How do worldwinner/skilljam prevent hacking?

Quote:

---

Originally Posted by cowkiller6

My game is like a target shooting game where the time counts down and you get points for every target hit.

---

It is not possible to make a game like that hack proof. If it comes down to it, anyone could just write a program that simulates mouse clicks on the targets.

Quote:

---

Originally Posted by cowkiller6

- Disallow all "impossible" actions (again, server side)
Checking if score is reasonable.

---

And how will you judge reasonable? What about lag introduced by the network causing false positives? A hacker isn't going to toss in a score 50 times the previous high.

If it is logically possible in any way, taking advantage of any form of forged packet, network lag etc to get an undeserved score when given all the source files for both the server and the client, you have failed to make your game hack proof.

The most secure way to make the game you are thinking about would be to have the server stream a video to the flash client, which sends the coordinates of any mouse clicks. You will need to compensate for latency (aka any clicks that are received by the server will have to be compared to a previous image). The only way to cheat this game will be to make a bot that plays it, which is why I suggested avoiding reflex/timing based games in the first place.

As you can see, even mediocre protection makes the game hundreds of times more complicated, as well as requiring the server to randomly generate several video streams and record all the previous frames for comparison of the clicks. Making a secure multiplayer game is nothing like making a singleplayer game.

Your best bet is just to let the cheaters cheat and control your losses. Or better yet, choose a game type that is actually hack proof.

To see if the score is reasonable, I would just make sure its not like 10 bajillion. That would not be strong protection, but it is one layer.

So, how do you call a function in a server side file. Like can I just keep the score server side the entire time? In flash can you call specific functions in your php file? If you can, is it EASILY hacked so that they can just keep calling the add to score function?

This sucks. I have a sweet game that I want to set up like a site where people can wager money on who gets the highest score, but it looks like I wasted 2 years making the game in flash which isn't secure at all :(

Also, how is the security regarding cheating in real time multiplayer games (like both players would have their own aimer and shoot at objects on the same screen at the same time) using like smartfox (I would be willing to learn how to do it if it is hard to cheat on).

Quote:

---

Originally Posted by cowkiller6

This sucks. I have a sweet game that I want to set up like a site where people can wager money on who gets the highest score, but it looks like I wasted 2 years making the game in flash which isn't secure at all :(

---

Be careful when creating games like this. Often times games like this fall under gambling laws.

For all of your questions, it is a big no.
All of your plans so far are incredibly easy to hack. Your current work is probably only good for art.

As I said, the only real way to get complete protection (or, at least as much protection as logically possible), would be to have the server send a video stream in a way that the locations of the targets are not machine readable (at least without some serious computational power) and send click coordinates back to the server, compensate for lag, and check them server side.

This type of game just doesn't work, whatsoever, for any type of secure multiplayer. You can go ahead and encrypt the data, send stuff back to the server to be validated, do anything, and I would never put money on the line over it.

This type of game is akin to making a "guess the number" game, except you are telling the player what the number is ahead of time.

That is precisely what is going on. The flash file needs the coordinates to display the targets. If the coordinates are on the users machine, they will find them, and they will be used.

Thats just the way it is. If any critical decisions are ever made on the client, you have absolutely no idea, whatsoever if the client actually did something or if you are being fed a stream of BS from some Java application or even some kid typing post requests into firefox.


Yes, with enough time you could probably make the difficulty of hacking just not worth it. The chances are that it won't be worth it for you either. If you moved stuff around and released a new version every 24 hours for the next 5 years you would probably be secure, but do you really want to do that? The benefits are pitiful compared to the amount of work that will be necessary for this. If you want to have money trading hands over flash games, this isn't the game you are looking for.

The fact of the matter is that anything running on the client can be hacked. Even your video suggestion is easily hacked by simply having some code that watches the screen and can tell what the enemies look like and then moves the cursor to them. I can't remember the name of the program but a hack for EQ2 came out soon after launch to allow for hands-off crafting and it worked by watching for icons that appear and pressing the right reaction.

With that said, I do feel that you are preaching way too much doom and gloom. While it's possible the client will be hacked, you can make is so hard that no one will bother. You need to target the major hack points in a multiplayer Flash game.

Direct client manipulation breaks down into two categories; memory hacking and decompilation/manipulation. Memory hacking is easily prevented using a trick that stores variables encrypted in memory. I post an AS3 utility that does this for you on my blog:
http://mikegrundvig.blogspot.com/200...memory-to.html

Decompilation/manipulation is tricky. Using a tool like ActionScript Viewer people can turn your code back into AS and see how you do everything. This is why your security system can't depend on smoke and mirrors. It must be actually secure. For instance, my memory crypto code uses TEA to encrypt variables. TEA is a real algorithm that while it's well documented, is exceptionally hard to hack.

