Update - Disconnects and Latency Issues

Regardless of the issue, Nexon will ALWAYS take their sweet time in fixing it. Your point is moot.

Though I do wonder what the point in taking the game down is in regards to the hackers.....

You underestimate the complexity of the issue. Nexon owns many, many, many servers, and their set-up would be quite complex. Trying to combat a DDoS attack (especially if it's their first time dealing with it) would be difficult. There are many different types of DDoS attacks that could be occuring, and blocking them may prove to be more/less effective depending on the method(s) used. It takes time to identify the proper solution. It's not as simple as replacing hardware (which isn't all-together that simple, either).

Now, as a large game company, one might expect that they do a better job at beefing up their security. I agree with this, but it's just important to put this in perspective. We know Nexon does not have all the resources it should (especially in terms of American manpower). At least we know they're trying.

Admitted it last time? They only admitted it after lying to everyone saying that it was an internal server issue, instead of a DDoS attack.

we experienced a combination of network instability as well as an increase in malicious attempts to take down our systems. During our nine days of instability, our development and production teams have been working around the clock to track down the causes of the issues and solve them. The good news is that weve made a lot of progress. There remain problems to solve though, and the battle against external forces that can affect our games is ongoing.

Well according to them it was a combination of both. Seems hard to believe but we shall never know the truth. They also said back then the issue is on-going. I don't remember them posting a message since then saying that's everything is fine now.

Regardless of the issue, Nexon will ALWAYS take their sweet time in fixing it. Your point is moot.

Though I do wonder what the point in taking the game down is in regards to the hackers.....

They're obviously doing it for duping. Don't think the method is made public for everyone to see else it would be patched by now but a large group of them know what they're doing apparently, and keeping it quiet too.

Well according to them it was a combination of both. Seems hard to believe but we shall never know the truth. They also said back then the issue is on-going. I don't remember them posting a message since then saying that's everything is fine now.

To be honest, it may very well be both. For all you know, Nexon's ISP could have had general issues those couple of days, and there may also have been increased DDoS cases. It's very plausible. But at the same time, Nexon could be feeding us BS. There's really no way to know.

They're obviously doing it for duping. Don't think the method is made public for everyone to see else it would be patched by now but a large group of them know what they're doing apparently, and keeping it quiet too.

This isn't too intelligent on their end if it attracts legal attention, since they'll just be tracked down like some of the ones who attacked Sony(More severe). Now if legal entities present themselves in this matter, that's something else entirely aha

If the motivations behind all of this are indeed duping, it worries me. It seems like it has become public, because quite honestly if it were very private, it wouldn't cause this much of a problem. Perhaps the right approach here isn't combating DDoS attack, but combating the motivation behind them... (cc: @Nexon)

When thousands of WS and PS are getting produced each time the server goes down, it really is no secret anymore.

If the motivation is indeed duping, why would they do it on such a massive scale? That would just trigger yet ANOTHER rollback from Nexon, thus making all of this a worthless endeavor on the hacker's end. I feel as though there's much more to this than meets the eye, but I doubt it'll ever reach our ears.

Now, as a large game company, one might expect that they do a better job at beefing up their security. I agree with this, but it's just important to put this in perspective. We know Nexon does not have all the resources it should (especially in terms of American manpower). At least we know they're trying.

I just hope their fix doesn't IP ban SP again like it did last time, mistaking our more casual checks and probes for part of the DDoS.

Attempting to crash channels in order to duplicate items I'd imagine. That or they're annoyed that Nexon are now actually trying to fix the problems that they [the hackers] started. Removal of hacked items probably has something to do with it.

Crashing channels =/= DDoS. Most of the time, the channels don't actually even crash, players just lag extremely bad and D/C themselves. Timing a crashing channel with a DDoS attack would be way too hard, and the people doing it would no doubt have a much more safer and not bring so much attention.

And I highly doubt it has anything to do with removal of hacked items.

This is probably someone who is being paid to do it, or they just want to see Nexon squirm and flail while they watch it.


