Protecting Games: A Security Handbook for Game Developers and Publishers

PROTECTING GAMES: A SECURITY HANDBOOK FOR GAME DEVELOPERS AND PUBLISHERS STEVEN B. DAVIS

Charles River Media A part of Course Technology, Cengage Learning

Australia, Brazil, Japan, Korea, Mexico, Singapore, Spain, United Kingdom, United States

PROTECTING GAMES: A SECURITY HANDBOOK

© 2008 IT GlobalSecure, Inc.

FOR GAME DEVELOPERS AND PUBLISHERS

STEVEN B. DAVIS Publisher and General Manager, Course Technology PTR: Stacy L. Hiquet Associate Director of Marketing: Sarah Panella Manager of Editorial Services: Heather Talbot

ALL RIGHTS RESERVED. No part of this work covered by the copyright herein may be reproduced, transmitted, stored, or used in any form or by any means graphic, electronic, or mechanical, including but not limited to photocopying, recording, scanning, digitizing, taping, Web distribution, information networks, or information storage and retrieval systems, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without the prior written permission of the publisher.

Marketing Manager: Jordan Casey Senior Acquisitions Editor: Emi Smith Project/Copy Editor: Kezia Endsley PTR Editorial Services Coordinator: Jen Blaney Interior Layout: Shawn Morningstar Cover Designer: Mike Tanamachi

For product information and technology assistance, contact us at Cengage Learning Customer and Sales Support, 1-800-354-9706 For permission to use material from this text or product, submit all requests online at cengage.com/permissions Further permissions questions can be emailed to [email protected]

Indexer: Valerie Haynes Perry Proofreader: Ruth Saavedra The information contained in this publication is not intended to convey or constitute legal advice on any subject matter. Readers should not rely on the information presented in this publication for any purpose without seeking the legal advice on the specific facts and circumstances at issue from a licensed attorney. Readers should not consider the information presented in this publication to be an invitation for an attorney-client relationship, and providing the information in this publication is not intended to create an attorney-client relationship between you and any author or contributor to this publication. The information in this publication contains general information that is intended, but cannot be guaranteed, to be always up-to-date, complete and accurate. Any representation or warranty that might be otherwise implied is expressly disclaimed. The authors and contributors expressly disclaim all liability or responsibility in respect to actions taken or not taken based on any or all of the information contained in this publication.

Material in this book may include discussion regarding issues reported in the public media and public legal system regarding services, products, and other material that may be subject to laws granting copyright protection. These issues are discussed for illustrative purposes only and the facts presented are limited to that purpose. Those wishing to seek further information about any illustrative point discussed are encouraged to engage further research. All trademarks are the property of their respective owners. Library of Congress Control Number: 2008932480 ISBN-13: 978-1-58450-670-6 ISBN-10: 1-58450-670-9 eISBN-10: 1-58450-687-3 Course Technology, a part of Cengage Learning 20 Channel Center Street Boston, MA 02210 USA Cengage Learning is a leading provider of customized learning solutions with office locations around the globe, including Singapore, the United Kingdom, Australia, Mexico, Brazil, and Japan. Locate your local office at: international.cengage.com/region Cengage Learning products are represented in Canada by Nelson Education, Ltd.

Printed in the United States of America 1 2 3 4 5 6 7 12 11 10 09

For your lifelong learning solutions, visit courseptr.com Visit our corporate website at cengage.com

For my parents, sisters, family, friends, teachers, and colleagues. Thank you for your patience.

Acknowledgments

irst, I would like to thank Emi Smith, Kezia Endsley, and the team at Cengage Learning for taking the chance to publish a book on game security.

F

Thank you to my readers at PlayNoEvil.com who, through their interest and engagement, have sustained me through the past several years. Thank you to Cheryl Campbell, my great friend and business partner for over 10 years at IT GlobalSecure and also my tireless editor. A special thank you to Joseph Price and Marcus Eikenberry, for their contributions to this book. Thank you to Adam Martin, Pierre Laliberte, Alexandre Major, Marc-André Hamelin, and the other industry professionals who provided invaluable editorial input to the book. Thank you to Richard Davis and Eleanor Lewis for their editorial help. Thank you to my teachers, mentors, friends, and colleagues at the National Security Agency (especially my coworkers in R56, V6, and C7) who instilled in me a passion for the security field and an appreciation for how security “fits” in to the rest of the world. Specifically, Mark U., Brian S., Tim W., Bill M., Cecil S., Sid G., Tanina G., Bill U., Nancy G., Jim A., Ed G., Ed D., Robert W., Bob D., and many others. Finally, thank you to the game industry and gaming industry professionals who have welcomed a strange “security guy” into their midst. Although many people have contributed, the final responsibility for the form, style, content, and everything else related to this work is ultimately mine.

iv

About the Author

Steven Davis has over 22 years of IT and IT security expertise and has focused on the security issues of the gaming industry for more than a decade. He advises game companies, governments, and regulators around the world. Mr. Davis has written numerous papers and speaks at conferences on all aspects of game security. He is the author of the game security and industry blog, PlayNoEvil (http://www. playnoevil.com/). Mr. Davis has international patents on game security and IT security techniques, most notably the anti-cheating protocols that underlie the SecurePlay (http://www.secureplay.com) anti-cheating library. He has designed several games, including DiceHoldem (http://www.diceholdem.com), and acts as a design consultant. He is the CEO of IT GlobalSecure (http://www.itglobalsecure.com), which develops game security products and provides game security, IT security, and game design and evaluation services. Mr. Davis’ experience includes security leadership positions at the U.S. National Security Agency (NSA), CSC, Bell Atlantic (now Verizon), and SAIC. He has extensive cryptographic and key management design experience, including work on Nuclear Command and Control systems, the Electronic Key Management System, and numerous other commercial and government projects. Mr. Davis has a BA in Mathematics from UC Berkeley and a Masters Degree in Security Policy Studies from George Washington University.

v

About the Contributors

Joseph Price is an Associate in the Antitrust and Telecommunications practice groups at Kelley Drye & Warren LLP, with a track record of successfully representing companies in strategic mergers and acquisitions, and is especially adept at working with companies to structure transactions and achieve business goals with competition and antitrust issues. With a particular expertise on counseling companies in regulated industries, Mr. Price has helped clients protect interests threatened by consolidation in the communications industry. He has obtained FTC and DOJ Antitrust Division clearance on numerous transactions, and provides Hart-Scott-Rodino Premerger Notification counseling, preparation, and filing on behalf of many clients, including technologyrelated entities, equity funds, investment funds, and targets of investments. Mr. Price represents clients in public and nonpublic DOJ and FTC investigations and has served as counsel in public and nonpublic FBI, FCC, and State Attorneys General investigations and enforcement matters, including formal and informal administrative complaint proceedings. Mr. Price also provides a full range of legal services for clients that provide technology and broadband services. He works to assist clients achieve business goals, whether they involve access to cutting-edge technologies, growth of market share, product development, or expansion of distribution channels. Mr. Price speaks and writes frequently on antitrust, technology, media, telecommunications, and network security subjects, including the Communications Assistance for Law Enforcement Act (CALEA). His analyses have been quoted in a variety of publications, including Wired, BoardWatch, and Light Reading. Previously, Mr. Price served as a law clerk to Judge Edwin H. Stern of the New Jersey Appellate Division. While earning his J.D. at Catholic University, he served as Editor-in-Chief of the law journal, CommLaw Conspectus: Journal of Communications Law and Policy, and received an advanced certificate from the Communications Law Institute. vi

About the Contributors

vii

Marcus Eikenberry is a serial entrepreneur. He makes his living dealing in intangible goods and services within online video games. His companies sell huge volumes of game registration codes and game time codes as well as providing anti-fraud solutions for other sellers within these online gaming markets. Back in 1990 when the Internet was just for universities and the government, Mr. Eikenberry was doing computer hardware sales to the public. Fraud was very rare and not something that needed much attention. In 1993 when Mosaic hit the public, he attempted to start doing business on the web. In 1994, he published computer hardware sales sheets and started doing mail order sales. Because he didn’t like dealing with physical products, he looked for other products to sell that did not require shipping. In December of 1997, he found the perfect item to sell: intangible goods within online video games. Marcus is a pioneer of sales of these intangible video game items and services. Today, Mr. Eikenberry owns Markee Dragon Inc., which includes several companies, including: TrustWho (www.TrustWho.com)—Anti-fraud services providing transaction processing and payment verification for companies experiencing high fraud rates. Markee Dragon (www.MarkeeDragon.com)—The largest site in the world for the buying, selling, and trading of online game accounts. It is estimated that over 2.5 million dollars worth of accounts and services trade hands in this site’s forums monthly without any charges to the members. Shattered Crystal (www.ShatteredCrystal.com)—Where new game codes, upgrades, and game time have been sold to several hundred thousand satisfied customers since 2002.

Contents

Introduction

xv

The Protection Game

1

1

Game Security Overview What Is Game Security? References

2 3 5

2

Thinking Game Protection Independence Lazy, Cheap, or Stupid Threats, Vulnerabilities, and Risk Beyond Protect, Detect, React Asymmetric Warfare Process, Testing, Tools, and Techniques Second Grader Security References

Part I

Part II

viii

6 7 8 12 13 15 17 19 20

Piracy and Used Games

21

3

Overview of Piracy and Used Games

22

4

The State of Piracy and Anti-Piracy Determining the Scope of Piracy Trusted Brand Security: Nintendo and ADV Anti-Piracy Innovators: Nine Inch Nails and Disney Going Forward References

23 24 28 29 30 31

5

Distribution Piracy Preventing Duplication Detecting Duplication Collectables, Feelies, and Other Stuff Disk as Key License Keys

32 32 33 34 34 35

Contents

ix

Splitting and Key Storage Busted Pirate: Now What? References

39 42 43

6

DRM, Licensing, Policies, and Region Coding The Basics of DRM Why DRM Doesn’t Work Types of DRM Systems License Policy References

44 44 45 46 51 54

7

Console Piracy, Used Games, and Pricing Attacking Consoles The Used Games Market Pricing Pirates Out of Business References Server Piracy Trends

55 55 60 62 65 66

8

Server Piracy Authenticating the Server References

66 70 74

9

Other Strategies, Tactics, and Thoughts Measuring Piracy Fighting Pirate Networks Multi-Player Gaming Rich Interaction System Digital Affiliate System Playing with Secure Digital Distribution References

75 75 76 79 79 84 87 91

10

Anti-Piracy Bill of Rights Basic Fair Use Principles Registration Options Installation Options Connection Options References

92 93 94 95 95 96

11

The Piracy Tipping Point Determining the Goal of Anti-Piracy Policies References

97 97 99

x

Contents

Part III

Cheating

101

12

Overview of Cheating

102

13

Cheating 101 Cheating and the Game Industry Fair Play Cheat Codes The CARRDS Reference Model The Remote Data Problem Security, Trust, and Server Architectures Random Events Player Collusion Business Models and Security Problems References

103 103 105 106 110 111 121 125 127 129 131

14

App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures Memory Editors, Radar, and ESP Data Obfuscators Code Hacks and DLL Injection Blind Security Functions, Code Obfuscators, and Anti-Tamper Software Design Save Game Attacks, Wallhacks, and Bobbleheads Secure Loader and Blind Authentication References

132 132 134 137 139 141 142 145

15

Bots and Player Aids Is It “Help” or Is It Cheating? CAPTCHAs: Distinguishing Players from Programs Cheat Detection Systems References

146 146 149 150 154

16

Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions ACID, Dupes, and SQL Attacks Defensive Proxies Hacker Proxies Thinking About Network Time: Act, But Verify Securing Time References

155 155 157 158 163 165 165

Contents

xi

17

Game Design and Security 166 Design Exploits 166 Collusion 167 Trivia Games 167 Word, Number, and Puzzle Games 169 Algorithmic Games, Physics Flaws, and Predictable Behavior 170 Speed, Twitch, Timing, and Pixel Precision 173 Strong and Dominant Strategies and Deep Game Play 175 Power of People: Rock-Paper-Scissors, Poker, and the World of Psychology 175 Game Play Patterns: Combat Devolved 176 Designing for the Medium 179 References 179

18

Case Study: High-Score Security Cheating in High-Score Games Encryption, Digital Signatures, and Hash Functions Client-Server Option Randomly Seeded Client Alternative High-Score Strategies Puzzles, Skill-Based Games, and Other Deterministic Games Inappropriate Player Handles Summary References

181 181 182 184 184 185 186 187 187 187

Part IV

Social Subversion: From Griefing to Gold Farming and Beyond with Game Service Attacks

189

19

Overview of Social Subversion

190

20

Competition, Tournaments, and Ranking Systems (and Their Abuse) 192 Understanding Tournaments and Ranking Systems 192 Lobby Attacks 195 Syndicates and Bots 197 Tournament and Ladder Game Play Attacks 197 Abandonment: The “Game Over” Game 199 Game Operator Problems 201 Identity Problems 202 Countermeasures 204 Retrofitting Games for Tournaments and Skill Games 206 Summary 206 Resources 207

xii

Contents

21

Griefing and Spam Communications Griefing and Spam Game Play Griefing User-Created Content Liability and Business Risk References

209 210 215 217 218 221

22

Game Commerce: Virtual Items, Real Money Transactions, Gold Farming, Escorting, and Power-Leveling Amusement Park Economics Alternative Models On Virtual Items Gold Farming Gold Frauders, Online Thieves, and Insiders Potential Solutions Power-Leveling Escort Services, Subletting, and Virtual Prostitution Summary References

223 226 227 228 230 236 238 239 240 240 241

To Ban or Not To Ban? Punishing Wayward Players Crime, Credibility, and Punishment The Cost of Punishment: Who’s Being Punished? Possible Punishments and Credible Deterrence Summary References

243 243 244 245 248 249

The Real World

251

24

Welcome to the Real World

252

25

Insider Issues: Code Theft, Data Disclosure, and Fraud Code Theft and Other Data Disclosures Office IT Infrastructure Insider Fraud Playing Your Own Game Privileging and Isolation References

254 255 258 259 260 262 265

26

Partner Problems Contracting Security? Security Accountability in Third-Party Development Security Accountability in Third-Party Licensing Service Provider and Partner Security Issues

266 266 267 268 270

23

Part V

Contents

Community and Fan Sites References

xiii 273 274

27

Money: Real Transactions, Real Risks Payment Processing Inside the Payment Process: PayPal Anti-Fraud Integration for Automation Payment Fraud References

275 276 280 282 286 287 287

28

More Money: Security, Technical, and Legal Issues PCI-DSS and Security Account Security, Virtual Items, and Real Money Money Laundering and Illegal Payments Money Laundering: Legal Issues References

288 289 289 290 291 293

29

Identity, Anonymity, and Privacy The State of Identity and Anonymity The Registration Problem and Identity Management Systems Age Verification Usage Controls and Game Addiction Account Compromise, Identity Theft, and Privacy Legal Requirements for Privacy Protection References

294 295 296 302 304 306 308 310

30

Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers Dealing with Cyberbullies, Pedophiles, and Stalkers Kids’ Communications, Parental Controls, and Monitoring COPPA Children and Identity Child Pornography References

313 315 316 319 320 321 322

Dancing with Gambling: Skill Games, Contests, Promotions, and Gambling Again What Is Gambling and What Is Not Accidental Casinos Skill Games Miscellaneous Security Issues Legal Considerations References

324 325 326 327 328 329 333

31

xiv

Contents

32

Denial of Service, Disasters, Reliability, Availability, and Architecture What Can Go Wrong, Will Go Wrong Denial of Service Scalability and Availability Sample Game Operations Architecture Disasters and Disaster Recovery Contingency Planning References

335 335 336 339 340 342 342 343

33

Scams and Law Enforcement Scams in Games Game Scams Law Enforcement Facilities Requirements: Potential Unexpected Laws and Regulations References

344 345 347 348 349 350

34

Operations, Incidents, and Incident Response Secure Operations Active Measures Incidents and Incident Response Public Relations and the Perception of Security References

351 352 354 354 356 358

35

Terrorists Virtual Terrorism Online Tools for the Modern Terrorist References

359 359 360 363

36

Practical Protection “We Have Met the Enemy and He Is Us” The Business of Game Protection In Closing References

364 364 367 370 370

A

Selected Game Security Incidents

371

B

Glossary

379

Index

385

Introduction

his book is intended to infect its readers with an interest and concern for game protection. My goal is not to preach to the ”security converted,” but to convince game designers, developers, programmers, managers, marketeers, and artists that they should care about the security of their games and give them confidence that there are ways to secure their games.

T

Asian hackers hack for money, not glory. They do not share their hacks, but sell them and do not seem to be as sophisticated as those in the US and elsewhere who target services in the US. —Whon Namkoong, CEO, NHN USA, Casual Game Conference 2007 Designers ask, “How can I make my game fun?” Executives ask, “How will this game make money?” Both questions have a security component: How can someone undermine my game’s play? How could someone play and not pay? What could undermine the success and potential of this game? Game protection is about answering these questions. Ignoring them can ruin the game and cost its creators their business. Ideally, this book will also be useful for IT security and game security professionals. There is a lot of game security information scattered about on the Internet and in various press releases and magazine articles. This book brings this information together in one place. When I started discussing game security, a number of industry professionals told me that the game industry needed its “Pearl Harbor” to bring security to the fore. Although there hasn’t been a single, spectacular and devastating attack, there is an ongoing guerrilla war that distracts the industry from its primary goal—to build great games. As a longtime security professional, I have found game security problems quite fascinating.

xv

xvi

Introduction

Even on a bad day, traditional IT security for business is relatively straightforward. There are only a limited number of things that can happen—money changes hands, maybe with a third party involved via escrow; assets move through a workflow process; and decisions need approval. Very rarely does IT security get deeply entwined into the unique aspects of a business. Not so with computer games. Even a simple card game has more complicated interactions than many business processes—information is concealed and shared, cards must be dealt fairly, wagers made and resolved—and most games are much, much more complicated. Customers are often the adversaries: exploiting game mechanics, stealing game assets, and hacking high scores and achievements. Games can have a wide range of rules, systems, and transactions limited solely by the imagination of the game developers, the skills of its programmers, and the strategies of its executives. Today, games face longstanding challenges from piracy and cheating with the new additions of protecting children and privacy. The list goes on and on and on. Plus, you still have all of the traditional IT concerns, including money, authentication, encryption, and so forth. Protecting games is fascinating, fun …and a whole lot of work.

K NOW Y OUR F OE The game industry is in a tremendous cycle of innovation with new games and game business models emerging. Participation is expanding beyond the industry’s traditional audience of teenage boys into a market that includes everyone from kids to mom, dad, and even seniors. The bad guys are following right along. I began my security career at the National Security Agency working, mostly, on Nuclear Command and Control systems. Our adversary was the USSR—a highly motivated, skilled, well-funded, committed foe who would do whatever necessary to defeat us. Instead of the KGB’s staff and budget, game hackers and cheaters tap a global pool of talent who will happily attack a game for free with their only reward being pride at being the one who breaks the latest title: a serious foe to be taken seriously. Even worse, criminals have learned that games are a lucrative target. A stolen World of Warcraft account is worth more than $10, whereas a stolen credit card number can be had for as little as $1.50. The game industry groups estimate that piracy costs billions of dollars a year.

Introduction

xvii

Viruses, worms, and phishing scams aren’t just being created for fun. IT security threats are now a major criminal problem. Hackers don’t write viruses just to infect as many computers as possible, they write highly targeted worms that sniff game account passwords or loot online poker accounts.

S TRUCTURE

AND

C ONTENT

Most security books are structured around technologies or solutions: encryption, firewalls, digital signatures, and so on. Because the subject of this book is protecting games, I have organized it around the topics that game developers care about including—piracy, cheating, tournament hacking, gold farming, protecting children, and protecting identity. Many attacks on games and security methods use common underlying techniques and so there is some redundancy of exposition. For example, memory editors are useful for piracy and cheating, whereas challenge/response protocols are useful to protect high scores and remotely authenticate software. Interestingly, traditional security techniques such as encryption and digital signatures are much less effective for protecting games because most of our attention is focused on insider attackers who have access to the platform and software and therefore can often access cryptographic keys or circumvent digital signature functions. Cryptography still has an important part to play in protecting games. However, because this is text is targeted at general readers, I do not spend much time explaining the details of the cryptographic protocols I discuss. There are plenty of books on these topics for interested readers. I try to draw example games from the entirety of the industry—everything from gambling and skill games to advergames, casual games, subscription MMOs, free-to-play games, and first person shooters. Occasionally, I will cite examples from traditional (and not so traditional) board and card games, as it is often easier to understand the actual game mechanisms when there are no fancy graphics or animations. There are numerous specific security incidents cited throughout the book, drawn from fairly credible press or public sources. The actual facts of the incidents are often unknown, as game companies, like most other businesses, are not in a hurry to share the details of their security problems. Often I am guessing as to what the underlying problem is and what a plausible solution could be, based on my experience. When I have been given official knowledge of game security problems, I am almost always constrained by a non-disclosure agreement. The specific security incidents discussed are not an indictment of any individual, developer, or publisher, and certainly not an endorsement of any hacker.

xviii

Introduction

In most cases, there is no way to verify that the descriptions or problems are completely accurate. Rather, the incidents should be considered examples of the types of problems that games and game developers face. Many of the countermeasures that I discuss are non-technical. I am a big believer in trying to find easy ways to avoid problems rather than always solving problems with a technical fix. If possible, I try to include multiple solutions since your game and your environment may be far different than my examples. If nothing else, I want to show that protecting games is not purely, or even primarily, a technical problem. I do include some pseudo-code. It isn’t C or Java or Python, but simply an efficient way to describe various algorithms, protocols, and processes.

A TTACK T OOLS

AND

T ECHNIQUES

I discuss attack tools and techniques throughout the book. If possible, I try to keep the discussion at a generic level and not give sufficient information to implement a specific attack on any specific game or product. I do mention several widely known tools for hacking games. This is not an endorsement of these products, confirmation of their functionality, or a recommendation of any kind. Anyone who considers using such attack tools should do so with great caution. Criminals delight in including key-loggers, spyware, adware, and an abundance of other malicious code with installation packages for hacking tools. Even compiling these tools from source code can be risky—are you really going to examine every line of code and every included library?

O NWARD This book is the product of over seven years of tracking and analysis of game security issues, the last three of them covered in my blog, PlayNoEvil (http://www. playnoevil.com/). My hope is that I convey some of the excitement that I feel when a new game problem comes along... and, even better, my satisfaction when I see or create a solution. The game industry is in the midst of an amazing transformation and I believe that protecting games will be critical to the success of that transformation. Steven B. Davis

October, 2008

Part

I

The Protection Game

In this part, you’ll find the following topics: Chapter 1, “Game Security Overview” Chapter 2, “Thinking Game Protection”

1

1

Game Security Overview

hy should we worry about game security? Who should worry about game security? What exactly is game security? How much should we worry about game security?

W

Welcome to the “security game.”

Everybody plays the security game. You play whether you want to or not. You are playing the security game when you build or operate a game: Your customers want to play for free, always win, say what they want, and do what they want to whomever they want. And the Internet only makes this worse. Your players can come from any country. Misrepresent their identity. Upload and download your games (paid for or not) to an audience of millions or billions. However, you want to make money (usually), players want other players to play fairly (whether or not they do so themselves), treat them well, and protect their children. And, of course, there is one kind of help you usually don’t want: the government. Game violence, addiction, privacy, obscenity, pedophiles, gambling, marketing, terrorists, hackers, criminals—all sorts of issues can get you on the government’s radar. Finally, you have traditional IT and ecommerce security issues including data theft and information disclosure, disaster recovery, and, when things do go wrong (and they will), incident response. I’ve been told security is the game publisher’s problem; I’ve been told it is “a technical problem;” and I’ve even been told that it is no problem at all or to wait for the game industry’s “Pearl Harbor.”

2

Chapter 1 Game Security Overview

3

W HAT I S G AME S ECURITY ? Game security is two things: First, it is the dark side of your game. It includes all the problems that you don’t want to think about, but that could ruin your business and your game. Second, and more hopefully, good game security may open up new ways of operating your game or implementing your business that would not be possible otherwise. WHEN SHOULD YOU CARE ABOUT GAME SECURITY? This is simple. If game security does not save you money, enhance your reputation, or make you money, don’t waste your time on it. Security should be held to the same standard as anything else you are doing. A nice thing about security in the game industry (and elsewhere) is that it is often quite cheap to address at the beginning of a project. Security can be horribly expensive or just unsolvable late in the development process or after the game is running. Security and quality go hand in hand. In fact, many security defects are really quality defects. WHO SHOULD WORRY ABOUT GAME SECURITY? Everyone. You will be able to avoid or solve most of your security problems just by being aware of them and considering the possibility of things going wrong while you work. Security is not the responsibility of the security guy (or gal). Security staff is there to focus on security just as testers focus on testing, designers focus on design, and marketers focus on marketing. Hopefully, they bring domain expertise to the subject, but, at the end of the day, everything needs to be balanced (the business model, the game design, the art, the budget, testing, and security). In general, good data on security incidents is pretty scarce. People don’t like to admit their problems unless they have to. Without California’s Data Disclosure1 law, it is unlikely that any of us in the US would hear about the numerous compromises of our personal data. Security problems can lead to real changes in consumer behavior. According to a survey by Unisys of 8,000 individuals, 45 percent stated that they would change financial institutions because of security problems 2. The game industry faces unique challenges in this regard because players see security problems that affect both themselves and others. Security problems with most businesses are only visible to the individuals involved. Even in a publicly traded company, security problems are buried in overhead expenses. Game security problems are noticed by everyone. Even single-player games are social. Players share results and achievements. Once you move to multi-player games, even something as simple as a shared high score list creates intense attention to perceived cheating. Thanks to the Internet,

4

Protecting Games: A Security Handbook for Game Developers and Publishers

problems with games get broadly distributed very quickly and can cause irreparable harm to the game business. Traditional criminals do their work in the dark. Attacking games can be a true ego trip spurring game hackers even without any financial reward: Attackers have the attention of thousands or millions of fellow players. Of all the articles that I’ve written on my blog, PlayNoEvil (http://www. playnoevil.com/), the long-term, number one page view is an article I wrote about cheating at Flash games written in early 2007 (currently, the leading contender is an article on hacking children’s games). Many of the comments I receive are requests for help cheating in the various games I discuss! Consumers care about security. In 2005, a survey of 150,000 Chinese online game players found that “no game hacking and cheating” was the Number 2 issue for choosing a game to play (at 11.02 percent), just behind graphics and audio content. It also found that “game cheating and hacking destroyed game” was the Number 1 reason for leaving a game (18.5 percent) with “game security” itself at Number 9 (5.85 percent)3. In the US, Intel did a small survey of 226 gamers focused on cheating and found that 71% were either extremely concerned (23 percent) or somewhat concerned (48 percent) 4. Cheating problems are of such concern to game companies that they regularly delete related discussions from their online forums. Popular concern with game addiction has led to actions to restrict the number of hours consumers can play in China and elsewhere 5. Although consumers care more about cheating and excessive game play, piracy is the number one concern for many traditional computer game companies. The Entertainment Software Association (ESA) estimates that piracy costs the U.S. game industry $3 billion per year 6. Another disturbing fact is that games, particularly online games, are increasingly the targets of criminals. In June 2008, Fortinet found that 13 percent of Asian malware (malicious programs such as worms and viruses) targeted games 7. The growth of online gaming has made game account theft lucrative. Criminals use key-loggers (programs that extract keystrokes from a computer and send them to a remote location) to steal players’ usernames and passwords to empty player game accounts and sell the contents to others. The global nature of the game industry makes legal remedies virtually futile. Blizzard, the operator of the hugely popular online game World of Warcraft, has gone so far as to start selling a low-cost authentication token8—a technology previously reserved for serious consumer applications like bank and stock trading accounts as well as within corporations and governments. The problem is getting worse. Hackers are following the money and there is easy money in attacking games. In the early days of the online gambling industry, hackers attacked an online casino running software from Cryptologic Inc. The company quickly shut the servers down, but during those short couple of hours, everyone playing craps and video slots won every game, costing the company $1.9 million 9.

Chapter 1 Game Security Overview

5

Gaming is no longer a niche; it is a major form of global entertainment. Everyone is getting in on the act. Ordinary companies are incorporating games and contests into their marketing campaigns. Deloitte Touche Tohmatsu found in a 2008 survey of Dutch advergame sites that over 90 percent of the games are vulnerable and over 50 percent are, in fact, attacked 10. Companies are tying cash and prizes to these games, making them targets and turning what could be a marketing bonanza into a public relations nightmare. THE GAME SECURITY CHALLENGE The challenge of game security is that you, the game creator, have to play by the rules. You can’t break laws; you have limited time and a perpetually squeezed budget; and you have to keep your customers safe—all while providing an entertaining experience. Your foes are constrained only by your efforts. They know no boundaries, and may attack you simply because they can. Let’s see if we can win.

R EFERENCES 1. California (2002), “SB 1386,” http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_ bill_20020926_chaptered.html 2. W. Eazel (2005), “Majority of World Worried about Internet Fraud,” via http://playnoevil.com/ serendipity/index.php?/archives/144-Bad-Security-Makes-Consumers-Change-Online-Behavior-GoodDemographics-Metrics.html (original link http://www.scmagazine.com/us/news/article/530336/?n=us) 3. PlayNoEvil (2006), “Game Security Major Issue for Online Gamers in China,” http://playnoevil.com/serendipity/index.php?/archives/719-Game-Security-Major-Issue-for-OnlineGamers-in-China.html 4. Intel (2006), “Intel Fair Online Gaming Study” 5. China Daily (2007), “China Clamps Down on Teenage Internet Gaming,” http://www.chinadaily.com.cn/china/2007-07/17/content_5438062.htm 6. ESA (2007), “Video Game Industry Applauds Game Pirate’s Sentence,” http://www.theesa.com/ newsroom/release_archives_detail.asp?releaseID=20 7. Fortinet (2008), “The State of Malware: June 2008 Edition,” http://www.fortiguardcenter.com/reports/ roundup_jun_2008.html 8. Blizzard (2008), “Blizzard Authenticator Offers Enhanced Security for World of Warcraft Accounts,” http://eu.blizzard.com/en/press/080626-ba.html 9. B. Warner (2001), “Hacker’s Heaven: Online Gambling,” http://www.cbsnews.com/stories/2001/09/10/ tech/main310567.shtml 10. Deloitte (2008), “Advergames op Grote Schaal Gehackt,” http://www.deloitte.com/dtt/press_release/ 0,1014,sid%253D13354%2526cid%253D202819,00.html (English language version at http://playnoevil.com/serendipity/index.php?/archives/2107-SeriousAdvergame-Hacking-Problems-Deloitte-Touche-Tohmatsu-Netherlands-Survey-Findings.html)

2

Thinking Game Protection

y first impulse when I began this project was to use the word “security” in the title. After all, we usually talk about IT security: When I started in the field in the mid-1980s at U.S. National Security Agency (NSA), I worked in communications security (COMSEC) and computer security (COMPUSEC) and later information security (INFOSEC). There was also Operations Security (OPSEC), transmission security (TRANSEC), and a whole bunch of other SECs.

M

The problem with the word “security” is that it is a bit of a lie. You can never be completely secure (and every security person will tell you this). Security is an ideal, like truth, beauty, and art. This linguistic trap was articulated in one of the few really good books in the field that I have found: Information Protection and Other Unnatural Acts by Harry Demaio1, sadly, long out of print. Protection captures our endeavor much more accurately than security. We are in the business of protecting games, because we know that we can’t fully secure them. We face the same problem everyone else does—protection fails, sometimes with spectacular consequences. When we think about protection, we are already thinking in economic terms—“how much protection is enough?”—rather than in absolutes. There is power in imperfection. My goal in this section and throughout this book is to change how you think, not about game security problems, but about game protection and how to achieve it. This section does not address the specific issues of piracy, cheating, or any of the other numerous challenges that drive game developers to distraction. Rather, it gives you a framework you can use to think about protecting your games in the face of these threats, or at least how to protect your games “well enough.” Game developers and publishers often seem a bit fatalistic about security. There seems to be a tendency to give up and simply accept the problems. Or, conversely, developers and publishers seek some magic bullet—a single product that will solve their problems with one purchase; preferably bought at the end of the development process from someone else’s budget.

6

Chapter 2 Thinking Game Protection

7

This violates my first security principle: Security Principle 1: Anything that is easy to add is easy to remove. Many anti-piracy solutions such as digital rights management (DRM), which is discussed in Chapter 6, repeatedly demonstrate this problem. The notion of “layers” is used when discussing security, but the term is widely misunderstood. It is common to talk about a “security layer” or about “security services.” Tools like encryption, key management, firewalls, and intrusion detection are put into nice little architectural blocks to be called on when needed and are called security layers or services. Nothing could be further from the truth. Properly speaking, one should talk about “layered security.” When we are in the world of protection, we understand that all our security tools are far from perfect. The art and engineering of well-protected systems comes from combining multiple, interlocking security techniques into a powerful whole. Rather than building a security chain that is only as strong as its weakest link, you need to create a security mesh of independent elements that is much stronger than any individual links and will continue to operate even if a single tool fails. Effective protection requires weaving security throughout your application or business. Some of your protection tools may not even be security techniques, but simply carefully chosen parts of your business or technical strategy.

I NDEPENDENCE In 1990, Clifford Stoll wrote perhaps the first true computer security caper story The Cuckoo’s Egg 2. It was even made into a NOVA special. Dr. Stoll was an astronomer who, unable to get a job doing astronomy, worked at Lawrence Berkeley National Lab as a system administrator. His boss asked him to investigate a $0.75 discrepancy between an old, custom computer accounting system and the standard UNIX one. This investigation led to an international spy ring, the FBI, CIA, and all sorts of other entertaining things. It’s a great book or video. The most important lesson of the story seems never to have been learned and is my second security principle: Security Principle 2: Effective security comes from weaving together independent systems.

8

Protecting Games: A Security Handbook for Game Developers and Publishers

The only reason that this case came to light was because someone noticed the accounting discrepancy between the old accounting system and the standard one. The hackers knew enough about the standard UNIX operating system to attack the accounting system and hide their tracks. They did not know about the strange old Berkeley accounting system. If they had, they would likely have beaten it, as it was running on the same computer. To show how bad the problem is, many computer security references use the term “audit trails” routinely. The term “audit trail” clearly implies all sorts of wonderful independence and security. Unfortunately, these tools are not audit trails at all, only accounting records. There is only one system involved that is generating the report, not two independent ones. When I talk about independence, I am really talking about statistical independence: Entities are independent of each other if events or actions related to one do not affect the other3. The challenge, of course, is how to build independence into your system—without breaking the bank. Independence is discussed much more extensively in the field of safety engineering by those who are building reliable and highly available systems than it is as a security principle. Passenger jets have multiple engines so that the plane will be able to fly when one (and sometimes more than one) engine fails. The Space Shuttle has five flight computers that vote to avoid undetected failures. We can actually achieve the goals of independence in multiple ways. As described, we can have multiple entities that independently generate identical results (we hope). We can also have systems that generate multiple results that are independent of each other—a log of game wins, losses, and wagers compared to a financial log of deposits, transfers, and payments. One of the areas where games have an advantage over other entertainment media is that they are naturally highly transactional. While I may buy and watch a movie, for many games I can post high scores, play with other people, and otherwise repeatedly interact. These numerous interactions can be used together to prevent and detect piracy, discourage griefing, and deter cheating.

