Daniel Bradbury
Exploiting P2P Game Hosting in Dead by Daylight
Any gamer will tell you dedicated servers are prefered to someone being selected as the host and having an unfair advantage with much better latency. P2P online gaming is just awful for anyone who wants a true competetive environment; clients must maintain a connection with the host and if the host leaves the game ends? graceful transfer? (who knows until it happens) + bullshit like the following POC is too damn easy to pull off for anyone who has basic Python abilities.
If you haven't heard about DbD I'd actually highly recommend the game + give props to the creators for making a fun and original multi-player survival horror game (Steam link). The basic idea of the game is that 4 players are Survivors, responsible for repairing generators and escaping from the graps of the Killer (another player whos goal is to hunt and kill as many Survivors as they can before they all run to safety). Simple idea but really enjoyable if you can get a group of friends and try to survive together / enjoy messing with folks as a killer.
Since the game was made by a very small team there was a wave of complaints and issues in the early days. Once more and more networking issues were being reported/experienced I had to pop open Wireshark and see what was going on.
I joined a game and waited for the load screen to start the Wireshark capture. As soon as the game started you could see the flood of UDP packets + our trusty friend STUN (in this case CLASSIC-STUN but the ideas are the same) and I knew we'd be able to have a little fun
For those of you who might not be familiar with the STUN protocol here's a quick review:
Session Traversal Utilities for NAT (STUN) is a protocol that serves as a tool for other protocols in dealing with Network Address Translator (NAT) traversal. It can be used by an endpoint to determine the IP address and port allocated to it by a NAT. It can also be used to check connectivity between two endpoints, and as a keep-alive protocol to maintain NAT bindings.
Who is sending / receiving these packets?
STUN Client: A STUN client is an entity that sends STUN requests and receives STUN responses. A STUN client can also send indications. In this specification, the terms STUN client and client are synonymous.
What info do we care about in the packet?
MAPPED-ADDRESS:
- Protocol Family: IPv4
- IP: 192.168.0.1
- Port: 53199
This is all you have to know about to follow along but if you are interested in knowing more about STUN check out RFC 5389
Each player is acting as a client and is handling both requests and responses to maintain a connection to the other players in the game. If we listen to the traffic we have access to a public IP and port that is open for communication (to confirm just watch UDP packets transportation either way)
Imagine a simple script that listens STUN headers and generates a list of victims and runs a simple UDP flood ``` import socket import random client = socket.socket(socket.AFINET, socket.SOCKDGRAM) bytes = random._urandom(1024)
victim = input('Target >') vport = int(input('Port >'))
packetssent = 0 while 1: client.sendto(bytes, (victim, vport)) packetssent += 1 if packets_sent % 100 == 0: print('.', end=' ') ``` and the victim is pwnd.. 🎉
In the case of DbD the victim is flooded out of the game and points are given to the killer.
As the killer (hosting the game) you can target players with a simple test flood (watch them skip and shut it off before they are out of the game) and then D/C them if they are near escaping (giving the player 0 points and rewarding the killer for a successful kill).
As the survivor you can periodically flood the killer when he is chasing to make sure he cant hit you while you juke / escape his grasp (why not flood and wiggle at the same time?) or you can lag out your fellow survivors to pick up a particularly nice item they are running that game (too funny to lag out a friend who is bragging about some sick item he is going to run this game).
The main point I'm trying to make is that this is a simple simple attack that can be pulled off by any jobber with minimal skill.
In my testing a simple UDP flood like the one shown above using the STUN response results was 100% effective no matter when the flood was run (port remained open for entirety of game and then some..). I ran tests for hours at a time and spaced it out over months of gameplay to see if EAC was every going to pick up on this obivous attack... they never did. In fact EasyAntiCheat will not detect attacks like this (tested in other games they "secure") + is generally a shit given waht they promise.
TLDR; Networking is difficult and gets messed up often. If something feels poorly implemented chances are it is and there could be some fun to be had understanding whats going on under the covers.