Disconnecting Users from Virtual Worlds with a Single Packet: an Unreal Untold Story

Online worlds, with online games at the forefront, have become ubiquitous in our lives. In 2024, the gaming industry worldwide revenue was estimated at US$455 billion [1]. Yet, this industry is facing a growing number of cheating actors and techniques.We introduce new attacks targeting multiplayer games based on Unreal Engine (UE), such as Fortnite, PUBG, and Valorant. These attacks disconnect players from ongoing game sessions against their will. Cheaters can launch them as a Denial-of-Service against opponents with very few packets (sometimes only one) to steal the victory from the target without exposing themselves as fraudsters.This paper shows how such issues present in a single game engine can spread widely across several games produced by different editors, focusing on Unreal Engine, whose source code is publicly available. UE is also commonly found in digital twins, virtual reality, and other Metaverse solutions. We present our analysis of the design and implementation choices made within Unreal Engine. We cover how to exploit UE networking protocols and discuss how to defeat some common countermeasures used on the Internet against IP spoofing. We propose some mitigation strategies for video game developers.