L AZY , C HEAP ,

OR

S TUPID

I’ve long enjoyed the engineering truism “good, fast, or cheap; choose two.” In other words, if you want something good and fast, it won’t be cheap and if you want something fast and cheap, it won’t be good. I think the security field needed something similar, so here’s my stab at it: Lazy, cheap, or stupid: Any one will get you. … or some such.

Chapter 2 Thinking Game Protection

YOU CAN’T COUNT ON TRUST “Trust” gets waved around a lot in the world of IT security (and, recently, in discussions about fighting piracy). When I started out in the security field, a big focus was on trusted operating systems and since then we’ve moved on to trusted platform modules. The whole idea of these products is that by building a whole lot of “security” (whatever that means), we can “trust” the “trusted” thingy and be secure. The goal is noble, but rather naïve. First of all, there is no objective definition of security. The security requirements for another business can be very different from yours even when you both are using the exact same applications and platforms. The game industry is not the same as the military; which is not the same as a dating service or an online auction service. Second, most real security problems occur at the application and business operations levels, completely independent of the underlying platform. Spell checkers may be able to determine whether a word is spelled correctly, but they can’t tell if you’ve chosen the wrong word (a problem that I’ve found often while editing this book). If you have incorrectly defined or configured your ordering process, an unauthorized individual may be able to furnish his house at your expense. A trusted platform will do nothing to solve malicious use of a legitimate application. Third, the interaction of arbitrary applications on top of a trusted platform can no longer be considered trustworthy. As I noted, when my career began in the 1980s, trusted operating systems were all the rage. What we found was that once we started adding applications to these platforms, our security analysts were able to undermine the system by attacking the applications directly. Currently, the focus is on hardening standard operating systems—basically getting rid of the gratuitous “stuff’” that can cause some of the worst problems. This includes removing unnecessary applications such as editors and compilers as well as unneeded network services, analysis tools, and many of the other products that are provided as part of a standard operating system distribution. Fourth, what if the trusted platform fails? It happens. Even if you wanted to, could you risk your business on the promises of a third party? Once upon a time I worked on a government project with a very clever anti-tamper piece of hardware. Our security team had to plan for the scenario where we would lose one of these devices (which we had spent a lot of money making tamper-resistant). Our final assessment was that we had to operate the system as if we had no tamper protection. That, if we ever lost control of one of our anti-tamper boxes, we still had to assume it had been compromised and implement our procedures to recover our security status—even if it was returned “intact.” Trust is not enough. All of this is not to say that using trusted systems is not good practice. However, it’s best to use these products as tools and part of an overall security system plan, not as the hard kernel of security.

9

10

Protecting Games: A Security Handbook for Game Developers and Publishers

To an outsider, security often looks like black magic. The field is full of magic words: rootkits, worms, viruses, hackers, penetration tests, amazing sagas, embarrassing failures, and spectacular capers. Scratch the surface, however, and you’ll find that almost all security problems arise from one or more basic human failings: laziness, being cheap, or stupidity. These are security’s three deadly sins, so let’s look at each in more detail. Laziness

There is depth and even some real complexity as you learn the art of security, but the reason many security experts can appear to work miracles and divine problems after taking only a cursory look at an organization, system, or project comes from knowing the following: Security is not a primary concern of most people. When you don’t care about something, you tend to take shortcuts and cut corners. People are wonderfully consistent, especially in how they cut corners. Of course, things aren’t quite this simple. You need to have a good deal of knowledge of development practices, programming, system design, project management, business planning, and “human nature” to pull off these “miraculous” insights. Once someone describes a situation for me, the first thing I think about is “what would be the easiest way to build this system?” and, because the easiest way to build something is rarely the right way, “what is the easiest way to exploit the poorly built system?”. Habits are wonderful for predicting future disasters. In the game industry, the biggest cheating problems come from the fact that most developers start by programming a single-player game and then add multi-player features. Even though everyone knows and complains about piracy, they don’t actually seem to start planning a strategy against it until the game is about to launch. The game industry is not alone. I’ve been brought in on classified government projects after years of development and many millions of dollars spent, where security only came up because someone noticed that the system needed to be accredited as secure before it was allowed to operate. Being Cheap

Security is never given a decent budget. It is a legitimate problem for planners. Security rarely shows up as a positive revenue line item. It is always portrayed as a cost with nebulous benefits at best. Interestingly, one of the things I like best about the game industry is that its security problems are so closely tied to its core business.

Chapter 2 Thinking Game Protection

11

In many other industries, it is very hard to argue whether one firewall is better than another or if one should invest in an intrusion detection system or not. This is not true for the games industry. Piracy costs sales. As a security analyst, I can make estimates of those costs and the benefits of my proposed anti-piracy strategy and present a reasonable business case to management and ask for a budget. Cheating has not been seen to be a major problem for traditional, single-player games that are sold shrink-wrapped at a retailer. However, as we move towards multi-player and online games and the industry transforms from a product-sales business to a service business, cheating becomes much more important. Cheating and game integrity has always been critically important for skill games, contests, and the gambling side of the industry. Similarly, payment processing, identity, protecting children, and the other topics that I will discuss are not theoretical problems. They can cost your business money or, even worse, give you the opportunity to deal with irate customers or governments. Stupidity (Ignorance Is Bliss, for a While)

Developers in every industry are rightfully proud of their accomplishments and eager to hurry their products to market. After a long slog of development and hopefully some testing, most developers are rather confident about their product’s ability to work well. In physics, Work equals Force times Distance. If you don’t go anywhere, you haven’t done any Work. The remorseless calculus of security doesn’t care how hard you worked or who you are. Hackers just care about what you have actually done. When I made my first security presentation to the game industry in 2001, developers shared horror stories of players hacking Flash games just to get high scores on their individual sites. Eight years later, players are still hacking Flash games to get high scores to win prizes and lots of cash… and causing some large companies serious grief in the process. Gold farming isn’t a new problem and people have been creating bots since the early text MUDs. However, pretty much every modern MMO has continued to be plagued by these attacks. Now, instead of a couple of guys running a game on a university server, gold farmers are earning millions, if not billions of dollars, and chewing up entire customer support teams. Major game publishers are spending untold dollars suing bot builder companies knowing full well that another will spring up, probably in a jurisdiction beyond the effective reach of their lawyers. All of the security issues discussed in this book are fairly well known to professionals in the industry as well as interested consumers and even more interested hackers and criminals. The best way to avoid security problems is to simply acknowledge them at the start of a project and address them early in the development process. Or, at the very least, ignore them consciously. It is simply stupid to do otherwise.

12

Protecting Games: A Security Handbook for Game Developers and Publishers

The good news is that solving many of your security problems may be as simple as adding “remember security” to your project’s PowerPoint templates.

T HREATS , V ULNERABILITIES ,

AND

R ISK

The game industry knows who its attackers are: Pirates steal games, cheaters win unfairly, griefers and gold farmers are just a pain for everyone. The IT security literature talks a lot about vulnerabilities, threats, and risks. The language of the industry and its processes in this regard are a bit confusing. The real question is: What, if anything, can a security analyst tell you that will cause you to change how you operate or spend money to fix something? While people may talk, and talk about security requirements, in practice, these requirements are undermined when there is money and effort required. This is frustrating for security analysts, as they spend a lot of time hunting for vulnerabilities, writing them up, and presenting them to management only to be told “we’ll accept the risk.” The problem is, management might not be right about accepting the risk, but the basis of their decision seems to have little to do with the described vulnerability, but rather with rhetoric. Risk is the nemesis of protection. Risk is where people get into the most trouble. It is basically a qualitative assessment of how likely someone will do something (bad) and the probability that he or she will succeed. Risk also captures the consequences, usually in financial terms, of an incident. On paper, this doesn’t sound like a bad concept at all. The problem is with its use. Risk assessments, vulnerability assessments, and threat assessments seem to all boil down to a long questionnaire and Excel spreadsheet that reduces risk to a number. Often commercial products will generate some “risk score” number, which is then used to determine whether you are secure enough. There are three important problems with this approach. First, the weighting schemes that are used to compare one attack or vulnerability to another are often hidden and reflect the biases of the tool maker (or consultant) rather than the priorities of the client. Second, some risks are not commeasurable, or rather they shouldn’t be: It makes little or no sense to combine security issues related to identity theft with those for denial of service. Third, the tools rarely seem to support business decisions. Instead of giving a final numeric score, these tools would be

Chapter 2 Thinking Game Protection

13

more useful for determining relative residual risk between programmatic choices: Should you choose Option A with Budget B, which yields Risk Profile C or choose Option D with Budget E, which yields Risk Profile F? Making assumptions about your adversary is quite dangerous. People tend to “mirror image” their foes. They assume that the enemy has the same propensity for risk and values as they do. The game industry is particularly vulnerable to this problem: Game pirates put a radically different value on games than a publisher does. In practice, they face little to no risk for the actual act of breaking a game’s security and they seem to have the time and patience to effectively defeat many security systems. Gold farming is, allegedly, a billion dollar industry employing tens of thousands of individuals worldwide. Aggressively exploiting an MMO’s economy is big business. For the game operator, controlling gold farming is often a low priority. It falls somewhere between customer support and bug hunting. The operator’s main priority is to keep the servers running and the players playing and paying.

B EYOND P ROTECT , D ETECT , R EACT Protect, detect, react. It has become something of a mantra in the traditional IT security community. First, you protect your information from attack. If they successfully attack you, you detect the attack and react appropriately. This iron triangle of IT security probably arose out of a military perspective: Attack, defend, and counterattack. Protect, detect, react is simple, wonderful, and far from complete, even in a military context. There are at least seven additional basic security strategies: Recover—Reconstitute the system to a secure state (or secure as possible). Interestingly, this strategy is critical for military systems as well. For example, if an encryption key is compromised, you create and distribute a new key and remove the old one. If security equipment is lost, it is simply locked out of the network. It is important to note that this does not reestablish the security of any data that has already been compromised. In a military setting, the compromised data may no longer have any value. The message “Go to War” is not a secret for all that long. Unfortunately for game developers, if a digital rights management (DRM) system does not restore the security of the lost game, it restores the security for future games.

14

Protecting Games: A Security Handbook for Game Developers and Publishers

Avoid—There are some fights that are not worth fighting, battles not worth winning, and problems that are “too hard.” For games, often we can change the game’s business model and design as well as its code as a way to thwart attackers. Online games that use the “free-to-play” business model where everything is purchased from the game operator are essentially immune to gold farming. Botting, the use of automated programs that play on a player’s behalf, is a hard problem, in many cases. Game developers might consider changing the game design to make botting impractical or change the game rules to make the benefits of botting negligible. An Indian game operator used this tactic for an MMO that he had licensed that was known to have problems with bots4. The game operator added direct item and currency sales to the subscription game, thereby reducing the benefits of botting. Ignore—Some problems are just not that bad. It is certainly fair to choose to ignore them, especially if the cost of addressing the problem is high. Many traditional computer game developers often ignore cheating problems with their multi-player games, as the entire multi-player feature is often considered just another option added to the core, single-player experience. Delegate—Sometimes you can transfer a problem onto someone else. If you are able to do this, why not let someone else deal with the problem? The delegation strategy can be particularly useful to transfer liability. There are certain third-party companies that are legally authorized to accept liability for protecting children’s identity information and limiting marketing under COPPA. This may be a more effective, and less expensive, option than complying with COPPA internally. I would argue that many in the entertainment industry are trying to delegate their piracy problem to the government. Department of Justice lawyers and FBI and Customs agents are almost free for the industry; they cost just a bit of lobbying. Insure—If you can’t eliminate a problem, why not buy insurance? It works for car accidents, after all. Unfortunately, this option is rarely available for IT security or game security problems today. It is probably the great unmet security opportunity. Watch for companies who offer security services to see if they also offer liability protection. Many work like your home security system; their insurance basically consists of a refund on your security system equipment purchase (at best) or a refund of a month’s fees. In the IT security area I have seen identity theft insurance that falls in this category. Reward—Why focus on “sticks” when you can offer “carrots” to those who might otherwise harm your product or business? The key, of course, is that the reward has to appear significant to your customers while being very costeffective to provide. The “good driver discount” for auto insurance and airlines’ frequent flier programs are familiar examples.

Chapter 2 Thinking Game Protection

15

Deter—The threat of punishment works as long as the possibility of being caught is high and the punishment is substantial. Law enforcement, peacetime armies, and nuclear war all rely on deterrence. Compelling good behavior is often much more expensive than relying on deterrence. Also, systems that attempt to compel goodness often are less effective at detecting their own failures. There is a bit more that can be added to the original mantra: Protect—As noted while discussing “Recover,” you actually need to know what you are protecting. I have seen many people confuse using encryption with “security” and hash functions with “integrity.” Game developers have relied on a browser’s encryption function to protect high scores from manipulation. Unfortunately, high-score cheaters are the actual people playing the game and thus have access to the score before it is encrypted. Similarly, several major commercial games have used hash functions to “sign” data, not realizing that the data hash can simply be replaced with one for the hacker’s preferred game configuration. Detect—Detecting problems can be tricky. Game piracy without network connections is essentially impossible to quantify, as there is no direct feedback. If the number of validated, registered licenses is less than the royalties for a game developer, it could be an interesting question whether the game has a piracy problem or an issue with the publisher withholding royalties. React—Ban, ban, ban. Banning pretty much seems the only strategy used to punish gaming wrongdoers, whether they are pirates or cheaters or whatever. For a game company, banning is pretty extreme and tends to deprive the company of revenue, so it is a fair question as to whether banning always makes good business sense. A complete security system is built by creatively combining these strategies to form a coherent whole. For all of the game industry’s complaining about piracy, particularly on the PC platform, there doesn’t seem to be much thought put into managing piracy during the game development and publication process.

A SYMMETRIC W ARFARE Security is about managing uncertainty. You never know for sure when and where you are going to be attacked, but you are pretty sure that it is going to happen sometime. Also, security is a support function to your real goal of providing a great game and running a successful business. It is not the end, but a means. Good protection has got to be lean.

16

Protecting Games: A Security Handbook for Game Developers and Publishers

Protection is a battle between you and your foe. Both of you have time and resources to allocate to the fight. The only advantage you have as the defender is you get to set some of the rules and choose the battlefield. As noted previously, one the biggest problems that you face is asymmetric values. Your foe may be far more interested in attacking your game than you are in defending it. Also, you are obliged to defend the entire game and succeed everywhere, while your adversary only has to find one hole in your armor and you are lost. Sadly, a clear example of this asymmetry is the state of airport security in the US since 9/11. We are spending billions of dollars to try to defend every airplane against all potential hijackers. And, as numerous incidents have shown, there are always weaknesses in the system. A terrorist individual or group has to find only one vulnerability that he or she can successfully exploit to cause serious trouble. Or, these attackers can attack somewhere else where we are not defending at all. Fortunately, games are much more constrained systems than national defense. However, they do both face highly motivated adversaries. Game developers and publishers have much more control than Homeland Security does over the systems that hackers want to attack. Security Principle 3: Make your adversary work a lot harder than you. Defensive methods should be chosen for their low cost and coverage of a wide range of threats. For game cheating, the most common strategy is to include some sort of “cheat detection” tool with the game. The major anti-cheating products in the industry are Blizzard’s Warden, Valve’s VAC, Even Balance’s PunkBuster, nProtect’s GameGuard, and AhnLab’s HackShield. They are all signature-based systems, similar to anti-virus products that use signatures of the individual versions of malicious software to detect attacks. The cost of this system is that it must be constantly updated5 to keep up with the latest cheats and, just as the security industry has found with viruses, hackers are very good at attacking anti-virus tools directly as well as hiding themselves from the anti-virus tools and altering their malicious software’s signatures6. While the work of creating and distributing an individual signature is not significant, there is a fair amount of effort to find hacks, understand them, and build a reasonably stable signature. It is worth noting that this strategy for detecting hacks depends on cheats being widely used. If there are only a couple of cheaters using a specific technique, the security surveillance system will be unlikely to detect the attack. This is becoming increasingly true for traditional malware, which is now targeted at specific companies or individuals as opposed to the world as a whole 7.

Chapter 2 Thinking Game Protection

17

In MMOs, professional gold farmers are motivated to develop and use internal or limited distribution tools instead of mass-market products. This is also true for the online casino industry: If you have a real, effective cheat that makes you a lot of money, you are not going to sell it to anyone. Once cheating or hacking is a business and not just vandalism, there is no reason to broadcast attacks. One of the real reasons that encryption is such a popular security tool is that it is cheap and easy to implement—whether it is effective or not is a different matter. The most effective security strategy, for games (and anyone else), is to change the system so that there is nothing that can be exploited. You are probably lost if you are constantly hunting for hackers.

P ROCESS , T ESTING , T OOLS ,

AND

T ECHNIQUES

Although “thinking right” about security up front will get you a long way, there are useful tools and tactics to complete the job. Penetration testing gets a lot of visibility as a key security strategy. Penetration testers attempt to break in to a system from the outside, just like an attacker. When they succeed, it is impressive and compelling (if a bit late in the development process). There are three weaknesses to penetration testing: Many of the “revealed” security weaknesses are generic operating system and common application vulnerabilities. This is not to minimize their impact, but there are cheaper and easier ways to find these problems earlier in the development process. Penetration testing is often very time-constrained. As such, penetration testers do not have time to become familiar with the target and so go for the easy, generic attacks. The most damaging flaws are often in the target’s unique business application (or, in this case, game) environment. Finally, you cannot test either security or quality into a system. They need to be built in from the beginning. My preferred security analysis and testing strategy is to run in parallel to development: from concept through implementation and deployment. This has substantial advantages. Design errors can be addressed when they are still just PowerPoint slides and Word documents. Because the security analysis team has full access to the design and code, it is much better able to focus on proactively finding real problems at the source before they get out of control and expensive to correct. Again, security resources are very scarce compared to those of the attackers.

18

Protecting Games: A Security Handbook for Game Developers and Publishers

Although a hacker may need to reverse-engineer your system to attack it, he may also be a former team member or have “dumpster dived” to collect your documentation or even downloaded the source code from your server. There is no benefit to forcing your security team to emulate this phase of the attack. If your only defense is that the hacker does not know your system design, you are dependent on “security by obscurity” as your sole security barrier—and you are in deep trouble. Good security testing tools should be a standard part of the toolbox of every developer and system and network administrator. Similarly, there are numerous software quality and security testing tools that can help avoid memory leaks and other common coding errors. One of the real challenges for security in games and other applications is that you need to build protection in during the development process, but its benefits do not appear until the product or service is operational. This causes a number of annoying, but real, problems. The biggest problem is that most organizations separate their development and operations budgets. Features like protection against attack that are hard to measure during development are easy to drop: They have no consequence until the development team has been paid and moved on to another project. Another issue is that many security failures are largely silent. When your house is robbed or car is stolen, you tend to notice it rather quickly. Code theft, identity theft, and unsecured servers may never be noticed. It is important to build “security instrumentation” into your system to help make both known and potential threats visible. It may be possible at an early stage to at least detect problems that you may not be willing or able to prevent at that time. This will give your live team and operations staff the tools they need to identify and fix the problem later. There has been a rise in active measures to fight hackers, pirates, and cheaters— both within the game industry and outside it. Services like MediaDefender, which actively seeds peer-to-peer networks to disrupt and locate music pirates, can sometimes create more problems than they are worth. The StarForce anti-piracy saga8 and the Sony BMG Rootkit case have become cautionary examples and created objections to almost any form of anti-piracy technology. Even Blizzard’s Warden anti-cheating tool has raised privacy concerns (see Chapter 34). Some of these methods can be quite effective. However, if you are going to implement them, you should consider possible consequences. Some of these tools can cause problems directly, as when MediaDefender targeted a legitimate P2P distribution service9, and some can cause indirect problems. For example, Sony BMG’s Rootkit was used to attack World of Warcraft. The decision to use these active strategies should be made at a senior level. After all, at some point, you may have to defend your active measures strategy to the public in The Washington Post.

Chapter 2 Thinking Game Protection

19

S ECOND G RADER S ECURITY Many people confuse complexity with security. One of the disdainful comments regularly used by those in the security field is “security by obscurity”: the notion that if you make something sufficiently complicated, surely it will be too difficult for an adversary to unravel. This is rarely the case. Usually, the result is that the system is so complicated that it cannot be maintained: Your own team does not understand the system and there are often obscure parts of the design that make it more vulnerable to attack. Or, even more likely, your maintenance staff will come along and “clean up” the design so that they can support it—and completely undermine your “obscurity” efforts. Probably the most important design principle that I learned at NSA was to focus on clean, clear design. Good system engineering and good security engineering go hand-in-hand. Ugly, complicated designs are rarely secure. Any security weaknesses in a well-architected system will stand out like a sore thumb, and usually be reasonably easy to fix. This leads to my next security principle: Security Principle 4: If it’s not simple, it’s not secure. Or, if you can’t explain it to your manager (or a second grader) on one PowerPoint slide, it probably isn’t secure. There are computer scientists and mathematicians who look for ways to “prove” security. They use complicated symbolic languages and systems to create security theorems and then prove them. Fascinating stuff. These techniques are great for PhD candidates and academics, but, I’m fairly confident, totally irrelevant in the real world. Why do I doubt this? Let me briefly don my tattered, ancient mathematical credentials… If you’ve heard of Gödel’s Theorem, made familiar outside of the circles of academia by Douglas Hofstadter’s widely owned but rarely completely read Gödel, Escher, Bach: an Eternal Golden Braid 10, you may recall that Gödel proved the Incompleteness Theorem11. This important work of mathematical logic states that, in short, for any sufficiently complicated system, you can neither prove nor disprove every theorem about it. Gödel also proved undecidability (whether you can decide if something is true or not), and Alan Turing disproved computability. The bottom line of these three theorems is that anything that is even slightly complicated cannot be completely understood and therefore, you cannot really know that it is secure.

20

Protecting Games: A Security Handbook for Game Developers and Publishers

In practical terms this means that the only way to make something really secure is to make it “trivially secure”: The hard part of good security design is to make the system simple. This ends my lofty discussions about security and protection; let’s get to work on protecting your games.

R EFERENCES 1. H. Demaio (1992), Information Protection and Other Unnatural Acts: Every Manager’s Guide to Keeping Vital Computer Data Safe and Sound, Amacom Books, ISBN 0-81445-044-X 2. Cliff Stoll (1990), The Cuckoo’s Egg: Tracking a Spy Through the Maze of Computer Espionage, PocketBooks, ISBN 0-7434-1146-3 3. Wikipedia, “Statistical Independence,” http://en.wikipedia.org/wiki/Statistical_independence 4. D. Sengupta (2007), “It’s Virtual World Out There, All for Hard Moolah,” http://infotech.indiatimes.com/ Its_virtual_world_out_there_all_for_hard_moolah/articleshow/1388388.cms 5. A. Modine (2007), “World of Warcraft Spykit Gets Encrypted,” http://www.theregister.co.uk/2007/11/15/world_of_warcraft_warden_encryption/ 6. R. Lemos (2005), “World of Warcraft Hackers Using Sony BMG Rootkit,” http://www.securityfocus.com/ brief/34 7. S. Gaudin (2005), “Targeted Virus Attacks Replace Sweeping Assaults,” http://www.esecurityplanet.com/ trends/article.php/3554046 8. A. Varney (2006), “StarForce Must Die,” http://www.escapistmagazine.com/articles/view/issues/issue_72/414-StarForce-Must-Die 9. R. Paul (2008), “Revision3 CEO: Blackout Caused by MediaDefender Attack,” http://arstechnica.com/news.ars/post/20080529-revision3-ceo-blackout-caused-by-mediadefenderattack.html 10. D. Hofstadter (1999), Gödel, Escher, Bach: an Eternal Golden Braid, Basic Books, ISBN 978-046502-656-2 11. Wikipedia (2008), “Gödel’s Incompleteness Theorems,” http://en.wikipedia.org/wiki/Incompleteness_theorem

Part

II

Piracy and Used Games

In this part, you’ll find the following topics: Chapter 3, “Overview of Piracy and Used Games” Chapter 4, “The State of Piracy and Anti-Piracy” Chapter 5, “Distribution Piracy” Chapter 6, “DRM, Licensing, Policies, and Region Coding” Chapter 7, “Console Piracy, Used Games, and Pricing” Chapter 8, “Server Piracy” Chapter 9, “Other Strategies, Tactics, and Thoughts” Chapter 10, “Anti-Piracy Bill of Rights” Chapter 11, “The Piracy Tipping Point”

21

3

Overview of Piracy and Used Games

roadband communications and the Internet have transformed piracy from a garage sale nuisance and shady street vendors selling games from the back of a van into a pervasive problem. Virtually any digital media is only a quick Google search and click away online. Of course, the real questions for any business are how much money is this costing and what can one do about it?

B

Piracy is theft. Some may quibble about “software piracy” being copyright infringement; however, the bottom line is that when people don’t pay for a commercial good or service, they are stealing (at least from the seller’s perspective). Open source advocates claim “software wants to be free.” Software does not want to be free. Freeloaders want free software. But, it is also worth looking at other industries where sales revenue is lost. Not just to unauthorized copies, but also to used goods where creators do not earn revenue from the secondary sales. Movies, books, and music have always had some market for used products, but the growth of console games has created a massive used game retail market (PC games are rarely sold used). In the next several chapters, I discuss the various aspects of the piracy problem and used games—the traditional techniques that have been used to fight piracy, and some alternative strategies. Additionally, I address legitimate consumer concerns about anti-piracy measures.

22

4

The State of Piracy and Anti-Piracy

he first questions that should be asked about piracy are “how bad is it?” and “whom does it affect?” There are two completely different ways to measure piracy. The first is based on the estimated number of pirated copies of a game or other work and what those items would cost at retail. This seems to be the preferred model used by the U.S. Business Software Alliance (BSA) and Entertainment Software Association (ESA). These numbers are quite suspect on a number of counts. The second approach is to measure how many actual sales are lost. After all, many people will use something if it is available for free, but have no interest in buying the item.

T

The nature of digital piracy makes it quite difficult to estimate the size of the problem. Downloading files and duplicating disks do not leave easy trails for forensic investigators. An article about casual game piracy claimed a piracy rate of around 92 percent based on attempted connections to the company’s server 1. At least this number came from an actual measurement. A report by China’s government, whose citizens are often a target of anti-piracy rhetoric, noted that based on BSA’s estimates, one quarter of the country’s Gross Domestic Product (GDP) would, or rather should, have been spent on software in 20052. The BSA is not alone in having difficulty with numbers. The Royal Canadian Mounted Police seemingly made up its estimate of 10 to 30 billion Canadian dollars in piracy—a number that apparently went from a bullet on a PowerPoint slide into national policy 3. Australia has moved to challenge a report by copyright holders on the damage from piracy, stating that the numbers needed to be substantiated, especially as they were being used to justify increasingly harsh civil and criminal penalties4.

23

24

Protecting Games: A Security Handbook for Game Developers and Publishers

D ETERMINING

THE

S COPE

OF

P IRACY

Even if we do accept these high piracy rates, the real question for business is how many of those customers would actually have purchased the item. After all, the marginal cost of producing digital items for the publisher is very low, so the sunk material and production costs are often not a major issue. Typically, therefore, there is no real cost to the publisher from these pirates. This is not always the case, as SiN Episode 1, a downloaded game that was distributed via Valve’s Steam service, found when they were overwhelmed with customer support requests by irate “customers” who hadn’t actually purchased the game5! Companies that operate a free online game play service, like Blizzard’s Battle.Net or ArenaNet’s Guild Wars, need to be especially concerned about piracy, because the way they subsidize the online service is through product sales. Several years ago, it was not unusual for Blizzard to announce bans of hundreds of thousands of CD keys, many of them because the game copies were pirated6. Specifically, the players were using counterfeit keys to register the games with the Battle.Net service. One of the powerful advantages of a service like Battle.Net is that it provides information on numbers of pirates (or, at least, unauthorized registration attempts) as well as numbers of legitimate players. It also provides an incentive for players to convert from an illegal copy to a legal one so that they can participate in the online service. Finally, the service provides a means to compare actual sales (and royalties) with numbers of registered players to estimate the success of counterfeit CD key piracy. It might even be able to measure how many pirates purchase legitimate copies once caught. In general, there are few good methods to determine how many pirate game users would actually buy a game. However, the stereotype of gamers (and game pirates) as young and poor is no longer true. Game demographics have shifted to older players who are generally less likely to pirate games. This would seem to imply that sales lost from pirates isn’t significant—older players are likely to buy legitimate copies and younger players would never purchase the game at all. Brad Wardell of Stardock has been quoted7 as saying that game developers need to focus on the actual population of paying customers: “When you make a game for a target market, you have to look at how many people will actually buy your game combined with how much it will cost to make a game for that target market. What good is a large number of users if they’re not going to buy your game? And what good is a market where the minimal commitment to make a game for it is $10 million if the target audience isn’t likely to pay for the game?”

Chapter 4 The State of Piracy and Anti-Piracy

25

“If the target demographic for your game is full of pirates who won’t buy your game, then why support them? That’s one of the things I have a hard time understanding. It’s irrelevant how many people will play your game (if you’re in the business of selling games that is). It’s only relevant how many people are likely to buy your game.” The computer game industry has adopted four major strategies to address piracy: Console-based games Digital rights management/license management Online gaming Prosecutions The dominant anti-piracy strategy by the computer game industry has been to focus game development towards game consoles. (As a side note, the film industry’s move towards Blu-ray from DVD would seem to be an attempt to follow suit.) The general argument has been that control over game hardware will prevent piracy. In fact, the move to consoles has not really stopped piracy and, potentially even worse, it has essentially created the used game market. Used games are a totally legal way for customers to buy games. They provide no revenues to the publisher or developer and may even cost sales of new games by giving wavering customers a chance to “wait a bit” and buy a game for less. (There are some counterarguments, however. The fact that consumers know that they can resell a game means that they may purchase a $50 game knowing that they can sell it for $10 or $20, meaning the effective cost is $30 or $40.) Console piracy is rampant in Asia with modified consoles often publicly sold for a modest $50 premium above a legitimate console8. Nintendo’s very popular DS handheld console has been facing increasing problems from the R4 cartridge9. These console hacks allow players to download games for free or purchase them on the black market for only a couple of dollars. The game industry has not abandoned PC games, but they have stepped up their use of increasingly draconian licensing tools. One product, StarForce, became so unpopular due to its modification of drivers, that popular pressure forced publishers to abandon the tool10. In the music industry, Sony BMG earned the ire of music fans and lawsuits with its secret, automatic installation of a rootkit program when certain music CDs were played on computers11. More recently, several publishers have substantially loosened installation and registration requirements for their games after widespread objections in game blogs and online communities 12.

26

Protecting Games: A Security Handbook for Game Developers and Publishers

Simple economics and widespread piracy of traditional computer games and other software drove game developers in Korea and China to focus on online games. Particularly in Korea, the government’s focus on developing a world-leading telecommunications infrastructure opened the door for sophisticated games played on a server rather than sold at retail. Games operating as a service are inherently more difficult to pirate. Stealing a copy of the player client software is not enough; a pirate server must be set up, operated, and maintained. This makes the pirate server operation much more vulnerable to being detected, located, and shut down by law enforcement. It is worth noting that any break-even analysis should probably be done when the game is “green lighted” and the developer makes an initial estimation of expected sales. The question should perhaps be asked—if this game had an additional $2 million to spend, how could it best increase sales to compensate for the estimated “anti-piracy” expenses? Other security options may make sense and should be considered. After all, the only additional revenues are going to come from additional sales. The Entertainment Software Association, the trade group for most U.S. computer game publishers, claimed that piracy cost the industry $3 billion in sales a year13. They have worked to strengthen penalties and pushed law enforcement to actively pursue individuals and organizations involved in software piracy. When I reviewed ESA’s announcements related to piracy in October, 2006, I found that in the previous 12 months, the ESA and U.S. and Canadian governments had imposed total fines of $36 million and pursued four major cases. This is just over one percent of their own estimates of the pirate market14. Since there has been no claimed reduction in piracy, there should be a question as to whether these prosecutions deter would-be pirates at all.

HOW MUCH IS ANTI-PIRACY WORTH? Piracy is a real problem. It potentially costs the game industry billions of dollars worldwide each year. We can’t wish piracy away, so it seems our only alternative is some sort of anti-piracy product. Just as with our analysis of piracy, we need to consider how much anti-piracy is worth. Should we ignore piracy or fight it? For example, let’s assume that we are developing a traditional PC game. We choose an anti-piracy software provider that has an upfront licensing fee of $100,000 and a royalty of 4 percent per copy sold (of the game’s retail price). Then our actual upfront costs are: Total Upfront Anti-Piracy Costs = $100,000 + Integration Costs

Chapter 4 The State of Piracy and Anti-Piracy

27

Vendors everywhere assert their products have no integration cost. Sometimes, this is true, but usually, there is a cost for integrating any piece of software. At the very least, you need to test it to make sure that the new software doesn’t break your old software. In our example, we’ll say these costs are zero, just as the vendor promised. Let’s assume the game sells for the fairly standard price of $50 and our revenue per copy is $20 (after packaging, marketing, revenues for the retailer, and so on). Then, our net revenue is: Net Revenue = $20 (profit) – $50(.04) ($2 anti-piracy royalty) = $18 However, we may lose some sales because of the anti-piracy tool we use and also incur some additional customer service costs to handle complaints and such. Once again we’ll make a simple assumption that this costs us 2 percent of sales. With a game that sells a respectable 1 million copies, without anti-piracy we’d see: No Anti-Piracy Revenues = $1 million x $20 = $20 Million With Anti-Piracy, our revenues are: Net Anti-Piracy Revenues = $1 million x (98 percent customer base) x $18 – $100,000 = $17,540,000 It is obvious that I am giving no credit for additional sales for the anti-piracy solution. So, how many more sales do we need to earn to break even and recover the costs of our anti-piracy product? The additional profit we need to make up, just to break even is $2,460,000. Increased Anti-Piracy Sales = $2,460,000/$18 = 136,667 additional units Or, around a 14 percent increase in sales is required to compensate for the costs of the anti-piracy product. Suppose, instead, the anti-piracy product had no up-front fee and didn’t cost any sales, incur any customer support issues, or otherwise make life difficult (for the customers or us as the game’s publisher). Our break-even additional revenue number would be $2 million and 111,111 additional sales, just to cover those royalties. The upfront licensing cost has negligible impact on the price; the key driver is royalties. This is simply a break-even analysis. There is inherent risk adding any software or expense to a product. In order to rate the anti-piracy product a success, any publisher should include a margin of error for expected additional sales of perhaps 200,000 or 20 percent.

