Spoiled Xmas Mornings: The Dark Side of the Online Future

Once upon a time, batteries were the bane of Christmas morning. Kids would run downstairs at ungodly hours of the morning to unwrap eagerly-awaited presents; then, within minutes, exhausted parents would be awakened from their slumber by an anguished plea; "do we have any AA batteries?". If the answer was no, as it so often was (who on earth remembers to stock up on batteries in the rush of trying to juggle all the ingredients for a Christmas dinner in your mental shopping list?), what followed would likely be tears, sulking and upset until such time as the shops re-opened on Boxing Day.

These days, most toys come with built-in rechargeable batteries, or at least with a dodgy pair of off-brand AA's stuck in the packaging somewhere; but not to worry, there's always some source of upset available on a Christmas morning, and this year the role of missing batteries was played, instead, by missing online services. With both Xbox Live and PlayStation Network down for extended periods over the holidays, brand-new consoles spat out errors at anyone hoping to use their increasingly ubiquitous and essential online features, while new games couldn't be played online. Even single-player games suffered, as increasingly common day-one patches proved inaccessible to players, leaving them with unforgivably buggy experiences (once they'd clicked through the various screens panicking about the inability to connect to the internet and warning darkly about non-working features as a consequence).

This is, of course, the dark side of all of the excitement about connected consoles and the power of the cloud. Not so long ago, the great thing about a console was that no matter what happened to the company that manufactured the system or its games - be it hacking, bankruptcy or any other misfortune - the consumer would not be impacted in any way. Now, both hardware and software are increasingly subject to the whims of online services. Many games rely either partially or entirely on the continued provision of online services by their publishers; services which can be and often are pulled, leaving the game non-functional or partially-functional, after a surprisingly short period of time. Moreover, those same services are prone to targeting by hackers, opening up a whole new universe of reasons why your expensively purchased game and hardware might simply stop working.

"I don't think it's fair to lump the blame on the network operations teams at Sony or Microsoft - both of whom undoubtedly had their Christmas holidays ruined to a far greater degree than any gamers experienced"

Many have rushed to criticise Sony and Microsoft for their failure to secure PSN and XBL, respectively, against this assault. Sony has found itself particularly in the firing line, since this is far from the first time that hackers have run rings around the company. Between the hugely damaging release of data on some 77 million customer accounts in a hack of PSN back in 2011 (causing an almost month-long outage for the service) and, more recently, the embarrassing release of Sony internal documents and emails in a 2014 hack somewhat dubiously attributed to North Korea, Sony's reputation for information security was already in tatters by the time PSN went down over Christmas, so it's hardly surprising that they bore the brunt of the criticism.

Yet in this instance, I don't think it's fair to lump the blame on the network operations teams at Sony or Microsoft - both of whom undoubtedly had their Christmas holidays ruined to a far greater degree than any gamers experienced (not that that makes the disappointment of a game-less holiday any better, of course). While in the eyes of the media and most consumers Christmas' downtime was just another "hack", the truth is a little more complex. What hit Sony back in 2011 and again in 2014, when customer details were stolen, was a genuine "hack" - a network intrusion which took advantage of insecurity in the company's systems to access private resources and steal data. What happened over Christmas, however, was quite different. It was, by all indications, not a "hack" - it did not target poor security in the network or aim to access private resources. It was, instead, a much more brute-force approach to damaging a company's online services - a "denial of service" attack, which works by simply flooding the servers with so much Internet traffic that no legitimate consumers can reach them.

The way that this is achieved is simultaneously quite technically complex, and worryingly accessible to ill-intentioned people with few technical skills of their own. In a typical case, a virus which has quietly infected PCs around the world is activated via coded commands, ordering each of these PCs (perfectly ordinary desktops and laptops belonging to everything from corporations to gamers to grannies Skyping their families on Christmas morning) to start bombarding the target service with requests. The owners of the PCs don't know this is happening; their PCs continue functioning normally, even as their network connections are being flooded with traffic designed to knock out a public service somewhere online. Collectively, these "zombie" PCs are called a "botnet", and here's the kicker; it's possible for just about anyone with a grudge and a bare modicum of technical knowledge to rent time on a botnet relatively inexpensively, allowing them to take down the internet service of their choice.

