1
\$\begingroup\$

I am currently developing a multiplayer game for a university project. The purpose of the assignment is to learn about the use of a cluster architecture, but I have a question concerning security.

The multiplayer role-playing game that I'm developing for class utilizes a client-server architecture. The client holds all of the game assets and a 2D game engine. The server provides authentication to log into a user account, provides access to characters and their progression, etc. The server also provides the positions of non-player characters and other players on the same server, and also provides their actions and movements.

My question is whether a tech savvy user that modified the source code of the client could "play the game" without authenticating, forcing a kind of single player version of my game? I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot. Maybe he/she would simply want to move around the game world freely.

1) Does this scenario seem possible?

2) Most importantly, what harm could this cause to a multiplayer game? Perhaps I have content that I don't want someone to be able to access without properly purchasing the game, or if they have been banned for some reason.

3) If this is a problem I should try to mitigate, how could I go about preventing this kind of thing from happening?

\$\endgroup\$
  • \$\begingroup\$ If you prevent if from happening, the person who can modify the code can just delete the code you add to prevent it from happening. From a security perspective, a person who can modify the code can do exactly the same things they could do by writing their own code - that is, they can do anything that is possible for code to do. They could write their own game that's exactly the same as yours except it's offline, would that be a vulnerability? \$\endgroup\$ – user253751 Apr 7 '18 at 5:51
1
\$\begingroup\$

1.) This scenario seems possible, as there also exist private servers of some MMOs.

2.) I don't think that this could cause much harm. The important data for your game are on the Server. So they won't affect anything in the Online experience of other Players. Datamining will probably always exist in games. To prevent story leaks you could stream Texts from your Server. (Thanks Bálint for the idea)

Acessing areas they are not meant to go is a interesting point. For the MMO Guild wars 2 exists http://www.tyria3d.com/ There you can see the wohle World of the Game in your browser. If something like this would be a Problem you are not allowed to Store the Map on the Client. (that could be difficult)

You can't keep bannes players from playing offline, or on private Servers. So just ignore them.

3.) I don't think this is a Problem and i also don't think that you can avoid something like this as long as the Players have a local Client.

\$\endgroup\$
1
\$\begingroup\$

When you have a multiplayer game, then any calculations which happen on the client can be controlled by the client in order to cheat. So you should think carefully about which game mechanics should be client-sided and which mechanics should be server-sided.

I am imagining a user sending the client his/her own custom information about where to spawn enemies and whatnot.

Enemy spawns should definitly be something which is server-controlled. If you let clients control mob spawns, players can cause all kinds of shenanigans. Like spawning a few hundred instances the rare one-every-day mob which drops the Ultrarare Unobtainium Sword of Awesomeness and farm it.

Also, when it is a multiplayer game, you certainly want mobs to be synchronized across clients. That will be a lot easier to accomplish when they are server-controlled.

When you move any mechanics worth manipulating to the server, then there aren't many fun things left the player could do without being connected to the server. Exploring the world on their own without being bothered by other players is one thing which would be quite easy to do. But any form of progression (gain exp, earn items and money...) should be impossible unless the client is connected to a server acknowledges that the player did something which makes them entitled to that progression.


But considering that this is an academic project and you have very likely drastically underestimated the amount of effort it takes to create an MMO (everyone does), I would recommend you to just pick the easy route and not worry about cheaters at all.

\$\endgroup\$
  • \$\begingroup\$ I am not sure if I'm missunderstanding you or you the OP. I think with the quote he meant a "Hacker" would use the chance to play without authentication to send the client custom informations to spawn mobs ( acting as a private server ). So OP has that stuff on the server side and thinks somebody would emulate such server informations locally to his client for example. \$\endgroup\$ – Nico Apr 6 '18 at 9:50
  • \$\begingroup\$ Nico is correct! Nevertheless this is a very informative answer that reasures me about some of my design decisions. Philipp, you're right that an MMO is a lot of work. Very thankfully the game portion of this project will be minimal. Most of what I'm being scored on is the server architecture that supports this type of game. I was just curious as to the effects of this type of situation, and my curiosity has surely been satisfied with these 3 responses. \$\endgroup\$ – Christian Westbrook Apr 6 '18 at 13:44
0
\$\begingroup\$

A notorious example would be the 2016 (?) Sim City. It was multiplayer only, which definitely made the game less accessible (due to server issues and EA being EA). Someone hacked the game to have a single player (offline) mode.

The harm there wasn't huge, the same content was accessible, but without having to be connected to the server.

If you have content you want to keep secret, you should stream it to the player instead of bundling with the game. That way you also stop any attempt at data mining and also people trying to crack it.

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.