Along the lines of ASV, clever hackers will use Flasm which works very well. It turns your swf into very low level human readable machine instructions that can easily be modified and then re-generated into a swf again. This is the trick I use to show vulnerabilities in the high score boards if they have tried to secure them with a checksum or other approach.

There is one way to make either of these approaches much harder. You need to obfuscate your SWF file. Look into using something from Amaleta or another company to do this. That makes it much harder to use ASV. Flasm will still work (I believe) but the variable names will be meaningless which really makes it hard to hack.

Another approach you should do in conjunction with obfuscation is to take all your initialization values in your game and append them end to end and create an MD5 or SHA1 hash of them which you then send to the server. The correct value of the hash should be known on the server side already. If the hash doesn't match, you know that someone has edited your game variables directly and the server knows they are a hacker. You could regenerate and send this hash multiple times over the course of the game to ensure memory hacking wasn't occurring as well. This type of trick is used in C++ games as well. They just do it internally. They also use precompiler directives to inject this code all over the place so it's very hard to track down.

If I were using Flasm to hack things it would go something like this. In a shooter game, I would change the enemy health way down, or the speed they shoot, or my gun damage, or the points per kill, etc. Depends on the game.

If the hash contains all those values then the Flasm trick will be made much harder because they will need to edit the variable to the value they want, but also track down the code that creates the hash and give it a different value. Very difficult to do properly and will stop most Flasm hackers in their tracks. This combined with obfuscation will make attacking the client itself quite difficult.

The next big thing people try to do is to attack the data being sent from the client to the server and back. The easiest and most effective solution to this is simply encryption. If you are using GET/POST then use SSL. It's very secure and works great. If you are using a socket server, make sure it supports encryption between the client and the server.

Now that ElectroServer 4's release is eminent, I can talk about how we do this a little bit as it might be useful to you. When a client connects, we negotiate a dynamic key just for that connection using the Diffie-Hellman key exchange algorithm and then use that key combined with DSA to encrypt all data going over the wire. This means that any hacker trying to sniff packets will see just the encrypted data. Additionally, the server and client maintain a series of message IDs that increment and rotate as needed. This makes it very hard to inject messages because two messages with the same ID get flagged by the server as a hacker and logged as such. The current vulnerability to this approach is a "man in the middle" attack that we are working to fix before release.

If you implement enough layers, the difficulty to hack it will be such that no one will bother. As for taking money, you will just have to decide for yourself if you think it's secure enough or not.

Wow thanks. That is very helpful. I had decided to just make some php based games that users can compete one since it is all server side. However, if I did take the time to do all that, I really think no one would try to hack it.

Thanks

Also, with SSL, for what I am using it for, do the like $20 SSL things from places like godaddy work? Or do I need that other ssl certificate thats like $1000?

Thanks. I'm trying to start with that memorycrypto utility you made, but I'm confused about how to implement it into my game. I don't see any code in the InMemoryEncryption.fla, yet it traces the 300 score you make in the other file. :confused:

You could always do it the Al Capwn way! Just program your game as crazy and as ghetto as hell. Make useless objects everywhere and fill them with worthless comment code. Have all important game code be called by functions that are hidden in random objects. Make it so half the functions called don't do anything anyway. Fill your game with bad advertisements if it's not on the correct URL.

Put in a million objects, but then only load the ones you need. If it's not on the right site, load so many objects that it breaks down the server it's on, wipes out the bandwidth, and explodes the users computer.

Make that site responsible for so much liability, they are forced to declare bankruptcy. Put so many flashing ads in the game that people start having seizures. Make the sound very quiet at first, so people turn up their volume loud, then go from setVolume(10) to setVolume(100). Then invest in window businesses and make all of your money back.

...only in a perfect world...

lol nice!

sometimes people have to ask them selfs if their crappy project is even worth the whole security.
This whole discussion sounds so important and buisness like but most games I see then from such threads are very plain and basicly only about submitting highscores. And of course some teenagers have fun hacking those tables but those IP´s or behaviours can be easily isolated.

But gaming sites really like tables.

And if you put in a hi Score table, you can put ads on it and make more money.

Quote:

---

Originally Posted by renderhjs

sometimes people have to ask them selfs if their crappy project is even worth the whole security.
This whole discussion sounds so important and buisness like but most games I see then from such threads are very plain and basicly only about submitting highscores. And of course some teenagers have fun hacking those tables but those IP´s or behaviours can be easily isolated.

