Behind The T1 DDoS Attacks

[@r.v.jscourge2032]

DDoS and hand injury but he still won worlds twice in a row

[@Jasongy827]

Faker built different

[@texasallstar6969]

and was one game away from 3 peating lol

[@Heiji1337]

@@texasallstar6969 If they get a DDOS ill bet they do a Lan-Party with over 500 Korea Challenger Player and Pro Teams xD

[@trevorryder9732]

To think they still endured and won worlds. Insane

[@DootyDuck]

@@ribthiefz8283 how bitter can one be

[@replex8889]

@@ribthiefz8283 Yeah lil bro, their games are about real money, not your Robux coins. It's a big psychological factor for them because it's their job and career to win. And when they can't train, of course, it takes a toll on them

[@TwoTwig]

@@ribthiefz8283 So bitter lol, you must be Chinese or an LPL fan huh? T1 still won, get over it.

[@shinodamasaru7945]

Those DDos hackers must be basement dwellers who never grows.

[@Gojiradogzillagodzilla]

@@ribthiefz8283 If you think thats just "internet issues" for a professional league team then you're seriously lacking in basic cognitive function

[@ChonkyBoi_yt]

It's even more impressive T1 managed to win so many worlds with this bs

[@Roflmao6173]

Its not like their local LCK performance didn't suffer though. But I think worlds with its isolated patch and isolated practice environment allowed them to showcase how they can get ahead of the rest in adapting to the meta if given the proper chance to

[@ChonkyBoi_yt]

​@@Roflmao6173 yea it just shows how much better their players are if they can win on equal grounds and opportunities. Other world champions in the past didn't have to deal with this mess

[@RandomPL69]

@@Roflmao6173 actually they even ddos some LCK match(it got time out for hours then they agreed to play the next day cuz its late) if i remember then riot switch to LAN thats how they dodge the ddos

[@benjaminghazi787]

@@RandomPL69 yeah, it was only t1 matches too

[@arthurlul]

stop glazing t1, its a very average team

[@HACKERNEWS2025]

this is a real problem in multiple games, i got hit offline 2 times in a week by kids who have something called nightmare stresser or booter or something like that, i am getting sick and tired of this... if someone has a fix other than a vpn please tell me the vpn is too slow and laggy

[@shadowimagery]

Being able to DDoS people in solo queue is one thing, but being able to DDoS people during a professional match is unacceptable. Pro matches and/or scrims should not be pinging the RIOT servers in any capacity. It's unnecessary when we have the technology to create private servers that don't require an internet connection to the outside world. RIOT has billions of dollars in revenue every year and they actively choose to not use this type of setup during pro matches when it's stupid simple to do with their resources. Absolutely disgusting.

[@gemesil]

They need an external connection for vanguard / other anti cheats detection. It's not as simple as it seems.

[@rleften5788]

@@gemesil There is no reason to need an external connection besides that being their own design. There is no reason they can't have a local server with the necessary data they need for it to operate and have an updated connection URI. I think LCK is being played fully offline now though?

[@asdfg5721]

Is this real? I thought T1 was ddos in solo queue not pro match?

[@kaine438]

@@asdfg5721 t1 got ddos in both

[@rleften5788]

@@asdfg5721 There was an incident were LCK matches were postponed and eventually played off stream because LoL Park was DDOSd, I was watching live when it happened, but I'm pretty sure that is why they really moved on making an offline server a thing.

[@SilverDarkin]

its obvious what's happening, clearly they're just writing the T1 player's names in the Lag Note

[@Xshifto]

my best guess is gambling, if they can win money by ddossing to win bets...that's a lot of money and its a lot more money if they also own a betting platform.

[@BlackAnarchia]

Bookmakers will cancel any bet results due to disconnects, plus solo queue bets have lower betting limits that official matches. Its something else.

[@notyourdad9548]

Still money to be made. As long as it isn't huge bets no one will care. A couple hundred dollars here and there will never be investigated.

[@codingorgaming982]

​​@@BlackAnarchiathat changes it only a little bit. If one entity has control of ddosing and they bet for a T1 player to lose, then they simply don't ddos if that player is losing. If they're about to win, then they ddos and get the bet cancelled. If you have 2 entities who can ddos and they bet opposite of each other, then that game is guaranteed to be ddos'ed.

[@DragoonRyRs]

its 100% chinese hackers trying to win worlds, its not that deep. Gambling they would not just be hitting t1

[@codingorgaming982]

@@DragoonRyRs Why not both? Chinese gambling for LoL is pretty big, and most money going into gambling on games is on T1 players, no?

