{"id":695,"date":"2009-02-06T03:32:59","date_gmt":"2009-02-06T11:32:59","guid":{"rendered":"http:\/\/cubist.cs.washington.edu\/Security\/?p=695"},"modified":"2009-02-06T03:35:36","modified_gmt":"2009-02-06T11:35:36","slug":"xbox-live-ddos-attacks-become-popular","status":"publish","type":"post","link":"https:\/\/secblog.cs.washington.edu\/Security\/2009\/02\/06\/xbox-live-ddos-attacks-become-popular\/","title":{"rendered":"Current Event: Xbox Live DDoS Attacks Become Popular"},"content":{"rendered":"<p>Xbox Live DDoS Attacks Become Popular<\/p>\n<p>Cheating in online multiplayer games has always been an issue.\u00a0 Each genre of game has been plagued with a certain type of hack: Map discovery hacks for RTS games, Aiming hacks in FPS&#8217;s, and hacks to force opponents to leave ranked games.\u00a0 Now, DDoS attacks are being used by some Xbox Live users to kick their opponents from games.<\/p>\n<p>The article \u201cHackers Use DIY Botnets To DDoS Xbox Gamers\u201d focuses on ready made Botnet solutions which make it easy for a script-kiddie to set up his own botnet.\u00a0 The programs discussed were BioZombie and HostBooter, and both come with a couple bots but require the user to add more.\u00a0 These bots can be added willingly (via friends), or the aspiring botnet emperor can trick others into running an executable.\u00a0 Many places advertise botnet creation services, or zombies for a fee ($2 per bot was a price referenced in the article).\u00a0 Of course, anyone who successfully spreads their botnet would \u201cfind themselves a drone for the original creator.\u201d\u00a0 This seems like an excellent case of social engineering to spread a botnet.<\/p>\n<p>The new popularity of this kind of exploit is directly caused by the gaming subculture&#8217;s lust for vengeance and carelessness in cheating, but an interesting new use of DDoS attacks.\u00a0 Unfortunately for Xbox Live users, no fix is on the horizon.\u00a0 If games were all hosted by a central server and there was no peer to peer communication, then a DDoS attack would not be possible because the attacker would not be able to find out the other gamers&#8217;s IP addresses.\u00a0 To stop this exploit from booting gamers, the Xbox game creators will need to change the way games are hosted, although this will mean that they must pay for more hosting.\u00a0 Positive reactions to this kind of cheat would be to complain to Microsoft about the need to consider the security of online gaming protocols.\u00a0 If nothing is done, every automated online competitive ladder could be cheated.\u00a0 Fortunately, this malicious activity would be possible to be tracked and a list of malicious users could be banned.\u00a0 I remember when Blizzard banned a large number of IP addresses and game serial numbers for maphacking in Warcraft 3.\u00a0 Hopefully Microsoft and other game developers will take a proactive role as well, or else many people will become frustrated with their online gaming experience.<\/p>\n<p>link:<br \/>\nhttp:\/\/blog.spywareguide.com\/2009\/02\/hackers-use-diy-botnets-to-ddo.html<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Xbox Live DDoS Attacks Become Popular Cheating in online multiplayer games has always been an issue.\u00a0 Each genre of game has been plagued with a certain type of hack: Map discovery hacks for RTS games, Aiming hacks in FPS&#8217;s, and &hellip; <a href=\"https:\/\/secblog.cs.washington.edu\/Security\/2009\/02\/06\/xbox-live-ddos-attacks-become-popular\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":98,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-695","post","type-post","status-publish","format-standard","hentry","category-current-events"],"_links":{"self":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/695","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/users\/98"}],"replies":[{"embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/comments?post=695"}],"version-history":[{"count":4,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/695\/revisions"}],"predecessor-version":[{"id":699,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/posts\/695\/revisions\/699"}],"wp:attachment":[{"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/media?parent=695"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/categories?post=695"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secblog.cs.washington.edu\/Security\/wp-json\/wp\/v2\/tags?post=695"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}