1
\$\begingroup\$

I used to play Diablo II, both online and offline. The game was so easily “hackable” offline that one could download a program called Hero Editor and, using a nice, comfortable interface, change their character in many ways. However, it was harder to hack the online portion of the game, and many that did were caught. Thus some of the game’s content was restricted to online play, doubling up as a way to promote people playing together.

Now I’m making a mobile TD using Unity, targeting the iOS, Android, and perhaps PC/Mac/Linux platforms initially. Players would slowly earn some rare currency during play that can be used for permanently unlocking exciting (but non-essential) extras, or they can just pay for them.

I’m concerned that if I allow this gradual unlocking to happen offline (without a server to confirm the accrual of said currency), then it’ll be as easily hacked as Diablo II’s offline mode and that many people would simply resort to doing that instead of either playing it through or paying for it. However, I’m also reluctant to force online play, as the mobile environment has significantly lower network stability and this is a relatively long game to be playing in such conditions, so drop-out is very likely.

So my question is: how concerned should I be about the mobile game getting hacked for the purpose of acquiring these unlocks without going through the correct methods? Is it so easy that your average user could do it, like they could for Diablo II, having the potential to significantly damage the game’s bottom-line? Or is it difficult such that only a small percentage of people who are interested enough would bother to try, so I can focus on providing the best UX for all players without worrying about these hackers?

Brownies for anybody who can summarise how it may actually be hacked!

\$\endgroup\$
  • 2
    \$\begingroup\$ It sounds like you accurately understand the risks, and that hacking your game's local data could be as easy for a player as downloading a nice, user-friendly app that does all the dirty work, with no technical knowledge required. Whether you should worry about that or not is then not a matter of information you need from us, but of evaluating your own goals and risk tolerance. What percentage of your expected audience could resort to these hacks before your business model is compromised? And are you, personally, comfortable making the bet that the number will always remain lower than that? \$\endgroup\$ – DMGregory Feb 19 '18 at 4:51
  • 1
    \$\begingroup\$ It was easy to do for the average user in Diablo II because some people with programming skills had nothing better to do than put lots and lots of work into reverse-engineering the savegame format and creating a user-friendly GUI application for doing it. When a game is as popular as Diablo, there will be some people among its community who feel like investing that effort for fame and glory. But when your game is rather obscure then much fewer people will be interested in doing this. \$\endgroup\$ – Philipp Feb 19 '18 at 11:13
  • \$\begingroup\$ Thanks for the thought-provoking comments. As observed, I do (think I) understand the risks. I suppose my question is more about how often this seems to happen for less popular games. I'm no Blizzard (yet ;)), so I'm not as concerned as I'd be if I made Diablo, but is being hacked like that commonly a problem for less popular games, or is it typically so hard that people wouldn't invest the time in doing so for the much more limited "fame and glory"? Anecdotal evidence welcome! \$\endgroup\$ – Bilal Akil Feb 20 '18 at 7:49
1
\$\begingroup\$

It all depends how you implement the server-side code. If, for example, when the user logs in, they send the number of currency they collected while offline, and the server accepts that currency without any check, there's a huge potential for people to abuse that (assuming they have some programming skills, and they care enough).

One thing you can do, is something like "if you want to collect this item, log in online" which kinda forces players to be connected, which is not nice (and as you said you'd rather avoid that).

One other way would be, when the player sends the data, the server checks if the data make sense. Can a player collect a million of your currency in a day? If not, that player probably did something malicious (or found a bug), in which case the server can reject the currency.

I like the logic of "if you play offline, you are free to do whatever you want with a game, including hacking it, but if you want to play online, this changes". Following this, the best course of action would perhaps be "connect online to collect this" and the server can then check if things are valid.

On the bright side, most games do not become as big hits as Diablo II, which means not a lot of people will care about hacking you. Considering that huge companies are getting hacked, you can never be 100% safe, so as long as you have at least some minor protection, you should be alright.

\$\endgroup\$
  • \$\begingroup\$ Interesting concept of considering how much of the currency can be earned in a given time period. Definitely a good thing to consider, even if not for security purposes. \$\endgroup\$ – Bilal Akil Mar 21 '18 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.