[@alcatraz8694]

knowing how useless riot is, I can Imagine someone from the comunity exposing them out, however that would not solve the problem, it is just shitty for everyone

[@oskkim2163]

Coming from riot, they will ban the korean servers instead of fixing their problem xD

[@oskkim2163]

Or they will put the queue soloq ddos bypass for 20$

[@zwingler]

Riot has a Dev culture where you get punished for mistakes but not rewarded for outstanding work. They just offload risky work to external devs to wipe their hands clean of any responsability.

[@coycen]

what do you mean useless? DDoS attacks are impossible to defend against. all you need is enough power to send so many packages that the receiving server can't handle it. it is MUCH easier to just send packages than receiving them

[@MartialArtsNk]

@@coycen Stop crying, they are literally useless. They have been a useless company from their inception. Other than catching lighting in the bottle at the beginning with their marketing tactic, they have been utterly incompetent. Lets not pretend just because it's hard to deal with ddos attacks that Riot isn't utterly useless.

[@Nokomak]

The motivation is not clear? Please! You'd have to have been living under a rock to not see the gigantic hate this team is subjected to. More than anyone the EU fans. The team is the greatest of all time. Undeniably so and they do everything they can to sabotage the "T1 empire" as it's labeled every time T1 wins. A moniker that's not with positive intent but scorn. Trying to make them seem like oppressors. People can't accept that to beat them you just gotta git gud.

[@SuperWaistcoat]

"gotta git gud" its that mentally is why people don't like T1 or their fans

[@HatoriYamato08]

Then mostly all of the Team GenG,China and EU...

[@r.c.c.10]

EU fans? But T1 is EU and LAT pride. 😂 There may be some haters of course, but when EU and LAT teams don't perform, they always support T1.

[@legitlama288]

My hunch is, that it's LPL Supporters. 2023 T1 demolished LPL in worlds. Since then the DDoS happened. Jokes against Faker being raised by his dad only where a hot topic. A van was send by Chinese people in front of the T1 HQ insulting Gumayusi. Faker getting SoloQ griefed by chinese players because of betting games. How many scandals has T1 had with oversees fans that aren't LPL supporters? The only "toxic" incident from the west was KC Ultras booing Faker but thats it. The biggest toxic cult is the T1 fanbase but there is no real reason to DDoS the Team T1...they send vans instead or do smth infront of the HQ, if they arent happy. So I stick with salty LPL supporters

[@gr4vityjuli4n]

You know... I like T1 a lot. Especially the non professional videos where they just have fun for shits and giggles. But there is a reason why people dislike T1 and its exactly coz of the fans. Fans like yourself. "gotta git gud" not only do you spell it in a way to make it MORE provocative, even the fact that you are saying that at all is provocative. And this has been going on for almost 10yrs. People obviously are annoyed by the ever arrogant T1 Fans that are not only hyper toxic (see Zeus leaving) but also controlling and near bat shit insane. No one really dislikes the T1 Players. All of them have blank sheets for scandals and are highly likable whenever I see them. Its fans that just seem to put down anyone and anything while deitifying T1 that make people hate T1 as a whole. Because a Brand is its Users. Just like with Apple. The Devices are cool and all but the diehard Apple fans are as annoying and blinded as they come.

[@0Wizard]

The chinese hackers thinking they would win a Worlds by ddosing t1

[@hailstorm5616]

Tinfoil hats still in style?

[@Shsj272]

Or from a rival fan like geng idk

[@TeamRocketRed]

5 Chinese can't win worlds.

[@k.w0]

@@Shsj272 Why would GenG when they Won everything until Worlds.

[@burnerturner7749]

By that logic na and EU teams would be more desperate and likely to hack compared to Chinese teams lmao 😂

[@vrygon0]

The reward is UP TO 100k This means that should you expose the hacker(s) and give riot the info, they don't have to give you all the money if they don't want to

[@DanteYuy]

Or give you money at all

[@chinchillinghere]

or even straight up accuse u to using them and ghost u right away

[@Venit-ae]

Reputation means a lot in the bounty world so if companies don't pay people will find exploits they're "offering to pay for" and sell them on the BM. That's why larger companies tend to pay out the deserved amount.

