Disconnecting Games With A Single Packet: An Unreal Untold Story

The talk examines a denial-of-service weakness in Unreal Engine, a widely used game engine whose source code can be inspected publicly. The presenter explains why cheating is a major concern for the games industry and why the network layer, which every client and server depends on, is a useful target. Unreal's application-layer protocol runs over UDP, and the game server identifies each client only by its IP address and port. When an incoming packet fails the engine's sanity checks, the engine disconnects the associated player instead of simply discarding the packet.

Using static analysis of the engine code and profiling of a simple test game, the researchers identified five ways to craft packets that fail these checks without needing any knowledge of earlier traffic. Payload encryption does not stop this, because the fields that trigger the disconnect sit in the header, which stays unencrypted. Two demonstrations were shown: a Valorant match where a defender was repeatedly disconnected while the bomb was planted, and a Fortnite scenario where a peer-to-peer call over the PlayStation Network exposed an opponent's address.

The speaker then covered how an attacker could reach a target: broadcasting on a shared local network, spoofing source addresses from networks that do not validate them, and brute-forcing the port behind a firewall, which can take only seconds at modest rates. Suggested mitigations include encrypting the full packet, dropping rather than disconnecting on failed checks, and using TLS or DTLS. The vendor treated the report as informative and did not fix the issue, so the speaker urged studios to modify the engine source themselves.