Only way this could be for duping is if they're locking accounts, and this lag unlocks them causing rollbacks, thus duping.

I just hope their fix doesn't IP ban SP again like it did last time, mistaking our more casual checks and probes for part of the DDoS.

Is SP still occasionally being blocked or is that all over now? Hopefully they changed the threshold to be more accurate & thus SP is no longer being picked up as a threat.

Well, I will be one to give Nexon credit in their efforts to counteract these attacks. It seems they have figured out a way to make it so that the mushie/Channels don't fully crash, therefore no duping is being done, at least that I have heard of via this new wave of attacks. Beforehand they( the attackers) were capable of almost crashing channels at will. Hopefully Nexon will continue with some of the new attention they are paying to the game and trying to rectify these issues as they spring up.

Is SP still occasionally being blocked or is that all over now? Hopefully they changed the threshold to be more accurate & thus SP is no longer being picked up as a threat.

I've distributed the checker across multiple IP addresses on a randomized pattern.

Our primary IP, the one the domain resolves to, appears to have been permanently blocked, or at the least has been blocked for more than 72 hours.

What I do find most interesting is, according to mmostatus, only Maple is being hit by this. It's a very focused DDoS. The others are barely showing a ripple.

What I do find most interesting is, according to mmostatus, only Maple is being hit by this. It's a very focused DDoS. The others are barely showing a ripple.

Well, that does seem to support the theory that the motivation behind this DDoS is directly related to an in-game advantage (namely duping). I'd imagine last time was really more of a connectivity/ISP problem, which is why all games were affected.

Someone above said something about how a DDoS wouldn't really crash a channel. That's pretty true. A DDoS would just create intense lag... which could eventually lead to a crash. Based on what has been said about duping, this doesn't seem like a favorable scenario for the hackers... I was under the impression that they need to crash the server at a specific time in order for the dupe to be successful?

I'm not quite sure what to make of all this.

Depending on how the game is designed a extreme lag via DDoS could result in a dupe by creating a save state collision between two channel servers and the character database.

Well, that does seem to support the theory that the motivation behind this DDoS is directly related to an in-game advantage (namely duping). I'd imagine last time was really more of a connectivity/ISP problem, which is why all games were affected.

Someone above said something about how a DDoS wouldn't really crash a channel. That's pretty true. A DDoS would just create intense lag... which could eventually lead to a crash. Based on what has been said about duping, this doesn't seem like a favorable scenario for the hackers... I was under the impression that they need to crash the server at a specific time in order for the dupe to be successful?

I'm not quite sure what to make of all this.

They just need to know when it's going to crash, which is possible, just hard and probably more trouble than it's worth for duping.

I can't imagine they're lying, but I'm interested to see how well shifting blame works for them.

My guess? Rage.

Admitted it last time? They only admitted it after lying to everyone saying that it was an internal server issue, instead of a DDoS attack.

I wouldn't say they lied to us more like they thought it was an internal server problem and on further investigation it turned out they were being attacked. Nexon doesn't normally lie they just tend not to say anything at all. Hime doesn't count in that previous sentence.

Unfortunately, fixing the DDoS attacks ultimately achieves nothing in the long term. Hackers will find another way to crash the servers, seeing as there are much too many pre-existing loopholes. The fact that duping can even occur (on a database level) is what is most concerning here.

It may not be possible or practical to protect the servers against every takedown method imaginable. What is possible, though, is constructing the software to deal with these situations in a way that protects the integrity of the database (Ex. identifying & automatically deleting dupes through individual item keys/ids, etc, etc, etc.)

Nexon would be heaps better off working on its database structure & preventing the possiblty of dupes even occuring rather than spending time defending DDoS attacks that wouldn't be happening if duping wasn't possible.

I wouldn't say they lied to us more like they thought it was an internal server problem and on further investigation it turned out they were being attacked. Nexon doesn't normally lie they just tend not to say anything at all. Hime doesn't count in that previous sentence.

It could've also been a hardware problem due to having been pounded on by external influences. Wouldn't be the first time network hardware buckled under stresses it was never planned to handle.