Summary
For the last few weeks, our games servers have been targeted by Distributed Denial-Of-Service (DDOS) attacks by exploiters who have payed to access services to bypass UDMUX DDOS prevention; we have some extra information regarding this. These attacks have appeared to come in waves during certain times of day. Additionally, we have been asked to pay a ransom at the very start of when these attacks started.
These have been extraordinarily detrimental to players within our community, we also have some slight information regarding the origin of the attacks.
We’ve done a lot of internal research into our games mechanics and have not located any significant vulnerabilities within our codebase.
What we’ve tried
We have ruled out the following possibilities:
- Remote Event Spam
- Remote Function Spam
- MessagingService Vulnerable Functions
- Backdoors & Harsh Code
- 3rd Party API related functions
Additionally we have checked:
- ScriptProfiler
- LuaHeaps & Server Memory
- Network Statistics
Extra Notes
We have also detected a strong relationship between when our servers have been crashing and the MessagingService API.
This may likely possibly be related. In our game (including places) there’s only 2 occurrences of us using the MessagingService, which are out of reach, and both very protected & watched. In our dashboard, PublishAsync requests can be seen going from an average of 0 over a day, to a multiple hundred publish requests. On the other side, we have noted a total of 0 of received messages across our game during any of these attacks. This may be an in-direct relation, but it’s something to note.
We hope to find a solution and be able to restore some peace within our community and bring it back to normal soon!
A private message is associated with this bug report