28

Protecting Games: A Security Handbook for Game Developers and Publishers

Peer-to-peer piracy is an even harder problem, because there is really no criminal enterprise to target. There are just individuals looking for a free game or song or movie. The main business advantage of using prosecutions as an anti-piracy strategy is that private companies can push the costs onto governments (and taxpayers). However, this works only if piracy is actually reduced.

T RUSTED B RAND S ECURITY : N INTENDO

AND

ADV

There is one kind of piracy protection you can’t buy: the trust of your customers. For many years, Nintendo has cultivated a close relationship with its customers. Game players in Japan, the US, and Europe have invested years and years of affection for characters like Mario and are quite fond of their Game Boy and NES consoles. Nintendo works to have a great relationship with its customers. For example, there have been a number of recent anecdotes in which players had problems with their Wii game consoles, contacted Nintendo, and a replacement was rapidly shipped at no cost and with no questions asked. The power of Nintendo’s brand is such that for many years instead of a piracy problem, Nintendo had to deal with counterfeiting. Criminals would create pirated copies of Nintendo game cartridges and try to pass them off as legitimate ones for sale. Nintendo’s piracy resources were focused on education: to protect consumers by educating them on how to identify counterfeit games. The recent, explosive popularity of both the Nintendo DS handheld and Wii game consoles has created a new problem for Nintendo. As the company has expanded from its long-term, long-established customers in the core markets of Japan, the US, and Europe, Nintendo is beginning to face typical piracy problems. These new customers do not have any real loyalty to the Nintendo brand and are much more willing to use tools such as the R4 Data Cartridge (see Chapter 7). This product allows players to download games from the Internet and use them for free instead of purchasing legitimate game cartridges. In 2008, Nintendo is probably the most aggressive and public opponent of piracy of all the console manufacturers and has gone from tolerating tools like R4 to actively fighting them15. Nintendo is not the only company in the entertainment industry to build this kind of brand loyalty. ADV Films, an importer and publisher of Japanese anime (animated films) in the US, has also built strong ties with its customers. ADV has faced the difficult challenge of dealing with the cost of localization (translation into English) of the large number of anime films and TV series. The company cannot afford to translate every anime film or show. Instead it supports independent localization by passionate anime fans through its online community, even when ADV has rights to the product. However, once ADV Films does create the official

Chapter 4 The State of Piracy and Anti-Piracy

29

translation of a product, the community voluntarily abandons the unauthorized copies. U.S. anime fans know that they need to support ADV to ensure access to great products and work to protect the company16. The U.S. anime fan community and ADV have recognized that they need each other.

A NTI -P IRACY I NNOVATORS : N INE I NCH N AILS

AND

D ISNEY

There have been several attempts to fight media piracy by using voluntary payments and hoping for volume sales. Stephen King launched The Plant as a serialized book in 2000. Although he initially met his financial objective of 75 percent payers vs. downloaders (paying $1 for each part), the numbers dropped off. After six parts were released, the project seems to have been abandoned with the last release in December of 2000 (starting with the fourth installment, there was a price increase to $2, the payer rate dropped to 46 percent, and there were substantially fewer downloads)17. The band Radiohead released a low-bandwidth, MP3 version of their album “In Rainbows” for free in October 2007 with the downloader having the opportunity to “pay what they want,” only to abandon the strategy by April of 200818. One band, Nine Inch Nails, seems to have found a way around the problem with a strategy that could be duplicated by any game, music, or movie publisher. Nine Inch Nails basically created a wide range of versions of their products priced for different portions of their audience for their album “Ghosts I-IV.” Nine Inch Nails gave away “Ghosts I” for free, had a $5 download version of the entire album, a $10 double CD set, a $75 deluxe edition, and a $300 Ultra Deluxe Limited Edition set19. This last version was limited to 2,500 copies and sold out in three days— earning the band $750,000 and, even after paying for all of the “goodies” (which probably cost $10 to $20 to produce), no doubt yielded a substantial profit. China is notorious for having severe problems with piracy and counterfeit goods. However, the billions of potential customers are irresistible to companies around the world—including Disney. In 2006, Disney launched a promotion where they offered customers who bought Disney products the opportunity to enter to win a number of prizes ranging from a DVD to a trip to Hong Kong. All the customers had to do to enter the contest was mail the official Disney holographic seal that was included on every official Disney product20. This is a brilliant anti-piracy tactic. Customers are turned from pirate accomplices to detectives. First, they are going to check to see that items are legitimate and, second, any good fake holographs will get sent in to Disney to be used to help hunt down counterfeiters and the stores that carry their products. Entertainment companies could easily use variations on this strategy to battle pirates, counterfeiters, and even used games.

30

Protecting Games: A Security Handbook for Game Developers and Publishers

G OING F ORWARD Based on industry rhetoric, piracy is certainly a serious concern for the traditional console and PC game industry. There are real questions about whether game companies seriously consider piracy during their business and product planning process. I have talked to a number of security companies with various anti-piracy solutions and they typically get a courteous hearing from publishers, but no real business, not even a pilot project. If asked for advice, I recommend that anti-piracy companies look at other markets. Using your brand to fight piracy is an amazingly powerful tactic and can be quite effective. Iconic companies like Apple can charge a premium price for their products in the market and maintain almost fanatical loyalty among their customers. This does require a long-term, strategic investment in building superior products and powerful, supporting marketing. A brand-building tool that can also support anti-piracy is a compelling online service, a topic that I will be revisiting later. Promotions and premium versions are powerful and underused anti-piracy tools in the game industry. Even better, they are funded out of the marketing budget, not the (typically paltry) security budget. Selling concept art and model sculptures, giving away vacations and game libraries, and creating “frequent player cards” are all standard marketing techniques that can also have wonderful collateral antipiracy benefits if used carefully.

Chapter 4 The State of Piracy and Anti-Piracy

31

R EFERENCES 1. R. Carrol (2008), “Casual Games and Piracy: The Truth,” http://www.gamasutra.com/php-bin/news_index.php?story=17350 2. W. Xing (2008), “Piracy Debate,” http://www.chinadaily.com.cn/bw/2008-06/09/content_6746151.htm 3. S. Davis (2007), “Piracy—Fact, Fiction, and Future,” http://www.playnoevil.com/serendipity/index.php?/archives/1674-Piracy-Fact,-Fiction,-and-Future.html 4. S. Hayes (2006), “Piracy Stats Don’t Add Up,” http://www.australianit.news.com.au/story/0,24897,20713160-15306,00.html 5. brownlee (2006), “Pirates to Buyers Ratio for SiN Episode 1? 5:1,” http://kotaku.com/gaming/piracy/ pirates-to-buyers-ratio-for-sin-episode-1-51-190178.php 6. Blizzard (2004), “StarCraft and Warcraft III Accounts Closed,” http://www.battle.net/news/0403.shtml 7. K. Gillen (2008), Wardell: “Piracy Is Not the Primary Issue,” http://www.rockpapershotgun.com/2008/03/12/wardell-piracy-is-not-the-primary-issue/ 8. Cho J. (2008), “Nintendo Wii Ready for Korea Debut,” http://www.koreatimes.co.kr/www/news/biz/biz_view.asp?newsIdx=20735&categoryCode=123 9. C. Ciabai (2008), “Nintendo Starts Epic Battle Against R4 Piracy—The Fight Is On!,” http://news.softpedia.com/news/Nintendo-Starts-Epic-Battle-Against-R4-Piracy-90953.shtml 10. A. Varney (2006), “StarForce Must Die,” http://www.escapistmagazine.com/articles/view/issues/issue_72/414-StarForce-Must-Die 11. EFF (2005-6), “Sony BMG Litigation Info,” http://www.eff.org/cases/sony-bmg-litigation-info 12. Polybren (2008), “Mass Effect, Spore DRM Loosened,” http://www.gamespot.com/news/show_blog_entry.php?topic_id=26385172 13. ESA (2007), “Video Game Industry Applauds Game Pirate’s Sentence,” http://www.theesa.com/newsroom/release_archives_detail.asp?releaseID=20 14. S. Davis (2006), “Modchip Manufacturer Fined $9 Million—Only 332 More Pirates to Go!,” http://playnoevil.com/serendipity/index.php?/archives/846-Mod-Chip-Manufacturer-Fined-9-MillionOnly-332-More-Pirates-to-Go!.html 15. Nintendo (2008), “Nintendo Anti-Piracy,” http://ap.nintendo.com/index.jsp 16. D. Roth (2005), “It’s... Profitmón!,” http://money.cnn.com/magazines/fortune/fortune_archive/2005/12/12/8363101/index.htm 17. Wikipedia (2008), “The Plant,” http://en.wikipedia.org/wiki/The_Plant 18. G. Sandoval (2008), “Radiohead Won’t Repeat ‘In Rainbows’ Giveaway,” http://news.cnet.com/8301-10784_3-9932361-7.html 19. Nine Inch Nails (2008), “Ghosts—Order Options,” http://ghosts.nin.com/main/order_options 20. G. Fowler (2006), “Disney Fires a Broadside at Pirates,” http://www.chinadaily.com.cn/world/2006-05/31/content_605106.htm

5

Distribution Piracy

ntil the recent rise of digital distribution, games were available via CDs, DVDs, floppy disks, and proprietary game cartridges. Blank media that can be purchased for pennies, while good for game publishers, also makes piracy economically viable and trivial to implement. There are three ways to fight content duplication:

U

Prevent duplication Detect duplication Use a key that is difficult to duplicate or ignore

P REVENTING D UPLICATION Preventing duplication has become a bigger challenge as games have moved to standard physical media and digital distribution. Originally, many games used proprietary distribution technologies (game cartridges) for a number of reasons, including fighting piracy. The only major game platforms that still use proprietary distribution systems are handheld game consoles. The game cartridge from the Nintendo DS and Sony’s PlayStation Portable (PSP) UMD disk are probably the last generation of proprietary physical media. One important factor is cost. The cost of data storage has plummeted even faster than improvements in processing power and graphics. When storage was expensive, it made sense for game companies to have their own proprietary systems, especially because this had a collateral anti-piracy benefit. Pirates had to basically operate a factory to make counterfeit game cartridges. Widespread, modern outsourced, and low-cost manufacturing effectively eliminates the last vestiges of anti-piracy benefit from using proprietary media.

32

Chapter 5 Distribution Piracy

33

Other anti-piracy techniques take advantage of the way media is physically duplicated to prevent making a useful copy. Videotape protection systems work on this principle. For digital media, there have been several anti-duplication techniques that work by modifying the master CD or DVD during the production process. Other approaches stretch the CD and DVD standards in unconventional ways such as manipulating low-level indexes and offsets to hide portions of the media from standard duplication techniques. The problem with this tactic is that not every product implements all portions of the standard specification the same way, resulting in unpredictable disk failures and customer complaints.

D ETECTING D UPLICATION If you can’t protect the distribution media itself, another approach is to protect the data and detect duplication. The simplest way to do this is to simply label the data as “do not duplicate” so that standard media players will not read or process the data. The regional encoding system used for DVDs that prevents disks formatted for different parts of the world from being played in players for other regions is the most familiar example1. Ironically, some early Sony PlayStation 2s ignored regional coding information for DVDs—a problem that was quickly corrected once it was identified. The most notorious anti-piracy product in the game industry, Starforce, used this strategy (among others). It actually modified the low-level software (drivers) for PC DVD players to detect whether a disk was “Starforce protected.” Although this detected some piracy attempts, it also caused problems for other legitimate applications. The most recent example of this approach came to light through a successful attack on Microsoft’s Xbox 360 console. The Xbox 360 uses standard DVDs for distributing games. DVDs include low-level information that describes the content on the disk so that it can be handled by the appropriate application software in the console. Disks are labeled as music CDs, movie DVDs, rewriteable DVDs, and Xbox 360 game disks. Microsoft has always used digital signatures on Xbox 360 game files to prevent their modification. However, the low-level disk label is not protected. The label is part of the DVD media specification, and Microsoft wanted to use standard DVD players in its console to reduce cost. Hackers took advantage of the ability to update the firmware that is available in most commercial DVD drives. This feature is included for maintainability and to support legitimate updates from the drive vendor. Unfortunately, hackers used this capability to replace the standard firmware with a modified version that reported to

34

Protecting Games: A Security Handbook for Game Developers and Publishers

the game console that disks labeled as rewriteable DVDs were instead reported as Xbox 360 game disks2. This hack has been widely used in Asia and is essentially impossible for the console itself to detect3 (something that can be addressed by a service like Xbox Live, which is discussed in the section entitled “Rich Interaction Systems” in Chapter 9). The power of duplication technologies and cheap mass storage has driven game publishers towards other approaches, particularly in the PC market. All of the things that make a PC useful also make it a powerful tool for piracy—lots of processing power and storage, full access and control of the hardware, and powerful and cheap programming and analytic tools.

C OLLECTABLES , F EELIES ,

AND

O THER S TUFF

If you can’t protect the game media, then you need to find something else that you can protect and tie the operation of the game to it. One of the earliest applications of this strategy was Infocom’s “feelies”4. In the 1970s and 1980s, Infocom produced adventure games that were quite popular. There was no widespread Internet access or even common use of modems, so the local game had to be able to detect if the copy was legitimate. Infocom’s innovative approach was to ship the game with various physical items that were hard to duplicate, yet played an important part in the game and the game experience. Customers valued maps, manuals, decoder rings, and other items that were often tied into game play, and, most importantly, were difficult to duplicate. For a while, game companies went a bit crazy with this approach. Games would require players to type information from game documentation into the application to start or continue play and, at its extreme, players were forced to transcribe entire paragraphs of the manual letter-perfect. In some sense, the rise of collector’s editions today harkens back to this earlier era, but many publishers seem to have forgotten the anti-piracy benefits of physical, tangible items.

D ISK

AS

K EY

Although the CD key is the subject of many complaints today, its early rise was an antidote to the inconvenience and cost of using feelies for authentication. Instead of regurgitating game documentation, players simply had to keep the disk in the computer while they were playing. Initially, the CD was needed because hard drives were too small and expensive to store entire games.

Chapter 5 Distribution Piracy

35

Today, the game installation process still doesn’t install everything from the DVD onto the hard disk. A portion of the game software, or even just a bit of data, is left behind on the DVD and is checked or loaded from the disk when the game is executed. This has become the de facto standard anti-piracy approach for PC games: combining the disk key with some sort of physical or software anti-duplication technology. The rise of the Internet has allowed the creation of another variant of this tactic where the withheld data or code is downloaded in real time from an online server (see the section called “Online Authorization” that follows). Once hard drives got big enough and cheap enough, players didn’t want to have to haul game disks around. After all, if the entire game can be easily stored on the hard drive, who needs a disk? Also, if a player owns 10 or 20 games, she has to keep track of where they all are when she wants to play. Or, even worse, if the customer plays her games on a laptop, the idea of carrying around even a single disk, much less a disk for every game, is very unappealing. Hackers have come up with programs that convince the game that the disk is present or alter the installation process so that items that aren’t supposed to be installed and stored on the hard drive are. These “NO DISK” hacks are terribly popular to this day, even with legitimate, paying customers.

L ICENSE K EYS The license key was developed in parallel with the CD key. This long alphanumeric string allowed the game software to determine whether the user was legitimate or, at least had access to a legitimate game key. License keys have also been used in conjunction with online registration and authentication. A license key is essentially a rather long password and typically works in one of three ways: ID and Checksum Public Key Encryption Online Authorization I discuss each of these methods in the following sections. ID AND CHECKSUM First the key can contain a random ID and checksum. The game program has a mathematical algorithm that the program runs on the random ID portion of the license key to determine whether the computed checksum matches with the checksum provided in the license key.

36

Protecting Games: A Security Handbook for Game Developers and Publishers

The problem with this approach is that hackers often reverse-engineer the process (or game developers are lazy and use a familiar function such as the MD5 standard hash function) and can generate valid license keys on demand. These hack programs are sometimes called, not too cleverly, keygens. This algorithmic process is very tempting for online registration systems because it doesn’t require any storage of keys to validate licenses. Also, distributors and manufacturers can be given the company’s key generation process, which substantially simplifies production: A manufacturer sets up a printer to produce as many license keys as desired. They do not need to coordinate anything with the game publisher, maintain or track how many keys they have produced, store the specific keys that they have produced, or send actual keys back to the publisher to support online registration validation. Also, the game disks are identical, making their production cost low: Generate Random ID Generate Checksum (Random ID) Build License Key = Random ID, Checksum(Random ID)

Verification is also simple: //Checksum algorithm is all that has to be stored in the game software Split License Key into Random ID and Checksum Compute Checksum (Random ID) Compare Computed Checksum with Received Checksum

PUBLIC KEY ENCRYPTION The second license key system replaces the checksum with a public key decryption function (see the glossary). This would appear to stop hackers pretty well. After all, knowledge of the public decryption key does not give access to the secret encryption key: // The game software stores the public key decryption // algorithm and the game’s public key Decrypt License Key with Game Public Key Validate License Key

This just requires hackers to change their tactics. Instead of looking for the checksum algorithm, they simply need to find the stored public key. To complete

Chapter 5 Distribution Piracy

37

the attack, the hacker “finds and replaces” the game public key with one that the hacker has generated. The hacker then uses his own private key to generate whatever license key he wishes. ONLINE AUTHORIZATION The third major approach does not authenticate the key locally, but requires a connection to an online license server operated by the game publisher. In this case, the license key is essentially a password. The game program sends the password to the license server for authentication. Mathematically, the process is identical to the process described for the “ID and Checksum” method, but with the verification carried out at the license server instead of locally: // At some point, the customer enters the license key // into the game application Game Application retrieves License Key Game Application sends License Key to License Server License Server validates License Key License Server sends Validation Message to Game Application Player plays (or not)

The license server can operate just like the local license check, and often does. One advantage of an online license server is that it can detect attempts to reuse license keys on different computers. If the license server stores a list of keys that have been registered, it can reject or take various actions based on a company’s license policy (see the “License Policy” section of Chapter 6). License servers can use two approaches to track keys: a fixed list of issued keys and an algorithmic approach, as described for game application license verification. It is very tempting to use an algorithmic approach to license verification. It requires less storage on the online server and no coordination with whomever is producing the game disks and license keys. The downside of this approach is that it is vulnerable to any exploitation of the key generation process: Once the process is compromised, the license server can only verify the uniqueness of the license keys, not their legitimacy. If, instead, the license server contains a list of all of the license keys that have been legitimately issued, it is much less vulnerable. First, there is no need to create a license key generation algorithm: The keys can simply be stored in bulk. If a key is compromised before it has been issued, it can be removed from the license server list and the company can recover from the compromise or avoid the compromise entirely.

38

Protecting Games: A Security Handbook for Game Developers and Publishers

It is possible for the key producer and license server to use a shared secret key to generate individual license keys. In this case, the two parties share a license generation key (LGK) and a license generation function (license_generator). The license generation function creates license keys based on an index (i) and the LGK: // algorithm to generate the ith license key license(i) = license_generator(LGK,i)

The key producer and license server simply need to exchange the latest index value for the license key that has been generated. The license server can then generate all of the license keys that have been created since the last batch by simply iterating through the new index values: // if last license produced has L and the new last index is N for(i=L+1;i
This has some modest advantages in terms of necessary communications between the license server and the key producer, but does create additional risk in terms of the storage of the license generator key. Developers and publishers can also set up schemes based on the online license registration process to accurately track piracy. Failed license registration attempts do not correspond to individual pirates. Motivated pirates who fail to successfully register a game will likely try and try and try again until they succeed.

WHO OWNS THE PIRACY PROBLEM AND PROTECTING DEVELOPER ROYALTIES I’ve had a number of discussions with game developers about piracy and, in many cases, they basically feel that piracy, and security in general, is the problem of the publisher. This is fine, up to a point. However, developers often earn royalties based on the number of games sold, so they do have a vested interest in good anti-piracy protection. For example, a developer could use license keys as a way to directly audit game sales—if a license key is valid, then, clearly, the developer should earn royalties for that game copy. If license keys are issued in lots or by using an index-based key generation process, the developer can use the highest license key index as a royalty tracking metric.

Chapter 5 Distribution Piracy

S PLITTING

AND

39

K EY S TORAGE

Keys can be used for game activation, validation for operation, or both. A key for activation is essentially used one time to convince the game software that you have a legitimate license key. This can be done locally or with a license server, as described previously. A key for operation is required each time the game application runs. In order to avoid forcing the users to reenter a license key every time a game is executed, the game needs to store the fact that the game has been activated in some manner. The activation key is an obvious target for a pirate. After all, if the activation process can be spoofed (faked out) in some manner, then the entire license and registration process can be ignored. Some games have moved towards using a realtime check with a license server to verify that the game license is valid each time the game runs. This can be very inconvenient for customers who do not have network access (such as on an airplane or soldiers or others in remote locations). In this case, the game application needs to somehow store the fact that it can’t connect to the Internet and still make a license policy decision. A common approach is to keep a counter of how long it’s been since the application has last been able to access the license server or how many times the application has been executed since the application was last able to be validated. This counter is also a great target for pirates. What to do? Unfortunately, this sensitive information (license key, activation status, last valid server authentication, and so on) ultimately has to be stored on the computer with the game application. Encryption has fairly limited efficacy as a tool because the encryption key has to be present in the game application for the sensitive data to be extracted and, if the key is present, it can be attacked. Protecting a license key is, in some sense, a bit easier than protecting other data since it doesn’t change. A diligent hacker will look for changed data and focus on the changes to prepare an attack. Instead of directly storing an encryption key, the game application can use static, but unique, data on the computer to build the key. For example, most PCs have an operating system license key or other information that is stored within the computer’s configuration information (for Windows PCs, this is the Registry). There are other unique data elements that may be used: MAC addresses for Ethernet cards, hard drive IDs, license keys for a number of common applications, even configuration data stored during the application’s installation. Game developers want the information to be platform-unique so that it is more difficult for a pirate to directly copy the installed game onto another computer.

40

Protecting Games: A Security Handbook for Game Developers and Publishers

Once one or more platform-unique, stable identifiers are found, you can protect your sensitive data by splitting it, obfuscating it, or both. SPLITTING DATA Splitting data is quite easy and fairly effective for small amounts of data, such as license keys. Basically, an application developer “adds” the sensitive data to the unique identifier (UID) and stores the sum of the two: // retrieve unique identifier UID = retrieveUniqueIdentifierX; /**Often it is a good idea to perform some sort of operation on the UID to provide a further simple level of indirection and, often more importantly, make the result the right size to work with the sensitive data. For example, a hash function, such as MD5, is used here. If you do use MD5, it is much better to use a keyed MD5 function. */ ModifiedUID = Hash(UID); /** Input the known sensitive data and add the two together (such as with an XOR function).*/ Protected_Sensitive_Data = ModifiedUID XOR SensitiveData // This data is then stored.

If an adversary reads out the stored data, it does not look like the license key or other sensitive data and it is tied to the specific platform. It is worth noting that sometimes unique data is not stable: Ethernet cards get changed, operating systems get updated, and registries get corrupted. To help ensure a smooth user experience, you can replicate this process with multiple items of unique data and perform a majority vote or other process to improve the reliable recovery of the stored sensitive data. OBFUSCATING DATA There are two kinds of obfuscation to protect sensitive information in a program. Code obfuscation protects against reverse engineering and data obfuscation hides data that is stored locally and protects it from manipulation. It is important to note that these solutions are inherently weak—when the program runs, the code needs to execute, so its underlying logic is present and can be read out (at least at the assembly language level). Similarly, at some point in time the program’s sensitive data needs to be read by the program into the processor’s registers so that it can be used.

Chapter 5 Distribution Piracy

41

The typical way to protect data from being read or altered is encryption. This solution is easy to implement using standard libraries. However, encryption is often CPU intensive so it would have an adverse impact on performance. Also, because the key needs to be present, encryption is only as strong as the ability to hide (or, in this case, obscure) the key. Because of these factors, it often makes sense to use a lighter-weight, non-standard function to obscure the data. The goal is to force the attacker to reverse-engineer the program’s code as well as find the key. As long as the function makes the work associated with extracting the data reasonably hard, it is probably good enough (or rather, as good as it gets!). SPLITTING

AND

OBFUSCATING DATA

It is possible, and can be a good idea, to combine the two concepts—you use splitting to protect the key used for data obfuscation: //Extract UID as above ModifiedUID = Hash(UID); // Retrieve stored data split and recover key SensitiveDataKey = ModifiedUID XOR Protected_Sensitive_Data_Key; // Recover sensitive data SensitiveData = Deobfuscate(ObfuscatedD$ata,SensitiveDataKey); // Validate Data

Validation is an important part of the sensitive data-handling process. The game application needs to know if an attacker has altered the data . A very simple option to protect your data is to store a copy of the data unprotected as well as one that is protected. This makes the unprotected data a very tempting target for hackers and, if they are lazy, they might not bother to figure out that there is obfuscation or other protection being used to protect the sensitive data. Another option is to store the sensitive data encrypted with two different keys. However the multiple versions of the data are stored, the game application then simply compares the protected and unprotected copies of the sensitive data. If they don’t match, there is a problem and the program has likely been attacked. If the program has been attacked, it can take actions to defend itself (see the section later in this chapter entitled “Busted Pirate: Now What?”). The final strategy that can be used is to take advantage of the ordinary file that stores a saved version of a game. Sensitive data can be stored directly or in an obscured form along with the saved game. You can strengthen the security of the sensitive data (and the saved game information) by using a keyed hash or cryptographic checksum on the game-saved data. This can work fairly well, as players want to save their game progress.

42

Protecting Games: A Security Handbook for Game Developers and Publishers

B USTED P IRATE : N OW W HAT ? One of the thorny questions with pirates and other troublemakers in games is what to do with the troublemakers once they’ve been caught. Very often, game developers choose to disable the game application or subtly cripple the program in some manner. Techniques can vary widely, and, since developers really, really dislike pirates, the countermeasures are often quite annoying for the pirates. A notable recent case involved the game Titan Quest, where the developers made the game experience miserable and buggy for game applications that detected that they had been pirated5. The game was leaked onto pirate distribution sites shortly after the game’s launch. The hackers broke the game’s primary anti-duplication system in order to make the game work, but had not removed its more subtle piracy-detection features. As a result, the pirates had a terrible game experience. The unintended consequence of this was that many people who downloaded the pirated game started writing very negative reviews and comments on gaming sites. The security system turned out to be a bit too clever. Instead of convincing pirates to either buy the game or uninstall it, the game rapidly earned an undeserved reputation for being buggy, unreliable, and generally crummy. Prompt, decisive action by the anti-piracy system makes it easier for hackers to analyze and eventually circumvent the security system. Although “soft failures” may complicate the removal of the anti-piracy service, they may actually hurt legitimate sales6. This is the central anti-piracy paradox. It is important to remember that individual players of pirated games are potential customers. After all, they did acquire the game somehow and, if nothing else, successful anti-piracy detection confirms that they are playing the game. Ideally, the game developer and publisher should want to drive the player towards a legitimate purchase. The anti-piracy system could activate nagware to encourage the purchase of the game, show ads for other games or products, and, over time, perhaps even offer the game at a discount (if one is an irredeemable optimist, you could look at a pirated game copy as one whose manufacturing, marketing, and distribution costs are zero).

Chapter 5 Distribution Piracy

43

LOCAL STORAGE AND ONLINE GAMES Most online games store all of the data on the server. This has obvious advantages in terms of security. It is possible for online games to use digital signatures and hash functions (or even encryption) to store data on local players’ computers as a backup and recovery strategy. Conceptually, there is no reason that the backup has to correspond to the specific player on the client computer.

R EFERENCES 1. Wikipedia (2008), “Regional Lockout,” http://en.wikipedia.org/wiki/Regional_lockout 2. J. Reimer (2006), “Xbox 360 Hacked, Microsoft Responds,” http://arstechnica.com/news.ars/post/20060323-6445.html 3. S. Carless (2006), “Exclusive: Xbox 360 Piracy Spreading Fast in China,” http://www.gamasutra.com/php-bin/news_index.php?story=10232 4. Wikipedia (2007), “Feelie,” http://en.wikipedia.org/wiki/Feelies 5. M. Fitch (2008), “Venting My Frustrations with PC Game-Dev,” http://www.quartertothree.com/game-talk/showthread.php?t=42663 6. B. Fox (2003), “‘Subversive Code Could Kill Off Software Piracy,” http://www.newscientist.com/article.ns?id=dn4248

6

DRM, Licensing, Policies, and Region Coding

et me begin by clearly declaring my bias—I am not a big fan of Digital Rights Management (DRM). Most DRM systems misunderstand and misuse cryptography. They cause more trouble for legitimate customers than they gain from preventing piracy, if they work at all. I’ve been asked on a number of occasions to recommend DRM systems and my short, flip answer is “Pick the cheapest one that works with your business model; that way you won’t be too disappointed when it fails.”

L

T HE B ASICS

OF

DRM

The full answer is more complicated. Technically, DRM systems are divided into two portions: the protection mechanism and the license policy. The protection mechanism is the technique (or set of techniques) used to identify the item being protected and specify its “rights.” The license policy takes this “rights” identification information and enforces it. In practice, DRM systems are often combined with digital distribution and payment processing systems. For many game developers and publishers, these features may ultimately be much more important than the DRM security tool itself. I’ve been monitoring a number of these companies for several years and it seems that the successful ones have evolved into general-purpose digital media distribution and sales services. The ones that have remained focused purely on DRM seem to fade away.

44

Chapter 6 DRM, Licensing, Policies, and Region Coding

45

The essential problem with DRM is the same problem we face with obfuscation: at some point the protected digital asset has to operate locally on a customer’s computer. This is where it is always attackable because hackers can do any of the following: Disable the DRM system. Convince the DRM system that everything is okay. Modify the DRM system so that it always reports that everything is okay to the main application. Let the DRM system operate but have the main application ignore the security violation. Simply strip the DRM from the main application. To add insult to injury, once a DRM system is compromised, the protected application is compromised permanently. Almost every DRM provider claims that it can recover from a compromise or failure. The DRM system can recover, but the security of the protected application is compromised permanently.

W HY DRM D OESN ’ T W ORK The very same cryptography that effectively protects communications and digitally signs documents fails miserably in enforcing digital rights. The reason cryptography is a powerful tool for security is that it basically turns problems for spies and hackers into problems for PhD mathematicians and lots of supercomputers. This works because standard cryptographic systems involve multiple parties that are engaged in some sort of transaction that they are trying to protect from outside parties. An encryption system uses cryptography and a key to allow communications between “good guys” to be protected from “bad guys” who are outside of the communications network. Encryption systems don’t work if one of the insiders is a bad guy: The bad guy can read or alter the data. I have seen people propose using encryption to protect game high scores. This doesn’t work because the person who wants to cheat is an insider—the player who wants to post an illegitimate high score—and this person can freely alter the data before it is encrypted. Digital signatures can allow the recipient of a piece of data to know that it is from the sender and that it has not been modified in transmission. If the sender sends malicious data, the digital signature process does nothing to distinguish between “good” data and “bad” data, just as with the encryption scenario. The recipient may

46

Protecting Games: A Security Handbook for Game Developers and Publishers

know whom to blame, but that is different from being able to determine that the data is “good.” Conversely, if the recipient wants to use the data even if the digital signature fails, there is nothing to prevent her from doing so. Again, the system fails if the bad guys are the ones creating the signature or if the bad guy is being “forced” to verify the problematic data. Pretty much every DRM system relies on cryptography to enforce its security. Unfortunately, the “bad guy” is the person trying to use the protected application and is definitely an insider (it is his computer, after all). All of these types of attacks can be used despite the presence of encryption or digital signature functions because the problem isn’t a math problem; it’s a hacker problem. Even if, somehow, you could protect the code, there still has to be a key somewhere. If the protected application is digitally signed by some authority, that authority’s public key is present. The simplest attack on digitally authenticated or encrypted data involves replacing that public key with an “evil authority” public key, for which the hacker knows the private key. The hacker can then sign and legitimize any data or license policy. In general, although DRM systems may include cryptography, they are not systems that can be cryptographically secured. There are ways around this problem. Hardware can make it more difficult to find or modify the software or keys. However, the most effective solution is to enmesh the users in a system where external parties verify their legitimacy. I call this a “rich interaction system” in Chapter 9.

T YPES

OF

DRM S YSTEMS

There are numerous DRM products and they work in extremely different ways. Rather than discussing individual DRM solutions, I’ve broken DRM down into a set of major approaches: Any specific product may combine one or more of these techniques. Also, a DRM solution may be combined with one or more of the media and licensing techniques I discussed earlier. FINGERPRINTING

AND

COVERT FINGERPRINTING

With fingerprinting, each copy of a work of digital media has a unique identifier (the fingerprint) embedded within it. Fingerprints are actually placed inside of the media file—modifying it in small, almost undetectable ways that ensure that the fingerprint is present without distorting the base media (usually music or graphical assets). A better term would really be a “tattoo,” as this data is not inherent in the digital media.

Chapter 6 DRM, Licensing, Policies, and Region Coding

47

Fingerprint systems can be attacked in three ways: by modifying the media, so that it is no longer fingerprinted, but still usable; by altering the identifier, so that it can be used with another media player; or by changing the media player, so that it ignores the fingerprint. Like fingerprinting, covert fingerprinting embeds unique identifiers into each individual piece of digital media. With this technology, customer media readers do not process or identify fingerprints. Rather, media distributors or their agents scan widely distributed copies and use the covert fingerprints to determine the source of unauthorized copies. Covert fingerprinting is actually a fairly effective solution for detecting unauthorized copies, especially to detect where a compromise occurred during the production process or during a limited release (to reviewers or external testers). For example, the Academy Awards sends out special DVDs and players to its members during the voting process. By using a covert fingerprint, they could determine if a specific copy of a DVD had been misused and take appropriate action against that member. As discussed in the “Attacking Fingerprints and Watermarks” sidebar, it is important that hackers not have multiple, distinct copies of the media file or they may be able to corrupt the fingerprint and make it much more difficult to track down the culprit. The biggest problem with fingerprint solutions is that they are somewhat expensive. One of the key advantages of license keys is that they are a small, efficient way of making a product unique. Fingerprinting systems have to be constructed carefully so that they don’t disrupt the user’s experience with the protected media—graphics can’t be visibly degraded and sounds can’t be audibly distorted. In addition, most fingerprinting systems require a standard license key or unique user identity to function. WATERMARKING A watermark is very similar to a fingerprint: It is information that has been embedded in all copies of a piece of digital media. The information is either identical for all copies or divided into large categories (the most familiar example is the actual “watermarking” found in paper currency). Watermarks are much easier to produce than fingerprinted systems, because designers have to create fewer distinct versions. As with covert fingerprinting, watermarking is more of a forensic or anticounterfeiting tool than a digital rights security tool—only special devices can read the watermark and determine the authenticity of a copy. Theoretically, watermarks can be used for digital-rights protection; however, the fact that the watermark is common across all copies and that all audience media players will have a copy of the “watermark checker” invites circumvention.

