GrumpyMuffin wrote: »

24 hours is fair enough, but nearly a week suggests bigger network issues

Giles.floydub17_ESO wrote: »

GrumpyMuffin wrote: »

dday3six wrote: »

A DDOS isn't something that's stopped by a firewall. It's not like typical malware or anything like that. It's done in many ways, but one of the most common is thousands of bots posing as legit users, all trying to login at the same time, and clogging the server. That's not something a firewall can protect against.

Almost all big websites and games get hit by ddos each day, yet they manage to avoid keep going down like this game does.

@GrumpyMuffin

Your comment is correct where it comes to the run of the mill ddos attack. Not all are run of the mill.

I guess few remember PayPal and other major commerce sites taken down by a DDOS attack. The location attack has significantly stronger prevention systems than Zos would expect to have. Yet the were significantly hindered for much of the day.

RinaldoGandolphi wrote: »

To chime in!

Its not true there is nothing you can do about DDOS attacks...Blizzard and EA not being able to do anything about a DDOS attack is just showing the incompetence of their network engineers, and the unwillingness of upper management to commit reasonable resources for threat mitigation.

Each DDOS attack is handled differently depending on if its a web site or a game service, etc....

The best ways to deal with DDOS is?

1. Bandwidth Oversubscription - This one is fairly straightforward. As you grow larger, your bandwidth costs drop. Generally large organizations will lease a significantly larger capacity than they need to account for growth and DDoS attacks. If an attacker is unable to muster enough traffic to overwhelm this, a volumetric attack is generally ineffective.

2.Automated Mitigation - Many tools will monitor netflow data from routers and other data sources to determine a baseline for traffic. If traffic patterns step out of these zones, DDoS mitigation tools can attract the traffic to them using BGP or other mechanisms and filter out noise. They then pass the clean traffic further into the network. These tools can generally detect both volumetric attacks, and more insidious attacks such as slowloris.

3.Upstream Blackholing - There are ways to filter UDP traffic using router blackholing. I've seen situations where a business has no need to receive UDP traffic (i.e. NTP and DNS) to their infrastructure, so they have their transit providers blackhole all of this traffic. The largest volumetric attacks out there are generally reflected NTP or DNS amplification attacks.

Third Party Provider - Even many fairly large organizations fear that monster 1 petrabye attack. They often implement either a DNS-based redirect service or a BGP-based service to protect them in case they suffer a sustained attack. I would say CDN providers also fall under this umbrella, since they can help an organization stay online during an attack.

System Hardening - You can often configure both your operating system and your applications to be more resilient to application layer DDoS attacks. Things such as ensuring enough inodes on your Linux server to configuring the right number of Apache worker threads can help make it harder for an attacker to take down your service.

Simply put, in ZOS cases, if they are having problems with DDOS I would recommend them to increase their bandwidth available by about 500%(More you have harder it is to flood your services) and also pay for Black Lotus. Black Lotus was recently acquired by Level 3 communications, they are traffic scrubbing, designed to mitigate DDOS attacks. There are other services besides Black Lotus/Level 3 that offer similar services.

there are many things you can do to mitigate or stop DDOS attacks on your network, it just depends if your willing to invest the resources to do it.

Saying you can do nothing is simply not true