---

I strongly agree, however the issue here is he wants to put money on the outcome of the game. Playing for money is a whole new "game".

That and there are other issues mainly based on people who lose consistently leaving the game, eventually narrowing your playerbase to a very few elite people and cutting off any new players.

I highly doubt this will ever materialize, but trying to make a shoot-em-up for money game in flash is practically an oxymoron.

Quote:

---

Also, with SSL, for what I am using it for, do the like $20 SSL things from places like godaddy work

---

Yes.

Quote:

---

Thanks. I'm trying to start with that memorycrypto utility you made, but I'm confused about how to implement it into my game. I don't see any code in the InMemoryEncryption.fla, yet it traces the 300 score you make in the other file.

---

Sorry man, it's pretty straightforward, now sure how to help you there.

Quote:

---

sometimes people have to ask them selfs if their crappy project is even worth the whole security.

---

Very true, you have the weigh the risks to determine if it matters to secure it or not. With that said, it's quite easy to encrypt key variables in memory and obfuscate the final SWF.

Thanks for the helps. When I have some free time, I am going to implement all this security stuff in a small demo game I have and see if people can cheat. (well I will use everything but the ssl because I am cheap). I would use ssl in the final release though.

If some one on here can hack it then I'll prolly not do this. However, if I reach the point where people have to make freaking aimbots to hack it, then I may use it.

Thanks again though. If worse comes to worse, I will just put links in this game to my website and use it to generate traffic. :)

:) :cow: :)

Quote:

---

Originally Posted by Al Capwn

You could always do it the Al Capwn way! Just program your game as crazy and as ghetto as hell. Make useless objects everywhere and fill them with worthless comment code. Have all important game code be called by functions that are hidden in random objects. Make it so half the functions called don't do anything anyway. Fill your game with bad advertisements if it's not on the correct URL.
Put in a million objects, but then only load the ones you need. If it's not on the right site, load so many objects that it breaks down the server it's on, wipes out the bandwidth, and explodes the users computer.
Make that site responsible for so much liability, they are forced to declare bankruptcy. Put so many flashing ads in the game that people start having seizures. Make the sound very quiet at first, so people turn up their volume loud, then go from setVolume(10) to setVolume(100). Then invest in window businesses and make all of your money back.
...only in a perfect world...

---

Comments aren't included in the .swf. Including "A million objects" will increase the file size. You are not going to "wipe out the bandwith". A web host is not going to host your 2gb flash file. He is not going to put it online without testing it.

The most you can do is throw the "flash is slowing down your computer" error after 8-10 seconds. Flashing and volume will probably surprise the person who is trying to put your flash online once, and then just be an indicator that the person who is hacking your file isn't finished yet.

The only one I would use would be crashing flash player, just because it makes it take longer.

Manual obfuscation works, but is a PITA and will cause more trouble than it is worth in a project worth protecting.

Btw there is no way I would wade through two weeks worth of obfuscation just to let you know it's possible. Of course, if it is actually two weeks (or more) worth of the stuff, you are probably pretty well off, but if the rewards are great enough, someone is going to do it.

A simple solution would be to check if the _url is wrong, if it is, just do a while (true) {}. The cracker things its a buggy game, and quits trying :)

Quote:

---

A simple solution would be to check if the _url is wrong, if it is, just do a while (true) {}. The cracker things its a buggy game, and quits trying

---

Sadly, this is very easy to defeat and often one of the first things corrected. Using ASV it takes only a couple of minutes to strip out an _url check. It's also very possible to get around this by editing your local HOSTS file so you can run the game locally for the sake of hacking. More info here:
http://en.wikipedia.org/wiki/Hosts_file

Quote:

---

Including "A million objects" will increase the file size. You are not going to "wipe out the bandwith". A web host is not going to host your 2gb flash file. He is not going to put it online without testing it.

---

Not if you load them externally or just make up a million blank objects with actionscript. Or just load the same object/variable a thousand billion times from his server.

Quote:

---

Originally Posted by Al Capwn

Not if you load them externally or just make up a million blank objects with actionscript. Or just load the same object/variable a thousand billion times from his server.

---

Trying to load them externally will fail, either because you are trying to load it from your own server (which will be denied due to security), or you are trying to load it from his desktop (which will either do nothing but crash the .swf normally, or fail since they wouldn't get cached in normal operation of the game, and therefore probably won't get downloaded)

Creating a bunch of new objects or loading the same object over and over are just roundabout ways of crashing the .swf. Anything you load will be cached by the browser so even if he does put it online without testing it, it won't take any more bandwidth than normal.

Things like URL checks, as well as checking if external files are available etc are all pretty much standard and expected protection.