48

Protecting Games: A Security Handbook for Game Developers and Publishers

ATTACKING FINGERPRINTS AND WATERMARKS One of the things that continues to surprise me is how little time security designers spend thinking about how a hacker could attack their systems. The power of fingerprints and watermarks comes from the difficulty in finding them: If they are easy to find, they are easy to remove. They are just bits, after all. So, if you have a basic item of digital media (DM), then you add a fingerprint to it by altering it into fingerprinted digital media (FDM) for each version (i): FDMi = DM + FingerPrint(i); // for each version i

The security designer looks at this and says, “Wow, given that the digital media is big and our changes are small, how in the world could a bad guy find the fingerprint and remove it?” Buy two copies. Hackers are lazy. Why work to find the fingerprint when you don’t have to? So, for the cost or effort of getting two distinct copies of the target digital media (FDM1 and FDM2), they can now attack it pretty easily. Let’s just “add” the copies together. (FDM1 + FDM2)

By using the exclusive or (XOR) function (which basically detects where bits are different), you can find the fingerprints… almost: FDM1 + FDM2 = DM XOR FingerPrint(1) XOR DM XOR FingerPrint(2) =

FingerPrint(1) XOR FingerPrint(2); // the two copies of the digital media (DM) cancel out

You don’t quite have either fingerprint, but you are pretty close. Basically, you know where all the bits are in one fingerprint, but not in both. If you randomly “flip” the bits associated with this combined fingerprint in copy 1 (FDM1) or copy 2 (FDM2), you can hopelessly garble the fingerprint so that it is not readable. Basically, this is like taking sandpaper or acid to your own fingerprints, but much less painful. If necessary, you can buy more copies and run experiments until you have successfully stripped the fingerprint. It is also possible to introduce the fingerprint prior to encoding or compressing the media. This can result in seemingly substantially different outputs. However, if the media can be returned to any sort of standard form, the fingerprint can still be removed or rendered ineffective.

Chapter 6 DRM, Licensing, Policies, and Region Coding

SECURITY LABELS

AND

49

TAGS

Security labels or tags are supplementary tags that are appended to a piece of digital media and may also be bound to the digital media by a digital signature (see the “Digital Signatures” section that follows). Tags are typically used with proprietary encoding and post-processing systems to limit copying or other use of digital media (the regional encoding for DVDs is probably the most familiar example). They can also include simple serial numbers or other identification and use control information. Tags can be easily removed or altered, as they are a distinct portion of a digital media file or stream. They are often clearly identified and explained in the public digital media specification (in contrast to watermarks or fingerprints). Nearly every DRM or other licensing scheme includes some sort of labeling and tagging system. Some developers attempt to conceal this information, but, ultimately, it must be readable by the local digital media player or license policy application, and will eventually be reverse-engineered. Sometimes, security information needs to be altered in the local copy of a piece of digital media. Dynamic security labels or tags are simply labels that can be modified by a local media player or the media itself, if it is an executable program, like a game. The most familiar examples are licensing systems that restrict the number of copies that can be made of a piece of digital media. Other examples that could be potentially more interesting uses of these labeling systems are “buddy” versions of games (where copies are allowed that are tied to a local “master” copy so that friends can play together with only a single, purchased copy of a game), family licenses that allow a set of authorized copies to be built from a single piece of digital media, or affiliate licenses that allow consumers to earn revenue from the individuals to whom they provide a copy of the media. DIGITAL SIGNATURES Digital signatures wrap a piece of media with a tag that includes additional information but is also derived from the media itself. Digital signatures are usually combined with one of the other means of protection. The important attribute of signatures is that a signature verifier cannot also create a valid signature because the system is based on public key cryptography. The problem is, as discussed, that the local public key can be replaced, or the entire signature process can be circumvented. ENCRYPTION Encryption is the use of a cryptographic function in conjunction with a secret key to protect data from being read by anyone without the secret key. The problem with

50

Protecting Games: A Security Handbook for Game Developers and Publishers

protecting digital media is, of course, that the “secret key” somehow has to exist in every copy of the digital media. Technically, this means that from a digital media protection perspective, there is no difference between encryption and proprietary encoding. PROPRIETARY ENCODING Proprietary encoding is the use of a distributor-controlled format for the distribution and a proprietary player that is required to read the digital media. Proprietary encoding can be used in conjunction with other DRM and security techniques. For games, Adobe’s Flash and Shockwave file formats are the most familiar examples. In the traditional PC games and console markets, Epic Software’s Unreal game engine is being used so widely that it may be becoming a de facto standard for the latest generation of games. The practical problems associated with proprietary encoding include the limitations that they impose on artists and distributors for the production and control of media. For example, Adobe’s Flash application, although it is very popular on the web, was not immediately supported by Apple’s iPhone. Other complications include allocating royalties to the owners of the encoding technology. The recent battles between Blu-ray and HD DVD disk formats, royalties on blank disks and tapes, and the battle between VHS and Betamax are all examples where proprietary encoding has created larger business problems. Excepting the iPhone platform, Adobe has largely avoided many of these issues with its proprietary products because of its business model—selling development tools while giving away the media players. The security problem with proprietary encoding schemes is that these schemes are vulnerable to reverse engineering: DeCSS allows DVDs to be read and processed in software by PCs with open source tools. In the hands of pirates, these tools can be used to regenerate the media into any form and format desired. DeCSS showed that the reverse engineering of the DVD proprietary encoding system was not difficult and we are already seeing similar weaknesses in the “next generation” formats: Blu-ray and HD DVD. Virtually every music-related DRM system seems to be regularly hacked and, in most cases, the media can be extracted into a standard format such as an MP3 file (this is not a problem for traditional games that are implemented as custom software). OBFUSCATION Obfuscation (also discussed in Chapter 5) is an anti-reverse engineering technique that protects the underlying media from being easily parsed or edited. Obfuscation is essentially an analog to old physical media security systems. This technique typically relies on very low-level machine language and file specifications to alter a

Chapter 6 DRM, Licensing, Policies, and Region Coding

51

program or data so that it yields the expected result, but the result is computed or stored in a manner that is difficult to understand without extensive reverseengineering. Obfuscators are just that—they obscure information; they don’t encrypt it. In and of itself, obfuscation is not really an anti-piracy technique since a copy of an obfuscated application or media will continue to work as expected. Obfuscation is used with other anti-piracy techniques to attempt to conceal the location, structure, and operation of the overall DRM system. Because of the inherent weaknesses of many DRM systems, the security of the DRM system is actually only as strong as its obfuscation, not the cryptography or other techniques. SPLIT DELIVERY Split delivery is a wonderfully straightforward tool. This technique works by limiting the digital media that is distributed to a person to only the portions that they have paid for (or are available for free). Instead of looking for a clever security technique to disable code, features, levels, or assets that a person hasn’t purchased, you just don’t send the un-purchased material to them. A number of game demos and casual games use this strategy. Many DRM systems also include an online component that operates as discussed in the section addressing license keys (Chapter 5). Digital signature systems, encryption, fingerprinting, and any other system whose security includes the notion of unique identity need to be concerned about the registration problem (see the section called “The Registration Problem and Identity Management Systems” in Chapter 29).

L ICENSE P OLICY The license policy is the most important part of any DRM system. It is the embodiment of a company’s business model. The protection mechanisms are the means to enforce this policy. If the DRM tool doesn’t support the licensing policy that the business needs, it doesn’t matter how effective the protection mechanisms are; the security system will not be effective. When I first started in the security field in the 1980s, one of the major topics was computer security as embodied in “The Orange Book”1. This volume specified a sequence of security grades for computer systems: D, C1, C2, B1, B2, and B3, with A1 being the highest. There were two security policy models included in “The Orange Book”: DAC and MAC. Discretionary Access Control (DAC) is similar to the project-oriented privilege structure that is familiar in UNIX, Windows, and other commercial operating systems. Mandatory Access Control (MAC) is structured

52

Protecting Games: A Security Handbook for Game Developers and Publishers

like the classification system used in the military—Unclassified, Secret, Top Secret, and so on. The DAC security policy was associated with the “lower” security levels of C1 and C2, whereas MAC was associated with the “higher” security levels B1 through A1. Even then, I was puzzled as to why MAC was somehow superior to DAC. These are simply different security policies. Neither is inherently better than the other. Many DRM products continue this flawed model of confusing security mechanism and security policy. Many security developers spend most of their energy on implementing security mechanisms, but they spend little thought on business models, revenue streams, and usability. This hurts the overall effectiveness of many DRM products substantially, as the DRM purchasers are unable to alter the DRM tool’s license policy. These awkward combinations of the digital rights (license policy) models with enforcement mechanisms restrict game providers and publishers from running their business as they see fit. They can only offer the services that their DRM vendor or internal developer chose to implement in the way the DRM provider implemented the services. Even worse, the DRM vendor’s revenue model can force the media publisher to price goods and services in a way that may damage their success in the market. This is lost opportunity as the game industry is in a period of intense innovation in business models and pricing. The system really should be reversed. The license policy design should be the central feature of a DRM system with the appropriate enforcement tools incorporated as needed to support the publisher’s business model. The movie industry’s use of DVD regional encoding has largely functioned as planned—a way for the industry to control release schedules and pricing to support widely different markets —even though it has been technically “broken” by hackers. It works because the business model matched the security technique chosen. The following are some of the options for controlling license policy: Regions/Markets—Just as with DVDs, publishers can control the release and use of different versions of a digital asset based on the market it is being used for. Note: This does require that the digital media player be able to determine which market the player is associated with. User Types—It is possible to categorize users and unlock features based on those categories. For PC games, it may make sense to distinguish between Internet Café PCs and home PCs to determine which sorts of features and configurations the publisher wants to support in each. One could even extend this to individual customers.

Chapter 6 DRM, Licensing, Policies, and Region Coding

53

Platform—Certain platforms or digital asset players may be subject to restrictions. For example, an arcade game machine has a different business model tied to metered play, whereas a console or PC often has a purchase-based model. Installation—The Blu-ray system has the ability to “key out” certain players because they have been compromised or associated with piracy. Digital media can include information to forbid or allow specific players. Also, license systems can restrict the number of reinstallations associated with a given platform, user, or license key. Tiered Distribution—One of the interesting capabilities of game handhelds is the ability to allow players to share a single, licensed copy of a game in order to play together. The subordinate players connect to the main player and download a special, limited version of the game. This could be extended for PC or other console games as a marketing strategy or as part of a peer-to-peer distribution system. Feature Versioning—Licensing systems are well suited to controlling which feature sets are enabled for an application. Just as with many of the licensing options, in some cases it is possible to implement controls directly at a specific media player by only distributing the features that are needed to that platform. This has the advantage of forcing hackers to somehow actually acquire the media that they want, not just figure out how to unlock features that are already present. Validation/Registration/Activation—License policies can control how the digital asset will behave if validation, registration, or activation has not been completed. This is often done to provide a gracefully degrading user experience in case of non-malicious situations (such as Internet access being unavailable for a period of time or, as often happens with new game launches, online license servers being overloaded). Unfortunately, malicious users can sometimes exploit these modes of operation. They force the system into triggering the alternate policy through tactics such as simply disconnecting the computer from the Internet. Live Connection—Certain games require a live connection, often for license control purposes. Timers, Clocks, and Counters—Key parts of many more sophisticated license policies are timers, clocks, and counters that track the status of the various policy restrictions included in this list. Game demos that are restricted to allow a certain number of hours, days, or even minutes of play are the most familiar example. The main challenge for a system that uses these changing attributes is that timers, counters, and clocks are obvious targets for hackers.

54

Protecting Games: A Security Handbook for Game Developers and Publishers

Content—Digital assets, for convenience, may include material that is not always accessible to all customers. One could argue that unlocking levels through game play is an example of this type of control, but game demos also restrict content. Sometimes they do this by requiring additional assets to be distributed and sometimes they unlock the restricted data after payment has been received. There are numerous other license policy areas—parental controls (usage duration, age restrictions, and so on), national censorship requirements (restrictions on violence, language, or sexual content), and payment information. The underlying concept of managing digital rights is not controversial. The critical question and challenge for publishers and developers is to build tools that effectively support their business strategy. The license policy should be the embodiment of the publisher’s business strategy.

R EFERENCES 1. DoD 5200.28-STD (1985), “Trusted Computer System Evaluation Criteria (TCSEC),” http://www.fas.org/irp/nsa/rainbow/std001.htm

7

Console Piracy, Used Games, and Pricing

onsoles can be pirated. There is a huge amount of complaining in the computer games industry about PC game piracy, but console games have always been successfully pirated. Console game piracy has become increasingly serious as game consoles have expanded into mainstream entertainment and new markets. This can be clearly seen by Nintendo’s growing attention to piracy problems1. Products like the R4 cartridge for the Nintendo DS handheld were tolerated for a long time, but these products are now the subject of lawsuits and other restrictive efforts worldwide 2,3. Nintendo is far from alone. The Xbox 360 has had a serious problem with its DVD player since 2006 4 and the Blu-ray disks used in the Sony PlayStation 3 are also being exploited5 (although, so far, not for games).

C

A TTACKING C ONSOLES The very nature of consoles actually facilitates some of their piracy problems. The ease of use that makes them popular also makes them a target. Console users simply insert a game disk or cartridge and play. This means that if a hacker can convince the console that a disk is legitimate, the game will be permitted to run. There are several methods that can be used to deceive the console. The first attack involves duplicating the game storage media. The R4 cartridge does this by emulating the physical and electrical interface between the game cartridge and the Nintendo DS handheld. However, instead of an official game cartridge, the R4 uses standard Flash memory cards (the same ones used for cameras and music players) that can be updated with whatever games the pirate desires. Balancing ease of use with security is an interesting design challenge. Uniqueness is a very powerful security tool, but it is not always easy to incorporate into a system. For PC games, customers are used to typing in a unique license key when they install the game. Console game players simply want to load the game

55

56

Protecting Games: A Security Handbook for Game Developers and Publishers

media and play. In order to add uniqueness to a console game without disrupting the play experience, some sort of unique, digital license information would need to be included on each game disk or cartridge. However, there is a cost for adding uniqueness into a production line, especially for disks like DVDs and Blu-ray. A cartridge system or Flash memory device could be customized more easily to support a unique identity. The next form of attack is to convince the media player that the counterfeit media is legitimate. This is what happens with the Xbox 360 hack. The DVD player reports back that disks labeled as “Rewriteable” DVDs are instead reported as “Xbox360game” DVDs to the console. Microsoft has made some headway against this problem by preventing the DVD firmware from being updated. However, conceptually, a hacker could always replace a media player with a computer or device that fully emulates the media player interface. The simplest and cheapest way to do this would be to find an alternative DVD player with a bit more EEPROM and RAM (see “Secure Loader and Blind Authentication” in Chapter 14) that otherwise uses the same interface protocols as the standard drive. All DVD drives use fairly similar protocols. A hacker would need to analyze the official Xbox 360 DVD drive interface to determine if anything was non-standard (it is likely that the Xbox 360 drive incorporates a couple of additional commands to distinguish it from a standard drive, although some standard commands may be altered in their format) and then emulate that interface with an alternative DVD drive. Emulators are a particularly challenging problem. Instead of attacking the console, an emulator duplicates the hardware and other features of a console in software. For a long time, emulators were not a particularly serious concern for consoles. Moore’s Law (the number of transistors on an integrated circuit has increased exponentially, doubling approximately every two years), which has been demonstrated by the huge acceleration in hardware capabilities in recent years, means that console games can be emulated fairly quickly: PS1 console games are playable on Sony’s PSP handheld just a decade later6. Even worse, generalpurpose PCs are getting so powerful and inexpensive, it is likely that they will be able to emulate new game consoles even more rapidly. The cost difference between a moderately powerful PC and a console has gone from substantially more than $2,000 to several hundred dollars or less. Finally, hackers can target the console processor and operating system directly. If hackers can change the core operations of the console itself, they can bypass all of the system’s security checks. This can be done by attacking the console’s firmware through traditional software weaknesses such as buffer overflows or through brute force replacement of the console’s operating system via modchips7 or other forms of hardware hacking.

Chapter 7 Console Piracy, Used Games, and Pricing

57

Hardware hacking is difficult. It often requires welding or replacing memory chips or even adding new processors and circuit boards to an existing console. The simplest attack is to replace the ROM memory that stores the console’s software with your own chip. Other attacks take advantage of hardware debug features, unused connectors, and interconnects that can be used to alter the operation of the console. Console developers are aware of these attacks. Once again, the challenge is to keep the cost of the console at a minimum while increasing the efforts required for attackers to be successful. Early versions of most consoles (and other hardware) contain more discrete components and more powerful, general-purpose processors or other programmable components that can be altered with software. This is done to get the product out on the market more quickly, but also to accommodate the inevitable bugs and problems that any new system faces. The flexibility that is needed for these early versions of a console tends to make it more vulnerable to attack. Later, once the design has stabilized, components can be optimized and custom circuits (ASICs) can replace the general-purpose processors to reduce costs. Hardware hacking requires the hacker to have to have some real skill to carry out the attack. First, someone has to do some reasonably serious reverse engineering to find a weakness in the system and implement the attack. Second, the attack needs to be “productized” in a way that is reasonably simple to implement by less skilled individuals (nothing more than opening the console and welding or replacing a chip). Third, the commercial pirate needs some sort of facility to produce any necessary equipment (memory chips, circuit boards, and so on) and numerous local business partners to implement the attack for customers. Software attacks are much easier. The goal is the same as with hardware attacks—somehow bypass or alter the console’s operating system. However, instead of attacking the console, the hackers look for weaknesses in the console or game software that kicks the console into a state where the hackers can run whatever program they want to. Because consoles usually don’t provide a command-line interface for users, hackers have to find their way in through parts of the system that are modifiable: the games themselves, game save files, other modifiable configuration files, and, increasingly, user-created game content. Consoles are fairly special-purpose systems: They run games, they save games, they may play games online, and sometimes they handle other media (like playing DVDs or showing pictures). This limited set of applications makes it easier for the console developer to lock down the hardware platform against attack than it is for a PC game developer to protect their game in a general-purpose computer. This does not mean that consoles are immune to attack.

58

Protecting Games: A Security Handbook for Game Developers and Publishers

SECURE BOOTSTRAPPING Ideally, a console developer would like to consider the entire console as a secure system and believe that no one can get inside the box. In reality, of course, hackers and pirates are willing to crack open the console, even if it will void their warranty. This presents a difficult security challenge. Your adversary can test, swap, probe, and otherwise alter and abuse anything and everything that is in your machine until they’ve beaten your security. (See M. Steil's report 8 for a fascinating, detailed discussion about reverse engineering the Xbox.) They can use part numbers to find technical specifications for your components and, fairly rapidly, completely reverse-engineer your design. Attacking information within a chip is still fairly difficult. This is the premise of products like the Trusted Platform Module (TPM). The notion of “secure bootstrapping” starts with a very small amount of protected memory inside the TPM that is used to get things started. Because this type of memory is very limited and expensive, it is used to authenticate conventional, unprotected memory, which is then used to load the remainder of the operating system. Once the operating system is loaded, regular applications are loaded and run. Another important consideration for a secure bootstrapping system is to make sure that it cannot be forced to revert to a previous version of itself. Sony’s PSP continues to have problems with downgraders that force the platform to an earlier, unsecure version of the operating system. This is because the previous versions of the operating system also pass the secure bootstrapping integrity checks. The way to prevent downgrading problems is that the core, trusted portion of the system must include a version counter in protected memory to prevent the operating system from being rolled back. Interestingly, while a TPM in a console does work for secure bootstrapping to ensure the integrity of the platform’s operating system, it does nothing to stop piracy on a PC because, as noted elsewhere, the entire game still needs to be available to the unprotected computer to execute.

For games to execute most quickly, they are typically given full hardware privileges by the game console. The standard way that a console game works is as follows: The console is started and the game is loaded, it retrieves and loads a previously saved game so that the player can resume progress from an earlier session, and runs until the player quits or the console is turned off. If there is a problem within the game that causes it to crash, a hacker may be able to use that crash

Chapter 7 Console Piracy, Used Games, and Pricing

59

(or even cause one) to knock the console into a non-standard state and take over the console. When an application crashes, it is stopped in a disorderly manner that can sometimes be used to run a different program with the same privileges and abilities as the crashed application. Game developers test the games pretty thoroughly. Sometimes, however, they don’t thoroughly test the process for loading saved games or other external information to ensure that they are not corrupted in some manner. This is where problems have occurred. The role-playing game The Legend of Zelda: Twilight Princess, for Nintendo’s Wii, allows players to name their horses (of course). The game crashes when the horse is given an exceptionally long name and the players later use the horse. This allows hackers to run code of their choice 9. Sony’s PSP has similar Game Save problems associated with the games Grand Theft Auto: Liberty City Stories and Lumines 10. The Game Save problem is a bit tricky for the console manufacturer to protect against. The console operating system can restrict the interface to write and read saved games and, hopefully, seize control back from an application when it crashes. In addition, the PSP had a problem with its image viewer. Certain corrupted TIFF files (a standard image format) can cause a crash and permit hackers to execute whatever code they desire11. Apple’s iPhone and iTouch are vulnerable to a similar attack12. The TIFF vulnerability is almost certainly the result of using a standard, probably open source, image library with a known flaw. In both of these cases, the console operating system should not blindly trust either the image viewer or the game application to behave well. Game Save files are tempting targets for direct attack. Usually, the saved files can be removed from the console via a memory cartridge or SD disk and then modified by a motivated hacker. Today, once one of these hacks has been created, hackers can install the altered save files on any console by using the same type of standard storage cartridges or media. One potential solution is for each console to digitally sign all Game Save files that it creates and bind them to itself so that they can’t be used on another console. This would also complicate the distribution of these attacks by hackers, because the attack would need to be replicated by hand on each target system. In the Zelda scenario discussed, hackers would need to play through the game to the point where they found the horse and name it in order to implement the “twilight hack” on each specific console. This would make the attack “too hard” for most lazy players who might otherwise take advantage of the hack. The clearest way to track the progress of software assaults on a game console is to monitor the “homebrew scene.” Homebrew developers basically spend their time figuring out ways to take control of game consoles so that they can run their own applications (or pirated games) on these powerful, but inexpensive, machines.

60

Protecting Games: A Security Handbook for Game Developers and Publishers

One of the ways to avoid tempting homebrew developers is to offer a safe, but open, interface. Sony did this with its PlayStation 2 platform and allowed developers to run the Linux operating system on the console. Unfortunately, it is not possible to determine if this had any effect on PlayStation 2 piracy. Interestingly, DRM solutions, which do not work so well on a PC, are much more effective in the controlled hardware environment of a console.

T HE U SED G AMES M ARKET Used game sales, like pirated games, don’t typically add any revenue to game developers or publishers. And, as seen by reviewing the financial reports of GameStop, a major U.S. game retailer, used games (both hardware and software) generated $1.3 billion in revenues in 2007 and are responsible for over 48 percent of the company’s profit13. As mentioned earlier, the Entertainment Software Association’s total piracy estimate for the games industry is $3 billion and GameStop is just one retailer among many. Although it is unclear how much of that $3 billion in piracy would convert to legitimate sales even if piracy could be stopped entirely, used game customers are spending money, in retail, to purchase these games. “We have the largest selection (approximately 3,000 [distinct products]) of used video game titles which have an average price of $16 as compared to an average price of $42 for new video game titles and which generate significantly higher gross margins than new video game products.” — GameStop 2007 Annual Report Some industry professionals have argued that measures need to be taken to stop used game sales and others have stated that these sales should simply be ignored. I argue that it is probably worth the effort for developers and publishers to try to capture some of the used game revenue without restricting the ability of retailers, or individuals, to resell games. One of the most humorous parts of this discussion is that, although PC games are the primary alleged targets of piracy, the rise of console games has been the key to the growth of the used game business. Typically, retailers will not accept returns or exchanges of PC games. They are legitimately concerned that the customer took the disk home and copied it. In contrast, console disks and cartridges are perfect candidates for resale: They are compact, fairly easy to inspect for quality, unlikely to be damaged, sell well, and, as discussed here, are more profitable than new games.

Chapter 7 Console Piracy, Used Games, and Pricing

61

“Increase Sales of Used Video Game Products. We will continue to expand the selection and availability of used video game products in our stores. Our strategy consists of increasing consumer awareness of the benefits of trading in and buying used video game products at our stores through increased marketing activities. We expect the continued growth of new platform technology to drive trade-ins of previous generation products, as well as next generation platforms, thereby expanding the supply of used video game products.” —GameStop 2007 Annual Report This is not a critique of GameStop, which is just a publicly traded company whose excellent annual reports clearly demonstrate the economics of used console game sales. Blockbuster, Circuit City 14, Walmart, and the other major game retailers probably have similar results. Almost half of GameStop’s profits come from used games (around 48 percent). This has to affect their business strategy. If they don’t stock that many copies of a new title, customers who want a game that is not available may walk out with another used game that is available immediately. Customers also know that they can wait a week or a couple of months and find most games at a substantial discount—a $16 per used game versus $42 per new game average price. There are ways to earn more revenues from customers without trying to directly stop used game sales. Downloadable content is certainly one way to gain revenues. It doesn’t necessarily deter customers from buying a used game, but it may discourage them from selling the game. Some console game publishers are experimenting with license keys for console games (something PC games have done for a long time) to link a single game customer to a game disk. One twist on using downloadable content is to release multiple, small downloadable items, but only for a limited time. Some MMOs do this for holiday items—virtual costumes for Halloween, flowers for Valentine’s Day, and so on. Although a valentine may be inappropriate for a World War 2 game, limited edition weapons, uniforms, and maps are certainly plausible—with the items available only for a week or month for currently registered and active players. The other anti-piracy strategies discussed for PC games, such as promotions, collectible items, and special editions, are all equally applicable to fighting the used game threat.

62

Protecting Games: A Security Handbook for Game Developers and Publishers

P RICING P IRATES O UT

OF

B USINESS

Price is a great anti-piracy strategy. Low price and convenience works as a way to fight piracy. Apple is now the number one leading music retailer in the US thanks to its low prices and convenience15. iTunes has been growing steadily, even though its FairPlay DRM system has been cracked repeatedly16. The computer game industry regularly touts itself as a competitor to the movie industry. However, in 2006, there were over 1.1 billion DVDs sold for $16.5 billion17 compared to 240.7 million games sold for $7.4 billion18. DVD players and video game consoles have been roughly comparable in price for quite a number of years. The big difference is that a new DVD typically cost less than $20, whereas a new game is priced at closer to $50. Part of the reason for this pricing disparity is history. PC games started off at $50 when they were the only form of entertainment on a computer in the late 1970s and 1980s. At that time, there was no Internet and the number of PC owners was quite small. However, the price really hasn’t changed since that time even though there is a vast range of free entertainment available on PCs (including other games) and phenomenal growth in the PC market as a whole. Some people argue that this is because a game can provide 30 or 40 hours of entertainment while a film only lasts 2 or 3 hours. However, many players only wind up playing games for a couple of hours and, if we used this metric for books, a novel would be much more expensive than a film. In fact, most recreational hardback books or quality paperback books are priced very close to the $20 price of a standard DVD. There is a substantial psychological difference between a $20 and a $50 purchase. I’ll buy a $20 book or a DVD on an impulse, but I pretty much always think about what $50 games I’ll purchase. The rise of “free-to-play” online games has shown that many consumers are quite sensitive to price. The popularity of games like Nexon’s MapleStory and Jagex’s RuneScape has shown that by lowering the barrier to entry for your customers, you can substantially increase your audience while still earning very healthy revenues. Lower prices make piracy and used games much less appealing. Although GameStop and its fellow game retailers can earn substantial margins when the price difference between a new game and a used game is $30, the retail appeal of used games is much less if the new game price is only $20. One of the challenges of experimenting with pricing for console games is the substantial royalties that game publishers have to pay to the console manufacturers. It should give everyone pause when Id Software has threatened to limit the features it is including in its Xbox 360 version of the game Rage because of the per-disk royalties that it has to pay to Microsoft20. Rage is supposed to be large enough that it

Chapter 7 Console Piracy, Used Games, and Pricing

63

would apparently require an additional physical DVD to be played on the Xbox 360 instead of fitting on a single Blu-ray disk for the PS3 console. Also, retail games compete with a wide range of free and inexpensive entertainment options on the PC—DVDs, video-on-demand, Netflix, endless free games online, cheap MMOs, YouTube, and so on. Another possibility is episodic gaming. Episodic games have not taken off so far, although it is intriguing to consider the idea of breaking a game into an initial release (sold for $10 or $20) and then having the remaining levels purchased as downloadable content. Potentially, this could be done for both PC games and console games.

BREAKING THROUGH THE GLASS CASE The high price of games creates an interesting problem beyond piracy or IT security: physical security. Because games are a physically small, high-value item, they are targets for theft. For general retail, theft is approximately 1 or 2 percent of sales, but for games, it is as high as 5 percent. The situation pushes retailers to protect games behind glass cases and forces employees to retrieve the boxes for customers (glass cases can cut sales by 35 to 45 percent, but reduce theft by 90 percent)19. Unfortunately, putting games behind glass substantially reduces impulse sales. Impulse sales are defined as sales where the customer did not visit the merchant with the intent to buy the specific item. Twenty-six percent of clothing sales comes from impulse purchases, but only 6 to 8 percent of game purchases are from impulse purchases. Game companies are experimenting with alternative packaging such as bundling games with toys and other packaging and sales strategies that would allow the games to need less physical protection. Of course, lowering prices and improving retail margins directly could help. A Technical Alternative Another strategy, better suited for PC games than consoles, would be to move product activation from the home to the cashier. Pre-paid cards are routinely activated today during the checkout process. The cashier scans a barcode on the pre-paid card when payment is accepted. This information is sent to the vendor, who activates the card. This same activation process could work for computer games. Game publishers could easily print the game’s license key on its box. When the customer checks out, the license key is scanned and the game publisher’s license server then activates the game.

64

Protecting Games: A Security Handbook for Game Developers and Publishers

This activation process would allow the game to be located in the store with substantially lower risk because possession of the game disk would not be sufficient to activate the game, even if the thief knows the license key. The cashier’s involvement prevents casual theft. The players then enter the license key, as they do today, when they install the game and registration proceeds. Another alternative would be to allow players to activate their games with an affinity membership card at the time of purchase instead of via online registration at their computers. It could even be possible for license registration information to be directly transferred from the merchant to the game publisher.

Chapter 7 Console Piracy, Used Games, and Pricing

65

R EFERENCES 1. C. Dring (2008), “JAPAN: Nintendo Attacks DS Piracy,” http://www.mcvuk.com/news/31376/JAPAN-Nintendo-attacks-DS-piracy 2. B. Ashcraft (2008), “R4 Price Going Up in Akihabara,” http://kotaku.com/5031834/r4-price-going-up-in-akihabara 3. Nintendo (2008), “Court’s Judgment of Illegality of Device, Such as R4, etc.,” http://ap.nintendo.com/_pdf/news/408905229.pdf 4. S. Carless (2006), “Exclusive: Xbox 360 Piracy Spreading Fast in China,” http://www.gamasutra.com/php-bin/news_index.php?story=10232 5. H. Goldstein (2006), “Blu-Ray Already Ripped on PS3,” http://ps3.ign.com/articles/748/748723p1.html 6. K. Orland (2006), “Hack: Play Ripped PS1 Games on PSP [update 1],” http://www.joystiq.com/2006/12/25/hack-play-ripped-ps1-games-on-psp/ 7. Wikipedia (2008), “Modchip,” http://en.wikipedia.org/wiki/Modchip 8. M. Steil (2005), “17 Mistakes Microsoft Made in the Xbox Security System,” http://www.xbox-linux.org/wiki/17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System 9. WiiBrew (2008), “Twilight Hack,” http://wiibrew.org/wiki/Twilight_Hack 10. A. Linde (2007), “PSP Firmware Exploit Found in Lumines; Sales Jump 5,900% on Amazon,” http://www.destructoid.com/psp-firmware-exploit-found-in-lumines-sales-jump-5900-on-amazon33690.phtml 11. Secunia (2005), “Sony PSP Photo Viewer TIFF File Handling Buffer Overflow,” http://secunia.com/advisories/16922/ 12. R. Block (2007), “iPhone and iPod Touch v1.1.1 Full Jailbreak Tested, Confirmed!,” http://www.engadget.com/2007/10/10/iphone-and-ipod-touch-v1-1-1-full-jailbreak-tested-confirmed/ 13. GameStop (2007), “GameStop Annual Report 2007,” http://library.corporate-ir.net/library/13/130/130125/items/295079/2007annualreport.pdf 14. A. Webster (2008), “Circuit City to Expand Used Games Plans,” http://arstechnica.com/journals/thumbs.ars/2008/02/08/circuit-city-to-sell-used-games 15. Apple (2008), “iTunes Store Top Music Retailer in the US,” http://www.apple.com/pr/library/2008/04/03itunes.html 16. E. Kirk, “App Store’s FairPlay DRM Hacked On Super Monkey Ball,” http://www.iphonealley.com/news/app-store039s-fairplay-drm-hacked-on-super-monkey-ball 17. S. Zeidler (2008), “U.S. DVD Unit Sales Dropped in ’07,” http://www.reuters.com/article/businessNews/idUSN0325539220080104 18. ESA (2007), “Essential Facts about the Computer and Video Game Industry,” http://www.theesa.com/facts/pdfs/ESA_EF_2007.pdf 19. T. Wolverton (2008), “Game Industry Tries to Break Through Glass Wall,” http://www.mercurynews.com/business/ci_10339660 20. N. Breckon and C. Faylor (2008), “Rage Will Look Worse on 360 Due to Compression; Doom 4 and Rage Not Likely for Digital Distribution,” http://www.shacknews.com/onearticle.x/53976

8

Server Piracy

ne of the reasons that companies started to create online game services was that they were a good way to fight traditional game piracy. After all, if a customer has to connect to your server, surely there is no way that she can pirate your game. Although it may be true that the game is truly on the server in a text MUD, for many graphical online games, most of the art assets, level design, and even game logic resides on the client application. And, really, the valuable part of the game is the art and game design. Because so much of the game is often on the client-side, the limited amount of server logic acts more as an online game key. And, as discussed in earlier chapters, there are many ways to attack license key systems.

