Dead By Daylight Doxxing Issue
Allow me to preface this by saying I am not a cybersecurity expert, nor do I pretend to be. This is based off of my own knowledge around the subject, and if I get something wrong please correct me as this is about player safety.
This is in no way a comprehensive guide, but basic tips you can (usually) easily follow to help protect yourself online.
intro
So, for people who don't know, DBD currently has a security flaw allowing people to track the IP addresses of people they match with, and with that IP address are able to track down personal information (doxxing) or DDOS attack (Distributed Denial of Service attack- where lots of packets of data are sent to the router all at once, causing it to overload and in some cases fry completely) you. This flaw was discovered on the PTB, however can be exploited on live servers too.
Don't believe me? Streamers, especially large streamers, have been getting DDOS attacks incredibly frequently, from Paulie to Otz, and streamer Elix has been swatted live on her stream. DDOS attacks cause your router to slow down drastically, and often kick all devices off of the router.
While waiting for an official statement on this, hopefully along with some upgraded security, here's some things you can do to help prevent this happening, and what to do in case it does happen.
EDIT: We have an official statement from BHVR, as confirmed by @MandyTalk:
what to do
So, on a PC there's one main thing you can do.
Invest in a VPN
VPN, standing for Virtual Private Network, creates a midpoint between you and the DBD server. Your data is encrypted between your router and the VPN (in most cases), so if it's intercepted then it won't be readable (some of this data including, you guessed it, your IP address). A lot of VPNs can cost money- obviously, if you're only getting it to play DBD, attempt a free trial or get a free one. Don't spend lots of money for a product you're using only to safely play one game.
There are free VPNs, just for the record, which will do the job of changing IP address and preventing DDOS attacks even if they won't provide the snazzy features of other VPNs.
VPNs do not make you completely immune to DDOS attacks, however the VPN will take the majority of the attack, allowing you to potentially stay online even if it is slower.
Change steam networking settings
It is worth noting that the following has no impact on DBD specficially, however could help in other games which do utilise this feature. Thank you to commenter @Austin for mentioning this, as I was relaying information I'd gotten from Twitter. VPNs are your best bet for preventing a DDOS attack from occuring in the first place.
To change these settings, naviate to "Settings" in your Steam client:
Head to the "In-Game" option:
And change this option to "Never":
I don't know any preventative measures on console, however I do know a way to help remedy the situation.
if you get ddosed
Change your IP address
This will (probably) differ between the different ISPs, however changing your IP address can help if people have it and are sharing it. This can be done in a few different ways, so I'll link you to this guide on how to do it:
Want to change your IP address for online security or to unblock websites abroad? We explain step-by step how to change your IP address for free.
And yes, two of these options do work on consoles too (contacting your ISP, or disconnecting and reconnecting all devices after around 15-20 minutes).
if you get doxxed
Doxxing is the act of publicly revealing a person's previously private personal information.
Firstly, doxxing is a criminal offence (even if some countries don't have regulations explicitly on the subject matter, it can lead to other charges). If you are worried about having been doxxed, contact local police. If you have been threatened with personal information, screenshot and save their account details for use in the police report. They can be tracked down a lot of the time, and you can press charges.
This article by WIRED helps explain what to do if you've been doxxed, with tips from a cybersecurity expert.
If a troll is spilling your personal info across the internet, you have ways to fight back. Eva Galperin, director of cybersecurity at the EFF, shares tips.
TL;DR- Assess if you're mentally ready to deal with it, lock down all socials and other accounts for a while, and report the account used for doxxing to respective sites (as it's often times against their TOS).
There isn't much you can do, but just make sure to keep everything as private as you can.
if you get swatted
Swatting is the act of deceiving the emergency services into raiding someone's location, usually their house, by giving false tips to the staff. This could be something from illegal narcotics to alleged kidnappings. Swatting is also a criminal offence- so if you were doxxed and then swatted, be sure to save the details of the doxxer (do it anyway, but definitely do it here).
I can't exactly give a lot of tips here, however it's worth saying that you should use common sense. If you're being swatted, the emergency services have reason to believe you are potentially dangerous. Do not give them any reason to affirm these beliefs. Try to remain as calm as you possibly can- which of course will not be easy- and explain your situation as clearly as you can.
Remember that your life could potentially be at risk in case of a SWAT. This is genuinely dangerous and it's imperative you keep a cool head and do nothing reckless which could endanger you or others.
Stay safe.
Comments
Yeah, if I knew how to set-up a VPN for my Xbox I would.
Unfortunately, it's only going to be a deterrent. People can still get through, it just makes it less worth their time.
So since I’m on console I can’t protect myself at all since I can’t activate a VPN? Good to know.
