LIZARD SQUAD is Back. Planning XBL Attack. "Biggest attack yet". [UP: XBL/PSN Down]

This craziness man, just saw a feed from BBC how this mother is asking for some kind of compensation from MS because this was her son's worst Christmas ever since he can't play his Bone

Uggh I bet that kid is an entitled little prick just like his mum. People need to get angry at the fuckers responsible for this and not the companies losing and spending money to fix it.
 
As misinformed and unrealistic as this post is, this is going to be the general sentiment among a lot of gamers.

People are going to be disappointed and pissed off.

People will be calling it a garbage service despite this being outage being something largely out of the control of Sony.

Cangrats Valar Morghulis, you pretty much represent the same opinion and feelings as many uninformed, casual gamers.

Yes. because the moment Lizard Squad claims they did it, we're all supposed to believe them. Here's some screens from twitter, look everyone, proof!

What about all those other times when there was reason for mass traffic, no mention of ddos attacks yet psn still crapped out.

I've had a psn account before it was even called that and it's always had issues, I'm paying to use it now and it's worse, everyone was shocked when psn was up and running the day Destiny released because everyone expected it to crap out, why is it that people are surprised that it worked when it should have in the first place?

Call it what you will, misinformed, casual, whatever the heck you want, bottom line is the service is crap. If you're fine with that, great, good, pat on the back. But I expect things to work when I pay for them.

I call bullshit on LS and ddos. Funny though, PS3, no issues at all. I'm online right now and so are several of my ps3 friends. PS4 on the other hand, issues. Let me guess, different servers?
 
So you can't prevent the attack from happening -- but what about discouragement? If they're just a bunch of script kiddies, why can't these multi-billion-dollar technology companies and/or law enforcement trace them and get them arrested? Especially since they're being so damned smug about announcing these attacks publicly way in advance. Where's the omniscient surveillance state when you need it.

This

https://www.youtube.com/watch?v=K2khTxU_eeA

lol
 
can i just say... my friend got an xbox one for Xmas.. with the service down.. WHAT A HORRIBLE EXPERIENCE for a first time user.. everything needed internet.
it got alot smoother when it started to get online but geez.
 
Finest squad = lizard squad. They are trolling everyone so hard.

I really wanted to believe...

But this seems pretty obvious now

Holy Crap

DWrI2JY.gif
 
When it comes to websites, I can see how this is an incredibly difficult problem to solve, and I'm sure I'm speaking out of naivete, but how is it that when we're dealing with a service that requires a piece of hardware to get the benefit from, that the platform holders don't just have a database of MAC addresses/serials or whatever the unique identifier is of each console in circulation, where they can make it so their servers just do not accept any traffic coming inbound other than from the consoles themselves?
 
Yes. because the moment Lizard Squad claims they did it, we're all supposed to believe them. Here's some screens from twitter, look everyone, proof!

What about all those other times when there was reason for mass traffic, no mention of ddos attacks yet psn still crapped out.

I've had a psn account before it was even called that and it's always had issues, I'm paying to use it now and it's worse, everyone was shocked when psn was up and running the day Destiny released because everyone expected it to crap out, why is it that people are surprised that it worked when it should have in the first place?

Call it what you will, misinformed, casual, whatever the heck you want, bottom line is the service is crap. If you're fine with that, great, good, pat on the back. But I expect things to work when I pay for them.

I call bullshit on LS and ddos. Funny though, PS3, no issues at all. I'm online right now and so are several of my ps3 friends. PS4 on the other hand, issues. Let me guess, different servers?

I don't think it's hard to believe that these networks both experienced DDOS attacks.
Xbox Live has been down, too. And that service is pretty stable. So when XBL and PSN both go down inexplicably, it shouldn't be all that outlandish to lend credence to the idea of a DDOS.

As far as PS outages on other instances, that's unrelated. And believe me, you're not the only one who is annoyed with the outages. There's huge threads on GAF discussing that.

If you wish to compare PS3 -> PS4 network stability, that's fine. But this thread really isn't the place for that.

And yes you are right, the PS3 and PS4 PSNs are indeed separate. They communicate with each other and integrate, but they are separate. So this would explain why the PS3 would still run while the PS4 is having issues.

When it comes to websites, I can see how this is an incredibly difficult problem to solve, and I'm sure I'm speaking out of naivete, but how is it that when we're dealing with a service that requires a piece of hardware to get the benefit from, that the platform holders don't just have a database of MAC addresses/serials or whatever the unique identifier is of each console in circulation, where they can make it so their servers just do not accept any traffic coming inbound other than from the consoles themselves?

PSN can still receive traffic over the web without Playstation hardware.
Even the common user can still interact with the PSN without a PS4, let alone DDOSers/Hackers.
 
No one even cared to knock out Nintendo's servers when the Wii and DS was at its height of popularity. That should be indicative of something from many of these script kiddies and hackers. Remember Lulzsec? They did actually hack into Nintendo's infrastructure but they told their support and everything on how to fix their vulnerabilities. They're reasoning was because Nintendo has yet to really do anything wrong.

At most, the only thing Nintendo seems to get the heaviest flack for is region locking.
 
So you can't prevent the attack from happening -- but what about discouragement? If they're just a bunch of script kiddies, why can't these multi-billion-dollar technology companies and/or law enforcement trace them and get them arrested? Especially since they're being so damned smug about announcing these attacks publicly way in advance. Where's the omniscient surveillance state when you need it.

Because they are hiding behind proxies and the attacks arent coming directly from their homes, they pay for DDoS attacks that are coming from all over the world, China being one example.

Call the authorities in China and they wont give a damn.....