O

S ERVER P IRACY T RENDS Server piracy has been around for a long time. Massively multi-player games are particularly vulnerable. Early MMOs like Ultima Online have been targeted1, as well as new games like World of Warcraft2. Even smaller games, like Star Wars: Galaxies, have been victims3. MMOs are not the only targets. The unauthorized “BnetD” server emulates Blizzard’s online service for multi-player gaming for Diablo II and Warcraft III 4. It is tempting to categorize pirating single-player downloaded games in Flash, Shockwave, and Java as examples of server piracy. However, in each of these cases, the game is distributed in its entirety to the players every time they visit the web page where the game is located. The absurd confusion about what is actually occurring is obvious when some online casinos call these types of games “no download” games. Of course the game is downloaded; it is just automatically downloaded every time the web page is viewed. For these types of downloaded games, the problem is much more akin to the problem faced when fighting piracy in standard PC games. 66

Chapter 8 Server Piracy

67

Sometimes, these pirate servers are just run for fun. Sometimes, players want to change the game to suit their own desires, and sometimes they just want control: “The RunUO Team has a plethora of things for you to choose from. We deliver an end-to-end solution for your Ultima Online needs. We give you everything from the server software to a client we have written from scratch. If you prefer the EA games client, we even have our very own UO Assist program designed to make game play much easier, called Razor. Below you will find a list of our products and everything there is to know about them.” —RunUO Products Page When online games became more popular and profitable, some pirates moved to run these unauthorized game services for money. There have been pirate servers all over the world. China has been a particular target: A pirated version of Legend of Mir 3 earned its operators 500,000 RMB (around $64,000, a fair amount of money in China) by offering lifetime subscriptions for 300 RMB (around the same amount a legitimate player might pay per month). The publisher, Guangzhou Optisp Company, claimed monthly losses of 10 million Yuan ($1.28 Million)5. They are not the only company that has faced this problem. A pirate server for Ragnarok Online, published in China by Shanda Interactive, was shut down with 260,000 accounts and could support 3,000 peak concurrent users6. China is not alone; there have been pirate server operations shut down in Europe7 and Russia8; the US is not immune either. In 2003, the source code for one of the first globally popular MMOs, Lineage II by NCsoft, was compromised and found its way to a server in China. It was purchased by a Texan in 2004 whose California business partner set up an illegal Lineage II server in the US. They had 50,000 users in 2006, and NCsoft claimed potential losses of $750,000 per month. The FBI shut this service down in late 2006. If the site operator is found guilty, he faces up to five years in jail and $250,000 in fines9. Most MMOs have relatively simple game mechanics, especially the portion that is implemented on the server. These mechanics are often substantially implemented by code on the client computer to minimize bandwidth and processing on the game operator’s servers. This leaves the pirate with a quite tractable task of reverseengineering the simple part of the game—its server game logic—or coming up with plausible alternative server code. This actually highlights an interesting irony about online games. One of the motivations for online games, particularly in Asia, is to fight piracy. However, the move towards simpler games and general stagnation of game design has made it easier to create a knock-off game and steal most of an existing game’s assets.

68

Protecting Games: A Security Handbook for Game Developers and Publishers

One could really argue that what is occurring is not server piracy, per se, but service piracy. There are a number of ways for a pirate to exploit an online game service: Stolen Server Code—Someone has an unauthorized copy of the source code for the server (usually with all of the client art and assets that aren’t protected, in practice). This can occur due to an accidental disclosure (leaving the code on an unprotected server, as with the Lineage II case), theft from the developer by an outsider, or a malicious employee. Reverse-Engineered Server Code—Someone uses the actual game client to reverse-engineer the game server and communications protocols. Reverse engineering is often legal (DMCA raises some real questions about this in the US) and very difficult to stop in practice, as seen with “BnetD.” Blizzard won the case to stop the distribution of this unauthorized version of the Battle.Net server code in the US, but the code is still widely available online. Stolen Art, Music, and Animation (and Plausible Client and Server)—A player with a legitimate copy of the game extracts the game’s art assets and uses them with their independently created game client and server. This is usually trivial to implement, because any legitimate player can collect the game’s entire creative content by simply playing through the legitimate game. This is certainly a EULA and copyright violation. However, the legal case may be very interesting if you require the player to have a legitimate copy of the original game client, especially if the original client is distributed for free. This is not the kind of “interesting” situation that businesses like to deal with. Cloning: Copied Art and Emulated Server—Building game art and animation and game play in the style of an existing game. This is a pure copyright violation. The only way to stop this is via the courts, which may not be effective in many of the jurisdictions that are likely to pursue this tactic. There are several trends that are going to make the server piracy problem worse, not better. China has become very aggressive in prosecuting online game pirates, especially as its domestic online game industry has grown. The rapid globalization of online gaming will likely lead to pirates moving their game servers to countries with immature legal systems. These countries will be happy to host services for online games for a license fee or the promise of tax revenues. The continued success of online gambling in the Caribbean, even in the face of severe sanctions in the US, is a clear indicator of the challenge of jurisdiction for online services.

Chapter 8 Server Piracy

69

Building an online game is gradually getting easier. Services such as Linden Lab’s Second Life, Makena Technologies’ There.com, and Areae’s Metaplace are designed to simplify building online games. There are also open source projects like The Croquet Consortium’s Croquet and Sun’s Project Darkstar, among others. Unfortunately, these same tools can be used to accelerate server piracy projects. Server piracy is going to get worse as these toolsets get better.

INSIDER PIRACY, TROUBLED PARTNERSHIPS, AND ONLINE GAME APPLIANCES Different types of piracy require different types of solutions. Typically, games are lowcost, mass-market items. Thus, there are severe constraints on how much a publisher can spend on security on a per-unit basis. This is not the only business scenario: Some high-end analytic software packages for niche markets are protected by using hardware tokens for license management. In the game industry, licensing large online games, like MMOs, exposes some unique security problems involving licensees and employees of licensees. Publishers of MMOs market their game to the world via an assortment of licenses into specific markets. The most familiar example in the US is Blizzard’s licensing of World of Warcraft to The9 in China. Many Korean and Chinese online game developers are also pursuing an aggressive international licensing strategy. The licensee operator handles localization (customization by language and market) and is much more familiar with important local issues like marketing, payment processing, and usage controls in accordance with national policies. For the licensor, the money is often quite good with substantial upfront fees and regular royalties as long as the game is operated. There can be problems with these relationships. The licensee has to have access to the game and there may be difficulties in the relationship between the companies. Often, the game itself is provided as an executable program without source code to keep the licensee from stealing the game. Although this tactic is reasonably effective, I believe that game licensors should consider shipping their game as an integrated hardware-software appliance. This increases the effort for a licensee to attack the game and makes supporting the game easier (since the hardware and software are controlled solely by the game developer). Also, game appliances can be leased and it may be easier to “unplug” a difficult licensee than it is with a pure software delivery. License fees can be scaled and controlled on a per-appliance basis, something that is much more difficult to do with a software-only delivery. A game appliance is easier to visit and audit and, if properly designed, there is less risk of a licensee employee extracting the game executable.

70

Protecting Games: A Security Handbook for Game Developers and Publishers

Increasingly, casual MMOs are moving to a peer-to-peer type architecture. They do this by building games that don’t require a very large number of players to interact together simultaneously, such as 2 to 16 players. This will make locating the pirate central servers more difficult, as the size of the central server infrastructure is smaller and can more easily be relocated. Also, casual games can be emulated fairly easily and have their art assets looted to incorporate into an independent game. Many of these casual games are built using tools like Adobe’s Flash and Shockwave, which have long been targets of reverse engineering to extract application code and asset theft. The growth of debit, anonymous, and casual online payment systems makes it much less difficult for server pirates to monetize their service. Ironically, the move to “free-to-play” business models makes this less risky, as there is a smaller outlay to participate in the pirated service. Customers are less concerned that their payment account will be looted by the merchant, as this is exactly the type of small-scale, high-risk transaction that these payment systems were designed to secure. One of my personal favorite anti-server pirate measures is a strong economic or status system, be it a rich in-game system, such as with CCP Games’ EVE Online, the entire Free-to-Play business model, badges and achievements ranking systems, or even gold farming. Although the software for these games and social systems may be easy to reproduce, the scale and vibrancy of the community and economic system makes such piracy largely meaningless. In these cases, server piracy is reduced by the presence of a big, visible, and fun-to-use status system with economic rewards. The most obvious “proof” of the effectiveness of the power of a strong economic system is the irrelevance of piracy in the world of online casinos or, less extravagantly, skill games and casual game portals. In most of these cases, the actual games and game software are easy to steal or duplicate. It does not matter; the service is its economic or status system, not included game or games. I will discuss this strategy at greater length in the “Rich Interaction System” section in Chapter 9.

A UTHENTICATING

THE

S ERVER

As seen from the previous discussion, server code can be compromised in a number of ways. If the server code or a game server is compromised, it is important that the game service be able to recover. Online games are increasingly moving to a peer-to-peer (P2P) architecture, particularly in Asia, as the cost of running large, centralized server farms is growing and games can have hundreds of thousands of concurrent users. A P2P infrastructure is especially common for free-to-play games or other non-subscription games that have don’t have a reliable way to recover their costs of operations for all players.

Chapter 8 Server Piracy

71

Most of the security focus for online games is on authenticating the player, and sometimes the client software, to a server. There is also substantial benefit to be had from authenticating the server to the client or binding clients together with the server in a peer-to-peer system. This technique is useful beyond the strict realm of server piracy and should be part of any online service. The power of authenticating the server to a client is that it more tightly binds the two together into an integrated game service. This is exactly what a good license server strives to do when it verifies licenses for a conventional software application. With good key management, cryptography can be a useful identity tool. Most of the time, it focuses on identifying the client to a server, but the techniques can work both ways. For example, the game client software can include the game server public key in its code to be used as part of the login process. This can be used to verify the game server to the client. One way to use the game server public key is to modify a standard challenge/ response login protocol. In the standard protocol, the server sends a random challenge phrase to the client. The client uses the random challenge phrase in conjunction with its secret key (or user password) to send a response back to the server for validation: ServerRandomPhrase; // generated and sent to the client Response = SecurityFunction(ServerRandomPhrase,ClientSecret); // created on the client and sent to the server

To authenticate the server to the client, the server uses its secret, private key to encrypt the server’s random phrase. In addition, the server appends a fixed authentication word to the random phrase and encrypts both together. The game client receives and validates this expanded challenge message and, if the new challenge phrase passes, continues the login process: ServerRandomPhrase; // generated by the server as before ChallengeMessage = ServerRandomPhrase,AuthenticationWord; // The authentication word should be a fixed field or a date & time combined with a fixed field or some other data that both the client and server can determine independently Encrypt(ServerPrivateKey,ChallengeMessage); // the server uses its private key to encrypt the challenge message and sends it to the client AllegedChallengeMessage = Decrypt(ServerPubic,Key,ChallengeMessage);

72

Protecting Games: A Security Handbook for Game Developers and Publishers

// the client, which knows the public key, uses it to decrypt the challenge message Validate(ChallengeMessage) = ServerRandomPhrase,AuthenticationWord; // this should pass only if the server private key was used to generate the message. The server private key should only be known by the legitimate server. Response = SecurityFunction(ServerRandomPhrase,ClientSecret); // created on the client and sent to the server

There are other protocols and methods that can achieve the goal of validating the game server to the client as well as the client to the server. Most take advantage of public key cryptography. It is possible for motivated hackers to replace the login code or the public key with their own, but this requires more work on the hacker’s part in order to connect to a pirate server. And, hackers are lazy, just like regular folks. You can fight the replacement of the server public key by using it in a number of places in the game client. It can be simply checked in several places or it can be used to encrypt client game constants and data. An example would be to use the server public key to sign (and maybe even encrypt) data updates from the server. Then, when the client wishes to load or use data from the server, it must use the server public key to recover the data.

BYPASSING ENCRYPTION It is fairly common for online games to encrypt the link between a client and server or between players. In some cases this is done to prevent disclosure of the data being exchanged. Occasionally, there is a legitimate threat that a third party may intercept the data. It is a misuse of encryption to attempt to conceal data from the player in this manner. Typically, the most important security requirement on the connection between a client and server or between peers is to ensure data integrity and provide source authentication. Data integrity is important to prevent manipulation of the data on the network link that could alter player actions or game state. Source authentication is particularly important, because malicious players could spoof source IP addresses or game message headers so they appear to come from another player. This can be a real problem in message-based system designs because the underlying IP address information is often discarded by the higher-level message.

Chapter 8 Server Piracy

73

There are three choices for achieving integrity and source authentication: digital signatures, encryption, and cryptographic checksums (or message authentication codes—MACs). All three techniques work, and may be useful for protecting a game, depending on other system design constraints: Digital Signatures—Use a combination of a hash function and a public key encryption function. Hash functions are often slower than conventional, private key cryptographic functions. If you can ensure the security of the player’s private key, the system can take advantage of a digital signature’s non-repudiation features. Non-repudiation is the property often associated with digital signatures that only the legitimate user could have created the signature, so the legitimate user cannot subsequently deny having signed the message. Non-repudiation is probably more important for skill games or gambling games than in conventional MMOs, as the set of messages could be used to create a “digital contract” to validate the game. Encryption—Encryption’s main benefit is to protect against disclosure to third parties. Certain modes do have the same sort of manipulation detection properties that a MAC has. Encryption can also be used to validate identity by having a unique key assigned to each sender in a client-server architecture. The developer can pre-generate or independently generate the key stream and sometimes operate faster by using a key-additive system. This is an encryption mode where a cryptographically generated key stream is simply added or XOR’ed with the plaintext data. When operated in this manner, the encryption system will only confirm identity, not protect against controlled data manipulation. Cryptographic Checksums—They leave the message in cleartext, but include an authentication phrase using a keyed cryptographic function that detects errors and manipulation. As with encryption, unique keys in a client-server environment can be used for secure identification. Cryptographic checksums can be designed to operate quite rapidly and therefore can have minimal performance impact. In peer-to-peer games, this is typically not a major factor. However, in client-server games, the server may need to process hundreds of messages from thousands of player clients in a very short time.

74

Protecting Games: A Security Handbook for Game Developers and Publishers

One of the reasons I recommend cryptographic checksums for client-server games is that the server can, if necessary, completely ignore the authentication process for player data. Because the message data is provided in cleartext, it can be processed without any problem, even if the message is not authenticated. Therefore, when the integrity and source of the message does not matter or the server is under a particularly heavy load, the server can bypass the authentication step or save authentication processing for later. This is the real work in cryptographic system implementation: the trade-offs between all of the options that are available for algorithms, modes, key management, and so on, to meet your performance and security requirements.

R EFERENCES 1. RunUO,” RunUO Products,” http://runuo.com/products.php 2. Google (2008), Over 1.1 Million Results for ‘Wow Private Server’,” http://www.google.com/search?hl=en&safe=off&q=wow+private+server&btnG=Search 3. Timothy (2006), “Star Wars Galaxies Emulator Test Server Hits Alpha,” http://games.slashdot.org/article.pl?sid=06/06/26/1850213 4. D. Becker (2004), “Blizzard Wins Online Game Suit,” http://news.zdnet.com/2100-9588-5403899.html 5. C. Li (2007), “Man Faces Court for Online Piracy,” http://www.chinadaily.com.cn/china/2007-01/11/content_780574.htm 6. H. Lee (2006), “Shanda to Crack Down On RO Pirates,” http://www.pacificepoch.com/newsstories?id=85006_0_5_0_M 7. videogaming247 (2008), “NCsoft Ganks Illegal Greek Lineage II Operation,” http://www.videogaming247.com/2008/04/10/ncsoft-ganks-illegal-greek-lineage-ii-operation/ 8. S. Davis (2007), “Russian Server Pirate Sentenced to 3 Years in Prison: Reverse Engineered Gravity’s Ragnarok Online Server,” http://playnoevil.com/serendipity/index.php?/archives/1300-Russian-ServerPirate-Sentenced-to-3-Years-in-Prison-Reverse-Engineered-Gravitys-Ragnarok-Online-Server.html 9. FBI (2007), “CRACKING THE CODE—Online IP Theft Is Not a Game,” http://www.fbi.gov/page2/feb07/iptheft020107.htm

9

Other Strategies, Tactics, and Thoughts

here are many ways to attack piracy. The inherent problem that games and other digital media face is that “bits are bits” and there is no way to distinguish between a legitimate copy of a piece of digital media and an illegitimate one. A pirate and a legitimate version of a digital media are, by definition, identical. In essence, strategies discussed so far have tried to find a way to make it impossible to copy something that is easy to copy, or to make things that are identical not identical, or both.

T

When we are fighting digital piracy in this manner, we are, in some sense, denying the very nature and power of the medium. In doing so, we may quite possibly be doomed to fail. Of all the solutions discussed thus far, online gaming seems to be the most effective method to actually fight piracy, both in theory and in practice. However, not all games are, or should have to be, online games. Altering pricing looks like it could also be an effective option, but it may not always be an acceptable business choice.

M EASURING P IRACY How bad is piracy? It is a legitimate question, but without real data on the extent of piracy, it is impossible to determine an appropriate response. The challenge is to find a way to collect good data. The first step is to create or find some sort of unique identifier for each copy of a game that can be collected and tracked. For PCs, it is reasonably easy since most games already include a license key. For consoles, one can probably use any unique ID associated with the console to track which machines the game has been installed on. One problem with consoles is that they don’t have any license key or unique identifier tied to each game copy. Most PCs include

75

76

Protecting Games: A Security Handbook for Game Developers and Publishers

a number of unique identifiers that can be associated with each platform—Ethernet card MAC addresses, Windows License IDs, and so on. If nothing else, the application can generate and store a random unique identifier when it is installed. Of course a pirate (or person with a second PC) may attempt to reuse the license key. If there is an online activation process or online service, it is possible to move from the initial identifier (the license key) to an active platform ID (a unique identifier associated with a specific PC or console). The advantage of this is that the publisher can then distinguish between different installations that share the same license key. There are benefits to allowing every user to at least start the game. After all, as long as such a person is not locked out, he is a potential customer. You can also begin to more accurately gauge how many actual game users there are, who these individuals are, the structure of the game’s informal distribution channels, and so on. If the game locks out users immediately, it may not be possible to distinguish multiple registration attempts by a single user from multiple users each attempting to register. One way to implement this is to allow the game to operate through an initial level even if the player has entered an invalid license key. The game would still do an automated connection and generation of an Active Platform ID. Then, when the player completes the first level, the software can take whatever action the publisher desires. With Internet access, the publisher could also use a GeoIP service (a service that associates IP addresses with approximate geography) to determine approximately where the user is coming from. It is important to track the Active Platform ID separately from any other identifiers. Invalid license keys can be analyzed to determine if they were mistyped or if the player attempted to use a tool to generate fraudulent license keys or reuse keys from other players. The publisher can track actual revenues compared versus Active Platform IDs and compare both to license information. With these three values, the publisher can begin to get a real handle on the extent of piracy as well as the total number of potential customers. The publisher can also experiment with different anti-piracy tools and, of course, techniques to convert pirates into customers.

F IGHTING P IRATE N ETWORKS In the world of digital distribution, publishers can battle pirates directly. Most pirated software is distributed through large peer-to-peer (P2P) networks (many use a family of protocols called torrents). These P2P networks are designed to be highly distributed. Anti-pirates can attempt to identify the individuals downloading

Chapter 9 Other Strategies, Tactics, and Thoughts

77

pirated media (as the RIAA has done for music), seed the online networks with altered game files, or create their own honeypots, which are pirate servers to help identify and track pirates. Developers and publishers may complain about piracy and feel that piracy is fundamentally unjust; they do have a choice. They can choose to battle pirates with rewards or penalties. The primary goal for a publisher is really not to stop piracy, but to maximize the revenues the publisher earns from its products and services. As discussed previously, publishers have sometimes chosen to modify the illegal copies of their games so that the games are unreliable and unstable—with negative consequences because this can hurt the game’s reputation (seen with Titan Quest). The initial motivation for this tactic was to make it more difficult for pirate hackers to locate and remove the game’s anti-piracy measures. Developers should have confidence that their security measures cannot be removed. In this case, the game should clearly lock itself up and indicate that the version has not been purchased or take the other tack and invoke nagware to endlessly remind players to purchase the game. An alternative approach is to distribute only part of the game initially and distribute the remainder of the game to paying customers who have clearly registered. For example, split a $20 game into two $10 game episodes. Requiring clear, detailed, user registration before implementing penalties may be a powerful piracy deterrent, especially if combined with an incentive such as a contest or promotion. A “$100,000 Titan Quest Giveaway” for registered players may do more to increase sales than $100,000 worth of anti-piracy. It is possible to attack P2P networks, as Introversion has shown with Darwinia1. After a pirated version of Darwinia was leaked onto pirate networks, Introversion spoofed the same P2P networks by widely releasing a demo version of its game that was intentionally mislabeled as the complete game. Introversion’s goal was to increase the likelihood that a potential pirate consumer would download the mislabeled demo rather than the actual hacked game. Because the demo clearly ended and was marked as a demo, it did not damage the game’s reputation. The company seemed satisfied with its results, although they have not publicly shared any details on how many sales they gained by using this technique. Pirate and P2P networks are inherently vulnerable to a wide range of spoofing and honeypot attacks. Because P2P networks seek to be anonymous, decentralized, and highly distributed, pirates can’t manage trust effectively. Because there is no central trusted authority, anyone can post, host, and alter files, as well as provide file descriptions. Unlike conventional criminal piracy where pirates earn money by counterfeiting and selling goods, pirates do not earn any money from these P2P networks directly. Therefore, game publishers have more incentive than the pirates to attempt to dominate the P2P networks. In this case, the decentralized, distributed nature of P2P networks gives the publisher an advantage.

78

Protecting Games: A Security Handbook for Game Developers and Publishers

Even if pirate networks move towards reputation systems, an organized effort by a publisher should be able to shape network traffic. It should be noted that there are strong financial incentives for criminal pirate networks that do sell games or operate game services for money. In such cases, pirates will establish trust relationships and often are able to freeze out the publisher’s countermeasures. Honeypot download services are operated by, or on behalf of, the publishers with the goal of identifying pirates for prosecution. They do this by hosting “official” pirated media, often at a number of host locations. Pirate consumers who download the media are subject to tracking by GeoIP to their Internet Service Providers (ISPs). Once identified, the company typically pursues some sort of legal action. The MPAA has used a service operated by MediaDefender2 to fight piracy in the movie industry3. There are several other companies operating in this market at the moment (mid-2008), including MediaSentry and BayTSP. MediaDefender, which has been a bit of a lightning rod in the industry, apparently goes further than the other honeypot services and scans the downloader’s computer for additional copyrighted material that may have been downloaded illegally. This can be quite devious and lucrative: If a media security company installed a monitoring application on any computer that had downloaded a game or other media from one of its sites, the company could catalog potentially compromised items and then contact the media publishers retroactively. The company could offer the publisher a deal such as, “I’ve got a list of 500,000 people who have installed your application— would you like to buy my services?” In some countries, this whole approach may be illegal and considered computer crime. This is a concern with a number of the more aggressive anti-piracy tools that aggressively monitor the activities on a computer, report information back to a remote site, or take measures to shut down “inappropriate” applications. Honeypot services can definitely fall in the legally and ethically gray world of active measures. Installing software on people’s computers, even if authorized in a EULA, could put the company at risk under both civil and criminal law. The pursuit of individuals involved in music file sharing has had limited benefits and has cost the industry a lot of good will. Even worse, such services can damage legitimate businesses: MediaDefender actively disrupts peer-to-peer networks for its clients. There are some legitimate companies that use P2P distribution because it lowers bandwidth costs. This is a growing tactic for lowering the costs of digital distribution, as end users have a lot of bandwidth capacity that they are not using. MediaDefender targeted such a network operated by Revision3 and wound up causing a denial of service attack against the service. This has resulted in lawsuits and an investigation by the FBI for violations of the Economic Espionage Act and the Computer Fraud and Abuse Act4.

Chapter 9 Other Strategies, Tactics, and Thoughts

79

M ULTI -P LAYER G AMING Historically, most computer games were single-player experiences only. Recently, multi-player gaming has grown rapidly in popularity. As noted by many industry observers, commercial single-player games have been dominant because, for most of computer gaming’s short history, bandwidth costs were high. Outside of the realm of computer games, there have always been far more multi-player games than single-player games. Building online multi-player games definitely has its challenges. It is interesting to note that many commercial game developers continue to see multi-player functionality as an added feature that can be dropped if there are problems, rather than as an essential part of the game. This seems quite strange from a pure business perspective, especially in the world of console games. Exit Games’ CEO, Harald Behnke, believes that multiplayer games can earn two or three times as much as single player games (to be fair, his business is multi-player gaming services)5. Other estimates have been closer to 20 or 30 percent in additional sales. At some level the rationale for this is pretty obvious. If I have a single-player game that I really like and I recommend it to my friend, I might simply give her my copy. For a multi-player game, in order to play together, we have to pay together, leading to additional sales. This is not guaranteed, of course. One of the reasons I think cheating is a critical industry problem is that multi-player gaming is a crucial part of making a game more successful. And cheating can easily ruin the multi-player gaming experience and hurt sales. The other great feature of multi-player gaming is that it is much easier to secure against piracy. Even a game with a minimal central matchmaking and lobby service can more effectively control piracy than an elaborate DRM solution. Multi-player gaming is one example of a rich interaction system; there are a number of others.

R ICH I NTERACTION S YSTEM Rich interaction systems (RIS) are valuable game play, game community, and player services that create opportunities for security transactions and incentives for players to participate in the legitimate game ecosystem. Security systems work most effectively when there are multiple interactions— the more often the system is validated, the more security it provides. A bike lock is fairly effective if the bicycle is parked in a public place where plenty of people see it.

80

Protecting Games: A Security Handbook for Game Developers and Publishers

OWNERSHIP MODELS: ACCOUNTS VERSUS PLATFORMS One of the interesting differences between Western gaming and games in Asia is the basic notion of game ownership. In the US, Japan, and Europe, computer games are typically owned when the user possesses a physical copy of a game associated with a single platform. In Asia, the physical or electronic copy of a game does not matter, because the company’s association with the player is based on an online account. Neither model is superior to the other. It is probably prudent for developers to investigate how to support both models of ownership for their games. Asian game developers may be able to tap game genres that are not solely multi-player and Western developers may be able to better position themselves for the rapidly growing market in Asia and other emerging markets worldwide. Although I cannot claim to have taken a comprehensive survey of game developers and publishers, I have studied quite a number of game company sites over the years. The only company that I’ve seen that seems to support both account-based ownership and copy-based ownership, at least to some extent, is Valve Software. Valve explicitly offers support for Internet Café licensing on its site as well as conventional sales, and its Steam online digital distribution service6. One area that has not been explored too much is a hybrid of platform and account-based licensing. Some MMOs do support “buddy” accounts for friends, but there could be more. Easy examples are intelligent licensing and services for people who play on both their home PC and a laptop, family licensing plans for MMOs and other games, and even multi-level marketing and affiliate programs to lower marketing and distribution costs (and even reduce payment risks).

If the bike was locked up in a vacant warehouse and abandoned, no matter how good the lock was, if someone who found the bike and wanted it, the bike would be gone. In some sense, a bike lock does not work because it actually stops thieves. A bike lock works because it is fairly obvious and reasonably time consuming for someone to circumvent it. A bike lock is a thief detection system, not a theft prevention system. Effective protection for games works the same way. Rather than trying to build an unbreakable lock, it is much easier and more effective to build an environment where the security system is public and involves multiple users. It is even better if the security system is part of a visible service that users routinely use.

Chapter 9 Other Strategies, Tactics, and Thoughts

81

At some level, licensing and DRM system providers understand this principle. EA initially configured its DRM system for two games, Mass Effect and Spore, to require the player’s license be revalidated with the online server every 10 days in order to ensure that the license key had not been compromised. After widespread customer outrage, EA and Bioware canceled this tactic7. The problem with their approach was not the underlying technical security strategy, but how players perceived it. Instead of making the security authentication and license check a standalone service (which also makes it a target for circumvention), why not provide a valuable online service that the user wants to participate in? For Spore, at least, creating a valuable online service would be trivial. One of the key elements in the game is the ability to create your own custom creatures and share them. Even though the game is single-player, this shared, online experience is a key part of its design and has already been very successful. There were over 250,000 creatures created the day the product was launched8 and, even better, HP and EA launched a worldwide creature design competition9, with the additional benefit that these players provided the companies with a lot of detailed personal information, no doubt, when they registered. If the game’s license re-verification system was embedded into the utility that allowed creatures to be posted or allowed players to register for the competition, there would have been little or no controversy. The real pioneer in providing this kind of service was Blizzard with Battle.Net10, its multi-player gaming and matchmaking service that launched in 1997. Although Blizzard’s games—the Diablo, Warcraft, and Starcraft franchises—are great and likely would have been quite successful anyway, Battle.Net probably turned them into worldwide phenomena and contributed to their amazingly long shelf life. It is unclear whether Battle.Net was designed as an anti-piracy tool, and there seem to be some security weaknesses in its implementation that indicate that it was designed primarily as an early social network, but Battle.Net certainly has turned into a way for Blizzard to manage millions of players and licenses. Surprisingly, very few game publishers or developers have followed suit and launched similar online services. The notable exceptions are Valve Software’s Steam, Stardock’s Impulse, and, for consoles, Microsoft’s Xbox Live, Sony’s and Nintendo’s online services are not nearly as tightly integrated. The larger the service and the more extensive the stable of games and features, the more effective the system works against piracy. In addition, the larger the service is, the more favorable the economies of scale and reduced cost for a common infrastructure for digital distribution and other online services. A RIS would give a substantial advantage to any large game publisher.

82

Protecting Games: A Security Handbook for Game Developers and Publishers

There are many ways to create a RIS. A RIS does not need to depend on a single service: Game Commerce and Downloadable Content (DLC)—Selling virtual items does not need to be limited to MMOs. Although Bethesda Softworks was criticized for charging $2.50 for horse armor in Elder Scrolls IV: Oblivion, the basic principle of selling items and maps is effective. The two most successful examples are probably Guitar Hero III and Rock Band’s regular additions of new musical tracks to these very popular games. Inter-Player Commerce/Real Money Transactions—MMOs know that players love to trade items. By creating scarcity, players have a reason to interact. Even the humble Nintendo DS allows Pokémon players to trade virtual items. Ironically, although MMOs condemn real money transactions (RMT) for disrupting game play, the RMT economic system creates an additional barrier for potential pirates. High Score and Badge Systems—Players have loved the ego boost of a high score, as well as other rewards and achievements, since the days of arcades. Microsoft has done a lot to revive this with its Achievements system on Xbox Live and pretty much every publisher and online service has followed suit. Tournaments and Ladders—Competition takes the basic pleasure of a high score and raises the stakes. Tournaments and ranking ladders create powerful incentives for players to participate in the official game service. ArenaNet has been running Guild Wars tournaments worldwide with substantial prizes and ongoing publicity for the game. Rewards, Bonuses, and Incentive Programs—Frequent flier programs have been a powerful loyalty tool and incentive to spend more money for fairly modest rewards since American Airlines launched AAdvantage in 1981. Some MMOs have given rewards to long-term players. Contests, Sweepstakes, and Promotions—Contests are a classic marketing tool and they can be effective in binding players to an online service. Operators just need to be careful to ensure that they do not violate the law (see Chapter 31). Game Updates—Regular updates to a game engine to fix bugs or, better yet, improve the game play experience, can also be an effective way to tie players to an online service. Game Asset Updates—Game assets are generally easy to update and compact to distribute. They can also give an expanded game play experience and revive interest in a maturing game system. Asian MMOs have been particularly aggressive in providing certain assets that are available to active players only during certain holidays, such as Halloween or Valentine’s Day.

Chapter 9 Other Strategies, Tactics, and Thoughts

83

Mods—Although there is a lot of discussion about user-created content, it has not had too large an impact on many games. Sharing Spore creatures, as cited previously, is a relatively modest example. Some games have allowed players to create maps and units and even modify the game engine itself. Games like Bioware’s Neverwinter Nights allowed players to create dungeons and maps for the fantasy game and even sell them. Matchmaking and Multi-Player Gaming—The prototypical RIS is a multiplayer service. Games do not actually have to be run on the server. Players can simply use the central lobby service to connect with other players and store game results. An increasing number of Asian MMOs are actually run as peerto-peer games. This allows a more modest central server infrastructure while preserving many of the anti-piracy benefits of server-based gaming. Persistent Player Profiles—My military friends used to joke about some officers’ “I Love Me” walls—the collection of plaques and commendation letters that they had received over their career. We all love to show off a bit and persistent player profiles support this even for single-player games. Microsoft has struck gold with its combination of Gamertags and Achievements. I suspect some players wind up buying the Microsoft version of a console game just because of these features. Machinima—A recent innovation in 3D computer games is the in-game ability to replay, stage, and otherwise manipulate game activities. This has turned into an interesting side industry of its own where players use the game engine to create original movies. Community Systems—Although many games have online forums for the game community, in most cases, they are often web services outside of the game application. Instead, these services could be deeply integrated with the game application itself and integrate machinima, real game avatars, player profiles, and other value-added capabilities. Chat and Buddy Systems—In-game chat and buddy systems are often found as third party add-ons to games. Tying them to the game can support your RIS security objectives. One interesting example is Kongregate’s general integration of a chat feature into all of its games, even if the games are single-player only. Server-Based Gaming—This is the classic strategy of moving game play from the client to the server as seen in MUDs and most MMOs (and discussed previously in the Server Piracy section). If the game itself is on the server, many of the objectives of a RIS are already being met.

84

Protecting Games: A Security Handbook for Game Developers and Publishers

The range of potential services is limited only by the developer or publisher’s imagination. The key to their effectiveness as a security tool is how well and deeply they bind players into the legitimate, licensed game and publisher infrastructure.

D IGITAL A FFILIATE S YSTEM I have read with some interest the debate over digital rights management for the past several years and the technical shortcomings and customer dissatisfaction with the available approaches. The Digital Affiliate System (DAS) design addresses the goals of any digital media publishing business. See Figure 9.1. There has been no evidence that any of the standard DRM solutions, such as software wrappers, digital signatures, encryption, and even hardware security systems, have had anything but a modest impact on individual or organized piracy. Also, all of these solutions “fail deadly” (they don’t “fail safe”); once the security system has been defeated one time, piracy scales towards infinity because there is no way to recover from the security compromise.

FIGURE 9.1 Digital affiliate system (DAS) architecture

In addition, virtually every DRM solution is encumbered by numerous pieces of intellectual property (there are quite a number of DRM related patents and, it seems, more every day) that can make companies a target for litigation.

Chapter 9 Other Strategies, Tactics, and Thoughts

85

A digital affiliate system is not a rights-management solution; it is a revenuesharing system. The “key” to the digital affiliate system is that it is designed to encourage the use of legitimate and protected media assets, no matter their source. The typical DRM system treats the customer as the enemy. Tremendous effort is expended by the publisher and DRM system to prevent customers from using the media asset that they have purchased. DAS treats the customer as a partner and source of additional revenue. When customers get an unauthorized copy of a DAS protected media asset, they have a financial incentive to re-enter the legitimate DAS environment. DAS works by transforming digital media assets into “currency” that can be used for future transactions and have inherent value. Thus, the movie, song, game, or whatever is only part of the value of the DAS Media Asset (DMA). Setting the value of the DMA is the responsibility of the media asset owner; the media player and distribution system simply support the process. Media player creators and distribution services may profit from a portion of the transactions, although this process should probably be as open as possible. The objective of DAS is to create a standard, easy to use, open, affiliate system, not to replicate the proprietary solutions of the DRM. The power of this approach is that the digital media “currency” can be linked to an individual and protected in a database outside of any devices or players that store the DMA asset. Rewards, exchanges, sales, and promotions can thus be used to encourage participation in a legitimate DMA market rather than encouraging customers to defect and find media from the information black market. Once you recognize that it is impossible to actually protect “bits” against someone who has legitimate access to them, any security design becomes much simpler. Ordinary media asset file formats will be wrapped in a simple extended file format that includes copyright information, ownership information, and “where to buy” information. These files are read by a simple DMA player that handles the copyright information and passes the actual file to the appropriate media player application. The center of the DAS system is a DMA registry. The registry handles the association of DMA players with individual owners and the association of DMA assets with these owners. Finally, there can be a DMA market that supports the exchange and sale of DMA assets as well as offers promotions, contests, and other value-added features.