BHVR is digging their own grave with NFTs, nerfing killers to oblivion, hackers and DDOS attacks. Lovely state we’re in.
Oh, but new content and cosmetics don’t stop coming! That’s all that matters, right?
Thanks Karu, that's good to know.
Thanks for the info Karu :)
Most of them own specialized services designed to hit through VPN's, I'm not familiar with how.
I do have a friend who was in that scene for a long time, so I could ask him if you're really curious.
Yeah, all of it is also super illegal as well. The issue is it's hard to prove and expensive to pursue a case.
I know the people who hit me, sent zip-bombs and fried my router tried to hit someone else offline, but they were on a military base's network, iirc. All of this is through the virtual grapevine, so take it with a grain of salt, but, they are currently being prosecuted because the military has both the money and the resources to prove and pursue a case.
I know nothing about how console networks do things. However, consoles are effectively PCs themselves, and you're still using your modem, so no. Presumably, console is in as much danger as PC.
"Our players are of the highest importance to us"
I don't think I even need to write up a snarky comment to that saying otherwise.
I still can't believe that I can be swatted by some guy getting upset over this game seriously wth.
This needs a full-blown PSA regarding the issue until the vulnerabilities are fixed. Any statements about BHVR caring about the community are completely hollow with anything less.
In the meantime, don't play the game until they fix this, period. Even if this was the best game ever made, it's not worth it.
ah crap, looks like i'll have to stop playing until the fix comes by, pretty sure there'll be random killer/survivors who gets pissed at me for maining blight and flashbang/headon/blastmine build. urgh.
but just to clarify, this doxxing issue can only be caused by players currently in your match, right?
Doxed by Daylight
Why do I even play this game bruh..
That's explains everything. Yesterday I played as killer and one survivor in post game chat said Hello to my home town. I was shocked a little.
I can't use vpn because I live far away from servers and I have to fight for every point of my ping to make game comfortable for me and my opponents.
Vpn will make my ping worse and switching steam settings probably make connection slower.
I wish BHVR or Amazon open servers somewhere in East Europe.
to avoid the whole hacker issue with dbd ive taken mathieus old advice about playing something else. I haven’t touched dbd in two days and I plan on not playing until all of this is addressed and fixed by the devs. This game is not worth all of the stress it used to put me through, now more than ever
Man, this is so sad.
Thanks for this thread. I think I might take a break then from playing this game.
Does playing with crossplay off on console help for the time being? I was already half way on the rift and I wanted to complete this one because I got so far with the event rift progress. If not, then I think I will just let this one go, since I don't think they will fix this in time before the rift ends.
I also hate the fact that they are once again completely radio silent about this issue (as well with other issues in the past and the recent hacker epidemic). And I don't count the sentence in that article, since I didn't even know that site before today.
They should be completely open about this issue, since it's a matter of a privacy breach on their end.
That official statement is the most pathetic thing I've read in a long time. Thanks for bringing more attention to this.
Are just hollow words imo. Because they needed to say at least something for that article.
+1 for including a source. Multiple +1s (which unfortunately are not possible) for the rest of the post.
One thing that should be added though:
So, on a PC there's one main thing you can do.
You can install a VPN on your router. That should protect you if you are playing on console as well. Not every router supports this. If you are using the router that was sent to you your ISP then there is a high chance it won't let you install a VPN. - often the routers that the ISPs provide are crap. You need to check the manual of your router or the router's menu to see if it's possible.
If your router does not support this you can buy one that does and replace the one your ISP sent you. Some ISPs in some countries require you to use their router, in that case you can activate Bridge Mode on your ISP router and connect your new router to your old router and install your VPN on the new router.
The thing is I don't really wanna advise people to go and do things which cost money, hence why I mentioned free VPNs, or free trials. You shouldn't have to pay money to play a game securely you were able to a few weeks ago.
I didn't wanna title the thread PSA but I'm hoping this can serve as an ample warning to at least all forums members
Seems like out of all the forums for DBD, only this forum has let me know about this security breach. Even the subreddit barely has any talk on this topic. It's as if majority of people just don't care about potentially having their router fried or worse, their information geting leaked and used against them.
You shouldn't have to pay money to play a game securely you were able to a few weeks ago.
Absolutely this. Quick note: Some ISPs do provide good routers that support VPN. I don't know how many free VPNs support routers though, so that could be an issue.
This thread should at least be pinned if I'm honest. The fact they don't do this, says enough for now.
Well, the reason I brought that up is because, let's be real, only a small portion of players are on the forums or reading a Eurogamer article. Many are blissfully unaware that all it takes is one lunatic to cause very real harm to them.
