Players Demand Offline Version After Diablo IV DDoS Attack

Author: Brian Powell Jr
Date: June 25, 2023 1:06:00 pm EDT
Last Updated: June 1, 2024 9:01:59 pm EDT
Read Time: 3 min read
Tags:

About the Attack

Late yesterday Diablo IV became assaulted by a DDoS attack that is currently still underway. Players are sounding off on the Diablo IV forums about how this underscores the need for an offline version of the game. Critics of this opinion say it would open the door for cheating and item duplication hacks.

Blizzard Customer Service Twitter feed responding to DDoS Attack

The attack started for me in the early evening hours where when trying to login the authentication process would say I didn’t have a valid license. Checking again just now, I can login but am not able to join the game world with my character.

Since Diablo IV launched the game has been met with backlash about the persistent need for an online connection. However, to create an offline version of the game is going to mean a lot of features will either need to be redesigned or just removed. The bulk of the these features, as we mentioned in our review of the game, are the end game content including World Bosses, Helltides, and Whisper Bounties.

I personally am not a fan of the persistent online connection as it has generally lead to an overall negative gameplay experience. I have also had some fun parts with it, though, where an impromptu group was formed to help me take down a Helltide Assassin. However, upon defeat of the enemy I was disappointed because the loot was all Magic rarity trash. It was an entertaining 5 minutes nonetheless.

What is a DDos Attack?

DDoS stands for Distributed Denial of Service. This is a process by which a server is overloaded with garbage internet packets that causes it to ultimately stop functioning. This excerpt from CloudFlare does a good job at explaining the process:

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt the normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic.

DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Exploited machines can include computers and other networked resources such as IoT devices.

From a high level, a DDoS attack is like an unexpected traffic jam clogging up the highway, preventing regular traffic from arriving at its destination.DDoS attack traffic metaphor

How does a DDoS attack work?

DDoS attacks are carried out with networks of Internet-connected machines.

These networks consist of computers and other devices (such as IoT devices)which have been infected with malware, allowing them to be controlled remotely by an attacker. These individual devices are referred to as bots (or zombies), and a group of bots is called a botnet.

Once a botnet has been established, the attacker is able to direct an attack by sending remote instructions to each bot.

When a victim’s server or network is targeted by the botnet, each bot sends requests to the target’s IP address, potentially causing the server or network to become overwhelmed, resulting in a denial-of-service to normal traffic.

Because each bot is a legitimate Internet device, separating the attack traffic from normal traffic can be difficult.

How to identify a DDoS attack

The most obvious symptom of a DDoS attack is a site or service suddenly becoming slow or unavailable. But since a number of causes — such a legitimate spike in traffic — can create similar performance issues, further investigation is usually required. Traffic analytics tools can help you spot some of these telltale signs of a DDoS attack:

  • Suspicious amounts of traffic originating from a single IP address or IP range
  • A flood of traffic from users who share a single behavioral profile, such as device type, geolocation, or web browser version
  • An unexplained surge in requests to a single page or endpoint
  • Odd traffic patterns such as spikes at odd hours of the day or patterns that appear to be unnatural (e.g. a spike every 10 minutes)

There are other, more specific signs of DDoS attack that can vary depending on the type of attack.

“What is a DDoS Attack?”, Cloudflare