Lag hack on NA ladder - Page 44

I couldn't defend it with a Phenom X6 and 8 MB down.

On July 04 2011 04:22 Furlqt wrote:
Made an account to try and clarify some thing about what exactly the Lag/Drop Hack is and how it works.

Essentially, the Battle.Net protocol is based around players sending events to the server and the server sending those events back to all the players in a match. These events all have unique IDs, and the codes for these events are relatively sparse (that is to say, if you pick a random number between 1 and 24 million, chances are it's not a valid event). However, the server does no filtering as to whether an event is valid--it sends the event down the pipe regardless of validity.

So, the drop hack works, essentially, by abusing this system to DoS your client. It spams the B.Net server with gibberish event IDs as fast as the Drop-Hacker's network can handle, and the B.Net server sends this back to your client, where your client is left confused trying to figure out why the server sent it a gibberish event. It looks up the event in all the game files and goes through all the rhetoric--but, these gibberish events are coming down the pipe so fast that the client locks itself up through this.

I think, also, but I'm not sure, that when a client encounters a gibberish event it tries to ask the server to resend the event, meaning one gibberish event might strike a chain of events that can't stop itself.

Now, this is also why when you're looking at a replay of these hackers that it slows down your client, since the replay is just a copy of the events that your client received during the match. A small test in a custom game showed that about 5 seconds of using one of these Drop-hacks on myself, through my very low bandwidth connection, produced a replay with an events file that was 917KB long (this gets compressed substantially, since the gibberish is produced in a very simple manner), compared to a normal replay which would be about 100KB of events uncompressed over 30 minutes.


All that would be required for Blizzard to fix this is to do a very simple filtering on events. I highly doubt this would slow down their server very much at all, if properly implemented, and it would take a 3-year-old about 2 minutes to implement. Why they have yet to patch their server, I have no idea.

[edit/addendum] The only limiting factor for the drop hacker is his upload bandwidth. The limiting factors for the person being drop hacked are his download bandwidth and his CPU speed. If the drop hacker has your average American cable connection, his upload bandwidth is maybe 384kBps. The person being drophacked would need something like a 1MBps download and something like an i7 to properly fend against it. Running SC2 from a SSD (hard drive) probably doesn't hurt, either.