[@Venit-ae]

Important to note that the senior security architects who offered their expertise to riot and were met with half the industry standard for pay. I personally found an abused javascript exploit/authentication bypass for RP being used (as well as the people using it) and got dono--walled by the company despite it costing millions a month. They eventually found the solution but a simple response and I could have given deeper insight for a faster resolution months prior and saved the company millions. I have no idea why they wouldn't want him to shut the API down but it's honestly on trend at this point...

[@edgymix9109]

That’s why you bargain for the money first

[@whynot3000]

Love these longer form style videos, always so well researched - keep them coming!

[@banemiladinov8202]

Its basically the same video as before the new part is just a brief segment of doran getting his teammates ddosed lol

[@S0daB]

Longer? TikTok really has fried peoples brains.

[@asdf0747]

$100k is laughably small amount of money.. back in the days, hackers were hired if they can breach a company security. now, corporations try to sue you out of existence. They never want to admit that their cyber security is garbage, instead, they want to jail people who want to advance the cyber security space

[@Miku-io4go]

Multi-billion dollar company offers $100k to fix an issue plaguing the greatest league team and player in league's entire history. Even funnier when you realize that Faker alone is responsible for a significant portion of league viewership, but $100k is the best they can do.

[@Sam-m6o3j]

@@Miku-io4go Seems suspect.

[@ChikoTheOGDog]

That amount of money could be exploited.

[@HunterBelkiran]

@@Miku-io4go world championship team, at that.

[@jaopedrorelesbeles]

Don't know if calling a guy who's doing this to T1 just "people who want to advance the cyber security space" is correct He is an asshole. That's all

[@doje8341]

With these i have more respect on Faker he stayed on this team for 11 years or more i think and still counting. It’s not easy to play for T1 great org but there are group of people out there trying to sabotage them.

[@RobotboyX2]

to be fair, if this ddos is happening to stop t1 from achieving stuff then it probably doesnt matter if faker stays or leaves, cus u would probably target faker all the time if that was your goal.

[@blue-pineapple]

What people not familiar with the Korean league scene outside of the pro scene don't realize is that the famous league streamers and 3rd party events and tourneys are getting ddos'd quite frequently even without T1 playing league. T1 is ofc the No.1 target of ddos whenever they stream, but there seem to be multiple attackers that are not related to each other. Like there's this one person who's been targetting one specific streamer and even stops ddosing for just one game after countless attacks because the streamer begged to stop. I'm assuming the attacker wanted to feel like a higher being than the streamer with this whole thing. I only heard this part from the streamer's fans, but it seems like this particular attacker understands Korean and has interacted with the streamer in such ways even the streamers realized they can communicate with the attacker. The streamers and 3rd party tourneys constantly getting ddos'd is ruining the casual league scene as streamers are playing league less, some completely stopping the league stream. A lot of these streamers are struggling because their fanbase is built on league, but they can't play league and therefore basically cannot make the same income as before. Imagine if Caedrel, Jankos, theBaus, Doublelift, Sneaky, Tyler1 etc all got ddos'd and tournaments like NNO cup got ddos'd too. I feel like there would be way more outrage right now. It's been awfully quiet for how many people are suffering in Korea. They've been getting ddos'd before T1 started getting ddos'd and they are still getting ddos'd right now constantly.

[@nottherealmana]

It's obviously the Chinese. Who else would do that? Those will surely do something like that.

[@realOGvoli]

it actually backfired and t1 won because of that. Just like in mma how fighters stopped sparring before fights because it cause unnecessary damage and fatigue so they are more fresh and powerful in the fight day. Same thing happened with t1 because professional players practice and play under so much stress they get a lot of wrist relax injuries but because of ddos they actually had less practice fatigue and more rest time. Giving them a chance to recover for even better performance. Professional are known to be push them selves too and there definitely is such a thing as over training.

[@izzdanial4323]

I guess it's a blessing in disguise because Faker had wrist injuries.

[@lioneagle2555]

Pretty insane documentary style video, good work Ryscu. I especially liked the animations you put in.

[@ImaskarDono]

I'm really not getting the confusion there. The teammates of T1 are targeted, so improvements in the T1 infrastructure are irrelevant. Vanguard might have the same vulnerability as Xigncode, or maybe even the game itself. IP changing periodically is irrelevant here, just a waste of time. First, it's still pretty stable, second, the attacker target T1's teammates. $100k is still a very small bounty compared to the size of the problem.

