If you click on a link and make a purchase we may receive a small commission. Read our editorial policy.

GameSpy could be used for DDoS attacks

By enterprising crackers

Flaws within GameSpy, a popular program that allows game clients to find and connect to game servers, might permit crackers to flood systems with useless packets and tie up processors through DDoS attacks.

The vulnerability, which affects many games across Windows and *nix server platforms, is based upon spoofed UDP requests, as an advisory by security research outfit PivX Solutions (which made public its research yesterday) explains.

Affected applications include Battlefield 1942 Server, Quake, Quake 2, Q3: Arena & Team Arena, Half-Life, Counter-Strike, Unreal Tournament 2003, and Return to Castle Wolfenstein... and more, according to the alert.

"As a basic rule of thumb, if it supports GameSpy, it will likely be vulnerable," said Mike Kristovich, a security researcher for PivX Solutions, who first identified the vulnerability.

Testing by PivX with Battlefield 1942 Server illustrates the mechanism of the attack and its potential potency, an attacker with a dial up connection might easily disrupt a game servers and prevent access by legitimate gamers (irrespective of whether they use a personal firewall).

"The attack does not only affect the bandwidth of the host and the victim, but it also tends to eat up a nice chunk of memory and CPU power on the server. Also, a side effect seems to be the server losing all its players, either by assuming their connection died or the players dropping the connection due to lag," Kristovich explains.

PivX has published proof of concept code to back up its warning.

Electronic Arts (publisher of many of the games involved) was notified of the problem on November 20, 2002. PivX is yet to receive a response from EA.

Although there isn't yet a fix from GameSpy, PivX says a patch is planned.

Copyright © 2003, Situation Publishing. All Rights Reserved.

Will you support Eurogamer?

We want to make Eurogamer better, and that means better for our readers - not for algorithms. You can help! Become a supporter of Eurogamer and you can view the site completely ad-free, as well as gaining exclusive access to articles, podcasts and conversations that will bring you closer to the team, the stories, and the games we all love. Subscriptions start at £3.99 / $4.99 per month.

Tagged With

Comments

More News

Latest Articles

Supporters Only

Eurogamer.net logo

Buy things with globes on them

And other lovely Eurogamer merch in our official store!

Eurogamer.net Merch