Dead By Daylight Doxxing Issue
Allow me to preface this by saying I am not a cybersecurity expert, nor do I pretend to be. This is based off of my own knowledge around the subject, and if I get something wrong please correct me as this is about player safety.
This is in no way a comprehensive guide, but basic tips you can (usually) easily follow to help protect yourself online.
intro
So, for people who don't know, DBD currently has a security flaw allowing people to track the IP addresses of people they match with, and with that IP address are able to track down personal information (doxxing) or DDOS attack (Distributed Denial of Service attack- where lots of packets of data are sent to the router all at once, causing it to overload and in some cases fry completely) you. This flaw was discovered on the PTB, however can be exploited on live servers too.
Don't believe me? Streamers, especially large streamers, have been getting DDOS attacks incredibly frequently, from Paulie to Otz, and streamer Elix has been swatted live on her stream. DDOS attacks cause your router to slow down drastically, and often kick all devices off of the router.
While waiting for an official statement on this, hopefully along with some upgraded security, here's some things you can do to help prevent this happening, and what to do in case it does happen.
EDIT: We have an official statement from BHVR, as confirmed by @MandyTalk:
what to do
So, on a PC there's one main thing you can do.
Invest in a VPN
VPN, standing for Virtual Private Network, creates a midpoint between you and the DBD server. Your data is encrypted between your router and the VPN (in most cases), so if it's intercepted then it won't be readable (some of this data including, you guessed it, your IP address). A lot of VPNs can cost money- obviously, if you're only getting it to play DBD, attempt a free trial or get a free one. Don't spend lots of money for a product you're using only to safely play one game.
There are free VPNs, just for the record, which will do the job of changing IP address and preventing DDOS attacks even if they won't provide the snazzy features of other VPNs.
VPNs do not make you completely immune to DDOS attacks, however the VPN will take the majority of the attack, allowing you to potentially stay online even if it is slower.
Change steam networking settings
It is worth noting that the following has no impact on DBD specficially, however could help in other games which do utilise this feature. Thank you to commenter @Austin for mentioning this, as I was relaying information I'd gotten from Twitter. VPNs are your best bet for preventing a DDOS attack from occuring in the first place.
To change these settings, naviate to "Settings" in your Steam client:
Head to the "In-Game" option:
And change this option to "Never":
I don't know any preventative measures on console, however I do know a way to help remedy the situation.
if you get ddosed
Change your IP address
This will (probably) differ between the different ISPs, however changing your IP address can help if people have it and are sharing it. This can be done in a few different ways, so I'll link you to this guide on how to do it:
Want to change your IP address for online security or to unblock websites abroad? We explain step-by step how to change your IP address for free.
And yes, two of these options do work on consoles too (contacting your ISP, or disconnecting and reconnecting all devices after around 15-20 minutes).
if you get doxxed
Doxxing is the act of publicly revealing a person's previously private personal information.
Firstly, doxxing is a criminal offence (even if some countries don't have regulations explicitly on the subject matter, it can lead to other charges). If you are worried about having been doxxed, contact local police. If you have been threatened with personal information, screenshot and save their account details for use in the police report. They can be tracked down a lot of the time, and you can press charges.
This article by WIRED helps explain what to do if you've been doxxed, with tips from a cybersecurity expert.
If a troll is spilling your personal info across the internet, you have ways to fight back. Eva Galperin, director of cybersecurity at the EFF, shares tips.
TL;DR- Assess if you're mentally ready to deal with it, lock down all socials and other accounts for a while, and report the account used for doxxing to respective sites (as it's often times against their TOS).
There isn't much you can do, but just make sure to keep everything as private as you can.
if you get swatted
Swatting is the act of deceiving the emergency services into raiding someone's location, usually their house, by giving false tips to the staff. This could be something from illegal narcotics to alleged kidnappings. Swatting is also a criminal offence- so if you were doxxed and then swatted, be sure to save the details of the doxxer (do it anyway, but definitely do it here).
I can't exactly give a lot of tips here, however it's worth saying that you should use common sense. If you're being swatted, the emergency services have reason to believe you are potentially dangerous. Do not give them any reason to affirm these beliefs. Try to remain as calm as you possibly can- which of course will not be easy- and explain your situation as clearly as you can.