[@wi1h]

if t1 hq's internet connection was connected to a backbone, it would effectively solve the issue, so i'm not sure why you're saying that changing the infrastructure is irrelevant. also, they could relatively easily have separate internet connections for each of the players, which would help at least a bit and would be a change in infrastructure. also, they could probably set something up with their ISP to filter out the traffic IPs changing periodically is _mostly_ irrelevant, i think he just mentioned that because it means that the vulnerability to obtain specific player's IP addresses is still out there, it's not like someone got t1 hq's IP address a year ago and has been ddosing the same one over and over. however dynamic IP addresses aren't "pretty stable". my ISP lets me change my IP with the click of a button as often as i want to, and i don't even have a business plan

[@MartialArtsNk]

The attacker isn't after T1's teammates mate, it's after T1's players... And yes anything bellow 1 million is an utter joke. Then again we're talking about Riot games which in itself is an utter joke.

[@Jaequan95]

@@MartialArtsNk Did u not watch the video...? T1 players aren't getting ddos'd anymore.. its the random players in their game that do

[@Weiqin1000]

The teammates are being targeted because T1’s infrastructure is now too hard to crack. It’s easier right now to target the teammates since it will still get them their goal: disrupting T1

[@downundabrotha]

Increasing the Bounty won't solve the problem. It'll only enable them to Ransom higher and higher amounts. There are a couple countries that repeatedly utilise hacking and espionage and one of them is always in the finals 😅

[@fleokan]

DDoS being an issue in 2024 is just scream unprofessionalism for Riot DevOps and net coders, nothing more.

[@Quackyius]

0:20 So Riot is offering itself 100k?

[@Riokv]

Riot is offering whoever fixes it in the community or outside, 100k. If their employees and proffesionals fix it then I guess they have their own salaries/rewards.

[@KaztenStudios]

It's a bug bounty, pretty common for tech companies to put them out for white hat hackers to make some money

[@wabbajack8283]

Still really sad that T1 can't stream to properly to this day. And people have the gull to hate them when the majority of the year, they can't practice efficiently, yet they still won Worlds. That's a slap in the face to the people hating them and DDoSing them.

[@MrFakefall]

Gangnam is a very elite, expensive district of Seoul, not a South Korean city, for anyone wondering. The video is great and these 2 may be my new favorite parasocial siblings

[@jrodgers674]

good stuff man, appreciate the content and it was well put together inormative and easy to follow. Keep it up man, i love this kind of stuff. Also i tip my had to you on the smooth transition into and out of the self promoting patreon add.

[@asterik917]

Seeing how cheap companies are with bug bounties is exactly why hacking is so prevalent as it is PayPal offering 300-5K for hacks that will cost them millions in fines is crazy.

[@alexlun4464]

I fondly remember that time someone said to me out of the blue "Im sorry myusername" in allchat seconds before my home wifi stopped working... we didn't have wifi at home for days ;D

[@anthrax3404]

You get a few things wrong in this video, a lot of it related to DDOS mitigations and bug bounties. The biggest thing you need to keep in mind is that the reason Riot put a $1 mil bounty is because the people that make money from doing this make way more than 10 or 15 thousand, so Riot needs to adjust reward so that someone will be willing to do something for it

[@FM1234]

The issue with this type of stuff is that if someone with the abilities wants to hack you, they'll be able to hack you regardless of what you do...

[@rawnoon1616]

Keep in mind gen.g record season was only after t1 was being ddos..... face them at their best and you die like the rest.

[@dascookie6767]

Guys a Bugbounty up to 100k is a completely normal phrasing. It depends on how fatal the vulnerability is. If you find a bug that might be leading to a ddos but you can't proof ip Adresses leaking you still get money just not a 100k this is normal for bugbounties

[@zackr.7628]

100k should be the annual salary of someone who can keep a game like League safe...

[@lefo-o9f]

Mediana for cyber security engineer is 122k in the USA, if RIOT would really like to get someone good they would have to pay more than 100k.

[@HappyGick]

A cybersec expert will always get paid more than double that per year.

[@LucasHadi]

T1 are the most profitable and watched org in the whole league, this attck didn't hit Riot as hard because T1 win the Worlds, if they somehow failed because of DDoS, their viewership gonna get hit so hard.

[@PepsT]

Exactly... which is weird, because T1 had not been in a good shape. T1 winning Worlds is suspiciously convenient to cover Riot's incompetence.

[@ryansentinos3483]

inside spy employed by another esports team that can't stand losing to T1 anymore. Shareholders pressure esports team why they cant win and so they invest in a dedicated hacker team

[@valentijnbarendse9044]

That people actually do this, what a sad bunch you must be

[@TwoTwig]

That's just how the Chinese are.

