Take the 2-minute tour ×
Game Development Stack Exchange is a question and answer site for professional and independent game developers. It's 100% free, no registration required.

Say I was planning on, in the future (not now! There is alot I need to learn first) looking to participating in a group project that was going to make a massively multiplayer online game (mmo), and my job would be the networking portion. I'm not that familiar with network programming (I've read a very basic book on PHP, MYSQL and I messed around a bit with WAMP).

In the course of my studying of PHP and MYSQL, should I look into hacking? Hacking as in port scanning, router hacking, etc. In MMOs people are always trying to cheat, bots and such, but the worst scenario would be having someone hack the databases. This is just my conception of this, I really don't know. I do however understand networking fairly well, like subnetting/ports/IP's (local/global)/etc.

In your professional opinion, (If you understand the topic, enlighten me) Should I learn about these things in order to counter the possibility of this happening?

Also, out of the things I mentioned (port scanning, router hacking) Is there anything else that pertains to hacking that I should look into? I'm not too familiar with the malicious/Security aspects of Networking.

And a note: I'm not some kid trying to learn how to hack. I just want to learn as much as possible before I go to college, and I really need to know if I need to study this or not.

share|improve this question
10  
Writing back-end server systems that can scale to numbers large enough to be considered "massive" is the much bigger problem for you than hacking if you are "not that familiar with network programming." Are you sure you're trying to make an MMO and not just a regular multiplayer game? –  Josh Petrie Apr 9 '12 at 15:27
1  
I see; the wording of your question really makes it sound like you're trying to work on this MMO now. –  Josh Petrie Apr 9 '12 at 15:35
7  
So, you are not familiar with networking, you plan to do an MMO (which is the hardest thing you can plan for), and you ask yourself if you really need to learn how to defend yourself against hackers. Uh. Of course you do, and you know that. What's the point of asking that? –  Lohoris Apr 9 '12 at 18:48
2  
related, gamedev.stackexchange.com/a/21598/6937 Short answer, if you've ever heard of iterative development, you can look at learning in the same way. Security tends to work as an add on after the fact. Before making a secure MMO server, just make an mmo server, Before doing that, read the answer to the linked post –  brandon Apr 9 '12 at 20:09
1  
This is like a 14 years old who wants to become president asking what's the most appropriate tie to wear with his future suit. That kid probably won't be the president, and even if he was he would have more important problems than the tie. You probably won't successfully create a MMORPG with a "group project", and if you do you have much bigger problems than this. –  Andreas Bonini Apr 10 '12 at 1:28

3 Answers 3

Yes, somebody (in fact, multiple somebodies) on the team that develops any multiplayer game, regardless of scale, should have a strong working knowledge of networking security concepts at both the hardware and software level.

This is especially true for games that will involve a lot of persistence of agency, since that constitutes investment on the part of the player and consequently is something that makes a lucrative target for hackers.

Taking networking/network security/general security (crytography, et cetera) classes in college will be helpful in giving you some of the requisite background knowledge to be one of those aforementioned developers.

share|improve this answer

Personally, I wouldn't worry about hackers yet.

The rationale is simple: you won't get hackers/cheaters until you're a fairly popular game; i.e. worth the time to hack/cheat. Wait until you have a game established first and revenue coming in to fund those kinds of things.

You can spend a lot (I mean, a lot) of time trying to fool proof your code to it can't be hacked or cheated. Or you could do regular offsite backups (which you should be doing anyway) and creating regular restore points. When an exploit happens, close it.

share|improve this answer
1  
While I agree that making a good game should take priority over making a secure one, I would say that some degree of awareness of common security issues and general best practices is good to have from the beginning. Otherwise you may find yourself in an untenable situation if and when you game does take off. If your original design is fundamentally insecure, trying to patch it up later may be like fighting a hydra: every time you close one exploit, the cheaters find two more, and the only way to stop it may be to redesign and rewrite a substantial fraction of your codebase from scratch. –  Ilmari Karonen Apr 9 '12 at 20:07
1  
@IlmariKaronen, I agree in concept, but not in practice. Given the context of the asker, they need to focus on learning networking in general. When you learn networking you tend to learn about cryptography. They're in the beginning stages. Security is only important once you know what you're doing and you create something worth securing. People who ask this type of question need to get to where they can even create something worth securing first –  brandon Apr 9 '12 at 20:12
1  
@IlmariKaronen I totally agree: if you disregard security you'll go Sony. Sony has survived its disaster just because it was so big, but anyone else would likely have gone FUBAR. –  Lohoris Apr 9 '12 at 20:23
2  
@Lohoris. I'll leave it alone after this, but this isn't sony. This is a guy who said he is just now learning the basics of networking. Learn security once you understand what it is that you're securing... –  brandon Apr 9 '12 at 20:30
    
Yes - this is the best answer: if your game becomes massively popular and is suffering from security problems, you can always hire extra developers etc, and refactor its network scheme to make it more secure. worry about it later. –  MarkR Apr 18 '12 at 14:18

Knowing something about security is a good idea before trying to write a multiplayer game, but things like port scanning and router hacking, or even cryptography, are not what you should be looking into at this stage.

Rather, the things you should learn about are trust, validation and robustness. Knowing a little bit about psychology, especially about challenges and rewards, is not a bad thing either. I can't really teach you much of that in a short answer like this, but here are some tips to get you started with secure programming:

  • Treat any input from outside your direct control as if it might not be what you expect. That includes all user input, anything you receive over the network, and even anything from other parts of your codebase. Try to get into the mindset of not thinking about what the input should contain, or even about what an attacker might feed you instead, but simply about what the input could possibly be and how to safely handle any possible input you might get.

  • Since you mention PHP and MySQL, start by looking at SQL injection and cross-site scripting attacks. If you're also familiar with low-level languages like C, look into buffer overflow attacks. Don't just think about how to prevent them — think about how you'd write your code so that mistakes like that simply cannot happen, whether by accident or through malice. Your programming language almost certainly has the tools to let you do that, if you just learn to use them as they're meant to.

  • In a multiplayer game, you'll presumably have some client code running on the player's computer. Get used to the idea that a sufficiently smart and determined user will always be able to compromise such code and make it do what they want. Don't trust the client, if you can avoid it. If you can't avoid it, make sure to only trust it as far as you have to.

  • Try not to put all your eggs in one basket. If you can't run your game, your website and your database on separate servers, at least run them under separate accounts, and make sure none of them have any more access to each other than they need. OK, maybe both your game and your website need access to your user database, but they surely don't need admin access to it, do they? Perhaps they don't even need more than read only access to it. At least, even if you don't enforce such strict compartmentalization to begin with, design your game so that it can be put in place later — don't make your game server require admin access to the database. Remember that all software has bugs, and sooner or later someone will find a security hole in yours.

In general, the thing to realize about security is that it's a mindset. It's not about knowing the latest security buzzwords, or about how the latest attacks work or about trying to anticipate what hackers will do before they do it (although all of those things may be of some use).

Actual secure programming is about learning how to use the tools you have the way they were meant to be used, about dividing your code into pieces small enough that you can understand what each of them does (and making sure they do it right, even if other parts are compromised), and about writing your code to expect the unexpected. If you do all that, you won't need to know what hackers might try, because you'll be prepared for anything.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.