of issues they never bothered fixing)
from my understanding isn’t this literally like entirely able to be mitigated with like less than 10 minutes of work by just checking the data sent
You guys didn’t watch the video, this service is well known and if you look at the video you can see that it’s indeed a denial of service, not an exploit.
The reason for the instructions in the video (joins on and not a full server) is to retrieve the place launcher URL which can then be resolved to extract the join ticket which contains information about the server (server IP and active port for that gameserver), this is then passed through a stresser (probably some mass DigitalOcean bot farm), and effectively kills the Roblox server due to stuff like timeouts.
A normal exploit cannot seamlessly take out a server like that, either the exploiter would receive high ping from the outgoing and incoming receiving, or the server would gradually become laggy (and FPS would be affected as well in most cases)
@Valindra I recommend you either message support or try and get into contact with DevRel about upgrading your servers to UDMUX like how @XoifaiI said, targeted DDOS attacks are quite literally impossible to prevent especially in your game which has a large player fill count, hence only 2-3 servers run at once making it an easy target.
I’m sure with enough conversation they’ll switch your server type, good luck!
All Roblox game servers are DDoS protected:
And most if not all already use UDMUX:
From the screenshots the OP posted, you can tell they’re spamming a remote – likely with a large table that the server does a lot of work on (which then hangs the entire server as a result). I strongly doubt this is an issue on Roblox’s end.
Literally the first reply after what you linked happens to show that this panel service is still rampant in their attacks. From the video filmed no external tools were used aside from the discord bot showcased that resolves the server IP and port via the join ticket and then sends it through a stresser.
Think an engineer is needed to verify what’s actually going on here, also, is it actually documented anywhere what UDMUX even does? I’m aware it’s some kind of proxy to mitigate denial of service attacks but from what I saw it’s private technology with zero documentation (maybe on purpose?)
Whatever the case may be it’s quite unlikely that what’s going on isn’t a DDOS, this service has been around for a few years but as I said no real way to confirm. @Valindra always good to give remotes a good check just incase, couldn’t hurt. 
Again, OP themselves show logs of a certain remote being spammed with a table by two attackers.
UDMUX does seem to be some sort of proprietary protocol/protection implemented by Roblox.
The video does not show any details of what the attack actually does (it only shows the bot and the server crashing). If this were such a widespread issue and not isolated cases of poorly written netcode being exploited we’d probably see more reports and action from engineers.
If Roblox staff say servers have DDoS protections and the screenshots show logs of remote exploitation – then it’s likely not a DDoS attack and more likely a case of remotes being exploited.
An engineer verifying what’s happening here would be appreciated of course, but given the screenshots (which also shows some questionable practices such as invoking the client with a RemoteFunction), I’d say it’s safe to assume it’s not an issue on Roblox’s end.
It actually is related to Adonis Admin, so really Adonis admin needs to fix this themselves
Imagine writing an essay to double down on how wrong you are.
OP themselves posted image proof it’s literally just remotes in the game being fired by exploiters.
Incase that wasn’t the most concrete evidence possible, you’re also forgetting that this issue is literally only in this single digit amount of games which are extremely poorly coded. You’re not seeing grow a garden complain about DDoS attacks are you?
Why would grow a garden complain about DDOS attacks? Thousands of servers that regenerate faster than you can take them offline?
It seems like in your reply you have a personal vendetta with the game and it’s past security, but you missed the fact that remote spam on vulnerable remotes does not instantly kill a game (like shown) for a multitude of reasons.
As another poster and myself said, until an actual engineer responds there is no way to tell what is going on, but regardless OP should try and secure their game wherever needed