86

Protecting Games: A Security Handbook for Game Developers and Publishers

DAS MEDIA ASSET As noted, a DMA is simply a wrapped media file in any format. The DMA includes: Media Asset—The actual asset of interest to the users Media Asset ID—A unique identifier associated with the media asset Media Asset Type—A tag associated with the media asset to indicate which player or other application will be associated with the asset Copyright Information—The standard legal disclaimer associated with the media asset Owner Information—The registered owner of this copy of the media asset Registry Information—Location information associated with the DMA registry to support the user and media player association Market Information—Location information associated with the DMA market to support purchases, promotions, exchanges, and so on It should be noted that this system does not preclude additional security measures implemented by the copyright holder. Covert fingerprints or other antipiracy features can be embedded in the wrapped media file. DMA PLAYER The DMA player is not an elaborate security system; it simply wraps the media player. The DMA player also knows the owner or owners of the player and can thus determine the validity of the media player’s owner’s access to any DMA. The player can also access DMA registries and even different DMA marketplaces and other value-added services. When the owner of a media player wants to access a DMA, the DMA player simply checks the DMA and determines whether the DMA is licensed by that owner. If not, the DMA prompts the owner to get a license from the appropriate DMA registry. The DMA player does not attempt to prevent the owner from using any media. Also, for art, sound, or other reusable assets, when any of these assets are copied or clipped, they should retain the DMA wrapper information and pass it into the new asset. If the DMA player is not associated with an owner, every time that a user attempts to use the DMA player it will prompt the user to register with a DMA registry. By continually prompting owners to “do the right thing” and, if the appropriate incentives are in place, this simple player can be at least as effective as any of the existing DRM solutions available. Also, because there is no benefit for a user to strip off the DMA wrapper, the user may re-enter the legitimate system at any time.

Chapter 9 Other Strategies, Tactics, and Thoughts

87

DMA REGISTRY DMA assets and asset owners are registered at one or more registries. A registry can be operated by a telecommunications carrier, a digital distribution service, a DMA asset provider, or other third-party entities. These can easily be set up to preserve the privacy of customers, for those who want to preserve their anonymity. More importantly, the registries control the ownership and basic payments for licensing of DMA assets. DMA players can connect to the registries online or handle paper receipts, and other purchase processes can be used to link DMA assets with DMA players and asset owners. MAKING PIRATES

INTO

RESELLERS

The crux of what this Digital Affiliate System provides is not the technical mechanisms described here, but rather the business services that it enables. Because ownership of a DMA can be positively tracked and controlled by the asset creators, multiple strategies for revenue maximization and protection are available. DMA owners who recommend or distribute DMA assets to other users can earn bonuses and rewards. Contests and incentive programs (much like frequent flier programs) can be used to reward registered DMA asset owners. Frequent flier programs show the power of these types of incentives. Even very modest rewards can have a real impact on consumer behavior. All of these revenue streams can be tied to legitimate DMA purchases, making the use of the legitimate DMA system a boon, not a bane, for media users. Even major pirates can become positive parts of the media distribution system by rewarding them as resellers (with higher levels of compensation for large numbers of referrals). And, for those pirates who persist, the value of simply duplicating DMA-protected assets will go down, as many legitimate customers will prefer to participate in the legitimate “media commerce” system.

P LAYING

WITH

S ECURE D IGITAL D ISTRIBUTION

Many PC and even console publishers and developers argue that the game industry is moving towards digital distribution for games. The rapid growth in broadband networks and reduction in bandwidth costs make this a technically viable and sound business strategy. In addition, many see digital distribution as a solution to the challenge of used games and piracy.

88

Protecting Games: A Security Handbook for Game Developers and Publishers

Digital distribution is a particularly appealing anti-piracy strategy for consoles, because it can take advantage of the closed architecture of the console platform to substantially raise the barrier for potential pirates and, if implemented properly, make it quite difficult for them to scale their attacks effectively across multiple users. This section describes a highly simplified, conceptual architecture for a secure digital distribution system oriented towards consoles, although it could be used for PCs. I am going to ignore many details to focus on some key security themes. There are two main elements of this distribution system—the distribution process from the central server to the console and the method to secure local storage within the console. The main objective of the distribution system from the central server to the console is to operate quickly and efficiently, but somehow incorporate some form of uniqueness for each game shipped to each console. In this case, the important requirement for uniqueness is not in the encryption and distribution service, but to be able to determine where piracy may have occurred in an efficient manner. Also, this example is not really concerned about the manipulation of the game code or assets. See Figure 9.2.

FIGURE 9.2 Secure digital distribution system architecture

In order to isolate who may have compromised a game, this example uses steganography to embed a “covert fingerprint” or tattoo (CTAT) into each copy of the game (GAME). During preprocessing, it will determine where you can safely combine these bits with the actual game file to create a “tattooed game” (CTGAME) for each console i: CTGAME(i) = GAME xor CTAT(i);

Chapter 9 Other Strategies, Tactics, and Thoughts

89

You do need to encrypt the resultant file and, inn this case, it makes sense to use a cryptographic function that is error extending, such as a ciphertext autokey (CTAK) or cipherblock chaining (CBC) mode. // Note, both modes require an initial value IV = PT(0) that is passed in the clear or is somehow known to both parties CT(j) = E[PT(j-1)] xor PT(j); // CTAK encryption, where E is the encryption function PT(j) = E[PT(j-1)] xor CT(j); // CTAK decryption. An advantage of this mode is that there is no need for a decryption function. CT(j) = E[PT(j-1) xor PT(j)]; // CBC encryption PT(j) = D[CT(j)] xor PT(j-1); // CBC decryption, requires a decrypt function

CRYPTOGRAPHY: THE DEVIL IS IN THE DETAILS When I was working through this design, I almost made a big mistake. I wanted to use a simple key-additive system: CT =

KeyStream xor PT;

// where the keystream is generated by a cryptographic function

The advantage of this approach is that I could store the combination of the game and keystream: GenericProtectedGame = KeyStream xor Game;

And then I would have added in a tattoo stream at the last moment for each player: ProtectedGame(i)

= GenericProtectedGame xor CTAT(i);

This would have been very fast and efficient from a performance and storage point of view. Unfortunately, it would have allowed an adversary to combine two ProtectedGames together to isolate the tattoo, just as fingerprint systems were attacked (see the sidebar entitled “Attacking Fingerprints and Watermarks” in Chapter 6). Instead, I had to change to the CTAK or CBC cryptographic modes to avoid this problem.

90

Protecting Games: A Security Handbook for Game Developers and Publishers

The reason you want the system to extend errors is that you do not want a third party who looks at the cipher streams from different consoles to be able to start isolating the covert tattoo. In general, there is little benefit to using a different key when sending the data to each individual console. The cryptographic modes described here can allow unique identification, even if the key is common for all users. If possible, it would be more efficient if the assets that are tattooed are at the end of the game file. This would allow the encryption of the front part of the file to be computed once and stored for all users. Then, the only portions of the game file that would need to be computed uniquely for each console would be in the tattooed region. It probably would be wise to change the key associated with a game regularly, but the risk of disclosure is more likely at the server than on the console. Thus, for each console (i) and game (g), the package sent to the client would be: ProtectedGame(i) = E[GAME xor CTAT(i),gkey]; // where gkey is the current key associated with that game.

The console and server will create or exchange the game’s key (gkey) via some public key or private key management protocol. On the console side, once the game has been completely downloaded and decrypted, the gkey will be deleted. At this point, the tattooed game file will be available at the console. There is a huge business advantage for consoles to allow players to purchase their own standard, commodity hard drives. Console makers make more money with less risk by focusing on the media that they want to distribute rather than on selling hard drives. In order to safely use a standard drive, however, the console needs to encrypt all data that is stored on the disk. There is no need for any other console or even the central server to know what key the console is using. This is nice from a production, operations, and key management perspective. (Exercise: propose a sensible way to handle console hardware failures that do not require the redistribution of all of the previously sent games.) Because the data is stored locally and encrypted with a unique key, the tattooed game file will be less vulnerable to hackers. Fortunately, consoles, and even many PCs that have a Trusted Platform Module (TPM), do have some internal secure storage. The key that is used to encrypt all of the keys for the various games will be stored in the TPM or encrypted in a unique key that is stored in the TPM. By using this process, if a game is found to be compromised, the game publisher can look at the game’s tattoo and use the tattoo to determine which console was the source of the game. The console maker can then determine which other games that had been sent to the compromised console are at risk. This does not recover the previously lost games, but it can help reconstitute the system as a whole.

Chapter 9 Other Strategies, Tactics, and Thoughts

91

Also, the publisher can implement a recovery strategy for other games that were distributed to that same compromised console.

R EFERENCES 1. M. Martin (2006), “Cause Mayhem to Disrupt Illegal Downloads, Says Introversion,” http://www.gamesindustry.biz/articles/cause-mayhem-to-disrupt-illegal-downloads-says-introversion 2. Wikipedia (2008), “MediaDefender,” http://en.wikipedia.org/wiki/MediaDefender 3. soulxtc (2007), “Gotcha! New MPAA Site Tries to Trick Users into Illegally Downloading Movies,” http://www.zeropaid.com/news/8877/Gotcha!+New+MPAA+Site+Tries+to+Trick+Users+into+Illegally +Downloading+Movies 4. R. Paul (2008), “Revision3 CEO: Blackout Caused by MediaDefender Attack,” http://arstechnica.com/news.ars/post/20080529-revision3-ceo-blackout-caused-by-mediadefenderattack.html 5. E. Gibson (2006), “Exit Games CEO Harald Behnke: Interview,” http://www.gamesindustry.biz/articles/exit-games-ceo-harald-behnke 6. Valve Software (2008), “Business,” http://www.valvesoftware.com/business/ 7. Polybren (2008), “Mass Effect, Spore DRM Loosened,” http://www.gamespot.com/news/show_blog_entry.php?topic_id=26385172&part=rss&subj=6190791 8. R. Purchese (2008), “250,000 Spore Creatures Created in a Day,” http://www.eurogamer.net/article.php?article_id=155360 9. HP and EA (2008),” Electronic Arts and HP Organize Regional Spore Creature Creator Design Competition,” http://h50025.www5.hp.com/ENP5/Public/Content.aspx?contentID=25116&portalID=375&pageID=1 10. Wikipedia (2008), “Battle.Net,” http://en.wikipedia.org/wiki/Battle.net

10

Anti-Piracy Bill of Rights

t the end of the day, treating your customers like criminals is bad business. Although piracy is a problem that should be taken seriously, the primary goal of any game company and the industry is to maximize revenues, not punish pirates. The industry does not need to disclose the details of its anti-piracy strategy to anyone, including consumers, but it is important that game companies are clear as to what they are doing to a customer’s computer and their expectations from their customers.

A

The entertainment industry, in general, and the game industry in particular, have come under fire for some of their anti-piracy tactics. Sony BMG’s Rootkit, the Recording Industry Association of America’s (RIAA) aggressive lawsuits, and the Starforce DRM problem among others have left consumers with an active distrust of the industry that has further encouraged piracy. Many games have had public relations problems with anti-piracy, including Bioshock, Spore, and Mass Effect, all of which have run afoul of their own antipiracy systems. Although most consumers are generally sympathetic to the industry’s concern about piracy, some of the draconian measures that have been taken have alienated many players and created more sympathy for pirates than game creators. Some of these cases can bite back. A crusading politician, or friend of a politician, who has a bad experience with a game’s security system could easily put forward, and even pass, legislation that would be difficult for the industry. Think it can’t happen? Illinois recently passed a law that specifies the requirements to be able to cancel an online game subscription after an unhappy gamer whose father happened to be a local alderman complained to a friend in the state legislature1.

92

Chapter 10 Anti-Piracy Bill of Rights

93

Although it would be ideal for an organization such as the ESRB to add Fair Use designations to their current product-labeling program, the game press and online review sites could include Fair Use Principles in their review criteria and ratings. Hopefully, publishers and developers will consider these guidelines when selecting and implementing their anti-piracy strategies. What follows is a proposed set of basic principles and designators for managing Fair Use for games (and other applications).

B ASIC F AIR U SE P RINCIPLES Computers, cell phones, and other devices are the property of consumers. It is a privilege to be selected by a consumer to be installed on a platform. Conversely, consumers should value and respect the rights of the creators and it is reasonable for a creator to be compensated for his or her work as he or she chooses. Therefore: 1. Any application that is installed on a consumer’s computer should be able to be cleanly uninstalled if for any reason the consumer no longer wants it on a platform. This means that there should be no residual software, drivers, data, or other information remaining on the platform as a default. Any variations from this should be clearly specified and at the discretion of the consumer. 2. No application shall alter other applications, drivers, libraries, or data on a platform. “Upgrades” or changes to other applications, drivers, and libraries should be clearly and individually indicated and approved during the installation process. Upgrades shall not be for the purpose of adding security or other functionality beyond that intended by the developer of those applications and should not impair the operation of other programs or libraries that may use these shared resources. Essentially, the only case where an application should modify another provider’s application is when it acts as an alternative distribution channel for that provider’s application. 3. No application, driver, library, or data will be installed on an application without the consent of the consumer. A clear and complete manifest of the applications, files, libraries, drivers, and data shall be provided to the consumer with the application process. Also, if any shared registry data, configuration information, or other such changes are made, they shall also be clearly indicated in the installation manifest as well as a listing or copy of the previous state of these configuration files, data structures, and so on.

94

Protecting Games: A Security Handbook for Game Developers and Publishers

4. No applications, libraries, or drivers shall operate when the provided game or application is not running. The consumer is the individual who determines when, or if, the application operates. The expectation is that this will be a manual decision by the consumer, not operating as a continuous or background task, unless clearly and affirmatively agreed to by the consumer. Any tools to facilitate updates or other background features shall be available and used solely at the discretion of the consumer. The consumer shall have the clear ability to disable any continuously operating or background services or applications at any time. 5. If the license or DRM service shuts down, the provider will either disable the DRM solution, transition support of its existing customers to a third party, or provide a no-cost migration path to a new solution. This problem recently came to light with Yahoo!’s announced termination of its music service.

R EGISTRATION O PTIONS Registration is the process of validating an installation of an application on a specific platform, often prior to use. This may be done via a license key, payment process, provision of personal information, or other process. RR: Registration Required—The application will not work without initial reg-

istration. It is highly recommended that any application that requires initial registration support a multitude of registration options, including phone, email, web form, and fax, and not just direct Internet connection. (See the “Connection Options” section.) Rxx (D or T)—Registration required within xx days (D) or times (T) that the application is used. V: Registration Value—Registration is required to access value-added services.

The application is still a meaningful, complete application without registration, not a demonstration or otherwise crippled product. RO: Registration Optional—There is no required registration for the installa-

tion and operation of the application. This may also include the case where there is no registration process at all.

Chapter 10 Anti-Piracy Bill of Rights

95

I NSTALLATION O PTIONS Installation is the process of installing and configuring an application on a given platform. I1—The installation is for a single instantiation on a single platform. It is highly recommended that any application that operates in this mode have a way to reconstitute or move the installation to another platform. This configuration is expensive in terms of customer good will. A1—This installation allows a single active copy associated with a license. The

installation can be moved or reinstalled on another platform. As with I1, the developer or publisher should carefully consider the operational scenarios where users may have legitimate problems with their platform that may require a reinstallation or transfer without a prior clean uninstall process. Ix—The installation is for a total of x copies spread over one or more platforms,

but by a single licensee. Ax—The installation is for a total of x concurrent active copies associated with a single licensee. The licensee is responsible for the activities of all individuals who use the product or service provided. Thus, if a “ban” or other punitive action is taken, it will be against all of the copies associated with that license.

C ONNECTION O PTIONS CR: Connection Required—The application requires a live Internet or data connection to operate. This levies a strong availability and scalability requirement on the application provider. It also constrains users from many legitimate usage scenarios. Cx (D or T)—Connection is required within x days or sessions to maintain use of an application. CV: Connection Value—A connection is required for certain value-added features of the application. The application is still a meaningful, complete application without a live connection, not a demonstration or otherwise crippled product. CO: Connection Optional—There is no required connection for the installation and operation of the application. This may also include the case where there is no connection process at all.

96

Protecting Games: A Security Handbook for Game Developers and Publishers

I am not the only one concerned about this issue; see Talkjack3 for another DRM Bill of Rights via ByteShield 4 and Stardock’s Gamer’s Bill of Rights5.

R EFERENCES 1. M. Fahey (2008), “Illinois Law Spurred by Final Fantasy XI Cancellation Issues,” http://kotaku.com/5032004/illinois-law-spurred-by-final-fantasy-xi-cancellation-issues 2. D. Rothman (2008), “Why We Hate DRM: Yahoo Music Store to Shut Down and Shaft Customers Who Bought Legal Music,” http://www.teleread.org/blog/2008/07/25/why-we-hate-drm-yahoo-musicstore-to-shut-down-and-shaft-customers-who-bought-legal-music/ 3. Talkjack (2008), “Is DRM Killing PC Games? (Part 1),” http://talkjack.wordpress.com/2008/06/22/is-drm-killing-pc-games-part-1/ 4. ByteShield (2008), “Is Anti-Piracy/DRM the Cure or the Disease for PC Games?,” http://www.byteshield.net/byteshield_whitepaper_0005.pdf 5. Stardock (2008), “Stardock Announces The Gamer’s Bill of Rights,” http://www.stardock.com/about/newsitem.asp?id=1095

11

The Piracy Tipping Point

n the past several years, piracy has moved from a nagging nuisance to being perceived as a real threat to the entertainment industries. The power of the music, film, and game publishers has been based on their control of distribution, marketing, and funding for new creative works. The Internet has radically reduced the costs for distributing and marketing entertainment. It is now possible for independent entertainment creators to compete with global corporations. Even more threatening, piracy no longer requires expending any real capital. Piracy no longer requires organized gangs who need factories and tools. Individuals can engage in piracy for their personal benefit. The extreme view, taken by the RIAA and some members of the film and game industries, is to target individual consumer “pirates” as if they were major criminals1. In the US, the entertainment industry’s lobbying efforts appear to have succeeded in pushing the government to take a lead role in both civil and criminal prosecutions of copyright theft cases2. Although this may succeed in the short term, it is too easy for pirates to move beyond the reach of prosecutors3.

I

D ETERMINING

THE

G OAL

OF

A NTI -P IRACY P OLICIES

The real question that entertainment companies need to answer is whether they are seeking to maximize revenues and profits or seeking to stop copyright theft. The two questions lead to quite different strategies. Is it really possible to stop copyright theft? The honest answer has to be no. No Digital Rights Management scheme or Trusted Platform Module or any other wonderful widget is going to “solve” copyright theft 4. Anyone who tells you different is simply trying to sell you a product. (Simple question: Will any anti-piracy vendor guarantee its product against failure?) At the end of the day, do you want to be a policeman or a businessman?

97

98

Protecting Games: A Security Handbook for Game Developers and Publishers

The real power of large entertainment publishers comes from their portfolio of products and tie-ins to each product. Instead of worrying about fighting pirates on a product-by-product basis, large companies can enmesh customers in an “entertainment ecosystem.” This is not a new idea. Disney pioneered licensing its characters for everything from lunch boxes to wristwatches and bed sheets5. The same Internet that makes it almost trivial to pirate media also makes it much easier to link products and services together. Whether it is something as simple as a loyalty card or as elaborate as an online community, there are many, many “carrots” that can be used to draw customers into the legitimate, paying entertainment ecosystem compared to the DRM and TPM “sticks.” They may still require security technologies, but the goal is to transform the hard problem of stopping copyright theft into the easier mission to verify and service legitimate customers. The game industry has recently and loudly joined the music and movie industries in the fight against piracy. Yet, of all of the major entertainment categories, the game industry is probably the best positioned to finesse the piracy problem. The early battles with piracy in Asia have resulted in the move to online subscription, and now free-to-play gaming. Although these solutions are far from perfect, they make piracy manageable. They raise the barrier to entry for meaningful abuse, provide continual incentives to participate in the legitimate game system, and make it much easier to take action against a much smaller pool of pirates… if anything, the music and movie industry should learn from the game industry, not the other way around. As a business, entertainment is amazing because it scales so well. A threeminute song or a game can entertain millions and millions of people. iTunes has shown that 99 cents is a great price for a song. The games Rock Band and Guitar Hero are showing that you can take this same song, wrap it into a game for modest cost, and sell the song again… and with substantially reduced concerns about piracy6. Reducing barriers to entry is key. iTunes made digital music good (enough), cheap (enough), and easy (enough). Game developers and publishers need to make similar assessments. If charging $50 creates a barrier to entry, perhaps changing the price or the way games are built to be able to charge $20 is necessary. Games are still substantially less expensive to create than movies, yet they cost several times as much to buy. Developers may want to consider episodic gaming as a way to reduce the in-store cost of a title. Rather than sell the whole game for $50 in a store, simply distribute the first $10 or $20 physically and sell the rest online to already hooked customers. This could battle the appeal of used games, the poor margins in retail, and the challenges of piracy all at once.

Chapter 11 The Piracy Tipping Point

99

Games are released at very different prices at very different times around the world because of the costs of localization and other issues. Ubisoft recently made a move to add subtitles to all of its internally developed games to make its titles more accessible to deaf players7. Simple subtitles, combined with digital distribution, could make it easier and quicker to release games globally simultaneously, just as movies do, to reduce the value of piracy for customers in many countries 8. “Piracy” is a trap. It reduces a whole range of problems, challenges, and issues into a single word. It invites one to believe that there is a simple solution. As you unpeel piracy into its components, you’ll find a number of problems and a range of solutions. Some may require you to change the way you do business, some have technical fixes, and some problems are simply hard. Albert Einstein stated9 that the definition of insanity was “doing the same thing over and over again and expecting different results.” By that standard, we should reconsider the industry’s approach to the piracy problem and do something different.

R EFERENCES 1. C. Dring (2008), “Law Firms Declare War on Pirates,” http://www.mcvuk.com/news/31730/Law-firms-declare-war-on-pirates 2. A. Broache (2008), “House OKs Copyright Czar, New Piracy Penalties,” http://news.cnet.com/8301-10784_3-9939265-7.html 3. C. Doctorow (2007), “Trade Court Allows Antigua to Violate U.S. Copyright,” http://www.boingboing.net/2007/12/22/trade-court-allows-a.html 4. M. Androvich (2008), “Encryption Chip Will End Piracy, Open Markets, Says Bushnell,” http://www.gamesindustry.biz/articles/encryption-chip-will-end-piracy-open-markets-says-bushnell 5. E. Epstein (2005), The Big Picture: The New Logic of Money and Power in Hollywood, Random House, ISBN 0-8129-7382-8 6. T. Johnson (2008), “Ripping on Metallica: Death Magnetic and Guitar Hero III,” http://www.nationalledger.com/artman/publish/article_272622686.shtml 7. J. Snow (2008), “Ubisoft Adds Subtitles to All Future Games,” http://blog.wired.com/games/2008/09/ubisoft-will-in.html 8. X. Jardin (2005), “Thinking Outside the Box Office,” http://www.wired.com/wired/archive/13.12/soderbergh.html 9. A. Einstein (attributed), “Albert Einstein Quotes,” http://www.brainyquote.com/quotes/quotes/a/alberteins133991.html

This page intentionally left blank

Part

III

Cheating

In this part, you’ll find the following topics: Chapter 12, “Overview of Cheating” Chapter 13, “Cheating 101” Chapter 14, “App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures” Chapter 15, “Bots and Player Aids” Chapter 16, “Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions” Chapter 17, “Game Design and Security” Chapter 18, “Case Study: High-Score Security”

101

12

Overview of Cheating

heating and games go hand-in-hand. It seems every game has its cheaters. This discussion of cheating mainly focuses on cheating in multi-player games. In traditional card and board games, the game’s mechanics and game play systems are clearly visible. This makes it easy for cheaters to see how to attack the games and forces game designers to consider cheating as the game is built. Computer games, on the other hand, have mechanics that are concealed by their elaborate graphics and high-speed play. They also have a strong, single-player legacy (often from standalone PC and console games) where cheating was hardly considered; cheating was a private affair between the player and herself. There are also cases where people trade on the seduction of “cheating” as a marketing tactic such as with cheat codes and Diablo 2’s Cheaters’ Tournament where players all play with maximized statistics. This is not really cheating; it is just an alternate set of rules of play. This part will explore a wide range of categories of cheats for computer games and discuss potential countermeasures.

C

Cheating is the next big frontier for computer game security. Multi-player and social games blend business, marketing, and anti-piracy strategies for many game companies. Multi-player, online, and social game services reduce distribution costs, ideally by bypassing retail, but certainly through sale of downloadable content and virtual items. The rich interaction system (RIS) strategy (see Chapter 9) is a powerful anti-piracy strategy because it ties players to the game publisher’s online service. Cheating problems undermine the very same business and security benefits that these strategies provide. Gaming services, such as MMOs and portals, need to acquire and retain players and keep their operational costs down—all of which are adversely affected by cheating. Finally, there is substantial growth in “for money” games. The success of promotional games, tournaments, and contests, and, of course, skill games and gambling games, is intimately tied to their control of cheating. Even the humble single-player game, after a high score system is added, counts on controlling cheating to achieve its social gaming success. Who wants to play when you know the high scores are rigged?

102

13

Cheating 101

heating is as old as gaming. When we shuffle and cut a deck of cards or use a dice cup, we are continuing the age-old battle against cheaters. Although the primary security concern of computer game companies is piracy, the number one concern for players is cheating. No matter what motivates a player to play a game, cheaters damage the game experience for everyone. The oldest commercial game companies, the casinos, recognize this and structure everything in their operation to instill confidence in their customers that there is no cheating.

C

C HEATING

AND THE

G AME I NDUSTRY

For a long time, the computer game industry has consciously traded on the seduction of cheating by incorporating “cheat codes” into their games. They sell “strategy guides” that give their users what some consider an unfair advantage in the games by disclosing details and tactics that a player would have great difficulty discovering through ordinary game play. They even have gone so far as to sell cheats to players1. There are several ways to interpret these cheats: Cynical attempts to cash in on player laziness Methods to make up for poor game design Bugs in game implementation Because these were single-player games, there were no consequences for the industry. This has, to some extent, created a “cheating culture” where players think cheating is okay.

103

104

Protecting Games: A Security Handbook for Game Developers and Publishers

However, as games turn into services and multi-player and online games become the dominant business model, the cheating culture remains. The problem is that no one wants to play a game where they perceive that they are at an unfair disadvantage. See Figure 13.1. When I first started talking about game security, I heard story after story about how players would work hard to cheat at any game with no real reward. They will cheat at anything from a simple Flash game on a website to earn a high score to hack a first person shooter to gain invulnerability. Do a Google search for “cheat” and you’ll get almost 80 million results (by comparison, “Angelina Jolie” returned a mere 35 million results). And at the top of those results are cheats for computer games. Search on “cheat code” and you’ll find 3.5 million results. Again, the top results are all for computer games. Cheating in games is a topic of compelling interest for many game players; everyone wants an advantage. If you create a good game that has value, someone else will try to squeeze it… Hacking we’ve found is like a drug. It’s addictive for the player, and they have a difficult time enjoying the game without the hack tools... A lot of players are turned off by it. [Hackers] turn away new and existing users, increase account theft rate, shorten life span of a user, create [an] abusive community [environment,] and discourage purchasing. [Hacking is] an epidemic we’d been ignoring in Korea. We realized it’s not just a US thing, and we developed detection tools and did mass bans…we moved the critical values to server side and implemented third party solutions. —Min Kim, Director of Game Operations at Nexon America on Cheating2

FIGURE 13.1 Why cheating matters

Chapter 13 Cheating 101

105

Cheating is costly. Players leave a game when they feel cheated. Players call customer service when they believe that they are cheated—whether they are actually cheated or not. Cheating players are often punished by being banned, but this deprives the game operator of further revenue from that individual. Lost players, banned cheaters, and increased customer support all cost a game operator money. Even worse, cheating is a problem whether it is real or just player perception. If players think that they are being cheated, they may quit even if there is no actual cheating. The same powerful network effects that bring players together for multi-player games, MMOs, and virtual worlds can rapidly turn from rapid growth to stagnation and even collapse if players feel that they are being cheated. Anything that even slightly reduces the likelihood a player will join a social network or reduces the duration that they stay can have large consequences. Exponential growth is very sensitive to small changes in its inputs. The key to success for social and multiplayer games is the perception of trust for all players and credible deterrence for potential cheaters. Often executives and thought-leaders in the computer game industry talk about becoming “like the movie industry.” In some sense, the computer game industry is becoming much more like its closer (and much larger) cousin, the gambling industry. The movie industry sells tickets and DVD products; the casino industry sells an ongoing entertainment service. This is where the game industry really seems to be moving. As this migration continues, the game publishers and developers will change their focus from battling piracy to fighting cheating.

F AIR P LAY Once we start talking about cheating, we need to ask—what is a “fair” game. First, there is the question: Is the game itself “fair”? A game is fair if it has an agreed-upon set of rules known by all of its participants and an expectation that those rules can be reasonably enforced. By this standard, casino games, even if they are biased towards the casino, are fair. The rules are known. Conversely, an MMO may not be “fair” if it is ripe for abuse: The often-cited example of real-money transactions (RMT) is not in and of itself unfair. RMT, or any other aspect of game play, become unfair only if it is not an explicit part of the game or a part of the culture of the game that is shared by all players. Collusion in poker is unfair only because it is not part of the game’s culture. One could easily imagine an alternate version of poker where players set up partnerships and agree to share winnings. The card game bridge works this way.

106

Protecting Games: A Security Handbook for Game Developers and Publishers

Second, what is “fair play”? Fair play includes the game’s rules, the game’s environment (the way it is being operated), and the game’s culture. It is certainly plausible to have a computer game that explicitly supports a “hacker culture,” where programming hacks and mods, aimbots, and wallhacks (and maybe even hack countermeasures) are all part of the game. Responsibility for fairness rests with everyone—the game designer, its operator and implementer, and its players. Game designers should consider cheating and other threats to the game in its basic design. Game operators and implementers need to protect the game play environment and ensure that the specific service they are offering cannot be abused. Players, too, have a responsibility to the other players to stay within the construct of the game, even if its implementation is flawed or the rules are incomplete. In a board game, a player has a copy of the rules. The lack of clear, written rules for many computer games makes cheating easier: You’re not “cheating,” you’re exploiting the code. A successful game will cultivate an environment of mutual trust and obligation to play together fairly. Perhaps the saddest legacy of single-player computer games is that lazy programming and poor game design have made cheating acceptable or even admirable. Even worse, players now expect to find “cheat codes,” and game companies and magazines profit from the sale of these codes and guides. Is it bad game design that makes it necessary to purchase a $25 strategy guide in addition to a $50 game, or just greed? What is clear is that now that multi-player and massively multi-player games are emergent, the sudden objections by the game industry to cheating sometimes seem a bit disingenuous.

C HEAT C ODES Cheat codes seem to be an accident of history. Testing software requires exercising all of its features and failure paths. For a game, this means spending a huge amount of time testing the application, and it is terribly inconvenient to have to start over the game from the beginning or require your testers to all be expert players for them to be able to do their jobs. The rather simple solution is to allow the game to be changed so that even a minimally competent game player can thoroughly test the application. Cheat codes were simply efficient triggers to access these test modes. Cheat codes can give invulnerability, infinite ammunition or lives, allow players to fly and jump around the game—whatever it takes for testing.

Chapter 13 Cheating 101

107

Most of the time, test code is removed from a game or application prior to its release. Security is one reason, but some of these test codes can also undermine the proper operation of the application. Unfortunately, this didn’t happen with some early games. Players discovered these “cheat codes” and became fascinated with finding them. Players would sometimes even pay for these codes, and cheat codes have become part of the marketing machinery of the computer game industry. Cheat codes are a currency used by public relations and marketing to reward magazines, reviewers, and websites, as the codes can bring in more traffic, advertising, and revenue for the publications. There are two real problems with cheat codes. The first is a missed business opportunity. These codes are rarely fully integrated into the game’s design and interface. In some sense, the cheat codes provide a wide range alternate modes of game play that should be easily accessible to all players. These alternate modes should include all of the features that you would expect from a game mode: an infinite life mode should have a separate high score, rewards, and other incentive systems distinct from playing without that feature. Game designers can tap these alternative game play options to efficiently expand the game experience for a wider range of players. I, for one, rarely buy first person shooters (FPS) because my “twitch” skills are pretty pathetic. If FPS games included well thought-out game modes that were more accommodating of slow folk like me, they might make some additional sales. The more dangerous problem with these cheat codes is that in many cases the game itself really doesn’t know that a cheat code is active. For single-player games, this is not really a problem. In fact, from a strict software testing perspective, it is better that the game doesn’t “know” that it is running in a cheat mode. For a multiplayer game, however, this situation leads to trouble. Players have been able to use some of these single-player cheat codes in multi-player environments in a way that

HARDWARE HACKS: R4 AND GAMESHARK From their early days, some cheaters have targeted game hardware—the console itself or its various inputs and storage interfaces. These hardware hacks can modify game save files and, in some cases, allow active modification of a game while it is running. The R4 product that targets Nintendo’s DS handheld and, to some extent, Mad Katz’s GameShark both subvert the console’s external storage systems. Some of these tools can even bypass the entire console operating system and give the hacker total control over the behavior of the platform. This can be done to give players an advantage in the game or as a method to pirate games. These devices have mainly had an impact on single-player games. However, they could cause real trouble as console multi-player gaming grows.

108

Protecting Games: A Security Handbook for Game Developers and Publishers

is not detectable by the other players. These kinds of careless cheat code implementations can allow a player to play a multi-player game at a huge advantage and ruin the game for the other players. Sloppy labeling of cheat code modes and poor management of state information in multi-player environments aggravates these problems. In an ideal world, the entire language and use of cheat codes would be abandoned. All of these additional game play modes would become part of the game play experience and listed on the back of a game’s box, just like other features. Only real cheaters would look for “cheat codes”… except they wouldn’t be able find them. Is it too much to ask those clever folks in marketing to find some other way to grab the interest of players, magazines, and websites besides advocating “cheating”?