[@mileslee8941]

They profit from betting against T1 since without being able to play the game they won’t perform as well as they should.

[@lix2146]

i do believe a high enough bounty will generate interest among cybersecurity experts and lead to the solving of this problem.

[@m0rep0rk24]

Brilliant video my bro. The quality is insane

[@gonfreecss5105]

Multi BILLION dollar companies offering mere thousands to tens of thousands for game breaking exploits...yeah sounds like people can sure retire and live a good life if they turned in the bounty, eh? That's a few months of rent at best, whereas selling the exploit in the black market can make 10x if not more. Being "good" means being shafted and underpaid it seems.

[@ice360]

I suppose this is a decent video for people who are non-technical, but alas, I still want my 13 mins back (and the next 5-10 mins that I'll be spending explaining this, 'cause I'm bored). Anyways, to provide some insight - there's no world in which Riot doesn't know if it's their stuff that's aiding the leakage. It's basic and quick to be able to query who queried what information (as in, in their logs, see who queried the system in any non-standard way, and got those guys' IP, and if not possible, you could just go by hand, and be done in a few hours). This is the objective truth. I imagine Riot has talked with T1, and ensured them it's not on them, and if it was, it got patched. It'd also be basic to just do some enumeration and disconnection of certain devices at times, to see where/what/how gets hit. Riot (and, I assume, the police by now) have access or can ask the owners of partner websites/services to also provide access logs and things that'd allow them to see if someone from T1 is revealing their IP because they're accessing a certain website every day. A person mentioned that this is an ISP-level thing - come on, stop reading things on the internet you have no idea about. Such thing would immediately get caught, and nobody's risking such a valuable position to make a League team lose some money. While it is technically possible, and it'd be easy to see who's who, even if traffic is encrypted, it's *probably* not the case. The most likely culprit is someone from inside the team visits a specific website that they don't know the attacker has access and/or one of their devices is infected. Anyways, whatever it is, it's easy to find. The most interesting bit - assuming it's true - is Riot saying they don't want to close the DDoS tool. It could just be that Riot realizes the attackers won't do it either way, OR they're running a honeypot-stint-operation, and the attackers themselves don't know they've been compromised. I assume this is at the direction of the authorities, who are trying to set an example, by arresting everyone that paid for this tool. Very common. Anyways. Computers aren't this blackbox nobody understands. Things are very transparent, and easy to trace. Scaringly so. Riot knows what's up. I understand you need to make a video to appeal to people who aren't in the [basic] know, but come on. This is like a bad intro to a 1998 movie about hackers.

[@user-gx3tl5fb8w]

Now the thing is that their teammates in their team are getting hit mid game, not even T1 themselves at the moment. How do you think that one happens?

[@SkiesWRLD]

Yeah you just have to re-route the OC3 optical line into the MD5# and you will easily find the culprit, if T1 wants to fix this situation they should just get completely new phones and computers and ban the members from accessing websites while at the facility

[@unusedmonkey4435]

Or if you want to think about it harder a hacker could have very easily get an ip grab sneak in and place it on their servers so even if they switch or changed equipment they still would have all the information from the main server. originally the first group most continue to until Vanguard but when Vanguard came out group a stopped. Now insert Group B seeing an opportunity to go ahead and make a lot of money copies group a but with one difference Group B decides to take things slightly further and infiltrate T1 in order to get a constant signal seeing as this could turn up a huge profit they decide to push it even further and keep up the attacks most likely it's a group but we can't defer that as it could be one individual.

[@Lookatthisguy0017]

You just gain a subscriber by bringing light into this

[@TerraDoLL]

Great video on explaining the situation!

[@Strive117]

Love how this is becoming a psuedo cybersecurity channel. Teaching a lot of people this stuff might bring greater interest in the field. Lots to learn.

[@igamse]

Amazing content like always! Unfortunatly this was posted in a period where there is a lot of dumb league drama with insane click baits, this video was recommened to me many times in the past 2 days but I kept ignoring it thinking it was one of them : ( Thankfully today I read the channel's name and realized it was you! Hopefully this video will get more attention, as it's very clear a fenomenal amount of work was done in it, and it was very informative! Thank you for your amazing work!

[@aintlessthan30shotsjaja57]

Pretty nice that someone is shedding light on problems in lolesports. It's not like T1 as an org is single handedly carrying the esport or anything like that.