Remember that your life could potentially be at risk in case of a SWAT. This is genuinely dangerous and it's imperative you keep a cool head and do nothing reckless which could endanger you or others.
Stay safe.
Comments
Yeah I’m on that same boat as well. Stay safe!
Now you save money in routers with a vpn
You probably quoted the wrong person
Just a little message to anyone who might be getting funny ideas. DDoSing is illegal in most countries and can end in you getting a criminal record.
Lets everyone get VPNs
Bit late to the party. Proton blocks P2P traffic when using the free version, so it will block DBD if playing PTB as PTB doesn't use dedicated servers, I believe. But, Proton will work when playing the "live" version of DBD - I use it.
Windscribe is free, but, I think that comes with a 20gb monthly bandwidth limit (that should be plenty enough for gaming though).
That said, you really do not need to worry if some stranger online knows your IP address, it isn't supposed to be "private". Every owner of every website you visit can see your IP address and millions upon millions of webites are run by random people who don't care about / take privacy very seriously at all. It's trivially easy to get someone's IP address.
You cannot trace a physical address from someone's IP address alone. An IP address will give an approximate location, but it isn't nearly precise enough for someone to know what house you live in, in order to send police on a false call. You can maybe pinpoint what city someone is in, but, that's about it.
I would recommend against using at least four of those VPN's.
NordVPN was recently hacked - If you don't trust DBD/BHVR in regards to IP leaking then it's probably not smart to use a VPN which was compromised and potentially allowed the interception of internet traffic going through their servers.
ExpressVPN was recently bought by an Israeli cybersecurity company (Kape). One of the executives "Daniel Gericke" used to be a"mercenary hacker" for the United Arab Emirates, where he and others would hack American machines for UAE government. I just don't think this company is trustworthy at all.
Surfshark, admittedly, I haven't looked into this one too much as I have a few niggling issues that probably wouldn't bother most people (trackers in apps, crash logs), but, there are simply better options which are free.
Hotspot Shield and TunnelBear just shouldn't be used by anyone. Neither of them are trustworthy at all.
From a privacy standpoint, I wouldn't use anything other than ProtonVPN, Mullvad, IVPN and perhaps Windscribe (unless you're overly paranoid about it being a Canadian company).
Virtually every site you visit logs your IP address, regardless of whether you're using a PC, a phone, tablet, console or anything else.
It's practically impossible to DDoS a decent VPN to the point that it actually affects their servers. It is impossible to "DDoS through a VPN". If the VPN sucks / is provided by an unreliable company, then you could potentially DDoS the IP of the VPN itself to the point that it gets taken offline, which would then reveal your real IP (a killswitch would prevent this), but, this wouldn't really work on any of the "larger" VPN providers as they have preventative measures specifically for this kind of thing.
There is no "specialised service" which can hit "through" a VPN.
Very few make them publicly available for the expressed and singular purpose of booting people offline.
True. Although, most companies which obtain/harvest your information and then sell/give it away do so privately and don't care what purpose whoever they're selling it to wants it for. They just offer it to the highest bidder - unfortunately though, that can often be hacking "groups", who regularly pay extortionate amounts of money for it.
rip game, rip console.
You’d have to give me a step by step then, because I was only trying it on the live version with the quick connect feature. It would temporarily shut off my Internet entirely once I found a lobby.
You know, you're absolutely right. I, apparently have a subscription with ProtonVPN, so I have the paid version (news to me). I just tested via an alternative "free" account and it wouldn't let me connect. Apparently, BHVR's coding is so bad that it still registers DBD's servers as peer to peer, as opposed to dedicated servers.
Windscribe is probably the only other free VPN I can think to recommend. It has a monthly limit of 10GB (used to be 20). If you receive a referral code you can gain a whopping additional 1GB a month (happy to send you one). If you "Tweet" something from Windscribe, your limit goes up an additional 5GBper month (you can find this in the account settings of your Windscribe account). That's at least 15GB. If you enable split tunneling and only direct traffic for DBD through windscribe and have everything else (browsers etc,) not directed through your VPN, then that 15GB will go much further.