EXPLOITS There is some confusion about the definitions of cheating, hacking, and exploits. In some sense, I am not really interested in clarifying the issue. For purposes of this book, cheating is an attack on a game application. I don’t care if it is based on some tool-aided assault or a quirk in the interface or game engine or some combination thereof. My categories have been based on how game developers and publishers typically perceive problems and their countermeasures. It is worth highlighting exploits, however. Exploits are flaws in the game as implemented that give a player an advantage. For example, the set of fantasy pub games for Fable 2 have a race condition flaw (a situation where the player can induce an inconsistency in the game’s behavior) that gives them a huge advantage. The Fable 2 pub games are a set of casino-style games where players can bet and win or lose chips. In one game, a player can “change her bet” from 60 gold to 600 gold (and win as if she bet 600 gold), but only be penalized for losing as if she bet 60 gold 3. There are innumerable variations on this problem. Basically, the game programmer and game designer are not implementing the same game design or the game programmer has not been sufficiently careful in controlling changes to the game’s behavior. All games have some sort of state (the current status, location, and other information about players, assets, time, and so on) and rules (the way that players can alter the game’s state and when they can take these actions). Race conditions are actions that alter the game’s state in a way that should not be allowed under the rules. One way the Fable 2 problem could occur is that there are two different systems: a player account system and a game system. The player’s account is checked when the initial bet is made and this is sent to the game and debited from the player account. But subsequent changes to the bet are not checked against the player account; they are only changed in the game itself. Then, if the player wins, the game sends the gold back to the player account.

Chapter 13 Cheating 101

109

Race conditions are associated with most “dupe” exploits (where players abuse the inventory system or other game mechanics to duplicate items). A sample “dupe” exploit could work as follows: 1. Player 1 drops an item out of her inventory and it is added to the local game environment. 2. Player 1 abandons the game before her inventory is updated. 3. Player 2 picks up an item from the local game environment and it is added to her inventory. The item has now been duplicated. The “dupe” attack works because the three data stores do not properly synchronize with each other. The key is that games are essentially transactional systems and need to be built as such. A proper transactional system would not allow the player to drop the item without updating the inventory: Either the item would be dropped and the inventory updated or nothing would happen at all. These problems can be even worse in online games when developers choose not to use standard databases or do not understand proper data transactions or are just not careful. Another major exploit area occurs when game developers use graphics engines to enforce game play. Graphics engines are optimized to smoothly render graphics and animation. Smooth playback is the most important requirement for most graphics engines, not careful enforcement of physics features such as collision detection or pathfinding. This can create a number of problems: Many games use the graphics engine’s model of the game environment to determine legal moves, visibility, and position. Exploits take advantage of conflicts between a game’s need for accuracy and a graphics engine’s goal of smooth rendering. Exploits can even exist in paper-and-pencil games. I used to play the super hero role-playing game Champions in high school. I was one of several people who found an exploit in the game’s mechanics that allowed me to deliver 20 times the damage of other players. Exploits are the responsibility of the game developers. They really aren’t “cheats,” because they do not require any modification of the game’s software or data nor can they be effectively addressed by anti-cheat tools. Basically, they require corrections to the game’s design and implementation. Clear documentation of general game rules and procedures should help reduce exploits and make them obvious flaws when they occur. The Age of Conan had an exploit that allowed customers playing the Demonologist class to advance extraordinarily quickly through the game4. For online games, detailed logging can be critical in locating exploits by tracking their consequences. Also, given the scope of the games, it is probably good to reward players who find exploits—after all, they are paying you for the privilege of testing your software. (Note: When a player reports an exploit, it is probably also worth reviewing their game play logs to see if they had some fun taking advantage of the exploit for a while.)

110

Protecting Games: A Security Handbook for Game Developers and Publishers

T HE CARRDS R EFERENCE M ODEL In order to continue this discussion about cheating, it is important to have a framework for talking about how games are built. CARRDS is a conceptual framework for talking about games and game security, and is illustrated in Figure 13.2. The advantage of the CARRDS framework is that it allows you to focus on the common elements of computer games that can affect security. Control—The keyboard, mouse, joystick, controller, Nintendo Wiimote, voice, biofeedback, or whatever raw means a player uses to interact with a game. Action—The normalized control that the game rules understand activities such as go left, fire, strafe, jump, turn right 30 degrees, fly NNW 1 hundred meters, and so on. Rules—The actual rules of the game. Random—Random events sit in the nebulous intersection of actions (players rolling dice to determine their move choices), rules (determining the result of an attack), and state (a player’s cards). Random events raise some interesting problems in a networked environment, as there are real questions as to how to provide fair random online. Display—The presentation provided to a player of the game’s state. (Note: There can certainly be multiple views of the game’s state.) State—The current state of the game, or, in a multi-player game, the partial state known to a single player.

FIGURE 13.2 CARRDS game architecture

Chapter 13 Cheating 101

111

T HE R EMOTE D ATA P ROBLEM In 2000, Matt Pritchard published one of the first significant papers on multi-player game security. In it, he set the basic categories of attacks—data and network—and began the discussion about one of game security’s most trying problems—trusted clients5. The “Trusted Client Problem” is seen in many games to this day. The Trusted Client Problem was targeted at client-server games and can be generalized and restated as “The Remote Data Problem,” as follows: Games tend to trust the state or information provided by other players. This approach seems works fine, most of the time, and is very easy to implement by using data synchronization techniques. Data synchronization is very good at handling cases where the players’ games’ states become slightly inconsistent. Unfortunately, the system falls apart when one of the players is cheating. Because the remote data is trusted, the peer player or game server tends to blindly accept information that is manipulated on the cheating player’s platform or on the network connection. If cheaters can force others to accept whatever data they want, they can change the game however they want—anything from giving themselves more ammunition and health, to changing their location, or entirely altering the game environment. It is also worth noting that in a number of game environments, there is a concern with cheating by the server. Gambling games and contests are obvious examples where players don’t trust the game server. Simple multi-player games that use player-run servers, like many first person shooters (FPS) and even MMOs, can have situations where players are suspicious of the server operator. The FPS Battlefield 2 ended ranked games on third-party servers because of this problem 6— a costly decision, as its publisher, EA, had to operate all of its ranked servers itself. STATE-BASED NETWORKING The simplest way to implement a networked game is to use a distributed state (or object) application that synchronizes the game state, as illustrated in Figure 13.3. This is very tempting. It is easy, fast, and the developer doesn’t have to think about the multi-player design. Essentially, the multi-player game is implemented as a series of parallel single-player games and the distributed state tool “smoothes out” the differences between each player’s version of the game.

112

Protecting Games: A Security Handbook for Game Developers and Publishers

FIGURE 13.3 State-based networking

There are several basic synchronization models that can be used by a distributed state system. At a minimum, players exchange state information (Sx), but they may also exchange time information (Tx): Newest Wins—In this synchronization scheme, the players exchange both state and time information. The one individual that has the latest timestamp determines which state is authoritative. For any of these systems, there is an interesting challenge associated with synchronizing time, particularly when faced with lag over a wide area network. Somehow, all of the participants have to start at the same time. Time itself can be spoofed by malicious players who alter their own local time to be much later than that of the other players, distorting the results of any application that uses this synchronization model by always forcing the other players to use the cheater’s state and time information. if (Ti > Tr) then (Si = Si, Ti = Ti); // for the case where the internal player (i) has // a newer timestamp than the remote player (r), the // internal player state and time is used. else if (Ti
Chapter 13 Cheating 101

113

// for the case where the internal players (i) has // an older timestamp than the remote player (r), the // remote player’s state and time is used. // there is an interesting question as to what to do if // the timestamps are identical. It is likely that many // developers would stick with local state, although there // is a reasonable argument that if the states are different // and the timestamps the same, there is a problem.

Average—The players average both the time and state information that they receive from each other. There are various weighting schemes that can be used to bias data based on how recent the information is both according to its timestamp and the actual, local time. It is quite possible for a cheater to abuse these systems by providing data that is far outside the ordinary behavior of a legitimate player (altering state information to be very different will cause its value to dominate the information from the other players—that is, if the cheater is only supposed to have 100 hit points, setting her own hit points to 100,000 will result in an average of (100,000+100)/2, or 50,050 hit points. Ti = AVERAGE{Tx}; // where {Tx} is the time for each player Si = AVERAGE{Sx}; // where {Sx} is the state for each player

Vote—Players use a voting scheme to determine the local time and state. These systems can also use a weighting scheme. One of the security measures used with these types of systems is to throw out outlying results (if there are multiple players). Collusion can be a problem for both vote-based and averaging systems. An important consideration for voting systems is that there is reasonably good time synchronization between the players. In order to have workable votes, all players need to participate with a vote for a given game “tick.” Ti = VOTE{Tx}; // where {Tx} is the time for each player Si = VOTE(Sx); // where {Sx} is the state for each player

Internal Authoritative—In this type of scheme, players “trust” themselves more than other players for data about themselves. The different portions of the game state are updated based upon what the data is and who is doing the updating. “Neutral” state and time data (information not associated with a specific player) is updated using an averaging or voting scheme:

114

Protecting Games: A Security Handbook for Game Developers and Publishers

// In general, a player’s game state is the state of // the player’s own information, such as her own status, // (internalPS) and the other players view of their own status. GameState(playerx) = {externalPS1, externalPS2, …,internalPSx, …,externalPSn); // the game state for each player x uses the state // information from each other player for that player’s // state and her own data for herself. // for example Game(player1) = (internalPS1, externalPS2); // Player 1’s view of the game state with player 2 // providing the state updates for player 2 and player 1 // providing the updates for player 1. Game(player2) = (externalPS1,internalPS2); // Player 2’s view of the game state.

External Authoritative—One of the ways to address cheating is to trust “the other guy.” In this model, the player trusts herself for data on everyone but herself. If there are more than two players, the player’s internal state and time is based on an average or voting scheme of the external players: // In general, a player’s game state is the state of the // other players’ view of their information (externalPS). GameState(playerx) = {internalPS1,internalPS2, …,externalPSx, …,internalPSn); // the game state for each player x uses the state information from the // external players for her state and uses her view for their state. // for example Game(player1) = (externalPS1,internalPS2); // Player 1’s view of the game state with player 2 providing the // state updates for player 1 and player 1 providing the updates for // player 2. Game(player2) = (internalPS1, externalPS2); // Player 2’s view of the game state.

Chapter 13 Cheating 101

115

All real-time network game schemes share one challenge: handling the synchronization between the game’s actual local state and its displayed state. This is a concern when games are played over a network because the network lag can introduce discrepancies in time in addition to any differences in time because of clock differences in each player’s game platform. In general, developers have two competing goals: a smooth presentation and an accurate reflection of the actual game state. The danger of erring too far on the side of smoothness is that important, current state information that could affect game play is not available to the player’s display. Also, player control inputs may not accurately reflect the game actions that they intended because the display state that they see and are reacting to is not the actual, local game state. Another common challenge for networking systems is how to handle scenarios where one player gets out of synchronization with the other players. It is very common to defer to the out-of-synch user to keep the displayed game smooth for that player. This choice leads to many of the more obvious attacks against multi-player games. In these “standbying” and “bridging” attacks, players intentionally break their connection to push the system from its regular operation into its “synch recovery” mode. These attacks are very simple to implement by simply installing a switch that physically disconnects the game computer or console from the network.

HIDDEN STATE AND PARTIAL INFORMATION Many games have asymmetric information: There is state information that is known to some, but not all, players. Players have partial information about the global game state. The most familiar example is card games. Players are dealt cards face down that are not known to the other players. A well-formed game has the characteristic that when a player sees an action from another player, this player can determine if the action is consistent with the game’s rules and its current state, even if she cannot determine exactly that that the action is legal. Once again with card games, when a player privately passes a card to another player, the receiving player can validate that cards that were passed are not cards that the receiving player knows could not come from that source, even if she cannot validate that the sending player legally had those cards. Hidden information can be verified only after the game is over (or when the hidden information no longer has an impact on the game—such as when all players are dealt a new hand in cards). Although real-time verification of fair play is ideal, because games include partial information, retrospective verification is sometimes the only option available.

116

Protecting Games: A Security Handbook for Game Developers and Publishers

In general, the problem with state-based networking is that: Games are distributed transaction systems, not distributed state systems. The rules are the key. As you can see from Figure 13.3, if a game uses statebased synchronization, cheating is very easy because the game’s multi-player system exists independently of and underneath the game rules. The incoming state from a remote player is implicitly trusted by the very nature of the communication system: The game’s rules are not part of the state synchronization process. Even if the communication path itself is encrypted, a malicious player can use a tool like Cheat Engine to manipulate her local game state and trust in the distributed state system to push the corrupted data to the other players, and it is even easier if she can get to the cleartext messages. In general, it is better to disrupt the game experience for the out-of-synch user and defer to the server or majority of users. In games where synchronization is critical, the game should roll back to the last shared “good state.” As we go down this rabbit hole, we do realize that a malicious player could attempt to attack the “last good state” system; therefore this also needs to be designed to be secure. In order to protect against attacks on the “last good state,” the players should immediately confirm that they’ve received a version of the game’s state with the other players as they move forward so that everyone knows the current “last good state” before one of them can exploit this. One of the protocols, Strobe, from our anti-cheating software, SecurePlay, is actually designed to provide a secure synchronization process for peer-to-peer or less trusted client-server systems: It delivers a “secure tick” to stop several attacks on time in games. CLIENT/AUTHORITATIVE SERVER NETWORKING The other standard approach to multi-player gaming is to implement a clientserver design with the server being trusted by all of the players, as illustrated in Figure 13.4. Trusting the server is secure—at least as long as you and your players both trust the server (see the section, “Security, Trust, and Server Architectures,” later in this chapter, for further discussion of trust and server architectures). Control or actions are sent to a central server for processing. The server then returns state updates to the client. The archetype of this approach is a MUD where players enter raw telnet text and send it to the server which in turn returns new state information. It is technically possible to implement a multi-player game solely via exchange of control information. The main limitation of this approach is that there are often substantial differences between computers in their raw control data (for example, encoding of characters, line termination, resolution and mapping of mouse position information,

Chapter 13 Cheating 101

117

FIGURE 13.4 Client with authoritative server networking

and so on). Also, different game players may want to use different types of control input devices (mice, keyboard, trackballs, and D-pad controllers) with different formats and content for the raw data provided by each. It is unnecessarily burdensome to force the game to understand all of the different valid control systems. The main problem with the authoritative server model comes from cheating by developers. The “cheat” I am talking about is that too often developers wind up implementing state and rules on the client-side and using a state synchronization approach to update the server. This is often done for legitimate performance reasons, but leads right back to the “trusted remote date” scenario that you thought you had escaped by using this networking strategy. ACTION-BASED NETWORKING The remaining choice for multi-player gaming is to exchange actions instead of state or control information over the network. Action-based game play networking (see Figure 13.5) has a lot of advantages. Game actions are almost always bandwidth efficient, as they reflect player choices that are limited by the inherent abstraction of all games. Architecturally, a nice aspect of action-based networking is that it can operate in either a client-server or peer-to-peer network, leaving more flexibility for game developers.

118

Protecting Games: A Security Handbook for Game Developers and Publishers

FIGURE 13.5 Action-based networking

Actions are selected prior to the invocation of a game’s rules. This has a substantial security advantage, as the pre-existing rules validation and processing system become part of the networked game’s security system. Control-based clientserver networking has some of the advantages of this approach, as control information is converted into actions at the server (where they are validated); however, state information is passed down to the player client where it is accepted without verification. By exchanging action information with remote players or servers, the game’s own rules can be used to protect against cheating. Also, the architecture is nicely independent of the location of the player or the game’s underlying communications (local or remote, client or server or peer), making testing easier by allowing the game rules to be fully tested through its API. Logging and replay features are also easy to add when using action-based network, as are metrics and tracking for performance monitoring and debugging. It is fairly easy to see why action-based networking is secure by looking at playby-mail chess. In chess, a player sends his moves to the other player. The receiving player: 1. Receives the incoming action. 2. Determines whose turn it is (can any action occur now from the specified player?). 3. Looks at the board and determines if the piece is available to move. 4. Determines if the move is legal (can the player take the specified action?). 5. Moves the piece.

Chapter 13 Cheating 101

119

In state-based networking, chess would be played by sending a new chess board or by sending the moved piece’s new position (along with any removal of an opponent’s piece). The receiver has a much more difficult time determining if the move is valid because she basically has to reconstruct the move or look at a list of all available moves and see if the selected one is included. For a computer game with more complicated actions and multiple active players or “pieces,” this problem rapidly becomes intractable. Formally, there are two basic types of action-based networking messages: PlayerID,Action + Parameters, ActionInitiationTime;

and PlayerID,OldGameState,Action + Parameters, ActionInitiationTime;

Under action-based networking, the model is essentially the same as for chess: 1. Receive the incoming action from a player (local or remote). 2. Determine if the player can take that action given the current game state. 3. Implement the action (use the action and its parameters in conjunction with the game rules to determine the new game state). 4. Update the state. It is important to note that there are really two types of rules processing. First, there are the rules that determine if a specific player can take a specific action given the current game state. This is an area where programmers often make errors. Often, the problems occur because the developers don’t assume someone would attack the control interface or the network directly and drive the game faster than normal. This type of action overrun attack is a fairly common form of network attack. The second type of game rules are those that take an input action and its parameters and determine the outcome to update the game’s state. One of the challenges with implementing action-based networking is maintaining synchronization between players. This is not a problem for state-based networking systems. In addition to being easy to implement, state-based synchronization schemes can be fairly “sloppy,” especially if they use an averaging scheme to synchronize. The various players will continually converge towards a shared state... and it almost doesn’t matter if the different player’s state is ever exactly the same. This approach is used in large-scale simulations where cheating security issues aren’t a problem for performance and simplicity of development.

120

Protecting Games: A Security Handbook for Game Developers and Publishers

Action-based networking first requires setting an initial state and time between all of the game players. Time can be particularly difficult to coordinate. One approach is to handle network time as a sequence of synchronized “ticks” that all players need to participate in before the game proceeds to the next tick.

MONEY, VIRTUALIZATION, ROOTKITS, AND THE END OF CLIENT-SIDE SECURITY Historically, the main focus of anti-cheating techniques has been on client-side security tools. These software techniques, libraries, and even standalone applications “look” for malicious code and alterations to the operating environment for the game application. These tools have been reasonably effective: There is only so much work a hacker will do when they are attacking a game “just for fun.” The game industry is changing rapidly. It is much larger than when most of these anti-cheating tools were created, and hackers are now breaking games to make money. The computer industry is also undergoing a bit of a revolution. Virtualization tools, like VMware and the open source product Xen, are changing IT. At the same time, hackers have moved to rootkits as a way to avoid detection. Barring the rhetoric, both of these tools are similar. Virtualization wraps an operating system instance and its associated applications in an isolated shell that is unaware that it is in a shared environment under control of another application. Rootkits are applications that use very low-level utilities to hide themselves from ordinary operating system monitoring tools. SoftICE, an early Windows tool, hid itself from the operating system as part of its function as a powerful platform debugger, and was used to attack Diablo. Most anti-cheating products are reactive; they detect specific cheats only after they have been identified. Like anti-virus software, they don’t actually search for new attacks; they look for signatures of known attack applications. This distinction is important. The company or group that keeps the game security software up to date needs to have an actual copy of the attack software in order to create a signature for it. If the attack software is changed, the signature needs to be changed as well. Even worse, a completely different program that exploits the same weakness also will need to be retrieved by the security company and a signature created for it as well. The key challenge that these tools face is that it is inherently difficult to separate legitimate programs, like mouse or keyboard controllers, from malicious programs that are virtually identical in function. After all, what is a “bot” but an exceptionally clever input device?

Chapter 13 Cheating 101

121

When cheats are done “for fun,” they are widely distributed and easily detected by a game company’s “Cheat Surveillance System” (the game’s online forums and fan sites). When cheating a game becomes serious business, hackers don’t share their attacks or sell them for a nominal fee; they profit from them directly. I have been told anecdotally that there are proprietary bots used by gold farmers for many MMOs that are not widely distributed, but used only as a tool for professionals. Detection of serious cheats can be difficult. An outsourced employee at a company that made an online poker calculator player aid (the tool automatically tracks the “rake” by the poker site operator) inserted a rootkit into the application 7. The malicious program installed a key-logger and other programs useful for looting the poker player accounts. This rootkit was still not detected by any traditional security software months after its insertion—I suspect, because it was neither widely distributed into the general population nor obvious in its nefarious activities. Virtualization provides a powerful avenue for attacking games. Just like other applications, software security tools live inside the virtualized environment and cannot detect that they are not part of the platform’s “real” operating environment. As software developers create more and more powerful virtualization tools, it is highly likely that some of these virtualization management, security, and testing tools will be used for malicious purposes, just as the SoftICE Windows testing tool was turned into a game hacking tool. Combining rootkits and virtualization is a plausible security nightmare with the recent demonstration of a rootkit that could move an operating system into a virtualized shell without being detected and leaving the rootkit in control of the platform8. Targeted malicious code is a growing problem for the security software industry. Previously, hackers would create viruses and other malware just to spread them to as many computers as possible. Recently, online criminals have begun to target specific, lucrative targets: companies or even individuals. The reasonable revenues and exceptionally low risk make all forms of online gaming a very tempting opportunity. Virtualization will also allow hackers to more effectively and inexpensively scale automated gold farming, pokerbot, and other systems to attack online games.

S ECURITY , T RUST ,

AND

S ERVER A RCHITECTURES

Almost every multi-player game uses a central server in its design. Even peer-topeer games include a minimal server system for matchmaking and storing persistent data and rankings. The standard assumption is that the server is trustworthy.

122

Protecting Games: A Security Handbook for Game Developers and Publishers

This is the view of the developer, of course. Players may have a different view, and rightly so, in some cases. Servers can be hacked or, even worse, a malicious insider may be abusing the game for his own benefit as happened at the online poker site UltimateBet.com9. In this case, the malicious insider was using the fact that the game state was available on the game server to read other players’ hidden cards— and, as a result, make extremely profitable wagers. Online gambling sites are not the only victims. A Shanda Interactive vice president and two accomplices were arrested for creating and selling virtual items in the MMO, Legend of Mir 210. The only reason that they were caught was that they chose to create and sell exceptionally rare items. They might never have been caught if they had chosen to sell widely available, but still valuable and profitable, game currency as has happened at several other online games. In addition to the “trusted server” and simple “peer-to-peer” models, there are at least three other architectures to consider: Trusted Third Party, Blind Service, and Collaborative Game Play.

FIGURE 13.6 Trusted third-party architecture

The Trusted Third Party model (see Figure 13.6) is an independent service provider who has no interest in the game’s operation or outcome. The third-party provider does not run the game, but either audits its behavior, or, more powerfully, implements key portions of the game itself to ensure its integrity. This scenario is the gaming analog of a real estate escrow agent who mediates part of a sales transaction to ensure money is transferred appropriately between buyer and seller. For MMOs, an escrow agent could be used to handle all asset transfers (and not just for sales between players as some Real Money Transaction (RMT) providers are doing

Chapter 13 Cheating 101

123

today). Conceivably, these third-party providers could roll dice, resolve combat, or even host the entire game. The success of the Trusted Third Party comes from proving its independence from the players and game operator, both technically and from a business perspective. Poker is an example of this architecture already being used for gaming. The players are not playing against the house, as in a casino, but against each other. Thus, the poker operator has no vested interest in the game’s outcome. The challenge comes from enforcing this separation. If an employee of the poker operator has a vested interest in the game’s outcome, as in the UltimateBet.com example, the model is undermined. Just as in promotions and contests, there are real benefits to the integrity of a game from prohibiting game company employees (or their friends and families) from playing the game (a topic that I will be revisiting in Chapter 25).

FIGURE 13.7 Blind service architecture

A variant on the Trusted Third Party model is to have an untrusted third party. The Blind Service model, illustrated in Figure 13.7, is a scenario where there are multiple service providers that can be chosen at random by the game participants. Ideally, the blind service would not even know who the players are. If there are enough blind service providers and the players use an intelligent randomization scheme for selecting the provider, the system can be secure. The nearest analogy is the Tor anonymous web browsing service11. The problem with this model is to find a way to make the set of anonymous providers large enough and make the service economically viable for a game operation. The system also needs a mechanism to communicate some information between the game operator and the blind service and players. Depending on the specific system and business model, cryptographic techniques, such as public key cryptography, may be helpful.

124

Protecting Games: A Security Handbook for Game Developers and Publishers

From an anti-cheating perspective, the ideal is to be “N-1 Secure.” If there are N players in a game, the game should be fair if at least one of them is honest (or, at least not part of the same cheating team). Action-based networking actually addresses a portion of this architecture, and is all that is needed for games like chess. The combination of exchanging information by actions with local verification of rules by each player means that the only role of a central server is to adjudicate disputes (see Figure 13.8). Players can independently rebuild the changes in the game’s state over time by looking at all of the players’ actions. If the previously recorded state is not identical (or at least is consistent) to the reconstructed state, some form of manipulation or corruption has occurred. My company, IT GlobalSecure, took this basic concept and extended it to cover more types of games and other game interactions, such as fair random numbers, handling hidden information, and securely synchronizing network time with our SecurePlay software.

FIGURE 13.8 Collaborative game security architecture

Issues of trust are important for game developers, game operators, and game players. Payment processors, regulators, and law enforcement may all be concerned with the integrity of a game for a number of reasons. One advantage of this architecture is that security evaluation can be made much simpler. Because each party to the game has an independent copy of the rules, independent game implementations can be used by each participant as long as everyone follows the same API. This could have some very interesting benefits for casino games, skill games, and contests where criminals can currently target game software for attack and there are ongoing concerns about game developers as potential threats.

Chapter 13 Cheating 101

125

R ANDOM E VENTS Fair random number generation is a really challenging problem for multi-player games. When we play games face-to-face, we have standard products (dice and cards) and standard procedures (shuffle, cut, and dice cups) that ensure integrity. If you go to a casino, a massive portion of the security design for games is around ensuring the integrity of random events. Slot machines, the most familiar and trusted form of automated random number generation, use real random noise (almost always) to generate random bits and the systems are sealed and have their code evaluated line by line—and they’ve still been attacked12. In the CARRDS model, “random” is highlighted because it creates its own set of issues and was one of the motivations for creating our SecurePlay software. An example of the blind service model, described previously, has been used for years by board gamers who play by mail to roll dice fairly. The players designate a stock symbol and future date and use the cents portion of the price as a random number. (Electronic Arts ERTS closed at 47.06 on Wednesday, 20 August 2008, so the random number would be 06.). There are actually several distinct types of random number systems that are of concern in computer games: Private Random with Replacement—The random value is known only to the individual player, but is drawn from a random sample, like dice, where random values can reappear. Public Random with Replacement—The random value is known to all players and the random values can reappear. Public Random without Replacement—The random value is known to all players and the random pool is sampled without replacement. For example, cards from a deck, where random values cannot reappear. Private Random without Replacement (Separate Random Pool)—The random value is known to only an individual player and the random pool is sampled without replacement, but the random pool is not shared across players (as in the game Magic, where each player has her own deck of cards). Private Random without Replacement (Shared Random Pool)—The random value is known only to an individual player and the random pool is sampled without replacement. The random pool is shared like cards dealt by a dealer. The question in each is how to generate a fair random event, preferably in a way that is N-1 secure. It is possible to use a trusted third party for random numbers (interestingly, this has not been tried for online gambling to my knowledge).

126

Protecting Games: A Security Handbook for Game Developers and Publishers

The random numbers could be encrypted as they are provided to the individual players for private random numbers. The sole problem with this approach is that you have to trust the trusted third party. Collaborative random number generation is an effective solution. Instead of involving a third party, each participant can create a random number, share it with the others, and combine the results: SharedRandom = (Random1 + Random2 + Random 3 +... + RandomN) mod Z; // where each RandomX is a contribution from one participant and Z // is the range of values desired as well as the range for each contribution.

If everyone is honest, this system works well. The problem comes from the contributions not being simultaneous. If you have ever played Rock-Paper-Scissors with a child, you’ve seen this problem—the child sees the value you’ve selected and somehow their hand slips into the advantageous value. Our SecurePlay software addresses this problem by creating a “logically simultaneous” action; we can use irreversible transforms to get things started: for each Player j { Transformj = IrreversibleTransform(Randomj,padding); // each player computes an irreversible transform of her // random value with arbitrary padding appended to it. }

Next, each player shares this information with the others and once everyone confirms that they’ve received the transform, each reveals the random value to the others, which can then be verified: for each Player j { AllegedRandomj = Randomj,padding; // each player shares their random value with padding if (Transformj == IrreversibleTransform(AllegedRandomj) { use Randomj; // as described above } else { call Police; // or other action } }

Chapter 13 Cheating 101

127

This core algorithm, with slight variations, can be used to cover most of the required random scenarios. For public random events, the process works exactly as described. For random events without replacement, the range (Z) is reduced by one as the random pool is depleted. Private random events can simply be handled by having the player who is keeping the random event secret (Player j) not provide her a value (AllegedRandomj) until after the game is over so that it can be verified. The one case where there is a bit of a problem is when there is a private random without replacement and a shared random pool. In order to generate a draw from a random pool without replacement, the dealer needs to retain knowledge of what has been dealt which allows her to share information with others. The dealer cannot affect the random event outcome, but she can disclose the private random information to other players—often a problem in games, as it can give advantage. A variation on this system can be used with a server/dealer to generate large numbers of random events quickly and if the dealer is somewhat trusted. Instead of directly generating random events, the players can all contribute towards building a collaborative random seed that is used with a deterministic random number generator to create a series of random events. As seen with the UltimateBet.com case, trusting a central server at all can be a potential threat. It may make sense to alter a game’s design so that the game is naturally N-1 Secure. Poker, for example, could be changed slightly so that players’ private cards are drawn from a separate, private deck (like in Magic: The Gathering). This would slightly shift the distribution of hands in the game and make it possible for a player to actually be dealt a natural five-of-a-kind hand, but separate decks would stop attacks from a compromised central server.

P LAYER C OLLUSION Player collusion is one of the more troublesome problems for all forms of gaming. Many, if not most, multi-player games are built on the premise of player competition. Collusion can occur “in band” using the game’s communication services or signaled via game play or “out of band” using external communication systems, like a telephone. Although it is easy to say that collusion is against the game’s rules (or terms of service), in practice it is very difficult to eliminate collusive behavior. It is even worse online where players cannot be physically monitored and they have easy access to alternate communications channels to share information and coordinate strategies. Collusion needs to be considered very carefully in game design. In one of my alltime favorite game design failures, a Swedish lottery firm, Svenska Spel, designed a

128

Protecting Games: A Security Handbook for Game Developers and Publishers

game called Limbo where players guessed a number between 1 and 99,999. If you selected the lowest number that no one else had chosen, you won a prize. If two or more people chose the same number, they “bounced” and were disqualified. Collusion was against the rules (as was making too many bets by a single person). You can probably guess what happened: Players formed large syndicates to systematically guess different numbers to increase their odds of winning and won hundreds of thousands of kroner. The contest was rather quickly and abruptly withdrawn13. Closure of the game cost Svenska Spel one hundred million kroner (over $15 million) per year. If you think this is funny, consider all of the games that forbid gold farming, but allow inter-player item exchanges. Many MMOs have a limited form of player vs. player (PvP) conflict, where you can fight players on other teams, but not your own. Members of “Something Awful” (an interesting collection of people who play a number of games, often in ways not intended by their designers or other players) organized a pair of guilds in World of Warcraft with the intent of using both guilds against other players and groups. World of Warcraft has two “teams,” the Horde and the Alliance. Players are allowed to attack members of the other team, but not their own side (Horde players could attack Alliance players, but not other Horde players and vice versa). The “Something Awful” guilds colluded together for their mutual benefit to take advantage of the game’s economy. The “Something Awful” Horde guild would escort and aid their Alliance counterparts who entered Horde territory since they were immune to attack by other Horde players. They also used the paired guilds to act as a protection racket: While an ordinary Alliance player can do nothing to another Alliance player, a friendly Horde player (or group) can attack Alliance players mercilessly 14. There are three main types of collusion: External Affiliation—In this case the colluding team has an external relationship that, in and of itself, gives them an advantage. Poker players who have a shared bank roll have an inherent advantage over the others at their table, even if they do nothing active in the game but share their winnings after the game is over. This type of collusion is essentially impossible to detect from the game’s or game operator’s perspective. Shared Knowledge—The next level of collusion is sharing knowledge between the conspirators. In poker again, this is easy to appreciate. When two players share the values of their hidden cards, they will have a substantial advantage in their game play.

Chapter 13 Cheating 101

129

Coordinated Action—As seen in the Limbo lottery game and the World of Warcraft examples, active collusion can be terribly destructive to a game. Many of the tournament attacks, discussed in Chapter 20, are based on players colluding instead of competing. You can randomize the matchmaking process to make it less likely that teams can exploit their relationship. In some face-to-face games, it is possible to restrict communications to avoid covert signaling. In its highest-level tournaments, bridge players use cards to indicate their bids so that vocal cues are impossible. Completely stopping collusion is virtually impossible. Online poker sites claim to look for team play by analyzing game play patterns. This may have some effect, but it is unlikely to even slow down a serious collusion conspiracy. For online games, at least, the best anti-collusion strategy may be to legalize collusion or otherwise alter game play so that collusion confers no significant advantage.

B USINESS M ODELS

AND

S ECURITY P ROBLEMS

Sometimes game security problems are a nuisance, and sometimes they are devastating. Game play and balance problems, no matter how bad they are, can almost always be repaired. Players may gripe or even quit when their favorite characters are “nerfed” (had their abilities reduced due to a software update/rules change) or favorite tactics thwarted. These are serious customer service problems, but they rarely are a threat to the business. Some game security problems can ruin your business. The more closely game play is tied to your business model, the more risk you face. For a game that is sold as a product, the major threat is piracy. For a subscription game, the threats are unauthorized, unfunded subscriptions and excessive play. At the other end of the spectrum, any form of cheating or abuse can undermine the success of a gambling or skill game operation. Free-to-play games and other games with hybrid business/game play models, like Second Life and Project Entropia, face some interesting challenges. Free-to-play games make their money by selling in-game virtual assets to players in lieu of charging subscriptions. This approach is becoming the dominant business model used in Asian games and is rapidly entering Western markets with games like Nexon’s MapleStory and Three Rings’ Puzzle Pirates. Although many players do not pay to play these games at all, some can spend hundreds of dollars on virtual items— much more than they would spend in a subscription game. Also, because the cost to play is zero, it is easier to reach a wider potential audience.