[@johnmcclane1933]

it could be someone in high position at riot, that would be consistent with the source code sold on the internet and not improving the game (the rank system) for 2 decades now...

[@CarterOW]

The bounty is most likely to be claimed by someone involved with the attacks. It acts as an incentive for pulling the rip chord.

[@anthonywalker6268]

Why these events don't have dedicated LANs set up to only get updates and communicate with each other is beyond me.

[@dragonslayervt]

If I were T1, I would fire the entire IT team. The most likely scenario at this point is that someone within the infrastructure team is leaking the ip address, or their network is comprised by someone who as direct access

[@yeoldegrayCat]

LPL so desperate to bean T1 by any means necessary, that's my theory on who's behind it😂

[@emred4653]

They should make and sale more jinx skins instead of fixing this. Classic riot

[@Gabrilos505]

You are telling me that the people responsable for writing the code of their own game can't figure out what is wrong is with it? But they expect the community to solve it for them? Wow... This is kinda like what I'd expect if Bethesda Softworks decided to enter the E-sports scene

[@TheGamingg33k]

Umm the more different eyes looking at the code, the better. Its not that they do not know their code. It might be something that needs outside the box thinking, not inside the box.

[@TFDusk]

Bug bounties in the industries are extremely common. Especially for the problem listed here there are so many variables as to why they could be specifically being attacked that weren't even specified in this video. T1s infrastructure could still potentially be compromised from the first time they're IP address was exposed, regardless of how well they believe they cleaned their stuff. Someone else completely unrelated to their team could've exposed their new infrastructure to malicious software by something as simple as opening the wrong email or the wrong link. The large majority of exploits happen from social engineering the workers that are within the company A software completely unrelated to league could be what's causing them to get compromised. Back in the days of peer to peer based games it was extremely common for people to use Skype for all of the things listed here. You'd go to a room with other people, ask something innocent related about where the person lives by state since it was common to be able to get an IP just by knowing roughly the state someone's in, then you'd take that IP and load it to a bot net or any tool you set up home grown to send in a bunch of requests. Beyond that, we're talking about a tool that isn't commonly used for the entire org, just for one region, and is also specifically targetting a pro team at this point. And as shown in this video, at one point everyone was getting DDOSED, but that has now shifted to only targetting T1. We have no idea if these attacks are even related or not, or if the same exploit is even being used for either of these attacks. For problems like this it is better to rely on the community and open source. There's a reason why shit like Linux despite all of it's software being publically visible for anyone to see and put in any amount of exploits they want is generally one of the most trusted tools in the entire industry. Exploits caught within open source software generally will get resolved at a much faster pace than anything a closed source company can produce, as you have more eyes watching things and a higher degree of experts that are accustomed to these kinds of attacks.

[@Gabrilos505]

@@TFDusk Shit... nice! That was some masterclass. Thank you, I had a good time reading your comment and learning about this topic! Sidequestion: Do you agree with the bounty monetary reward? I clearly don't know enough about this topic, but the more I think about it, the more I think this problem seems a lot bigger than 100K worth of compensation.

[@klywenc]

I think their DDoser has access to their IP address from the ISP level. Someone is selling him this IP, or the attacker himself works in such an agency

[@GOODLIFElol]

5:40 if the disconnect was in germany, it was most likely a vodafone issue xdd

[@Tropi_Lemon]

I love these kinds of videos! Keep up the great work! (Also, where can I find the older video?)

[@daikenkun]

Those hackers might tryhard crying so bad but Faker the OG GOAT still managed to get two-time World Championship, its like a biggest "L in the forehead" for those tryharders DDoS attackers bruh.

[@Sanji1337]

The AC probably has a function that grabs “player_client -> IP” (stored data) the cheating tool probably just reads that memory or data, thus avoiding trying to reverse player_data to grab ip

[@Mitke420]

if that was someone trying to resell 250 $ skin for cheaper they would send fbi

[@foreverdrain]

nice video! really well made

[@spadesx_]

Riot/Tencent is a Chinese company. LPL/Chinese server one of the biggest/profitable. LPL keep losing to LCK. once T1 lose on the World stage against an LPL team, i bet the DDoS attacks will stop.

[@RegularUser-t2f]

Won't happen until faker retires. He is simply their father

[@lagerinopino6012]

That's a hard FACT. But no one of relevant opinion or voice want to say it. 10cent,use the excuse of gamblers to still attacking T1,even reducing LPL's Budget,to make look Faker and T1 like the 'bad' in the eyes of Chinese people,If not, let's remember doinb's reaction when T1 won worlds.

