DDoS Attacks Confirmed

http://na.finalfantasyxiv.com/lodest...d033d72da5630c

Looks like Lizard Squad is at it again.

No offense but it really sounds more like an excuse at this point since they are saying it has been going on since the 16th (early access start) and one would think they would say something far earlier than days later AFTER the media has started publishing bad press about the expansions launch.

Edited in because char limits

I would also like to point out they have not only put out an expansion but have also opened up a free login campaign at the same point far overloading the capacity of the servers themselves. The "DDoS" may very well be their own CUSTOMERS trying to get what SE has sold and/or advertised.

I honestly hope that's the cause.. Otherwise these useless new servers they bought are even more useless.

Quote:

---

Originally Posted by Grimmel

http://na.finalfantasyxiv.com/lodest...d033d72da5630c

Looks like Lizard Squad is at it again.

---

Nope just an angry White Mage

It would kind of make sense, since the 17th and 19th were particularly less laggy, I haven't dc'd at all during those days, except for a few particular instances where I got stuck in a dungeon and being unable to log back in, but that was only once on each of those days.

Also important to note that the JP servers weren't having as much trouble with the servers as the NA servers, so yeah, it makes sense

Quote:

---

Originally Posted by Grimmel

http://na.finalfantasyxiv.com/lodest...d033d72da5630c

Looks like Lizard Squad is at it again.

---

This is why we need an actual online police force, along with real penalties for these no-life low-lives.

I play on Japanese data centre Elemental from 16th to 21th had no problem login time maybe 1 min wait or sometime instant login

Quote:

---

06/20/2017 2:56 AM
[Follow-up]Regarding Congestion for Instanced Battle Content: Follow-up 2
This is a follow-up regarding the difficulty in entering certain instanced battle content.

Since the start of early access, while monitoring the progression status of main quests and the number of users queuing up for instanced battles, we have been adjusting the number of users that can access instance areas and increasing the number of instanced Worlds in order to the alleviate the burden on servers.

Until now, we have been addressing this issue in stages, but due to the measures taken at 8:00 a.m. (PDT) on Jun. 17, 2017, we have been able to drastically increase the number of playable windows for instanced content and have confirmed that users are able to stably enter quest related instanced battles.

We sincerely apologize for the extended time that users have been inconvenienced and will continue to monitor the situation so that users can play comfortably.

Additionally, we have confirmed that a problem has occurred with the system that manages movement to content, and we will continue to address this issue as well.

Please see the news below for details.

---

This seems counter to the statement that its a DDOS attack and feels more like they're blaming it on it when they would have known day one (and quite quickly) it was DDOS from the amount of pings. Priorly the player base was informed within an hour of DDOS attacks starting not nearly a week.

Quote:

---

Originally Posted by Yurimi

No offense but it really sounds more like an excuse at this point since they are saying it has been going on since the 16th (early access start) and one would think they would say something far earlier than days later AFTER the media has started publishing bad press about the expansions launch.

Edited in because char limits

I would also like to point out they have not only put out an expansion but have also opened up a free login campaign at the same point far overloading the capacity of the servers themselves. The "DDoS" may very well be their own CUSTOMERS trying to get what SE has sold and/or advertised.

---

Or, you know, they considered it might be an influx because of the expansion but the investigation took these 4 days.

Did the DDOS build that bottlenecked MSQ instance, How about the huge queues letting 5 people in every 30 seconds. Just own the bad launch and get it fixed don't start blaming fake DDOS attacks...

I don't think it's a conspiracy or SE lying or whatever mumbo jumbo. I believe that they were dealing with an influx of players from the expansion and random DDoS attacks.

Quote:

---

Originally Posted by ExKage

Or, you know, they considered it might be an influx because of the expansion but the investigation took these 4 days.

---

No point trying to be rational, most people want to just make up some big conspiracy. [Sarcasm] Yes I am sure Yoshi P and everyone had a big meeting I am sure and discussed what the issues were and were like, yes, lets just lie to them. Tell them it was a DDOS attack, all of you people on the network team and everyone here let's all make sure we are on board with this big lie to the people because that is what us creators of video games love to do. Having respect and being passionate about our game? No way we all just want to rob people and lie to them because that is what our life is all about. [/sarcasm]

Quote:

---

Originally Posted by Elim

I don't think it's a conspiracy or SE lying or whatever mumbo jumbo. I believe that they were dealing with an influx of players from the expansion and random DDoS attacks.

---

Kind of a perfect storm really.

I play on chocobo server and everything went smoothly after friday. So the issue is only with NA DC.

I havent had any lag except mayb 1 5min lag spike in gubal libary via lvling roulette other day o.o

Me being on Odin aswell, the only issues ive been having since launch have been server queues and a single incident with lag in Rhalgrs Reach. Aside from that my experience wit the game have been smooth and mostly flawless.