We need some real life vigilantes to save us now......time to get the avengers together again.....
 
So you can't prevent the attack from happening -- but what about discouragement? If they're just a bunch of script kiddies, why can't these multi-billion-dollar technology companies and/or law enforcement trace them and get them arrested? Especially since they're being so damned smug about announcing these attacks publicly way in advance. Where's the omniscient surveillance state when you need it.

Much like swatting, it's rather difficult to trace the action of a ddos back to the actual instigator, since the instigator is so far removed from the situation.

Here's a loose and totally imaginary scenario, but it illustrates the point:

  • Attacker wants to initiate a large-scale DDoS attack on a site.
  • Attacker coerces a stranger to take an action for them, either by threatening them online (I have nudes of you, etc - you'd be shocked how often that works) or by taking something of theirs hostage (like using a cryptolocker variant that encrypts a person's HDD after they download a malicious file - the malware then phones home to a dead drop like an IRC channel, which the Attacker connects to via several layers of spoofing and anonymizing.
  • So now the Attacker has a Rube they can give commands to, like, download this file, install it, run it, enter in such and such information, and your credit card details.
  • What Rube has now done, is paid for airtime on one of many black market botnets - massive networks of zombie computers all infected with malware, that don't even know they're infected.
  • Rube's payment goes through, and Attacker gets the pass for the botnet from Rube. Attacker never sees Rube again, and Rube still has no idea who encrypted their HDD.
  • Now, Attacker logs into botnet - which is just an IRC channel somewhere with a password on it (via lots of proxies, etc), and tells it to attack a series of IPs. Like say, the IP addresses that show up when you do a very basic packet sniff of your network when the Xbox boots and connects to XBL. You can't hide those ip adresses, the TCP protocol is rather honest to a fault.
  • So now, the botnet wakes up, and millions of zombie PCs all start sending SYN packets to the IP addresses. Some of the servers, seeing the familiar SYN request for a synchronize, answer. They have to - that's how the internet works. They ACK, acknowledge. Now they wait for a SYN-ACK from the client who was trying to connect. Except the client isn't trying to connect, and while this was happening, a million other SYN requests came in. And the server has to ACK them all, and if it tries, it falls over.
  • However, most servers have mitigation in place - which is a complex process, this video explains it better: http://www.dailymotion.com/video/x14r6yg_prolexic-in-action-mitigating-a-160-gbps-ddos-attack_news
  • At best, the mitigation keeps the server alive, but now end-users might find themselves having a hard time connecting, since there's all this checking going on. They might go into a queue, or just be denied outright and told to try later.
  • And so the botnet continues to slam the servers, and others along the way, depending on how the command and control is set up. If it can't take down its target, it tries for one layer back, like the datacenter, or the ISP the datacenter uses, or the main trunk that leads to that ISP, and so fourth.

Meanwhile, who is Attacker? Nobody knows. How do you find out? That's a damn hard question to answer. You might, at best, discover Rube through investigations, and initially think Rube is Attacker, since they paid for the botnet access - but Rube claims innocence, but there's no way for anyone to figure out who Attacker was. Unless Attacker was sloppy, and left something in the malware that might lead back to them. Perhaps the investigation might get to the IRC channel the info is shared on, and the investigation team "fakes" being caught in the malware encryption trap, and tries to use the situation to get Attacker to out themselves. That's happened once or twice, but it's still rare.

(Ack, sorry for the wall of text)
 
can i just say... my friend got an xbox one for Xmas.. with the service down.. WHAT A HORRIBLE EXPERIENCE for a first time user.. everything needed internet.
it got alot smoother when it started to get online but geez.
The thing still (for most intents and purposes) still needs a connection for everything? Eew. Haven't exactly been keeping up on the current state of the XB1 OS. Given the frustrating and complicated nature of patching and online services this generation I have to say I'm extremely impressed that my PS4 was functional and could play a single-player (disc) game straight out of the box without trouble. That's a pretty pathetic thing to be impressed by (given the same thing has been true for every generation of hardware until now) but it's apparently a better experience than your friend had. I'm glad things seem to be looking up for them.
 
Did this take out the windows 8 store too cause my sister just got a laptop and it won't update. The updates all just say pending, wifi is working fine
 
Good point. Amazon would have to be down for more than a day for the mobs to get really impatient.

Thanks :) I rather thought so.

Seriously though, I'm only guessing at why there may be more attention here than there. It's impossible to know just how many people would REALLY be put out if Amazon went down.

I shop exclusively at Amazon for all items that aren't retailer exclusive. I'm betting a shit ton of people are the exact same.

Yes but you don't HAVE to and that's the difference.

If Amazon goes down and you want to buy something, you can find it with a 99.9% likelihood the price will be very, very close if not the exact same elsewhere.

If XBL/PSN go down, the users there have literally no where else to go if they aren't PC gamers.
 
When it comes to websites, I can see how this is an incredibly difficult problem to solve, and I'm sure I'm speaking out of naivete, but how is it that when we're dealing with a service that requires a piece of hardware to get the benefit from, that the platform holders don't just have a database of MAC addresses/serials or whatever the unique identifier is of each console in circulation, where they can make it so their servers just do not accept any traffic coming inbound other than from the consoles themselves?

1) MAC addresses, serials, etc. can be spoofed.
2) In the case of MAC addresses at least, legitimate users like people behind routers would be screwed.
3) It wouldn't help anyways. DDoS attacks usually don't even bother with trying to look legit, they just flood the target servers with requests. The target is too busy rejecting the bad requests to even listen to legitimate ones, much less authenticate that they are legitimate, hence the downtime.
 
Top Bottom