Printable View
Pliz help me to resolve the problems of my Top 10 list. Yesterday someone hacked my top 10 n entered an impossible score with name "careless, i still can hack this"
Where's the hole n how to fix it?
Here's the address:
http://donkei.com/games/yoe/hard.htm
I got the original script from flashkit tutor article n have modified a bit.
TIA
check your score list. :)
Do you want me to post the description here or send you a private message?
-rrrufusss
i think pm is better coz i know i'm sooooooo amateur...really dont have any deep knowledge about flash coz have just learned how to used it...
at least, dont laugh at my mistake yah..kekkez :p (but i bet so many people will, hehehe..)
ok, done. Check your messages.
first of all, put an index page in your folder, then its harder to find the files there.
Actualy I'm also interested in this... always wanted to know how these people do this, andhow to prevent it..Quote:
Originally posted by Rrrufusss
check your score list. :)
Do you want me to post the description here or send you a private message?
-rrrufusss
Can you pm me also plz?
SaphuA
The tutorial itself explains how to add scores by typing the variables into adress.
First things you could do is to rename the scores.php and scores directory into something not so obvious. Those could still be hacked from the swf, but not without proper tools.
Next, add some control variables. That would require rewriting php too. For example you could add up all the numbers in the score and send that sum as control:
score=1234
score_sum=1+2+3+4=10
Now you have to check in the php script if it has received correct score_sum and ignore it if not.
That too can be hacked, no question about it, but it would prevent someone just typing stuff straight into address.
try use TEVAS to Decrypt your URLS ..
it currently not work for FLash MX 2004 ...
Regarding the score_sum method:
You have to be tricky though, because if you create your score_sum based on the score that has been directly modified within the SWF, it will still appear to be valid.
I think there's got to be a way to do real-time protection against direct manipulation of the SWF. Some kind of random variable name generation or something, then check to make sure everything matches up internally. So, if the score suddenly changes, it's detectable immediately and you can halt the game or something..
-Rufus
btw, here's my little utility in action. :)
thanks for the response, u r all soo kind :D
specially to Rrrufusss who is really helpful :)
anyway, i'm a real stupid amateur..n i dont have any idea how to fix the hole in my top score till now.
here is my php script:
http://donkei.com/games/yoe/scores-php.txt
plz help me to modify the .php n .fla file :D
if you have a database on your site, use that instead. its much safer and it sorts everything automatically. mySQL is good, and free. and use post, not get to send the variables.
I dont think its possible to protect your game against direct swf manipulation. The things I pointed out earlier help you to prevent someone simply adding score by typing it to the address bar.Quote:
Originally posted by Rrrufusss
Regarding the score_sum method:
You have to be tricky though, because if you create your score_sum based on the score that has been directly modified within the SWF, it will still appear to be valid.
If however someone is capable to hack into your game directly and change the variables inside it, there is nothing you can do. The question is, why would anyone bother? :)
Im sure if you spend enough time, you could make the direct hacking harder, but is this worth your time? If the protecting highscores is going to take more time then making the game, I say, forget it. Just delete the impossible scores once in a week, because no matter how many clever little functions you add, the swf is still open to hackers.
Anyway, if you want to try out the sum, heres the modified php file.
In the Flash, use this code:
code:
on (release) {
function findsum (score) {
for(i=0;i<score.length;i++){
sum=Number(sum)+Number(score.charAt(i));
}
return(sum);
};
scoretable.filename = "scores/demo.sco";
scoretable.scoresize = 10;
scoretable.action = "INSERT";
scoretable.viewtype = "FLASH";
scoretable.winname = _root.name;
scoretable.winscore = _root.score;
scoretable.winsum = findsum(winscore);
scoretable.loadVariables("scores1.php", "POST");
}
Please help me!!! Is there any way to prevent the hackers write .txt files to my site? because he/she makes new .txt files in my score folder? The problem is if i close the permission for world to write + execute, my top10 will not work properly :(
How to fix this??
Thx a lot :)
Do you always type like as if you cant spell anything correctly?
You could remove the new score file creation part from the php script:Quote:
Originally posted by donkei
Is there any way to prevent the hackers write .txt files to my site? because he/she makes new .txt files in my score folder?
