Regarding current multiplayer issues

[Arheo]

Hi all,

I'm posting this to ensure that it is clear that we're aware of the current targeting of multiplayer hosts on HOI4.

We're fairly sure these attacks take the form of a 'DDos' attack. As those in software engineering will be aware, denial of service attacks are pretty much impossible to prevent on small-scale targets such as game hosts, however a vulnerability in a third party library incorporated into the game has made it easier for certain individuals to instigate this behaviour.

What are we doing about it?

Well, the long term solution is to replace the API in question. This is not something we can do quickly, and throwing people at the problem will not speed it up.

In the short term, we're looking into providing some ways in which hosts can work around the issues or avoid public visibility of their servers.

As of now, I have no ETA on any solutions. It's still the middle of our vacation period here, but those personnel which are available are investigating the issue.

/Arheo

PS:

Reports on this issue are still useful, but please avoid making reports on behalf of others. This skews our visibility of the problem, and is unlikely to yield any usable data.

 

[avcar98]

This is the SelfHatingTurk from reddit who made the post about the problem. Thank you, hopefully it will be fixed and we will be playing hoi4 mp without any problems again.

 

[ShaunD]

@Arheo,
Last night, me and a friend setup a small OpenVPN server over at Hetzner and we connected to each via OpenVPN. When one of us hosted a HoI4 lobby and the other joined the lobby, we noticed with Microsoft Net Monitor that part of the network traffic went through the VPN tunnel while part of the traffic went out over the internet to then connect to the lobby.

Is there somewhere in the HoI4 game, an option to host an MP game over LAN? The VPN routing itself would then handle the networking?

 

[unsdeagel]

the method being used to Ddos is by getting the host ip via the server list the obvious solution short-term is allowing hosts to turn the lobby invisible to the list or disabling the list entirely since most of the grand scale mps are set up via discord and don't really need the server list

 

[Rich_German]

Stopping the DDos would be great, but from my experience hosting on a 1000+ server almost daily, the much bigger problem are those scripts allowing people to start the lobby without being the host. They make it impossible to collect players in a prehost to get a mod game going. These scripts also let you take over control of other nations in game, so in 1940 the UK navy may just vaporise and 30+ players wasted 4 hours of their game.
These script problems are muuuuuch more pressing than the DDos, which has only happened once or twice on our server.
If I may propose an easy solution: Just disallow people from changing their nickname and instead tie it to their steam name, at least until the prolem is fixed. We know very well who is doing this and we know their steam profile too, so do most other server owners. Doing this would stop them from infiltrating games to trash them at a later point.

 

[Froinchi]

Dear PDX Staff,
The Twitch streamer TommyKayLive just published all the information he got about the DDoS case, including the way how script works, how did they manage to DDoS people. I think this is a critical thing for you to see. Please check out the Twitch stream replay I am dropping below:

Sincerely,
a fan who loves your games

 

[Kachanov]

Contacting technical developers
Hi, Im a famous youtuber in Russia by hoi4 Kachanov. I make videos on multiplayer games
Yesterday my multiplayer games were attacked by cheaters, they have access to the console panel
With the help of a cheat they can:
Become invisible in the lobby
Log in to the server without a password
Create puppets while playing
Add equipment
Create divisions
and much more
The problem is increasing every day, this cheat is publicly available
I also have a video with his work, here at 0:50 the cheater makes a USA puppet of Cuba
I also have access to it, so I can provide all the information I need. I hope you'll give me a hand

 

[Voigt]

What did the Streamer exaxtly do what would be Paradox job? Paradox needs to close the entries of Cheat Engine in multiplayer and give the host of the game to at the very least stay private on discord and give tools to ban people from their game.

It seems Tommy just gathered Informations how the existing hacks work, but why would you assume Paradox internally doesn't know about that stuff, if they are saying they are working on it?

 

[jpd]

@Arheo,
Last night, me and a friend setup a small OpenVPN server over at Hetzner and we connected to each via OpenVPN. When one of us hosted a HoI4 lobby and the other joined the lobby, we noticed with Microsoft Net Monitor that part of the network traffic went through the VPN tunnel while part of the traffic went out over the internet to then connect to the lobby.

Is there somewhere in the HoI4 game, an option to host an MP game over LAN? The VPN routing itself would then handle the networking?

A VPN, by itself, does not route any and all traffic through the VPN.

What a VPN does (as the name Virtual Private Network implies), is to make your PC part of a subnet of another network. That makes some changes to your own PC's routing table.

All traffic destined for one of the systems connected to the subnet your VPN is tunneling to will be routed through your VPN tunnel. All other traffic will be directed to your normal ISP uplink connection (things like DNS lookup requests).

If you want to change that, then you will have to manipulate your local routing table on your system. It's not something the game can do for you. The game merely generates TCP packets to be transmitted to other IP addresses. It's your own (windows) system, with it's routing table, that determines which route the packets need to take to reach their destination.

 

[Ganduler]

It seems like the issue also can be exploited in EU4 lobbies.