Could someone please provide viable free options? I tried one called Proton VPN, it ends up breaking my Internet connection (like a Twitch stream stops, can't load web pages either, etc.) when I'm about to join a lobby in DbD. Saying something about no P2P traffic is permitted on this server.
Oh definitely; I didn't know the article existed until I saw it on another thread. So I'm hoping this thread will at least be enough to warn the forums, and I know Twitter has many different threads on the matter too.
However, an in-game announcement telling people to be careful and if anything happens to save evidence about it? Would've been so much better. It's a lot harder to say you didn't know if it was in the in-game news and on official socials.
ExpressVPN, Surfshark, and NordVPN are three different free trials you could try, and Surfshark (at least for me) works for DBD. This covers you for about 30 days, which should be long enough for BHVR to have fixed the issue. CyberGhost is also quite good with a 45 day trial, but the only one I can really comment on in Surfshark because it's the one I use.
TunnelBear and Hotspot Shield are two free ones asides from Proton with pretty good ratings, but again I can't comment on usefulness.
I'm sorry for not being much help; I hope someone else can point you in the direction of one that works.
Windscribe has a free plan for 10gb per month, but that probably wouldn't be enough. However, you can buy unlimited data for one country of your choice for 2 dollars a month minimum, which is not bad. It's what I'm currently using, and it does the job well and is pretty good in general.
I think I cant be doxxed neither swatted.
Doxxing - I have no personal information in the PC.
Swatting - I'm in Europe.
Doxxing- they can trace your address and other information from your IP address alone. It doesn't hack into your computer, but your router.
Swatting- you can still have police called who will arrive potentially with weapons. Definitely the case here in the UK, anyway.
i guess the reason why this thread isn't pinned is because they don't want to lose players even for a short while. "players are our utmost importance" LUL
yes, they should clearly shut down the servers till the issue is fixed.
Did I just have this happen to me? Loaded a The Last Mask offering, my entire game crashes. The offering is gone but no DC penalty. ?
No, that seems like a regular crash. A DDOS will cause your entire router to slow down drastically and possibly force a restart, preventing every device from connecting to it.
It's very unlike that was a DDOS, if your Internet remains functional.
Im pretty sure in the US they can't get any more specific than your city unless your in law enforcement, Idrk tho, it can give info on the service provider, but only a rough estimate.
Are we talking about legally or illegally because illegally they can get a lot of information on you from IP address alone
I mean if they are in law enforcement than yea. Because the your ISP provider does have your exact adress, and if the police come with a warrant, asking for the location, it can be given with a warrant.
Really bad for us console players. Probably not worth playing this game anymore this is just too scary.
An IP address alone is not inherently going to identify you as a person, it's gonna tell whoever's tracing it where your local ISP datacenter is located. Depending on the details this can get as detailed as what city you live in, or more vague like general area. Certainly your country though, which might be uncomfortable but doesn't really narrow it down that bad.
Most (vast majority, I'd argue) doxing happens because of traversable information trails from anonymous aliases to IRL identities. Re-used usernames or other details (publically visible emails and other contact details can be particularly nasty) that let people go on a Google Detective journey from a gamertag to a forgotten forum post in 2008 where you shared your facebook, to use an example that might be a near-"best case scenario" from a doxer's perspective.
Of course I'm by no means saying it's okay to willy-nilly give away the IP addresses of players, both because it can be a piece of the doxing info-gathering puzzle and because you don't need to actually know who someone is to attempt DDoS. There's a lot of reasons why that kinda info should be obfuscated whenever possible.
Gonna stop playing until this is over too.
They're not going to care until such point as they are sued for it.
Bro, please. You don't get it. Bro, we care about inclusion and sportsmanship, like man please just buy this meg skin it has a cat on it, man please. Swear we care, we are monitoring the situation like please dude, here's 50 000 bloodpoints.
do we still have doubths about BHVR not giiving a ######### about us?- this is just way too much. BHVR is the most disastrous and pathetic company ive ever seen.
Damm guess I'm gonna go play f13 instead
I did not expect anything else from the DBD community.
If you feel that way then perhaps it's best to understand that putting yourself out there for potentially millions of people to see is dangerous. Especially, if you are including your political beliefs in your streaming or you are transgender/gay or whatnot. There are some people out there that will hate you for what you are or what you believe and will do whatever they can to make you pay. If you're going to put yourself out there for everyone to see then I would be prepared for something like swatting to possibly happen.
Same thoughts bro right now is possible thst between hackers to start DDOSing people just for fun.
Even when they say they fixed it Im gonna wait a month to actually be sure.We know they said we fixed this bug and keep hapoening and im not gonna bet my security on them.