A fast, easy to use, free, and community supported 2D game engine
Hi,
My game Bungee Stickmen is getting pretty popular now and so hackers are starting to post massive scores. Millions of points.
Currently I'm just deleting them.
But are there any ideas on how they are doing it and how I can stop them?
Would it be from a cracked version of my game where they adjust the score? Or are they hacking the cocolive DB somehow?
Thanks,
Travis
PS. I love cocoslive and cocos2d!
There could be a bug in your game, OR if you store your scores in a plist life, those are easily editable. What I do to combat that is (and I use OpenFeint, though cocoslive is really good too), I submit a score before it's saved on a device. That way, their device will show the correct score every time, and even if they don't have connection right away, OF will send the score as soon as the connection is made. OF stores scores in sqlite3, so I think that's a bit trickier to hack than a regular plist. Then the score is also duplicated on the device in a plist file. So they can adjust the plist file as much as they want, but the adjusted score will never get uploaded.
So basically this is how it works:
1) Player gets a score
2) Score is submitted to OpenFeint
3) OpenFeint either sends it out immediately, or stores it in sqlite3 (if connection isn't available) so it can send it at a later time.
4) Score is saved in a local plist file for display in the level editor
If a player edits the score in the local plist, nothing happens because there's no way to push that score to OF again, unless you actually gain that kind of a score.
Another thing they could be doing is an "object dump" on your binary, and finding out the secret keys required to send scores to your leaderboards. They they have a rogue program that just sends the score.
Frankly I don't see a point to cheat in online games like that, but some people do it just to do it. I had that happen to me before.
Steve Oldmeadow
Administrator
Anyone with a jailbroken phone can edit the filesystem on their phone - this opens up lots of exploits.
For example, games that allow the player to continue after the app is exited will be storing information such as current score and current lives somewhere. If that information is easily editable then all the hacker needs to do is exit the game, edit the current score and then restart the game.
Another possibility is to hack the level definitions if they are easily accessible. For example, some games store level definitions in XML files (often with very easy to understand formats). All a hacker needs to do is edit the level definition and adjust factors that will improve their score such as points per enemy, health, level time limit etc.
That is just two possibilities that require very little technical expertise. There are, of course, many more possibilities.
@Webtopia, as far as I know the only way to prevent a user of sending fake scores, is to send the movements(move,jump,fire,etc..) of the player to the server, and the server compute the score based on those movements. You don't send the score to the server, just the player's movements. But in order to work, the server must also implement the game's logic on the server.
cocoslive uses a more traditional an simpler way:
- it sends the score signed with a secret key.
So, you can't spoof the scores unless you know the secret key, or unless you modify your score before it is signed by the game.
I think that OpenFeint, Agon, Plus+ etc... also sign the scores, and if so, all of them are vulnerable to these type of "attacks".
Ah crud. This makes a ton of sense to me now. I was wondering how people were submitting all these ridiculously high scores and kept thinking I had a bug somewhere. But they could easily edit my plist file and screw around without ever touching the binary or OF submission.
Arg. Recording all the movements and then calculating the score on the server would solve the problem but that also means I can't use OF. Wow, this sucks.
One of the Openfeint guys has responded to the plea in this thread:
http://forums.toucharcade.com/showthread.php?t=41631&page=4
They plan on adding moderation tools which might discourage the cheaters.
Steve Oldmeadow
Administrator
@DonomaGames - you can easily thwart plist hackers by including a checksum. My advice would be not to use any known algorithm to calculate the checksum. Don't even call the checksum field anything that makes it obvious you are using a checksum.
This means the hackers will need to disassemble your code to determine how to calculate the checksum - definitely something beyond your average 12 year old script kiddy.
Hi all,
Thanks for all of your help. I was considering OpenFeint, do you know if it's easy to copy the current scores I have in cocoslive across to the OF or would I need to start again.
But it sounds like what is most likely is that they have a hacked version of my game and are just editing the scores.
Looks like I'll have to just keep deleting them. I know pretty much the maximum that anyone can get so if cocoslive was adjusted so that I could auto-delete anything over a score of X that would be helpful too.
Cheers,
Travis
PS. Thanks a lot to all the cocos2d people. It has really helped my game which is now number 21 in Paid and number 2 in FREE games. Cheers.
I've noticed some of these cheaters use their own thumbnails and tag name in Openfeint which means they're doing it for some form of notoriety. Deleting doesn't really work because the game can just re-submit no hassle at all for the cheat.
So, to sour the relationship a little why not append something like "X is a cheater" or "X is a moron". ok maybe not too harsh but you get the gist. How about changing the user thumbnail (if they exist in cocoslive) to that of an image of a clown?
Just a thought.
You must log in to post.