It could very well be a DDoS attack. WoW had the same issue when WoD launched.

Quote:

---

Originally Posted by Elim

I don't think it's a conspiracy or SE lying or whatever mumbo jumbo. I believe that they were dealing with an influx of players from the expansion and random DDoS attacks.

---

That is far more believable. Why would they lie? There is nothing in it for them to lie. And I swear the last few DC's I've been in for the past three days or so are far weirder than normal server issues. So I believe a mix. Cause day 1 EA... I believe was full player driven. Further from that day its been just a mix of weird and non weird issues.

Quote:

---

Originally Posted by Potchi

Don't be so quick to judge. It is actually very feasible that SE had suspicions of the DDoS attacks as early as the 16th, but lacked concrete evidence to support that suspicion. Square Enix stating that servers were congested was not a lie, it was a concrete fact. That is how DDoS attacks work.

I believe it was a very good PR move and very smart of SE not to throw out an accusation or pass blame until they were certain of the attacks beyond a reasonable doubt.

---

DDOS attacks also arrive in waves, which makes sense considering the repeated mass DC and lag events that happened this evening.

It probably isn't lizard squad. They're not as active anymore.

Quote:

---

Originally Posted by Kosmos992k

This is why we need an actual online police force, along with real penalties for these no-life low-lives.

---

Noooo! Why you in my head?!

Anyway, I'm not entirely surprised that 3rd party DDoSing could be an issue. Honestly, I think it to be a mix of the playerbase trying to get into the game (and past Rauhban, Pipin & Susano). Wouldn't be surprised if it were the same num-nuts responsible for the frequent DDoSing of Blizzard servers (some kids get real salty at losing in Overwatch).

1. launch of early access.
2. returning players re-subbing after months away.
3. massive influx of new players after a super aggressive advertising campaign. (Who would have expected that???)
4. No real world stress test on a full server migration just 4 weeks prior.

Recipe for disaster. But hey, if we want to blame a DDoS then you do you, SE.

Quote:

---

Originally Posted by OmegaFlare

I'm not a tech person but would they have known about the ddos attack the moment it occurred or within the first hour or so? Or does it actually take 3+ days to determine that the congestion of the instance servers were caused by a ddos attack? I sure hope SE isn't lying to us because I would be very sad if they were. I don't mind all the problems that we've been experiencing but I would feel very offended being lied to.

---

Any decent server admin will usually take a few hours to spot and investigate maybe a day or so at most if it is irregular attacks instead of patterned ones but 4+ days is a bit of a stretch. There is nothing you can really do to protect against them but spotting them isnt exactly rocket science.

Quote:

---

Originally Posted by OmegaFlare

I'm not a tech person but would they have known about the ddos attack the moment it occurred or within the first hour or so? Or does it actually take 3+ days to determine that the congestion of the instance servers were caused by a ddos attack? I sure hope SE isn't lying to us because I would be very sad if they did. I don't mind all the problems that we've been experiencing but I would feel very offended being lied to.

---

DDOS attacks don't come from a single source, they are massively distributed, amidst a massive increase in active players it would be hard to pick out such an attack at the time, but easier in hindsight. It takes time analyzing logs and traces, then you have to present your findings and decide how best to react and when/how to publicly respond. Accusing SE of lying suggests a lack of understanding.

Quote:

---

Originally Posted by Kosmos992k

This is why we need an actual online police force, along with real penalties for these no-life low-lives.

---

This is actually a real life crime and can be punished as such depending on the country of the offender/country of the victim and whether extradition agreements are in place. It is just rarely enacted upon as most companies dont feel it worth the legal fees to push.

Quote:

---

Originally Posted by Yurimi

This is actually a real life crime and can be punished as such depending on the country of the offender/country of the victim and whether extradition agreements are in place. It is just rarely enacted upon as most companies dont feel it worth the legal fees to push.

---

It's also hard to get international agencies to cooperate in DDOS attacks - depending on the scale. One point worth mentioning is that criminal prosecutions are not pushed by victims, they are pushed by prosecuting authorities.

All I will say is the last time they had a DOS attack the login cue wasn't 4k during normal times. It was an insane number, like 10k+. (I faintly recall it being something like 11xxxx or something similar.)

4k is the amount of players that was on the server in HW when it went up. If it was a DOS, why spend more time lowering the amount that can enter instances, and log in at one time? Why focus on that? Why not focus on the root of the problem? Why leave the servers up? DOS attacks get worse the longer the server is up, until the server cannot function(The last time, it only took them 30minutes-1 hour to work out it was a DOS attack.(And they took the server down almost immediately, not that you could play with the server being DDOS'd)). There would have been skill lag. It would have gotten WORSE. But things stayed generally the same.

I'm not saying it is or isn't an attack. Just that the signs I, and other players I've talked to, don't fit the typical DOS attack. I'm not saying they're lying or their not. Just that it is really odd. I won't deny the influx of players would make it harder to spot either.