[@strawhatJ]

Yeah bro the company that owns 100% of riot is ddosing their own game's biggest team 🤣🤣🤣League players really aren't the brightest are they?

[@timwilliams5076]

This is true and I was going to say the same thing. This is DEFINITELY a Chinese attack. It isn't surprising considering both the government's 'world plan' and how the typical Chinese citizen thinks/reacts at this point. The CCP creates an incredibly toxic environment. This isn't racist or hateful. It is a statement of fact. I've been to and dealt with China - when your government is corrupt, bordering on outright evil, controls everything and has total disdain for their own citizens, the result is what it is. RIOT etc needs to grow a pair and figure out some kind of solution to keep the Chinese off of T1's ass.

[@spadesx_]

@@strawhatJ i don't play League. and you must think Riot is this virtuous, holy, honest company huh. money > integrity? and closed door deals have way more corruption/money than their number 1 team can bring them. and let alone the pressure received from the LPL. the video even stated the creators offered to turn it off and they refused. you're a bit naive aren't you.

[@gloomy_night62]

It’s clear that this issue is far from isolated. Riot Games, as a multi-billion-dollar company, should have the resources and infrastructure to prevent these attacks from ever occurring. The fact that this is still happening, and that T1 players are being forced to compete under such conditions, is a disgrace to the entire competitive scene. Fine, anyway, Riot isn’t doing anything serious in my opinion - just cheap patching. so...yea let s buy more skins i guess:)

[@romans11277]

One YEAR after the first attack Riot offers a bounty? Laughable. Clearly Chinese-owned Riot doesn’t actually want to help T1/Faker who’s single-handedly raked in the most money, viewership numbers, and enduring popularity for them.

[@Danomis]

3:20 "There once was a vulnerability with League's code." *Classic Riot.*

[@gutzimmumdo4910]

100k for a problem that the whole of riot cant solve is a joke, if i had that amount of knowledge under my belt, i don't think i would be moved for less than a millon...

[@Mempler]

Not every ip is dynamic. Most ipv4 addresses are due to the 32-bit limit. But especially companies like to get static IPs. Because from an IT perspective, it's much easier to manage them.

[@HomicidalTh0r]

I don't know what this person or group think they're doing, but this cowardice is unacceptable.

[@xMorphasis]

People don't realize that 100k for a bug bounty is relatively high, although not as high as someone like google might pay. My guess is that someone on the inside at T1 has been leaking their IP addresses for cash and it doesn't have anything to do with Swiss Knife (anymore)

[@HappyGick]

That's my guess as well because it's too targeted. The best way to break a system is from the inside. There's an insider at T1 getting their IPs leaked, probably dealing with chinese gamblers, getting a cut from their betting profits.

[@Salzui]

​@@HappyGick that dosnt make sense now that T1 infrastructure has been upgraded and random teammates of T1 get ddosed instead of T1.

[@YamaguchiGroup]

All that money and Riot can't manage to set up an isolated server for worlds... It's rly not that difficult and it ensures that outside interference is impossible.

[@seri7890]

Riot paying more money to find these people, than the NYPD was to catch Luigi.

[@MartialArtsNk]

Riot paying absolute peanuts. And why would the NYPD be paid anything to catch Luigi? Hey no offense that but other guy had it coming.

[@PepsT]

They are offering UP to that amount. This is Riot. Even if someone does fix the bug, I wouldn't be surprised if they don't pay the max amount.

[@hecarimbozovski]

This reminds me of lemmino, very good production

[@Adamus-95hs74N]

Please support Riot Games by spending money to gacha so Riot Games can overlook and do nothing. YAY

[@Zamun]

Thanks for the content.

[@rageofsweets]

i don't have any evidence but here's my list of suspects: gambling sites, corrupt isps, jealous dota2 players

[@JasonAtlas]

Riot hosts Lan events that cant be played because the match server gets ddosd. They are hugely incompetent.

[@fpsWagz]

what happens when youre chronically online :

[@rl332]

T1: Hey Riot, can you stop these DDoS attacks? It's affecting your most popular team. Riot: Nah, our resources are being used through AI skins instead.. But hey, look, we implemented a GACHA skin mechanism, cool right?

[@HypersonicBeaver]

oh shiiii new Ryscu video

[@chrisfull7034]

My theory was always that there's an insider at an ISP or Riot who was leaking their IP, is that not the most obvious answer?

