[UartigZone]

Hello,

My server host have been attacking with VSE flood.
CS:GO Server
We have 750 Gbps DDoS Protection.

Then the attack come, its just killing the connection with steam. The whole dedicated server with 20 servers. One port was attacked and all servers running perfect but the steam connection is lost and will come back when the attack stop?

Any idea what that can be or how to stop it?
We are out of ideas for now. Must be packet or?

[JustCallMeLuke]

Give us way more information.
Way more.
VSE flood comes up with literally nothing in google so I really have no idea.

[UartigZone]

Originally Posted by JustCallMeLuke Give us way more information. Way more. VSE flood comes up with literally nothing in google so I really have no idea.

Me and the datacenter have no idea, only that it flood the system.

My Servers have NOT lag at all. Just the connection with steam.

You can connect with connect ServerIP:ServerPort on console so only steam server connection get hit.

Some stressers have it and i got some information on it from a skype chat with a support from one of the site that have VSE.

Here is the skype chat

[12:05:08] Demin / Mathias / UartigZone: Great.
 
I found out a user keep stressing/DDoSing my server and my host want to go to police with it. Is it possible that you can blacklist a IP ? Because he stress a server he don't own at all. Server IP: 185.121.173.83. I did some stress test a few days/weeks ago but this guy keep stressing it...
[14:48:32] Demin / Mathias / UartigZone: He keep doing it on same ips and is that even allowed?
[14:53:01] Website Support: We don't have logs and therefore we can't even say for sure that's coming from us.
[14:53:26] Demin / Mathias / UartigZone: But it say "There is already a flood running on this target." on our website
[14:53:38] Website Support: I did some stress test a few days/weeks agoWe assume that every user just like you using our service for legitimate reason.
[14:53:55] Demin / Mathias / UartigZone: When i try to boot it for 30 seconds so it coming from (The Stress website) website
[14:54:54] Demin / Mathias / UartigZone: That is true but
[14:53] Demin / Mathias / UartigZone: <<< But it say "There is already a flood running on this target." on our website
[14:54:57] Demin / Mathias / UartigZone: For the IP
[14:55:30] Website Support: Mhh oh well we don't have a blacklist system
[14:55:38] Website Support: so the only way is block the user
[14:55:44] Website Support: which I can not find out because we've no logs
[14:56:04] Demin / Mathias / UartigZone: Any idea what to do ? You should could find running attacks right now
[14:56:28] Demin / Mathias / UartigZone: And what user/ip that attack the server or starting the attack
[14:56:55] Website Support: mhh no
[14:57:01] Website Support: we've removed any IP logs
[14:57:05] Website Support: access/error log on webserver
[14:57:26] Website Support: and boot log only contain user id, method and boot time, the target itself is encrypted like the password we use with a SALT key
[14:57:43] Website Support: this is to protect our customers and ourself from hackers or other people that want to know what's going on ;)
[14:57:50] Website Support: So in our case, we don't know, they don't know :)
[14:57:52] Website Support: no one knows :P
[15:00:02] Demin / Mathias / UartigZone: Really bad
[15:00:24] Demin / Mathias / UartigZone: Last thing is go to police ...
[15:01:15 | Redigerede 15:01:25] Demin / Mathias / UartigZone: NC3 Police will take our case. Thanks for letting me know :)
[15:01:18 | Fjernede 15:01:28] Demin / Mathias / UartigZone: Denne meddelelse er blevet fjernet
[15:01:47] Demin / Mathias / UartigZone: Have a nice day.
[15:04:26] Website Support: Yea alright well as from our side I would like to help you
[15:06:20] Demin / Mathias / UartigZone: But aslong you don't have any logs or know anything about who start the attacks for like two weeks 24/7 we can not do anything else. All i know is that its a danish person
[15:06:35] Demin / Mathias / UartigZone: And the ips
[15:08:24] Website Support: yea that sucks a lot
[15:08:31] Website Support: mhh well how you're being attacked?
[15:08:39] Website Support: what's under attack?
[15:08:46] Demin / Mathias / UartigZone: Our dedicated server
[15:10:26] Website Support: you've no firewall?
[15:10:33] Demin / Mathias / UartigZone: 750 Gbps DDoS Protection
[15:10:40] Website Support: Voxility?
[15:10:45] Demin / Mathias / UartigZone: But your system do something that make the connection with Steam servers down
[15:10:53] Website Support: Yea we have VSE
[15:10:58] Demin / Mathias / UartigZone: No, we use danish datacenter
[15:11:04] Website Support: well our VSE method probably is used
[15:11:09] Website Support: we've updated it a couple days ago
[15:11:14] Website Support: and now it's almost impossible to stop
[15:11:19] Website Support: it bypass even voxility, ovh, nfoserver etc.
[15:11:21] Website Support: it's very epic now
[15:11:38] Demin / Mathias / UartigZone: It attack steam servers and not the server or?
[15:11:59] Website Support: yea
[15:12:08 | Redigerede 15:12:12] Website Support: it's 'valve source engine'
[15:12:21] Demin / Mathias / UartigZone: So it only attack the connection with the server and steam? How the fuck
[15:13:09] Website Support: yea
[15:13:17] Website Support: it look like real user traffic
[15:13:35] Website Support: you can't even differentiate what's the attack and what's the normal user since it's spoofed
[15:14:02] Website Support: hypothetically spoken of course. I do not say it coming from us.
[15:14:16] Website Support: There's no way you can track back attacks to us
[15:14:24] Website Support: and tbh
[15:14:26] Website Support: if they not use us
[15:14:29] Website Support: they will use someone else lol
[15:14:33] Demin / Mathias / UartigZone: But it say "There is already a flood running on this target." on our website
[15:14:42] Website Support: this text should not be there anymore
[15:14:43] Demin / Mathias / UartigZone: We do not wish to close you. Just the attack
[15:14:50] Website Support: You can't close us.
[15:14:57] Website Support: We're in Ukraine, outside of European Union
[15:15:01] Website Support: + there's no evidence
[15:15:09] Website Support: + even if someone coming to check, there's still no evidence
[15:15:16] Website Support: so yea best you go to OVH, Voxility, NFOserver etc.
[15:15:25] Website Support: buy yourself a server with good firewall (OVH probably you can afford)
[15:15:30] Website Support: free firewall to alls ervers
[15:15:35] Website Support: they have "game Firewall"
[15:15:37] Demin / Mathias / UartigZone: We have more DDoS Protection than OVH have

