Blog

What should I do if my game app is attacked?

06 Jul, 2025 stonecdn

Step 1: Emergency stopping of bleeding (done immediately when attacked)

  1. Type of Fire Location Attack
    • watch for symptoms::
      • Players dropping/lagging en masse → DDoS traffic attack(UDP Flood, SYN Flood)
      • Login/payment interface is down → CC attack(Simulates a real request)
      • Player account theft/property anomaly → Protocol Vulnerability Exploitation
    • Check logs: Use of iftop maybe nethogs Look at the peak traffic IP; use netstat Check for abnormal connections (e.g., a large number of half-connected states).
  2. Three axes of temporary defense
    • Cloud vendor backend open cleaningAliCloud / Tencent Cloud console has "emergency blocking", first to carry the first wave (Note: cleaning may accidentally injure the real players).
    • Manually hacking IP segments: Extract the attack source IP segment from the logs (e.g. 58.215.0.0/16), in the firewall bulk block (command:iptables -A INPUT -s 58.215.0.0/16 -j DROP).
    • Critical interface current limiting: Add token buckets to the login/payment interface to limit the flow (e.g., implemented with Redis.)EXPIRE user_login:${ip} 60 10(10 requests allowed in 1 minute).

Tears of Blood: Never reboot a server! Hackers may have planted a backdoor, and a reboot will result in a secondary paralysis.

Step 2: Reinforcement of defenses (mandatory after pause in attack)

1. Protocol layer protection - plugging the eye of the hacker's gun

  • Disabling hazardous protocols: Turn off all the servers on the UDP port(Unless necessary for game voice), hackers love to amplify their attacks with UDP reflections.
  • private protocol encryption: Do the game communication protocol (e.g. KCP) dynamic key exchange (DKE), reference code:
// Unity example: changing keys every 5 minutes
void Start() {
    InvokeRepeating("RotateEncryptionKey", 300f, 300f);
}
void RotateEncryptionKey() {
    byte[] newKey = GenerateAES256Key(); // Generate a random key
    NetworkTransport.SetPacketKey(newKey);
}

2. Server layer of protection - putting body armor on the machine

  • Linux kernel tuning(Anti-SYN Flood):
sysctl -w net.ipv4.tcp_syncookies=1 # Enable SYN Cookies
sysctl -w net.ipv4.tcp_max_syn_backlog=2048 # Increase the half-connection queue
sysctl -w net.ipv4.tcp_synack_retries=2 # Reduce retries

business isolation:: Putting Login Server,battle server,Payment Server Physical separation to avoid getting caught in the crossfire.

Step 3: Ultimate defense - on Professional Game Shield (StoneCDN recommended)

Why traditional high defense can't save the game app?
✘ High cleaning latency (200ms + players dropping wildly)
✘ Disowning game private protocols (hacking packets like nobody's business)
✘ Ridiculously expensive (1Tbps protection ≈ $1.1M/year)

StoneCDN Game Shield Hands-on Experience (Small Team True Scent Edition)

  1. Lightweight access, 10 minutes to go live
    • Import the Unity plugin directly (supports 2018~2023 versions) and the core API is just 3:
StoneSDK.Init("APP_ID"); // Initialization
StoneSDK.EnableProtection(); // enable protection
StoneSDK.SetRegion(Region.Asia_Southeast); // specify acceleration region
    • No need to change the game code and carry 270G attack traffic on the day of launch.
  2. Intelligent diversion, player 0 perception
    Attack Traffic → Global Cleansing Node (automated filtering of dirty data)
    Player traffic → direct server connection (latency <50ms)
    real effect: When attacked by a 310G UDP flood, the Southeast Asian player ping only went from 62ms to 71ms (no lag).
  3. Running at full frames even on a thousand-dollar machine
    • Memory consumption <20MB, OPPO A55 (Snapdragon 480) test: scene not open Shield open Stone Shield 100-player group battle 41fps38fps login scene 60fps57fps
    • Frame Rate Protection Tips: Dynamically degrade the encryption strength, using light encryption (ChaCha20) for low risk and cutting AES-256 for high pressure.
  4. Cost Direct 90%
    • Free version: get 50Gbps base protection (suitable for testing period)
    • Paid Version: 300Gbps Protection ≈ Traditional program 1/10th of the price
      Compare Bills: A cloud 500G high defense IP (45k/month) vs StoneCDN (4800/month)

One final truth: security is a game of reckoning

Hackers are business people too, and when the cost of attacking you is much higher than the benefit (e.g., it takes 500G of traffic to penetrate, while next door only uses 50G), they naturally move the goalposts.

StoneCDN GameShield's Best Value::
✅ Make it available to small and medium-sized teams at cabbage prices "Iron Persimmon" Defense(Attacks under 300G are basically no problem)
✅ Not picking a model(Frame rate loss <5% on $1000 machines, no player loss)
✅ stealthy technique: Dynamic port switching + protocol obfuscation, hackers can't even find the entry point of the attack

Tags.