[@doggodoggy]

"up to a 100,000" u know dam well they gonna skimp out

[@MisterAssasine]

1:10 - IP numbers can only be in the range from 0-255 so shown can't be an IP

[@proxy6330]

can't accidentally dox someone's ip if it isn't valid in the first place, it was probably intentional

[@cain9507]

Nothing to do with doxing, an RFC5735 address could/should have been used instead

[@JunHector]

I mean, its not really supposed to be an actual IP. It makes zero difference.

[@s1ngularities]

won't it be faster for them to pretend as an outsider offering a bounty to disrupt t1 then reverse engineering the approach into a solution to fix?

[@mystory_life]

the reason they lost some finals turanment... they even didnt practice properly...😢😢

[@hasellily]

ddosers such a good ppl they try so hard to make t1 touch grass but no use and even get marked as a vilian smh

[@tranthien3932]

Your videos are starting to become more of a piece of art rather and I'm not complaining about it. This is amazing.

[@JoaoSousa-vo2mm]

I don't see any comment about this possibility but for me this screams SOCIAL ENGINEERING so hard. Someone inside T1 facilities is being paid hard to leak the IP of the facilities where they are. It stinks

[@kephas-media]

You should arrest whoever thought 172.90.225 is an IP address, you should redo high school.

[@rtoujr]

The bounty is bait. They trying to get one of the hackers to expose themselves. Bet there's a team of Korean FBI waiting to claim the bounty.

[@noThankyou-g5c]

im sorry did u say anything in this video besides the fact that t1 are getting ddos’d and we dont know why and riot put up a big bug bounty for it? i feel like that could be covered in a short

[@TheAngelFolly]

Have we considered the possibility it is iwd

[@TheGamingg33k]

LMAOOOOOOOOOOOOOOOOOOOOOOOOOOOOO

[@wabbajack8283]

😂😂😂

[@Makeyourownluck-u6y]

My theory is that this isnt only happening to people in korea, i used to get target ddosed when i play league in higher elo in NA.. the only way to reconnect was to use a mobile tether.. i wonder if these random solo q players started to use VPNs maybe that would make it harder for hackers to get their ip.

[@Alexander_choi]

I get definitive fern vibes from this video brother. The production quality is INSANE

[@kyriehuehue473]

oh hell nah, its ok but not on fern level

[@michellediamant5084]

Funny thing is, there was one guy, who made so many things, for free. I would say, that Hawolt would had that problem already solved, if they didnt sue him xd

[@isaccosampaolo9376]

T1 is the most watched league team in Korea and probably in the world if the ddos is made by zombies, I mean, fan infected they will find a way to watch their loved players and therefore point the virus to ddos them. Or at least if something similar is possible T1 is the most logical target due to being so famous and followed. But probably is not that simple ^_^

[@blueastral6326]

Theses ddosing is just hacker helping them to get stronger, not gameplay wise but in mentally. And League is a mental game. You know the rest

[@drackoex]

This video is 1 second short of being 1337.

[@EVERYTYME]

This wouldnt happen if Vangaurd let you sign in with a VPN active, no? (Without knowing a lot about cyber security) i think its crazy how many "anti-cheats" dont allow VPNs active while you play...

[@SomeDudeOnYoutube16]

mentioned his patreon right after explaining what a botnet is. hmmmm, i think we just become part of YOUR botnet when we join your patreon huh? HUH?! :)

[@internfroddy2488]

Are the graphics AI?? 0:53 The IP address here only has 3 numbers and the one at 1:10 has a number that goes above 255.

[@unusedmonkey4435]

Probably so no one's actual ip gets leaked even by mistake

[@jasperzatch610]

​@@unusedmonkey4435straight up all these people in the comments angry he didn't show a real IP address as if the fake example needs to be real

[@EasyMoney322]

@@unusedmonkey4435 Just use TEST-NET-1,2,3 pools?

[@akzorz9197]

@@unusedmonkey4435 ....lol, no. you could give google's ip as they give it out publicly, you could use an internal IP, eg 192.168.0.1 etc.. this is either just AI or outright lack of knowledge.

[@paleJiyuu]

so this is why I've been losing my iron matches... they've targeted me!!

[@NickBusigo]

The attacker works in the building

[@syneresis]

crazy that riot is planning on allowing betting while they haven’t fixed this issue yet. or maybe that was their plan all along?

[@NotBirb01]

Create 2-3 proxy servers for with daily rotating ip addresses that act as the connection between their isp and their internal network.