Re: "Why didn't they announce it 3 days ago?"

It's a Japanese company. They dot their i's cross their t's, then send it to the committee before they do anything. So, yeah, 3 days sounds urgent on their schedule.

Quote:

---

Originally Posted by Kosmos992k

It's also hard to get international agencies to cooperate in DDOS attacks - depending on the scale. One point worth mentioning is that criminal prosecutions are not pushed by victims, they are pushed by prosecuting authorities.

---

Really depends as it would not be considered a federal crime in most countries but an attack of person so unless a company chooses to press charges (loss and damages in most cases) then there is really nothing a law agency can do other than "monitor" the offender for the future.

Quote:

---

Originally Posted by Yurimi

The "DDoS" may very well be their own CUSTOMERS trying to get what SE has sold and/or advertised.

---

Well my anecdotal experience says that today felt different than every other day since EA. Today I actually got lag in game where I would see multiple people with the DC icon, but I wouldn't actually disconnect. Every other time I'd get lag it would be for a few seconds and then I'd disconnect.

But all that says is today is different. Considering it is the release date, you might not be wrong. Well, anyways, to the routers it's a flood of packets whether it's customers or a malicious third party.

Quote:

---

Originally Posted by Yurimi

This is actually a real life crime and can be punished as such depending on the country of the offender/country of the victim and whether extradition agreements are in place. It is just rarely enacted upon as most companies dont feel it worth the legal fees to push.

---

It's also extremely difficult to gather sufficient evidence and determine who is exactly responsible, and there are still plenty of countries that don't have appropriate levels of law to deal with cyber crime.

As for this instance; no they haven't told any lie. It seems like a script kiddie decided to make the server issues worse than they should have been, using the early access and influx of players to hide their activity.

Quote:

---

Originally Posted by Yurimi

Really depends as it would not be considered a federal crime in most countries but an attack of person so unless a company chooses to press charges (loss and damages in most cases) then there is really nothing a law agency can do other than "monitor" the offender for the future.

---

Most countries have laws that make hacking a criminal, not a civil offense though, it's just low priority and very underfunded.

Quote:

---

Originally Posted by YitharV2

Well my anecdotal experience says that today felt different than every other day since EA. Today I actually got lag in game where I would see multiple people with the DC icon, but I wouldn't actually disconnect. Every other time I'd get lag it would be for a few seconds and then I'd disconnect.

But all that says is today is different. Considering it is the release date, you might not be wrong. Well, anyways, to the routers it's a flood of packets whether it's customers or a malicious third party.

---

I saw the same lag spikes on the first day of Early Access, including DC waves.

This explains NA servers but not EU last night I was unable to login I was in a que of 1600 when I got home from work by 8pm it had gotten down to 600 but then encountered an error which closed the game making it so I was at the back of the que again of 2600 in which point I gave up.

Well...

I suppose the servers held up fairly well considering...
They were actually still available during early access...

Quote:

---

Originally Posted by Kosmos992k

I saw the same lag spikes on the first day of Early Access, including DC waves.

---

Yeah, like I said, it's anecdotal, so take what I say with a grain of salt.

Quote:

---

Originally Posted by Kathryn

This explains NA servers but not EU last night I was unable to login I was in a que of 1600 when I got home from work by 8pm it had gotten down to 600 but then encountered an error which closed the game making it so I was at the back of the que again of 2600 in which point I gave up.

---

That would be the signs of a DOS attack on the EU, for example. If the que kept going up and up and up. That's one thing that happened last DOS attack when it had just started.

Quote:

---

Originally Posted by Kosmos992k

DDOS attacks don't come from a single source, they are massively distributed, amidst a massive increase in active players it would be hard to pick out such an attack at the time, but easier in hindsight. It takes time analyzing logs and traces, then you have to present your findings and decide how best to react and when/how to publicly respond. Accusing SE of lying suggests a lack of understanding.

---

How does SE defend against future ddos attacks? Do we have to deal with constant dc/interruptions every time an attack occurs? Could SE use ddos attack as an excuse every time server problem arises? If an attacker is persistent enough and attacks the servers everyday, does the game then become unplayable?

As an european player (from Chaos DC), i didnt get any trouble while playing since 16th until now so it can be true. The only problem was the queue but once inside the game i didnt feel any problem.

so... a DDoS...

http://i36.photobucket.com/albums/e3...an018/Orly.png

As pointed out, why was then EU Datacenter affected if they attacked the NA ones..?

smells fishy

PS: Monitoring Latency on EU Datacenter looked like this the last 30 days, still we had issues regarding instances in job and msq quests, congested worlds and login queues 2+ hours ...
you can´t blame this exclusively on some third-party alone

http://imgur.com/8jIPsYN
http://imgur.com/8jIPsYN
Somehow, my imgur IMG wont show up!?