The worst of this is that even an internet service that's patched, up-to-date and fully secure is vulnerable to a botnet attack. Distributing servers and services in a cloud-like fashion can help, but ultimately a service like PSN or XBL needs to have some central nodes where data is stored or exchanged, and even if those are secured, a clever botnet attack can target a point on the network further upstream and simply take out that entire small chunk of the Internet. The attacks come from everywhere at once; countless little bits of traffic, coming from perfectly legitimate, ordinary PCs, which add up to an enormous torrent of data that no network system can cope with. In a horrible irony, it's almost certain that some of the frustrated gamers swearing at PSN and XBL on social networks over Christmas were doing their ranting on the very same PCs which were, in the background, quietly taking part in the effort to take down the networks.

That's the short version regarding botnets; there's a lot more information out there if you'd like to look it up, and many of the technical, social and financial dynamics surrounding these illicit networks of zombie PCs and their operators are genuinely fascinating, in a slightly disturbing "we're all living in William Gibson's head now" sort of way. The take-away, though, is that if a determined group with the necessary technical or financial resources decides to take down PSN or XBL, there's not very much Sony or Microsoft can do about it except weather the storm until the attack stops, then get their services checked out and back online as quickly as possible.

This means, of course, that the real culprits here aren't the platform holders; the culprits, as ever, are the wicked little scumbags who thought that preventing kids (of all ages) from enjoying their games and consoles over the Christmas holidays was a worthwhile use of their time and resources. Don't bother trying to figure out the rationale behind this; you're giving far too much credit to the toxic subculture involved if you ascribe to it even the most wrong-headed of political and consumer-movement motivations. This was done because some people think this kind of "trolling" is funny; it was done "for the lulz"; and the awful thing is that the tools and resources required to carry out this kind of attack are now simple enough to be accessible even to people dumb enough to find humour in frustrating and upsetting millions of people over Christmas "for the lulz".

"The "always-online" future may seem closer than ever, but it's a mirage; in reality, the closer we come to always being online, the more appealing those online services will become to disruptive hackers"

There is, however, a degree of blame which must be ascribed to Microsoft and Sony; not to their network operations teams, who undoubtedly did their absolute best in impossible circumstances, but to the companies as a whole, who have hurtled down a path which has put more and more of the functionality of their games and consoles at the mercy of such network outages. Sometimes network outages happen naturally - either because the service goes down, or because your own internet connection goes down. Other times, they are forced by hacker groups, and unfortunately, having discovered that they can get headline attention around the world by means of such an attack, it's likely that such groups will target PSN and XBL again in future.

This should serve as a warning shot; not from the hackers, but from consumers in general. Consoles and games, except where absolutely necessary (there's not much an MMO operator can do for customers when services are taken down by an attack), should be perfectly functional without network connections. They should have systems in place to recognise network outages and create an experience as smooth and fully-functional as possible in those cases - and new functionality with an online component should be evaluated carefully with this requirement in mind. If that means sacrificing some of the always-on DRM your executives are dreaming of, so be it; your first priority is ensuring that your paying customers aren't screwed over by circumstances outside their control. If it means spending some time to develop a fallback option for a feature that otherwise needs to contact a server, well, that's time well-spent.

The "always-online" future may seem closer than ever, but it's a mirage; in reality, the closer we come to always being online, the more appealing those online services will become to disruptive hackers and other attackers, and some of those attacks will always prove to be unstoppable. It's the responsibility of platform holders and publishers alike to make hardware, operating systems and game software which recognises the imperfection of the online systems available to us, instead of hoping naively for a utopian always-reliable Internet; and in doing so, to avoid spoiling any more Christmas mornings.