Preventing High Score Board Hacking

High score board hacking seems to come up a lot. Over the last few days I've been contacted by several people asking for help on it so I figured I'd put something together to avoid all the re-typing.

In short, I feel there are four steps to preventing high score board hacking (or any type of hacking involving data transfer):

1) Use SSL to prevent hackers from manipulating the data being sent over the wire
2) Encrypt all important variables in memory to protect from memory hacks
3) Use a Flash obfuscator to prevent easy decompilation and patching of the code
4) Validate anything possible on the server (score vs. length of play, etc)

This does assume that you have already corrected game-specific bugs and exploits. If you go here you can read about this in a lot more detail. I provide links to possible source, techniques, etc. Have fun!

While these highscore hackings are annoying, there is also good thing. If sp many hackers are willing to spend time and effort on hacking our games, it means Flash games are good enough to be interested about the scores. I remember good old days when people simply posted their scores ("I got 125, woohoo!") and now we have SSL, Obfuscator, Decryption etc :)

Games get better, hackers get smarter. Simply put, we need to adapt to survive. I've posted a new blog entry on how to ensure the data integrity without using SSL since several people told me they don't have access to it. You can get to it here.

I read the post yesterday, there are some really good ideas.

Yeah, had a great chat with you that day Mike :thumbsup: . Thanks for posting the techniques. This will be a good reference :)