0
\$\begingroup\$

I'm developing a mostly off-line game. However, it'll communicate with the server for the following:

  • Collect data, statistical purposes (Yup, players will be notified and can opt-out).
  • Trigger and generate resources for daily gifts, events, etc...

The problem is, if I used any HTTP debugger (Say, Charles Proxy) I can see everything (No encryption is being used).

I want to hide the data about daily gifts, events, etc... or else any player with malicious intent can tamper with the requests/responses as s/he sees fit (which can affect other players as well).

Seems far-fetched?

Actually, I wanted to apply some kind of encryption, however, I came across few games that managed to hid their activity altogether. Doing a quick research, it seems they use SOCKS and not HTTP, A thing I have a lack of experience in. Example of such games includes Clash of Clans.

So is there a practical way to achieve the desired results?

\$\endgroup\$
  • \$\begingroup\$ I don't really grasp the problem. Why is it bad that people can see those requests? Especially, why would it affect other players? I can not see how this would happen except with a very botched architecture. The server should be authorative and only relay information to the client. \$\endgroup\$ – Polygnome Mar 8 '17 at 23:59
  • \$\begingroup\$ @Polygnome The game is entirely offline, except for its events, challenges, and such, many players will practice in those (as in Multiplayer). So hackers can break the balance easily if they found a way to manipulate requests/responses to get rare items, gifts, etc... \$\endgroup\$ – Eekan Mar 9 '17 at 6:57
  • \$\begingroup\$ What about making offline mode and online mode seperate? Players can only use online mode with items that are authoratively governed by the server. You can still play offline, but not participate online with that progress. thats the most common approach to solve the problem. Because no matter ow well you encrypt, if the serve isn#t authorative, someone will break it and spread the hack. \$\endgroup\$ – Polygnome Mar 9 '17 at 9:21
1
\$\begingroup\$

Use HTTPS. It will handle the encryption layer for you. Most networking frameworks will have some way to do HTTPS. However, setting up the certificates will be the tricky part. This article shows how to do this in java https://developer.android.com/training/articles/security-ssl.html

You can disable certificate validation making ssl much easier but that opens you up to man in the middle attacks meaning someone could point your game to their own server using dns spoofing and pretend to be your server and thier server could then talk to your sever pretending to be the game. Their sever would be getting all the traffic unencrypted breaking the purpose of encryption in the first place.

\$\endgroup\$
  • \$\begingroup\$ Thanks for the link and for mentioning HTTPS. I've only skimmed the article but will read it wholly for sure. \$\endgroup\$ – Eekan Mar 9 '17 at 7:05
0
\$\begingroup\$

Generally speaking HTTPS should be enough against most people.

However there are tools out there which can hook the calls that do the actual encryption/decryption and render it useless in some circumstances.

You can add small encryption algorithms like blowfish on top. (Just take your messages and wrap them up there are tons of examples on the internet).

Even a totally normal XOR might protect you from casual hackers.

If you really want to do it hardcore, use different algorithms for different events (and change them every release).

Sophisticated hackers will still know their way around it. (Finding out where the web requests get sent out, using IDA for example to get the structure, hook at the right place to get the decrypted content).

To avoid this being done easily you can do crazy stuff like saving your Networking Interface encrypted in your binary and decrypting it on runtime (similar to a packer) and blocking debuggers.

It's always a question of which kind of hacker you want to stop ;)

EDIT: Also using SOCKS doesn't mean that their content is encrypted. It probably is, but it only means it isn't relying on HTTP as a protocol for communication.

\$\endgroup\$
  • \$\begingroup\$ Exactly. It's only your casual hackers I want to protect from, the most important part here is the balance of specific game modes (online Multiplayer). The idea of SOCKS is that any casual will not pursue the matter further if he is a skid who only got to know how to use charles/fiddler/etc... No system is unhackable. \$\endgroup\$ – Eekan Mar 9 '17 at 7:02
  • \$\begingroup\$ Honestly using SOCKS would just stop some of the skids. If they know more or less what kind of data is being sent, as soon as it's not encrypted, they are going to get behind the structure by searching through the packets using information they know that has been transmitted. (I just received a gift that gave be 3000 Gold, so I'm going to search for 3000 (32-bit int) in the packets that have been send around that time). Adding just a simple encryption on top can accomplish much I think. They will just replace 3000 in the packets sent to them and see if it worked. \$\endgroup\$ – The19thFighter Mar 9 '17 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.