Pastebin: http://pastebin.com/RF6mKNvA

I changed the website name and support name to Website and Website Support because i don't wanna hang the website out or give people ideas that can make more attacks.

[JustCallMeLuke]

A bit of theory chat over steam I have been having with Uartig:

Luke: Yet I do not know what that type of attack is, google came up with nothing
Luke: Have you tried blocking the protocol or certain packets related to it or is it something that is disgused in a server packet to distrupt the server
UartigZone|New name soon👌💕: No, i use a Server host and i'm the one that help them because i found the way out that its the steam servers that get lost and not our servers
UartigZone|New name soon👌💕: You have time? I Can show you how it works
Luke: Yes ok then, just take it slow because from some of the things you have said, you have not made complete sense so i will have to read it more carefully
UartigZone|New name soon👌💕: I know. Try find this server on steam: 185.121.173.83:29023
Luke: Not responding...
UartigZone|New name soon👌💕: Its offline but if you connect in CSGO it works
Luke: no?
Luke: Do you mean through console
Luke: cause that might mean you have some setting wrong
UartigZone|New name soon👌💕: Try connect X
UartigZone|New name soon👌💕: Or wait
UartigZone|New name soon👌💕: Try X
Luke: Im not allowed to join it via country filter...
Luke: Oh nvm
UartigZone|New name soon👌💕: im coming
UartigZone|New name soon👌💕: 2 sec
Luke: Try putting this in
Luke: sv_max_queries_sec_global 10
sv_max_queries_sec 5 
sv_max_queries_window 10
host_players_show 1
host_info_show 2
Luke: Pretty nice server i guess... bit weird for me but i guess its a mini game server
UartigZone|New name soon👌💕: Yes MG yes
UartigZone|New name soon👌💕: its*
UartigZone|New name soon👌💕: I restart and see if its works
Luke: So what is the other problem apart from server not appearing
Luke: What is with the music as well?
UartigZone|New name soon👌💕: The music is normally in CSGO MiniGames Maps :D
UartigZone|New name soon👌💕: The only problem is someone is attack the server (Only so steam server taken offline)
UartigZone|New name soon👌💕: And when the attack stop, the servers comes up again... Its a kind of new attack
UartigZone|New name soon👌💕: Its not one year old
Luke: Personally it feels a bit extensive... For every minigame it seems to keep playing
Luke: Ok
Luke: So you have no logs?
UartigZone|New name soon👌💕: Nope
UartigZone|New name soon👌💕: its called VSE
UartigZone|New name soon👌💕: I only got pastebin from support on how it works
Luke: You need to get some logging or something. Without it your toast.
Luke: Wait, is the attack on steam servers or your server
UartigZone|New name soon👌💕: They attack my server but its not doing anything with server.. Just like it send it to steam?
UartigZone|New name soon👌💕: Maybe spoofing steam IP servers?
Luke: Cause if you have access to the server you need to find some firewalls and logging programs or something.
Luke: That is very weird.
UartigZone|New name soon👌💕: Because only steam servers get this attack but they attack my server IP
Luke: Wait does it say the steam servers lose connection?
UartigZone|New name soon👌💕: Yes but not in-game
UartigZone|New name soon👌💕: I can tell the host to log every single file
Luke: Wait when the steam servers go offline or whatever does the server do too?
Luke: This is very confusing. Unless that the attack makes it so the packet sent looks like a normal UDP packet for srcds but is corrupted in someway and or it takes a longer time to respond
UartigZone|New name soon👌💕: The server keeps doing anything fine, no errors or downtime, only the steam server get offline
Luke: Maybe its a forged packet that makes the server think its offline?
Luke: Packet injection prehaps?
UartigZone|New name soon👌💕: Yeah it looks like UDP
UartigZone|New name soon👌💕: Yeah maybe
UartigZone|New name soon👌💕: I don't think
UartigZone|New name soon👌💕: It give Steam error connetion 3
UartigZone|New name soon👌💕: Error 3 on connection lost
Luke: We need to find out where the source of the attack is
Luke: We need that IP where its coming from to learn more, then see if your provides will use wireshark or some packet capturing software during the attacks and compare the UDP packets headed for srcds to ones that are not at a time of attack

