Protecting Games: A Security Handbook for Game Developers and Publishers

Contents......Page 9
Introduction......Page 16
Part I: The Protection Game......Page 20
1 Game Security Overview......Page 21
What Is Game Security?......Page 22
References......Page 24
2 Thinking Game Protection......Page 25
Independence......Page 26
Lazy, Cheap, or Stupid......Page 27
Threats, Vulnerabilities, and Risk......Page 31
Beyond Protect, Detect, React......Page 32
Asymmetric Warfare......Page 34
Process, Testing, Tools, and Techniques......Page 36
Second Grader Security......Page 38
References......Page 39
Part II: Piracy and Used Games......Page 40
3 Overview of Piracy and Used Games......Page 41
4 The State of Piracy and Anti-Piracy......Page 42
Determining the Scope of Piracy......Page 43
Trusted Brand Security: Nintendo and ADV......Page 47
Anti-Piracy Innovators: Nine Inch Nails and Disney......Page 48
Going Forward......Page 49
References......Page 50
Preventing Duplication......Page 51
Detecting Duplication......Page 52
Disk as Key......Page 53
License Keys......Page 54
Splitting and Key Storage......Page 58
Busted Pirate: Now What?......Page 61
References......Page 62
The Basics of DRM......Page 63
Why DRM Doesn’t Work......Page 64
Types of DRM Systems......Page 65
License Policy......Page 70
References......Page 73
Attacking Consoles......Page 74
The Used Games Market......Page 79
Pricing Pirates Out of Business......Page 81
References......Page 84
Server Piracy Trends......Page 85
Authenticating the Server......Page 89
References......Page 93
Measuring Piracy......Page 94
Fighting Pirate Networks......Page 95
Rich Interaction System......Page 98
Digital Affiliate System......Page 103
Playing with Secure Digital Distribution......Page 106
References......Page 110
10 Anti-Piracy Bill of Rights......Page 111
Basic Fair Use Principles......Page 112
Registration Options......Page 113
Connection Options......Page 114
References......Page 115
Determining the Goal of Anti-Piracy Policies......Page 116
References......Page 118
Part III: Cheating......Page 120
12 Overview of Cheating......Page 121
Cheating and the Game Industry......Page 122
Fair Play......Page 124
Cheat Codes......Page 125
The CARRDS Reference Model......Page 129
The Remote Data Problem......Page 130
Security, Trust, and Server Architectures......Page 140
Random Events......Page 144
Player Collusion......Page 146
Business Models and Security Problems......Page 148
References......Page 150
Memory Editors, Radar, and ESP......Page 151
Data Obfuscators......Page 153
Code Hacks and DLL Injection......Page 156
Blind Security Functions, Code Obfuscators, and Anti-Tamper Software Design......Page 158
Save Game Attacks, Wallhacks, and Bobbleheads......Page 160
Secure Loader and Blind Authentication......Page 161
References......Page 164
Is It “Help” or Is It Cheating?......Page 165
CAPTCHAs: Distinguishing Players from Programs......Page 168
Cheat Detection Systems......Page 169
References......Page 173
ACID, Dupes, and SQL Attacks......Page 174
Defensive Proxies......Page 176
Hacker Proxies......Page 177
Thinking About Network Time: Act, But Verify......Page 182
References......Page 184
Design Exploits......Page 185
Trivia Games......Page 186
Word, Number, and Puzzle Games......Page 188
Algorithmic Games, Physics Flaws, and Predictable Behavior......Page 189
Speed, Twitch, Timing, and Pixel Precision......Page 192
Power of People: Rock-Paper-Scissors, Poker, and the World of Psychology......Page 194
Game Play Patterns: Combat Devolved......Page 195
References......Page 198
Cheating in High-Score Games......Page 200
Encryption, Digital Signatures, and Hash Functions......Page 201
Randomly Seeded Client......Page 203
Alternative High-Score Strategies......Page 204
Puzzles, Skill-Based Games, and Other Deterministic Games......Page 205
References......Page 206
Part IV: Social Subversion: From Griefing to Gold Farming and Beyond with Game Service Attacks......Page 208
19 Overview of Social Subversion......Page 209
Understanding Tournaments and Ranking Systems......Page 211
Lobby Attacks......Page 214
Tournament and Ladder Game Play Attacks......Page 216
Abandonment: The “Game Over” Game......Page 218
Game Operator Problems......Page 220
Identity Problems......Page 221
Countermeasures......Page 223
