Ban of cheater? « cocos2d for iPhone

cocos2d for iPhone » Programming » high score, social and ads networks

Ban of cheater?

(12 posts) (6 voices)

Started 2 years ago by awolCZ
Latest reply from riq

Tags:

awolCZ
Member
Hi,

is it possible to ban some user upon device id ( or IP )? To forbid access on cocoslive so it is not possible to post score again?

I want this because in my game, only score about 25000 is possible and this is what I found on the cocoslive today:
```
1  	  	us    	9deb0... 24.190.244.156  Haxed  37512931  	 29-Jul-09
2 		us 	9deb0... 24.190.244.156  N/A 	37512 	29-Jul-09
3 		us 	9deb0... 24.190.244.156  Irapeu 	37512 	29-Jul-09
```
Of course that I deleted this, but I do not want to delete this for ever :/

Thanks,
Lukas
Posted 2 years ago #
natanavra
Member

Hmmm... I saw this somewhere... I think you can check if the device is jailbroken - although this would be banning anyone who has a jailbroken device even if he didn't hack...
I'll search that article for you...

EDIT: there's a ton of info about this HERE

and here google

Posted 2 years ago #
awolCZ
Member

Hi, thanks for the reply. Problem is, that all security stuff should be done in cocos live. Encryption is not used which is bad, but no problem.

I only think that there should be some button at cocos live website, which you can use to ban the user. It is not there and therefore after deleting fake scores, hacker can post them again and again and again :/

Posted 2 years ago #
riq
Key Master

cocos live signs the "send score" with a secret key. there are some ways to obtain that secret key whether the device is jailbroken or not.

I could add the ban by device and/or ip address.

Posted 2 years ago #
awolCZ
Member

Hi riq,

I'm the network programmer at telecomunication company so I know that obtaining of the secret key is not so difficult since there is no encryption used. It would be very helpful if you add BAN feature because I can at least ban individuals who are breaking the security.

EDIT: I think that IP ban should be used, because device id can be easily faked using one of the ways.

Thanks a lot ;-)

Posted 2 years ago #
riq
Key Master

off-topic by I would like to clarify some points:

Encryption is not needed to send the scores since they are being signed. In this particular case encryption + auth is as secure as auth alone.

What is important is the secret key. And it is not difficult to obtain the secret key if you know what to do. But you won't obtain the secret key by sniffing the network traffic.

Posted 2 years ago #
awolCZ
Member

Nice explanation riq. But only proves that ban feature is required. We are now unable to punish people who broke the security and we can not stop them to make it again. Thank you ;-)

Posted 2 years ago #
ob1
Member

Just to be pedantic, Cocos live scores are NOT signed:

http://en.wikipedia.org/wiki/Digital_signature

Signing requires an asymetric algorithm.

Posted 2 years ago #
riq
Key Master

@ob1: yes, thanks.
cocos live uses a MAC (Message authentication code). it uses a hash function (symmetrical algorithm) to prevent spoofing scores.

Posted 2 years ago #
GinsbergWright
Member

I would also love to see a ban feature... I'm having a problem in Missiles with some rascal posting a fake high score. Every time I delete it he comes back.

On future updates I was going to implement a crude 'if' statement in PostScore to avoid this specific user's device ID, but that's not ideal.

Posted 2 years ago #
hanburyn
Member

on the matter of banning IP - i dont think that'll be very effective as many ISP's dynamically change the assigned IP.

I didn't realise the device ID could be faked - I'd be interested in knowing how they do that..

You mentioned blocking the device Id with an if statement - u could also block the IP with an if statement too. There are APIs to find IP.

Nigel

Posted 2 years ago #
riq
Key Master

implementing an IP address ban list per game is not difficult to implement. I'll add it, but not in the near future, since my focus is put on performance issues and rankings.

but if anyone send me a patch that implements IP bans, I'll happily add it to the server.

Posted 2 years ago #

RSS feed for this topic

Reply

You must log in to post.