[UartigZone]

Originally Posted by JustCallMeLuke A bit of theory chat over steam I have been having with Uartig: Luke: Yet I do not know what that type of attack is, google came up with nothing Luke: Have you tried blocking the protocol or certain packets related to it or is it something that is disgused in a server packet to distrupt the server UartigZone|New name soon👌💕: No, i use a Server host and i'm the one that help them because i found the way out that its the steam servers that get lost and not our servers UartigZone|New name soon👌💕: You have time? I Can show you how it works Luke: Yes ok then, just take it slow because from some of the things you have said, you have not made complete sense so i will have to read it more carefully UartigZone|New name soon👌💕: I know. Try find this server on steam: 185.121.173.83:29023 Luke: Not responding... UartigZone|New name soon👌💕: Its offline but if you connect in CSGO it works Luke: no? Luke: Do you mean through console Luke: cause that might mean you have some setting wrong UartigZone|New name soon👌💕: Try connect X UartigZone|New name soon👌💕: Or wait UartigZone|New name soon👌💕: Try X Luke: Im not allowed to join it via country filter... Luke: Oh nvm UartigZone|New name soon👌💕: im coming UartigZone|New name soon👌💕: 2 sec Luke: Try putting this in Luke: sv_max_queries_sec_global 10 sv_max_queries_sec 5 sv_max_queries_window 10 host_players_show 1 host_info_show 2 Luke: Pretty nice server i guess... bit weird for me but i guess its a mini game server UartigZone|New name soon👌💕: Yes MG yes UartigZone|New name soon👌💕: its* UartigZone|New name soon👌💕: I restart and see if its works Luke: So what is the other problem apart from server not appearing Luke: What is with the music as well? UartigZone|New name soon👌💕: The music is normally in CSGO MiniGames Maps :D UartigZone|New name soon👌💕: The only problem is someone is attack the server (Only so steam server taken offline) UartigZone|New name soon👌💕: And when the attack stop, the servers comes up again... Its a kind of new attack UartigZone|New name soon👌💕: Its not one year old Luke: Personally it feels a bit extensive... For every minigame it seems to keep playing Luke: Ok Luke: So you have no logs? UartigZone|New name soon👌💕: Nope UartigZone|New name soon👌💕: its called VSE UartigZone|New name soon👌💕: I only got pastebin from support on how it works Luke: You need to get some logging or something. Without it your toast. Luke: Wait, is the attack on steam servers or your server UartigZone|New name soon👌💕: They attack my server but its not doing anything with server.. Just like it send it to steam? UartigZone|New name soon👌💕: Maybe spoofing steam IP servers? Luke: Cause if you have access to the server you need to find some firewalls and logging programs or something. Luke: That is very weird. UartigZone|New name soon👌💕: Because only steam servers get this attack but they attack my server IP Luke: Wait does it say the steam servers lose connection? UartigZone|New name soon👌💕: Yes but not in-game UartigZone|New name soon👌💕: I can tell the host to log every single file Luke: Wait when the steam servers go offline or whatever does the server do too? Luke: This is very confusing. Unless that the attack makes it so the packet sent looks like a normal UDP packet for srcds but is corrupted in someway and or it takes a longer time to respond UartigZone|New name soon👌💕: The server keeps doing anything fine, no errors or downtime, only the steam server get offline Luke: Maybe its a forged packet that makes the server think its offline? Luke: Packet injection prehaps? UartigZone|New name soon👌💕: Yeah it looks like UDP UartigZone|New name soon👌💕: Yeah maybe UartigZone|New name soon👌💕: I don't think UartigZone|New name soon👌💕: It give Steam error connetion 3 UartigZone|New name soon👌💕: Error 3 on connection lost Luke: We need to find out where the source of the attack is Luke: We need that IP where its coming from to learn more, then see if your provides will use wireshark or some packet capturing software during the attacks and compare the UDP packets headed for srcds to ones that are not at a time of attack

Yeah.

Attacks stopped and connection to steam works again... Until it start again.

Again, if anyone know about it, we will love to know !

[sheo]

You should start from making attack logs on your server

[UartigZone]

Originally Posted by sheo You should start from making attack logs on your server

Server log or network log? :-)

I mean server/log or from network?

[DarkDeviL]

Originally Posted by UartigZone Server log or network log? :-) I mean server/log or from network?

Network.

Logging on your game server usually won't do much in situations like this.