// Create a Blank File if it doesn't already exist
if (!file_exists($filename))
{
$file=fopen($filename, "w");
fclose ($file);
}
i've tried to use what u suggested. THX a lot : )
Please check it up again just in case there is a problem :
http://donkei.com/games/yoe/hard.htm
THX :)
it doesn't work.. i've tried to use ur .php n flash action :(
i also use load var to hide my .php and random to make it difficult to search.
mmm....what's wrong?
Cant say whats wrong without knowing what did you do :(
Just a thought, not fully thought through though :),
How about checking that getenv("HTTP_REFERER") or $HTTP_REFERER is the same as your domain/swf file. Havent got a php server handy at the mo so the code could be buggy, but something like:
<?
if ($HTTP_REFERER != "http://www.mydomain.com/mygame.swf") return;
?>
That should check the page that called your 'savescores.php' script was from your domain/ip and was from SWF file.
Another idea (if you had a Database) would be to load a 'number' from the DB and multiply all scores by this number. Then in your PHP script load the same number from the DB and check that the score is perfectly divisible by this number and then only use the divided score.
if ($score % $multiplier == 0)
$score = ($score / $multiplier);
else
return;
Every so often change this number.
These will not solve your problem completely, but will just make it harder/impossible for the lame hackers who want mess up your scores.
If its sensitive data or a prize/competition site, you will want something a lot more secure.
Cheers
Ty
Sadly, "HTTP_REFERER" is not always passed from the Flash player and some browers don't necessarily pass it either. It is also quite simple to fake that using various tools. Any hacker beyond script kiddie will know how. Tonypa is correct: you can't really protect your swf against direct manipulation if it runs in the browser.
Electrotank has a terrible time keeping up with hackers trying to get through our high score boards. We currently use a home-made encryption based on the concept of one-time cipher pads and a few other tricks thrown in there. Go here for details (scroll down a bit):
http://www.cs.utsa.edu/~wagner/laws/pad.html
Basically, you load some random data from the server to be used to encrypt your score, you do the encryption and then send it to the server. The server then uses the same random data and reverses the process to decode your request. We actually encrypt the entire XML document requesting a score to be saved. The random data you used it generated on the fly (no duplicates ensured or accepted in code), is variable length (based on a minimum and a maximum size) and has a timed lifespan that is VERY short. The score system validates minimum and maximum values for a given game. We are also working out some code to ensure that the server can tell how long you were playing a game. Based on play time, you can calculate the maximum score possible and validate a submission. On top of this, the site automatically bans people that appear to send invalid requests (currently turned off till the other bugs in the site are worked out).
Thus far this has worked very well and while it's not hack proof, even experienced hackers would have to rip the hell out of the score code on the client to break it. If anyone wants more implementation details, you can PM or email me. Have fun!
So far I have done everything Rrrufusss ordered n also attach LoadVar instead of placing the .php straight, however it still doesn't work.
It can call the .php successfully but it can't write any new scores.
Plz help me..
Thx a lot :)
here is my flash button action script:
on (release) {
function findsum (score) {
for(i=0;i<score.length;i++){
sum=Number(sum)+Number(score.charAt(i));
}
return(sum);
};
scoretable.filename = "imgs/yoenida-medmaj.sco";
scoretable.scoresize = 10;
scoretable.action = "INSERT";
scoretable.viewtype = "FLASH";
scoretable.winname = _root.name;
scoretable.winscore = _root.score;
scoretable.winsum = findsum(winscore);
scoretable.loadVariables(googlerb+random(99999), "POST");
gotoAndStop(12);
}
Is the "googlerb" new name of your php script?
Does it work, when you use this line?
scoretable.loadVariables("googlerb", "POST");
Do you have "yoenida-medmaj.sco" in the "imgs" directory?
Is the movie clip "scoretable" same in the frame where you have this code and frame 12?
Is the "googlerb" new name of your php script?
yes, I've previously declared that variable as the address of my php script.
"scoretable.loadVariables("googlerb", "POST");" i'll try it soon.
Do you have "yoenida-medmaj.sco" in the "imgs" directory?
yes, n I've changed both the directory and .sco files permission to 777 too.
Is the movie clip "scoretable" same in the frame where you have this code and frame 12? yes.