0
\$\begingroup\$

I'm working on a multiplayer android game with Unity. For server side I use python. There is no login system or username. Basically, there is a matchmaking system and rooms. I send json object which contains room key , position of user and etc. from client to server. Room keys are unique and 10 digit hexadecimal numbers. I use udp socket for communication. Here is my questions.

Is it secure only using udp socket for gameplay. Clients already has source code and can change it easily. So they can change data that coming from client to server. Do I need implement an algorithm to make more secure from hack or cheat? Can anybody change apk file and ruin everything in this game?

\$\endgroup\$
  • 2
    \$\begingroup\$ Welcome to the site; you've asked three different questions in a single post, and we prefer that you ask a single question per post, so I've removed all but the question that is specified in the title. \$\endgroup\$ – Josh Oct 15 '18 at 16:53
2
\$\begingroup\$

No, UDP isn't "secure" in the sense that it will prevent hacking or tampering by the client. TCP isn't either, for that matter. If you want to prevent tampering by clients you need an authoritative server to validate the data sent over the network regardless of the transport mechanism.

Additionally, or if you don't have a central server you can rely upon (that you're hosting), you can do things to make tampering harder such as trying to obfuscate the data you send or implement "voting" mechanisms where all peers in the game vote on what they believe the game state to be and boot clients who differ (who are "cheating").

But ultimately anything running on and accessible to the client can be compromised with effort, and you can only take steps to deter such tampering.

\$\endgroup\$
0
\$\begingroup\$

Your question is a bit ambiguous.

First you write "Clients already has source code and can change it easily" and then you ask "Can anybody change apk file and ruin everything in this game?".

When the user has the sourcecode, they can of course change it and build their own APK file which does what they want it to do. And there is no way to detect this kind of tampering via a network, regardless of protocol. So there is nothing you can do on the network level to prevent players cheating by hacking their own game client.


But maybe that's not actually what you are asking. Maybe you are asking about a man-in-the-middle attacker tampering with the game by intercepting and manipulating the UDP packets of another player. UDP has no encryption or authentication layer, so if some evil hacker controls a router between another player and your server, they can do that.

Very few games bother to account for that scenario, though. It is usually assumed that a successful man-in-the-middle attack on another player requires more resources and criminal energy than you would see from the average online game cheater.

But if you believe that encrypting your network protocol is a worthwhile endeavour, then you can of course do that. One IETF standard protocol for encrypted UDP is DTLS.

\$\endgroup\$
  • \$\begingroup\$ Thanks for answer. Can I use SSL for prevent this? There is no personal information but can ssl encrypt packets? or another encryiption algorithm? \$\endgroup\$ – Mus Oct 15 '18 at 17:43
  • \$\begingroup\$ SSL is not an encryption algorithm. It's a protocol which can use different encryption algorithms. But yes, you can use that protocol over UDP. It's called DTLS. But it is not very common, so there aren't many examples around. \$\endgroup\$ – Philipp Oct 15 '18 at 18:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.