How to prevent "TSource Engine Query" DDoS attack?

Question

I recently started a game hosting company and one of my boxes is being hit very hard by what i believe is a botnet. We are getting thousands of IP addresses sending traffic to a port where a game server is located.

In total there was 2,613,561 packets sent from 40,000+ different IP addresses according to Wireshark. I rent boxes from OVH, and clearly their DDoS mitigation appears to not have any affect on this attack as it went on for over two hours.

AFter inspecting the packets with Wireshark, I found that the majority of them are directed at port 27115 (where a game server is located) and contain "TSource Engine Query" in the data:

I can provide the wireshark capture file if needed. I managed to capture packets for most of the duration of the attack.

What can I do to prevent this kind of attack in the future?

Answer 1

While I have not encountered such attacks when running game servers, I always had control over the box I was running them on.

In your case, you are being flooded by A2S_INFO requests, and according to US-CERT, this kind of attack is amplified by about 5.5x that of a "standard" query and response for information over UDP.

Information Security deals extensively with risk management. As we will consider this attack as a risk, there are three options to take (or combine):

You can mitigate it:

• Use an IPS or firewall to blackhole/shunt the packets by volume of requests.
• Ignore requests from certain IP addresses (limited in comparison to legitimate traffic).
• Cache the requests, and respond to new ones with a cached version.

You can transfer it:

• Notify your service provider that you require specialized DoS mitigation.
• Transfer to a service that understands you require mitigation of UDP traffic.

You can accept it:

• While not an answer you may want to hear, it is valid only if you loose little with the downtime.

Additional readings:

https://www.us-cert.gov/ncas/alerts/TA14-017A

https://developer.valvesoftware.com/wiki/Server_Queries

https://forums.alliedmods.net/showthread.php?t=273129

Answer 2

It appears that the game engine you are using (you didn't specify) may be using UDP and not TCP so the usual Install Fail2Ban and mod_security (listening on port 27115) then write a mod_security filter to trigger on the problematic "TSource Engine Query" requests if you can.... probably wouldn't work here.

That said you could easily do almost the same thing using Snort and Fail2Ban

There are other things you can do as well:

See if the IP's are associated with a particular BGP AS number, country, ISP, or possibly with Tor exit nodes (these can be blocked).

If the system(s) processing these specific requests can be isolated to a separate set of computers, such that other services won't be affected when this happens again, do so.

Do preventative performance tuning on your systems so they handle well under load. Identify key bottlenecks and push as much as possible into RAM including your database.

Look closer at the packets and see if there are any unique characteristics about the clients making these requests that might allow for easier and safer blocking.

Some anti-DDoS tools only work for specific protocols (TCP and not UDP) and/or only for certain ports (80/443), make sure you understand how these work and don't work. It may not be your ISP's fault but simply a case that the tool they have only helps if it's a website or a service running on TCP.

Do normal clients connect with a specific request before making additional requests? If so you may be able to use a server-side cookie (or at least leverage that equivalent action) to authenticate the type of user before allowing certain types of queries to be performed and block all others (Think: is this a "Human or valid client" cookie).

If there is any initial web component and it's an option, use a tool like reCaptcha when users initially arrive at the site to verify they aren't part of the attacking bots.

The best solutions will require more security architecture but these are good places to start. Snort combined with Fail2Ban and IPTables may be your best option for a quick solution for now.

Answer 3

You should probably hire a professional DDos protection service, such as CloudFlare or Akamai DDoS Protection.

Additionally, you can attempt to determine the attacker's C2 server. While this appears to be an UDP amplification attack, which uses spoofed packets, making it difficult to identify the source, sometimes, the attackers use the server itself to send packets as well. Often they will ping your server to determine if it's offline. Once you have that attacker's server IP you can report abuse or launch a DDos attack of your own to knock them offline and therefore prevent the attack. Fighting fire with fire... Of course you should check legality first, this isn't legal advice...

http://grehack.org/files/2013/talks/talk_3_5-nolla-ddos_amplification_attacks_with_game_servers-grehack.pdf

Answer 4

I wrote a simple solution for the mitigation DDoS attack to Source Engine

1. Extract packet from data flow by changing dst port to custom.
2. Proxy server listen this custom port and answer to client
3. Change answer src port to gameserver port and client will see response like from original server

For items 1 and 3 i use Linux Kernel module, and published the simplified version (proof-of-concept): https://forums.alliedmods.net/showthread.php?t=297237

You can use it for your servers protection.

But you need some application from item 2. Application should update caches (with gameserver responses) May be collect some statistic or apply heruistics to determine DDoS and block unlegit traffic

You can read more about this solution by link above