How much playtime does 15 GB with split tunneling translate to? Probably won’t last me the full month, haha.
I can't really comment amazingly on this, but it should be fine? I was playing using mobile data a year or so ago (awful Internet + I was playing on WiFi not Ethernet anyway) and after, like, an hour or so it'd only used about 500mb.
Thanks for the info!
You cant get personal info just from attacking a network. That's what social media and Twitch are for. Be careful what personal info you give to complete strangers on the internet.
I've seen people talk about this a lot in the last few weeks, as a result of certain trans streamers being doxxed and "swatted", though I hadn't really paid much attention until yesterday.
It's worth mentioning that "Elix" at least, has their personal information all over the internet. I'd never heard of them until yesterday, but, It took me about 10 minutes to find their real name, D.O.B, address, employment history, education history, family connections, credentials/qualifications etc,. (everything essentially) just to make a point to someone else that whoever "swatted" this person, did not get their personal information by DDo'S'ing via DBD, which is what a lot of people seem to think has happened.
I was genuinely surprised at how many people think that you can locate someone's physical address using their IP address alone and are advising others to use a VPN as a result, when really, it's not necessary at all. It's actually what prompted me to create an account and post here.
Can't really say that I've monitored my usage and it'd really depend on how many hours you play per month. A quick Google search led met to a post by a person who played for 49 hours and used 1.64GB. Another post elsewhere mentioned 30mb in an hour and 30*49=1470 (1.4GB), so it does seem to use around 30-50mb per hour. At 50mb per hour that would give you roughly 300 hours of playtime with a 15GB limit.
Is it possible to use VPN on a console?
That's why VPNs are becoming a hot thing now. People don't understand the internet and others are profiting off their misfortunes. Really sad to see companies doing that, but... just need to educate more people and give them better information.
I think you'd have to set it up on your router.
Even still, it probably wouldn't help on Console. There are sites that log and publicly show your IP so that others can boot you offline. I imagine they'll probably notice something is up if the IP associated with your account moves.
But maybe not, might be worth a shot.
You can set up a VPN on your router. Windscribe, for example, allows this. I've also found an interesting workaround for those unable to access router settings / don't feel comfortable doing so by using your PC as a Wifi hotspot, connecting your PC to a VPN, then connecting your Xbox to the hotspot on your PC:
https://www.reddit.com/r/Windscribe/comments/j8bark/xbox_one_vpn_using_windscribe/
There's also a free, open source app available on Android called "VPN Hotspot"made by "MyGod Studio", which you could also use, but this does require that your phone be rooted.
For those who have the option of using an Ethernet cable between console and PC, this method seems a little more straight forward:
https://www.windowscentral.com/use-vpn-xbox-one
Sorry for bumping this thread, but do we have any information of if/when this is going to be fixed? Feels like it's been completely forgotten about without any official confirmation that it's been addressed or patched.
PTB patch notes suggest a fix although we will never know for certain because more information = more people who know to stop so they don't get caught.
However, using VPNs and other Internet safety tips should still be followed wherever possible, because DDOSing/Doxxing isn't exclusive to DBD, sadly, and can be done through other online games or sites.
Just take as much caution as is reasonably possible given any circumstances you have, and if you suspect foul play contact your ISP. If someone is blackmailing you with personal info, etc, then go straight to police.
It's insane we have to worry about this now just for playing the game though. This wasn't an issue less than 3 months ago and now I can potentially be put in some sort of danger because BHVR won't fix whatever the problem is? This isn't directed at you, just general frustration.
I hope you're right that the vague patch note is alluding to a fix for this specific issue, only time will tell. Any support ticket I've sent in about the issue has been met with a response that indicates BHVR never found an issue in their servers, which is blatantly not true considering they confirmed as much in November and a warning was displayed on this very website for 2 months. I just want to know our security is a priority before I play the game again, I haven't touched it since November because of the general shadiness surrounding this whole event.
Any update on this? Are they just going to leave the game open for people to be DDOSed or has it been patched finally?