Summary......Page 225
Resources......Page 226
21 Griefing and Spam......Page 228
Communications Griefing and Spam......Page 229
Game Play Griefing......Page 234
User-Created Content......Page 236
Liability and Business Risk......Page 237
References......Page 240
22 Game Commerce: Virtual Items, Real Money Transactions, Gold Farming, Escorting, and Power-Leveling......Page 242
Amusement Park Economics......Page 245
Alternative Models......Page 246
On Virtual Items......Page 247
Gold Farming......Page 249
Gold Frauders, Online Thieves, and Insiders......Page 255
Potential Solutions......Page 257
Power-Leveling......Page 258
Summary......Page 259
References......Page 260
Crime, Credibility, and Punishment......Page 262
The Cost of Punishment: Who’s Being Punished?......Page 263
Possible Punishments and Credible Deterrence......Page 264
Summary......Page 267
References......Page 268
Part V: The Real World......Page 270
24 Welcome to the Real World......Page 271
25 Insider Issues: Code Theft, Data Disclosure, and Fraud......Page 273
Code Theft and Other Data Disclosures......Page 274
Office IT Infrastructure......Page 277
Insider Fraud......Page 278
Playing Your Own Game......Page 279
Privileging and Isolation......Page 281
References......Page 284
Contracting Security?......Page 285
Security Accountability in Third-Party Development......Page 286
Security Accountability in Third-Party Licensing......Page 287
Service Provider and Partner Security Issues......Page 289
Community and Fan Sites......Page 292
References......Page 293
27 Money: Real Transactions, Real Risks......Page 294
Payment Processing......Page 295
Inside the Payment Process: PayPal......Page 299
Anti-Fraud......Page 301
Integration for Automation......Page 305
References......Page 306
28 More Money: Security, Technical, and Legal Issues......Page 307
Account Security, Virtual Items, and Real Money......Page 308
Money Laundering and Illegal Payments......Page 309
Money Laundering: Legal Issues......Page 310
References......Page 312
29 Identity, Anonymity, and Privacy......Page 313
The State of Identity and Anonymity......Page 314
The Registration Problem and Identity Management Systems......Page 315
Age Verification......Page 321
Usage Controls and Game Addiction......Page 323
Account Compromise, Identity Theft, and Privacy......Page 325
Legal Requirements for Privacy Protection......Page 327
References......Page 329
30 Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers......Page 332
Dealing with Cyberbullies, Pedophiles, and Stalkers......Page 334
Kids’ Communications, Parental Controls, and Monitoring......Page 335
COPPA......Page 338
Children and Identity......Page 339
Child Pornography......Page 340
References......Page 341
31 Dancing with Gambling: Skill Games, Contests, Promotions, and Gambling Again......Page 343
What Is Gambling and What Is Not......Page 344
Accidental Casinos......Page 345
Skill Games......Page 346
Miscellaneous Security Issues......Page 347
Legal Considerations......Page 348
References......Page 352
What Can Go Wrong, Will Go Wrong......Page 354
Denial of Service......Page 355
Scalability and Availability......Page 358
Sample Game Operations Architecture......Page 359
Contingency Planning......Page 361
References......Page 362
33 Scams and Law Enforcement......Page 363
Scams in Games......Page 364
Game Scams......Page 366
Law Enforcement......Page 367
Facilities Requirements: Potential Unexpected Laws and Regulations......Page 368
References......Page 369
34 Operations, Incidents, and Incident Response......Page 370
Secure Operations......Page 371
Incidents and Incident Response......Page 373
Public Relations and the Perception of Security......Page 375
References......Page 377
Virtual Terrorism......Page 378
Online Tools for the Modern Terrorist......Page 379
References......Page 382
“We Have Met the Enemy and He Is Us”......Page 383
The Business of Game Protection......Page 386
References......Page 389
A: Selected Game Security Incidents......Page 390
C......Page 398
F......Page 399
M......Page 400
P......Page 401
T......Page 402
X......Page 403
A......Page 404
C......Page 405
D......Page 407
G......Page 408
I......Page 410
L......Page 411
O......Page 412
P......Page 413
R......Page 414
S......Page 415
T......Page 416
Z......Page 417