130

Protecting Games: A Security Handbook for Game Developers and Publishers

Unlike a subscription game, the game systems and real money payment systems are closely intertwined. Attacks on the game can damage the company’s business model directly. Recently, I was told about a licensed MMO that had a serious problem in which malicious users could hack the game and simply give themselves all of the virtual items they want by using a SQL injection attack to directly edit their inventory—even getting items not yet available to other players because they had not been enabled by the game operator. Several online games and virtual worlds have embraced the notion of user-created content and trading as central to their business model including IMVU, Second Life, and Entropia Universe (formerly Project Entropia). In these communities, the players can use tools to create and trade virtual items that can be bought and sold for real money (or, rather, virtual currency that can be converted into real money). Entropia Universe has gone a step further by directly auctioning off a massive space station for $100,00015 as well as five banking licenses for a total of $404,00016. The fact that virtual currency can be converted into real money raises the stakes for security. Second Life faced an attack that allowed a hacker to steal player’s money just by “walking by” a modified QuickTime file (moving their game character/ avatar close enough to an object in the game that included the hacked QuickTime file so that the game would cause the file to be loaded). For a while, Apple’s QuickTime file format was vulnerable to an attack that gave hackers the ability to insert and execute malicious code on the target computer, if the hacker could get the altered file onto the computer. Because players in Second Life can create virtual items, including items that incorporate QuickTime files, this attack could be launched against players dynamically in the virtual world. The hack basically forced the victim’s Second Life account to automatically transfer the game’s currency, Linden Dollars, to the thief17. MindArk’s Entropia Universe has the feature that many items that players find useful are consumed or damaged over time and need to be repaired or replaced: the essence of the company’s business model. Instead of a hack, players found an exploit that allowed them to guarantee that they would earn more money than it cost them to play18. This exploit undermines the virtual world’s business model, much as a slot machine that pays out more than it takes in is quite harmful to a casino’s bottom line, if not its popularity. What if your partners rebel? Activision and Infinity Ward faced a rebellion over the security failures of the World War II first person shooter, Call of Duty 2. The rebels were not ordinary players, but highly motivated gamers who hosted servers for the game. They called a strike to stop operating their servers until the game’s anti-cheat systems were fixed19. Even more costly, MGame in Korea’s licensee in China, CDC Games, stopped paying royalties until the company fixed piracy and other problems with Yulang, an MMO20, a dispute that was eventually settled.

Chapter 13 Cheating 101

131

R EFERENCES 1. B. Sinclair (2006), “EA Sells Tiger Woods Cheats on XBL,” http://www.gamespot.com/xbox360/sports/tigerwoodspgatour07/news.html?sid=6159881 2. Virtual World News (2007), “Blogging the AGDC: Coming to America: Nexon’s Micro-Transaction Revolution, “http://www.virtualworldsnews.com/2007/09/blogging-the—5.html 3. R. Miller (2008), “Fable 2 Pub Games Exploit Will Make You Very, Very Rich,” http://www.joystiq.com/2008/08/15/fable-2-pub-games-exploit-will-make-you-very-very-rich/ 4. S. Schuster (2008), “AoC Demonologist Exploit Fixed in Recent Patch,” http://www.massively.com/2008/05/26/aoc-demonologist-exploit-fixed-in-recent-patch/ 5. M. Pritchard (2000), “How to Hurt the Hackers: The Scoop on Internet Cheating and How You Can Combat It,” http://www.gamasutra.com/features/20000724/pritchard_01.htm 6. P. Klepek (2005), “Battlefield Server Delisting—EA and DICE Respond to Recent Server Modding by Users,” http://www.1up.com/do/newsStory?cId=3141484 7. R, Naraine (2006), “Rootkit Infiltrates Online Poker Software,” http://www.eweek.com/c/a/Security/Rootkit-Infiltrates-Online-Poker-Software/ 8. R, Naraine (2006), “VM Rootkits: The Next Big Threat?,” http://www.eweek.com/c/a/Security/VM-Rootkits-The-Next-Big-Threat/ 9. J. McCarthy (2008), “Online Casino Admits Insiders Changed Software to Cheat,” http://www.onlinecasinoadvisory.com/casino-news/online/online-casino-admits-cheaters-existed-1728.htm 10. A. Xu (2006), “Three Men Tried for Selling Online Game Weapons,” via http://www.playnoevil.com/serendipity/index.php?/archives/763-Insider-Virtual-Asset-Crime-inShandas-Legend-of-Mir-2-IMPORTANT.html (original link expired) 11. Wikipedia (2008), “Tor (Anonymity Network),” http://en.wikipedia.org/wiki/Tor_(anonymity_network) 12. S. Bourie (2008), “The World’s Greatest Slot Cheat?,” http://www.americancasinoguide.com/Tips/slot-cheat.shtml 13. J. Savage (2007), “Game Stopped After Cheat Allegations,” http://www.thelocal.se/6788/20070324/ 14. Joe Blancato (2006), “Diseased Cur,” http://www.escapistmagazine.com/articles/view/issues/issue_30/188-Diseased-Cur 15. BBC (2005), “Gamer Buys Virtual Space Station,” http://news.bbc.co.uk/2/hi/technology/4374610.stm 16. MindArk (2007), “Virtual Banking Licenses Sold!,” http://www.entropiauniverse.com/en/rich/6357.html 17. Internet Security For Your Macintosh blog (2007), “Second Life Hack Steals Real Life Money,” http://www.isfym.com/site/blog/Entries/2007/12/6_Second_Life_hack_steals_real_life_money.html 18. Entropia Universe Examined blog (2007), “The Final Entropia Exploit,” http://blogtropia.blogspot.com/2007/03/final-entropia-exploit.html 19. IWNation (2005), “The Time Has Come for Action, We Will Be Ignored No Longer,” http://iwnation.com/forums/?showtopic=17450 20. L. Alexander (2007), “CDC Sues MGame for Security, Tech Support Failures,” http://www.worldsinmotion.biz/2007/10/cdc_sues_mgame_for_security_te.php 21. M. Greene (2008), “MGame, CDC Settle Yulgang Dispute,” http://kotaku.com/365550/mgame-cdc-settle-yulgang-dispute

14

App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures o abusively paraphrase Sutton’s Law1, hackers attack the local application because “that’s where the game is.” And, it is convenient. And developers leave the application a vulnerable target. Both hackers and developers are lazy.

T

Author’s Warning: I name and discuss several programs used for cheating games during this chapter and elsewhere in the book. I am in no way recommending that people use these tools. Even if the tools themselves are safe, game cheating and hacking tools are often provided with free “extra” features, like key-loggers and other additions that may be used to hack your computer, steal your passwords, and otherwise ruin your day. Even compiling these tools from source code may be risky, because you aren’t actually going to review all the code, are you? And, even if you did, do you really think you could find serious, malicious code? There are many ways to attack a game via the local application. Hackers can modify the game’s state, its data, memory, and assets, or even the application itself. There are countermeasures for many of these attacks. However, many of these countermeasures can themselves be circumvented because they, too, are applications that run on the player’s computer. Local hacking is one of the reasons that developers have moved towards server-based game designs or should consider actionbased networking, as discussed in Chapter 13.

M EMORY E DITORS , R ADAR ,

AND

ESP

The easiest attack target is the computer’s memory. System memory needs to be used by all games and can be easily analyzed, so attackers don’t need to do any new work to attack different games. In the hand of even a “YouTube-educated” game cheater, free debuggers and standard utilities can easily read out the computer’s active memory and rapidly and empirically determine where key game data is stored. 132

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

133

This allows the cheater to directly change the computer’s memory contents. At the time of my writing this paragraph, there are 60 YouTube video demonstrations 2 of hacks on the simple, quite fun Flash-based role-playing game, Sonny 3. These are attacks on a free game! All computer applications write data into RAM memory while they are running. For an ordinary user, the operating system controls access to the RAM memory so that the applications don’t interfere with each other. Applications themselves create a structured “memory map” so that the application can easily and quickly find its own data. At their most basic level, memory editors are tools that can look at the entire RAM of a computer and manually change or lock any memory value. Smarter memory editors can learn the memory maps for different applications and automatically remember where certain data is located. The most generic attack on a game using a memory editor is pretty simple: 1. Start the game. 2. Launch the memory editor. 3. Look for the value in memory. 4. Change the value using the memory editor. 5. See if the value has been changed in the game. 6. Cheat and be merry (shame on you!). In practice, this may be difficult, as a given number or string sequence may occur in multiple places in memory. Also, games may try to hide values by changing how they are stored (via encryption or obfuscation). The more robust way to attack a game takes only slightly more effort: 1. Start the game. 2. Launch the memory editor. 3. Tell the memory editor to “Save State” (save a complete image of the computer’s memory or the area allocated to the game). 4. Do something in the game that changes the value of interest. 5. Tell the memory editor to look for differences in state (compared to the previously saved state). 6. Try editing these values. 7. See if the value has been changed in the game. 8. Repeat until satisfied. 9. Cheat and be merry (shame on you!).

134

Protecting Games: A Security Handbook for Game Developers and Publishers

The power of this technique is that it will work for pretty much any game, at least on a PC or hacked console. Instead of modifying a game’s state, in many multi-player games, simply being able to read state information gives the hacker a substantial advantage. Radar attacks and ESP (extrasensory perception) both, at their core, prey on a weakness found in many multi-player games—the need to pre-load remote data. Most modern games are played as real-time systems and the overwhelming goal of game developers is to provide a smooth experience for players. Because of the drive to provide a “smooth” game play experience, the player’s client application knows information about the game’s state that the player shouldn’t know. Several years ago, Dark Age of Camelot players could read location and useful map information about other players by analyzing the MMO’s network protocol (clearly, a state-based system)4. Apparently, these attacks were stopped when Dark Age of Camelot’s developer, Mythic Entertainment (now EA Mythic), began encrypting the network packets. Conceptually, an attacker should have been able to attack the game “above” the network layer (after the packets had been decrypted at the client) and extract the same information, but I have not seen any indications that this has occurred. These attacks can affect other genres including first person shooters such as SWAT 4 5 and, more recently, Team Fortress 2 6. Radar attacks and wallhacks, to be discussed shortly, can look similar and have identical game-cheating consequences, but their implementation is different. Radar attacks are dependent on reading out game state information, whereas wallhacks attack the display subsystem. ESP attacks directly extract the game state and provide their own display. Because Adobe’s Flash provides tools that make using state-based synchronization very easy, a number of developers of basic multi-player Flash games, including card games, simply replicate the game’s entire state at each player’s location. Once hackers extract this information, they have a huge advantage (as you can imagine if you were playing poker or bridge and could see all of your opponent’s cards).

D ATA O BFUSCATORS The best way to prevent a game client from disclosing data is to not provide it in the first place. Hackers can’t extract information that they can’t access. As is discussed in Chapter 17, game design itself can be an opportunity for game designers to help reduce security risks.

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

135

If it is necessary for the local game client to store a hidden game state, the only real choice is data obfuscation. Data obfuscation makes attempts to hide the format and location of important game data from memory editors. As discussed previously, memory editors don’t care where game data is stored in memory. Rather, memory editors look for known values and changes in values. Sometimes, developers use encryption techniques to hide the data. However, because the key has to be available on the platform as well as the data, the security, such as it is, comes from how well any keys are hidden and how difficult it is for the hacker to reverseengineer the encryption system’s design. So, instead of using the term “encryption,” which implies powerful security for many readers, it is more appropriate to refer to such systems as “data obfuscators.” “Encryption” is not the only option. According to the documentation for the Poke memory editor, Blizzard’s Diablo II used a system where they stored critical game data in multiple locations and, if only one was changed, the Diablo II storage system used the smaller one and changed both values to the same, smaller value7. Once this scheme was identified, it was fairly trivial for hackers to defeat. A slightly more complicated system involves using “differential storage”— where game data is split into two elements via addition or the “exclusive or” function so that individual memory locations cannot be usefully read by a memory editor: /// GD – game data to be stored // compute a random value, Random1 L1 = GD xor Random1; // compute the sum of the game data and the random info L2 = Random1;// store the random info GD = L1 xor L2; // retrieve the game data

This technique is simple and fast. If a fair amount of data is being updated regularly, it will be difficult for a hacker to easily isolate correct pairs of storage registers. Eventually, a patient hacker may be able to change memory locations one at a time and steadily work out the game’s differential memory map. One can add an anti-tamper element to this system by incorporating a checksum with the game data: /// GD – game data to be stored // GDCS - checksum on game data // compute a random value, Random1

136

Protecting Games: A Security Handbook for Game Developers and Publishers

L1 = (GD,GDCS) xor Random1; // compute the sum of the game data and the random info L2 = Random1;// store the random info (GD,GDCS) = L1 xor L2; // retrieve the game data if [Verify (GD,GDCS) == false] then {do countermeasures;} else {play;}

The challenge for any data obfuscator is that it must work quite fast and, essentially, force the hacker to reverse-engineer the design of the game’s obfuscation code to defeat it. Also, it is essential that the data obfuscator is easy to use. For languages such as C++, this would typically mean creating a custom data type or template and for many other languages the obfuscated data would be stored in a class or struct data type (when I created a data obfuscator for Flash, I created a set of classes that mirrored the language’s basic data types). It is important that the obfuscator not be called as a dynamic library at run-time, but integrated into the code during compilation. If the obfuscator is called as an external library, it can be “plugged out” so that it is bypassed entirely, as discussed in the next section. Also, beware of optimizing compilers, as they may optimize your data and code obfuscation techniques right out of your application. Ideally, the data obfuscator could be regularly updated by simply recompiling the game with a new obfuscator version and no modifications would need to be made to any of the remaining game code. The following are a number of data-protection techniques: Encrypt—Encrypting data with a static key (hardwired or game instance based) simply makes the static key of the encryption function the primary target for attack. Cryptographic modes are important (key-additive, cipherblock chaining, cipher feedback, and so on), because some may allow the hacker to change the encrypted data in a useful way without ever breaking the cryptography. It is important to recognize that the technique does not have to be cryptographically strong; it just has to effectively obscure the data from direct extraction by a memory editor. Attackers must find the function method or algorithm and key or blindly modify data in the platform’s memory. Data Hash—Even a simple, unkeyed data hash, if implemented properly, can be effective. A keyed hash requires the attacker to isolate the key, the code for the hash function, and its algorithm. Indirect Data Store—Instead of storing data in a memory location, store it indirectly via an object pointer. This can be used against static memory map tools by forcing an attacker to dynamically read-out memory.

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

137

Split Data Store—Split the data via some symmetric function (mod 2 arithmetic, addition) so that instead of storing a value (V), a random value (R) and a split value (R+V) are stored. An attacker must find the correct sets of memory locations in order to effectively modify the game data. Differential Data/Data Chaining—Instead of storing data directly, store it as an offset split of another data object. The data chains cannot be too long or complicated or a single data change may force many other data objects to be changed and have an adverse performance impact. Honeytrap Memory—A honeytrap is stored data that has a hard-coded, known value that is periodically checked. If the honeytrap data has been changed, the application knows it has been hacked. Soft Failures—Detected hacks do not immediately get punished or get punished randomly. Combined Techniques—These techniques can be combined to substantially increase the difficulty for the hackers. It is also important to note that these techniques do not actually allow you to prevent modification of game data, but make such modifications detectable by your game code. Ideally, your selected data obfuscation strategy will detect any unauthorized data modifications so that they will be not be accepted by the game.

C ODE H ACKS

AND

DLL I NJECTION

In a computer, code is data. Just as all of the data in a game is available to a memory editor, the game’s code is also vulnerable. The most vulnerable portion of a game’s code is its internal configuration data. These data constants are the embodiment of the game’s rules and can have a substantial impact on game play. Aaron Portnoy and Ali Rizvi-Santiago of TippingPoint DVLabs attacked the configuration data for Disney’s Pirates of the Caribbean MMO game client by altering the game’s “jump height” and “ship speed” constants. These changes allowed their characters to jump ridiculous heights and their pirate ships to move incredibly fast 8. In this case, the security analysts were not attacking raw binary data, but the byte-code generated by the Python scripting language. The attack was successful because the game uses state-based networking so that the actual jump or movement data was exchanged and blindly accepted by the remote players’ computers. This type of attack can be thwarted. CCP Games’ EVE Online also uses Python for its client, but, because game state is totally controlled on the game’s servers, a recent hack that exposed the game client code caused no problem for the game’s security 9.

138

Protecting Games: A Security Handbook for Game Developers and Publishers

More serious code attacks typically target external libraries (DLLs for Windows computers, and SOs for Linux). A hacker can insert a “shim” library with the same name as the actual library and redirect and edit data going between the library and the main application. Eyebeam Openlab’s tool OGLE (OpenGLExtractor) demonstrates the basic technique used for graphics engine hacks and DLL proxies to attack games. OGLE was not developed with malicious intent, but rather to support the extraction of 3D images for other uses. The tool uses DLL proxy techniques to extract OpenGL graphics information and derive a 3D scene so that it can be sent to a 3D image editor or 3D printer10. A number of game hacks use similar techniques to cheat in games. Game graphics engines do not pose a threat. However, developers sometimes rely on the graphics engine to enforce game logic and this can cause problems. For example, game engines sometimes use the graphics engine to determine whether a player or item is visible to another player. The problem comes from letting the graphics engine “see” a player or item that would otherwise be invisible—a tool similar to OGLE could then be used to highlight the character, make the intervening walls invisible, and so on, in order to circumvent the game designer’s intent to hide the asset. The “best” solution would be that a local copy of a game doesn’t know anything it doesn’t need to. If an “invisible” asset needs to be stored locally, it should be protected as well as possible. To prevent easy exploitation of this information, the data should not leave the game engine, but the scene should be managed by an intermediary program that determines visibility and other attributes based on game rules and level design (that is, making a wall invisible for rendering does not expose things behind it). This is similar to a dynamic loader but instead of simply focusing on improving the graphics engine’s performance, the “safe loader” makes sure that anything that should not be visible isn’t loaded to the graphics engine. It may even load alternate assets based on game state and rules for the assets that are loaded. The safe loader should have the side benefit of reducing the number of assets that graphics engine needs to render—there is no need to waste cycles on rendering invisible items. Also, the safe loader could allow for more intelligent camera systems (for example, walls graphics could be replaced by suitable “graphic stubs” if they block the main game action from the camera’s current position—just as found in TV or film sets where the director removes walls and props from sets when they interfere with observing a scene as the director wishes). It is even possible to locate hidden assets and information at a lower level. Hackers can find the underlying tables that map where game functions are located and redirect the function calls to alternative functions. This does require a fair amount of sophistication; however, the same tools that allow assembly language

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

139

debugging and software reverse-engineering (disassemblers and decompilers, among others) make implementing these attacks easier as software engineering tools get better (and more widely accessible and sometimes even free). Some anticheating tools will detect that software is running in debug mode as a way of attempting to fight these hacks. However, just as with memory editors, the debugging applications can also run independently of the application. These attacks are very specific to an application and its architecture. Network stacks, data stores, and other code that is tempting to store in a shared library may become a target by allowing the hacker to break the application into convenient pieces, just as the developer did.

B LIND S ECURITY F UNCTIONS , C ODE O BFUSCATORS , S OFTWARE D ESIGN

AND

A NTI -T AMPER

Protecting game code, just like protecting game data, is a very hard problem. After all, the code has to be present for the game to run. As discussed in Chapter 5, some games attempt to protect their code by not actually installing it with the game, but rather accessing it from a DVD or over the network when the application is executed. At this point, the code is loaded into the computer’s memory and it is vulnerable to being read, modified, or stored, just as the game’s data is. Some security techniques, such as data obfuscation, depend on the attacker not being able to (easily) reverse-engineer the application’s design. Code obfuscators work by making an application more difficult to reverse-engineer. Because the application does need to operate, what these tools do is introduce complexity into the executable program that makes it very difficult for standard disassemblers, decompilers, or parsers to convert into a higher-level language that is easy to analyze (this technique is also used for dynamic language’s byte code and simple scripting languages like JavaScript). The key advantage of obfuscators is that they can be highly automated. However, obfuscators can’t introduce too much complexity or else they will cause an unacceptable deterioration in performance. Games often have portions of their code that are very performance sensitive. Therefore, it is critical that obfuscators can be tuned so that they do not affect performance in key code areas. Blind security functions and anti-tamper software do affect the underlying operation of the game’s software. At their core, these tools introduce checks embedded deeply within the application to ensure that its data is correct and that its code is operating properly. Static data may be checked by loading the suspect static data in otherwise unrelated functions and comparing it with a pre-stored hash function or other validation:

140

Protecting Games: A Security Handbook for Game Developers and Publishers

/// pre-store hash of configuration data – CDH Load(ConfigurationData); if (CDH != Hash(ConfigurationData)) then {tamper processing} else {continue};

It is also possible to check that functions are working correctly. Developers can pre-store known results: // pre-store input, result pair for key function if ( result != KeyFunction(input)) then {tamper processing} else {continue};

This approach needs to be done cautiously, as hackers can replace the verification function with a series of NOOP (no operation) assembly language instructions or their equivalent if they can locate the verification functions. This usually means that these techniques work better if they are called in numerous places in the code. If a function is called only once or in only one way, it is easier for a hacker to target and remove or bypass. It is tempting for developers to wrap security and other functions up into a single line of code. This is, after all, standard coding practice. Unfortunately, this entirely valid coding technique makes reverse-engineering much easier. For example, it is very common to consolidate digital signature verification into a single function call: if (verify(data) == true) then {do good stuff} else {tamper processing};

A lazy hacker will simply alter the verify function to always return true, no matter how corrupt the data is. To detect such attacks, the developer needs to validate that the function is working properly: // first test the verify function by verifying corrupted data if (verify(data+ junk) == true) then {tamper processing}; else if (verify(data) == true) then {do good stuff} else {tamper processing};

These anti-tamper techniques can be quite powerful, but they are a lot of work for a developer to implement unless the developer has some powerful scripting or macro language capability to automate the integration of these features into the application. In general, these anti-tamper tools are going to be more effective if they operate on source code rather than on object code or an existing executable application that needs protection.

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

S AVE G AME A TTACKS , W ALLHACKS ,

AND

141

B OBBLEHEADS

Memory editor attacks are not well-suited for console games, as they usually are sealed systems that do not allow access to their memory state and do not include or allow the installation of memory editors or other utilities (at least until they are hacked). For console games, hackers can often attack and modify the save game file. Most consoles use Flash memory or other rewritable storage to store saved games. The save game file can be attacked and modified, as discussed in Chapter 7. Hackers modified the save game information to get infinite ammunition and missiles and several other benefits in Metroid Prime Hunter, a first person shooter on Nintendo’s DS handheld game console11. This “trainer” configuration change gave the cheater a huge advantage when playing via the handheld’s WiFi network—an unfair modification that seriously undermined the fun of playing the multi-player game12. Once again, this attack is largely due to the use of state-based networking to establish player configuration information.

SAVE SHARING Console games have typically used two types of memory: a DVD or other static media to store the game itself and a much smaller Flash or EEPROM memory to store saved games. Players are using both of these methods to transfer their personal player profiles and save game information to other consoles and post results onto services like Xbox Live. However, some players have exploited weaknesses in the existing save game and player mobility system (where players can use their account profile on multiple game consoles) to cheat13. The easiest way to understand this is to think of the Save As command in Word or other Office applications. Basically, some player excels at a game. They make their saved game available to other players. These players launch the game from its saved state and then use the “Save As” command (or, as it is actually implemented on a console, assign the saved game to another game save slot) to transfer the game from its original owner to themselves. So far, the main exploits of these shared saves have been to gain unearned achievements on Xbox Live and, perhaps, to unlock game content and share customized data14. Without better control at the individual console or a more effective central service, there is potential to use shared saves for more serious mischief.

142

Protecting Games: A Security Handbook for Game Developers and Publishers

It is possible to attack a game’s state without targeting the game’s state directly via a memory editor or similar tool. Many games use the graphics display engine to determine where players are and if they can be targeted. The simplest attack on the graphics engine is to alter the visibility (or, more specifically, the transparency) of the game’s scenery and walls—called a wallhack15. By making walls transparent, other players or creatures that would ordinarily be hidden are revealed, making them much easier targets. The same effect can be achieved by altering attributes of the graphics in the game’s map file. The “ultimate” level of graphics engine attack is to replace entire art assets. Thus, instead of the ordinary player or creature that the game should use, a hacker replaces these art and animation assets with ones of her choosing that make the player more visible or an easier target—such as turning regular game characters into big Bobbleheads.

GRAPHICS ENGINES VERSUS GAME ENGINES Conceptually, the display system for a game should be distinct from the game’s state. The game logic should determine what is visible, who can be shot, and how one can move. In practice, many games merge the graphics engine and game engine into one entity. Although this may have some performance benefits, it opens up the aforementioned wallhacks and other exploits like “holes,” where players can get behind or between graphical elements by abuse of the graphics engine. A pure “Game Play” engine should be much less vulnerable to these problems, as it is handling less data: Level models are simpler, player models are more abstract, and so on. Also, a game play engine understands what a “wall” is in a formal way, versus simply a polygonal mesh to be rendered. By splitting the game play engine from the game presentation/graphics engine, game developers might also have an easier time moving between computer or console platforms. Also, by decoupling game play from game presentation, developers should be able to improve testing and scheduling.

S ECURE L OADER

AND

B LIND A UTHENTICATION

Client-side problems are hard. As noted in several places within this chapter, changing the networking model to an action-based network architecture should help.

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

143

It is possible for the client application to authenticate map, asset, and save information, however. Anything that is loaded can be digitally signed, use a keyed hash function, or a cryptographic checksum. All of the solutions are equivalent from a security perspective. If hackers can determine the algorithm and find the associated static or semi-static key used with the algorithm, they can either replace the key with their own (the way to attack the digital signature) or use the key (which will work for the keyed hash function or cryptographic checksum). A very common design mistake is to use a regular hash function, such as MD5. Hackers will test common hash functions, like MD4, MD5, and the various SHA standards, over any loaded data to see if the hash values can be found within the application. MD5 is often used first, because it is probably the most widely available hash function. This can even work on consoles as seen with a partial, at least, hack of Gears of War16. More sophisticated hackers may alter the asset after its initial load by using a memory editor to change the pointer for the asset file to a preferred, alternate asset file. Thus, it is not usually sufficient to validate an asset only when it is initially loaded, but it should be checked periodically, preferably every time it is used (obviously, this has the potential to have a sizeable performance impact). The process for secure loading is very closely related to secure bootstrapping (see Chapter 7). A good secure loader design will also prevent rolling back to a previous version of software or assets, a problem that has plagued Sony’s PSP 17. From a performance perspective, using a regular cryptographic checksum, sometimes called a Message Authentication Code (MAC), is probably best, as these functions are faster than hash functions. This system can be used to validate game saves, art assets, maps and levels, and even game code. First, it is necessary to create the authentication word (AW): AW(assetx) = securityfunction(assetx,secretkey); store AW(assetx); // store the authentication word (and actual asset) somewhere

Then, to verify the asset, either when it is initially loaded or some other time, the authentication word is retrieved and it is compared with an alleged authentication word for the asset of interest: AW(allegedassetx) = securityfunction(allegedassetx,secretkey); //or AW(allegedassetx) = securityfunction(allegedassetx,publickey); // for the case where digital signatures are used if (AW(allegedassetx) != AW(assetx)) then { do tamperfunction;} else {process normally};

144

Protecting Games: A Security Handbook for Game Developers and Publishers

There is another use for this mathematical technique—blind authentication. It can be desirable to attempt to authenticate data or code at a remote game player’s location. In this case, keyed hash functions or cryptographic checksums are effective and digital signatures will not work. The challenging party generates a secret key and sends it to the other participant. The challenging party also sends an identifier associated with the code or data that is to be verified and must have a copy of the data: ChallengeMessage = randomkey,assetidentifier; // challenger generates random key and sends asset // identifier to challenged party

Both parties compute the authentication word for the specified asset: AW(asset(assetidentifier)) = securityfunction(asset(assetidentifier),randomkey);

The challenged party then sends the authentication word back to the challenger, who then compares it with her locally computed authentication word: if (challengerAW != challengedAW) then {take tamper measures} else {proceed normally};

This process is not perfect, but it does at least ensure that the challenged party has a copy of the valid asset. For a constrained platform, like a handheld console, this may be sufficient. It is also very efficient for authenticating saved game data for consoles, because most have some small amount of protected memory that can hold a secret key that can be used to check the integrity of a stored game save file.

Chapter 14 App Attacks: State, Data, Asset, and Code Vulnerabilities and Countermeasures

145

R EFERENCES 1. Wikipedia (2008), “Sutton’s Law,” http://en.wikipedia.org/wiki/Sutton%27s_law 2. YouTube (2008), “YouTube Search: Sonny Hack,” http://www.youtube.com/results?search_query=sonny+hack&search_type= 3. Armor Games (2008), “Sonny,” http://armorgames.com/play/505/sonny 4. RadarFTW (2005), “The Truth About Radar,” http://daoc.catacombs.com/forum.cfm?ThreadKey=511&DefMessage=1031585&forum=DAOCMainForum 5. sarzamineiran (2008), “SWAT 4 Aimbot/Wallhack/Radar Cheat,” http://www.youtube.com/watch?v=tsO_2KR-vbk 6. Smik3r (2008), “TF2 Hacks Aimbot NoSpread ArtificialAiming.net Scout Ownage,” http://www.youtube.com/watch?v=LWVqtzK0zf4 7. M. Anka (2007), “POKE,” http://codefromthe70s.org/poke.asp 8. A. Portnoy, A. Rizvi-Santiago (2008), “Reverse-Engineering Dynamic Languages,” http://dvlabs.tippingpoint.com/pub/aportnoy/RECON2008-PortnoySantiago.pdf 9. M. Martin (2008), “CCP Plays Down EVE Online Source Code Leak,” http://www.gamesindustry.biz/articles/ccp-plays-down-eve-online-source-code-leak 10. Eyebeam R&D (2006), “OGLE: The OpenGLExtractor,” http://ogle.eyebeamresearch.org/ 11. gbatemp.net (2006), “New Trainer: Metroid Prime Hunters (+4),” http://gbatemp.net/index.php?s=23f5870b73924be42c7c7a26a1de1a3f&showtopic=34050 12. 4 color rebellion/Mitch (2006), “Warning: Incoming MPH Cheating,” http://www.4colorrebellion.com/archives/2006/06/30/warning-incoming-mph-cheating/ 13. M. Nelson (2007), “Xbox LIVE Account Sharing and Gamesave Tampering (Don’t Do It),” http://majornelson.com/archive/2007/10/30/Xbox-LIVE-account-sharing-and-Gamesave-tamperingdont-do-it.aspx 14. B. Kuchera (2007), “Microsoft Tries to Stamp Out Cheating, Hurts Enthusiast Sports Gamers Instead,” http://arstechnica.com/journals/thumbs.ars/2007/05/16/microsoft-tries-to-stamp-out-cheating-hurtsenthusiast-sports-gamers-instead 15. Wikipedia (2008), “Wallhacking,” http://en.wikipedia.org/wiki/Wallhack 16. mr hoodie lol (2007), “Gears of War Hacked,” http://forums.maxconsole.net/showthread.php?t=45086 17. J. Ransom-Wiley (2007), “PSP Downgrader: 3.03 to 1.50 in 8 Simple Steps,” http://www.joystiq.com/2007/01/30/psp-downgrader-3-03-to-1-50-in-8-simple-steps/

15

Bots and Player Aids

he next stage of cheating beyond wallhacks, ESP, and radar is to use this knowledge to augment player performance. After all, once you are playing a game on a computer, it is a fairly small step to program the computer to play the game on your behalf.

T

Game players have always used tools to help them play better, whether the tools are legal or not. Bridge has its hand-ranking systems; blackjack has its basic strategy1; and chess and go have endless volumes of analysis. Interesting borderline cases exist, such as card counting where players use their memory to improve their performance in a game—a tactic that some consider legal and other people view as cheating.

I S I T “H ELP ”

OR

I S I T C HEATING ?

When do strategy and analytic aids cross over into cheating? When an individual person is no longer setting the strategy or making a decision, but the game play is driven by a machine or a team of people colluding together. The problem with fighting player aids is that they are separate from the game and are therefore essentially impossible to detect. There are tons of solvers for the very popular numeric puzzle game, Sudoku; the only way to even consider detecting a solver is to capture the precise timing and order that a player enters numbers into the game state array—both of which can be faked as well. Online poker faces a similar problem. Programmers are building increasingly sophisticated programs that can play a reasonably strong game of poker (in fact, the Polaris Pokerbot won the 2008 Man vs. Machine Poker Championship2). These automated play tools don’t actually need to perform optimally to succeed; they simply need to outperform the majority of players in the majority of hands for the majority of money—poker farming anyone?

146

Chapter 15 Bots and Player Aids

147

Automated poker play strikes at the very heart of the online poker industry. If players believe that they are not playing with other people (and they are losing), the industry could be in real trouble. There have been several largely unsuccessful experiments with using the skill game business model with first person shooters. These types of games are particularly vulnerable to botting and if one of these services ever takes off, it would be interesting to see how long or successfully they would be able to keep botters at bay. Even traditional chess is not immune. Chess computers have been around for years. However, in a recent case in India, a chess player was caught getting advice from a partner with a chess computer and a Bluetooth connection3, resulting in suggestions that future tournaments should be played in Faraday cages. Some games directly support tools for automating portions of game play, but as a feature, not as a cheat. These macros range from simple playback systems that repeat sequences of key strokes to highly elaborate scripting languages. Game developers become concerned when these tools are too successful at game play either when they undermine competition between players or allow totally automated game play (for example, the Glider4 tool automates play for World of Warcraft and is currently the subject of a major lawsuit about the legality of such third-party tools5). Automated game play can be disruptive to other players or can be used to over-efficiently exploit the game’s economy (see Chapter 22 on gold farming). In many cases, the only real violation of the game rules is the fact of these game automation tools’ existence. They are not cheating or exploiting actual game systems, but simply using a computer to play the game instead of a person. In practice, player aids and macros are very difficult to detect because they are not manipulating the game, only automating game play. Either the game operator has to try to detect the player aid application (which doesn’t need to even be on the same computer) or the macro program or else they need to detect automated play—unfortunately, this is often little different than the behavior of a highly skilled player. Some programs do more than play the game well by the rules. They take the next step and cheat. Welcome to the world of aimbots and other bots. A simple bot doesn’t really need to cheat. It can capture display information and use the same data to determine its strategy and directly drive the mouse and keyboard or controller. However, computer actions and reactions are far faster than a player’s and therefore the bot can perform much better (even without elaborate artificial intelligence programming). More sophisticated bots combine wallhack, radar, ESP, and memory editors with some AI programming and automated controls to play much better than a human. Some even replace the game client entirely. Aimbots can find targets and

148

Protecting Games: A Security Handbook for Game Developers and Publishers

DEMONSTRATING A HACK AND THE YOUTUBE THREAT I am lazy. When someone contacts me about their game and wants to discuss security, the first thing I do is check out YouTube. Often, I’ll find wonderful demonstrations and tutorials of hacks for the game. Almost as often, I’ll see examples of what are pretty clearly “fake hacks” that are used to lure players to disclose their account information and passwords. These fake hacks use memory editors and other tools, like Photoshop, to con players by altering the game display on one computer. The clearest way to demonstrate a cheat properly is to show the game display of more than one player at the same time, ideally from two different monitors. The reason for the separate displays is to show that other players are actually seeing the results of the cheat and that it is really having an impact on game play. If this can’t be done, it is actually better to show the perspective of the “cheating victim” rather than the cheater—especially for attacks that involve interaction with other players or the game environment like dupe attacks and speed hacks. This is not true for state disclosure hacks like wallhacks, ESP, aimbots, and radar.

shoot better and faster than any player6. Call of Duty added an interesting feature called “kill cam” that showed the final five seconds of a victim’s life from the perspective of the killer after the victim was killed. Because tools like aimbots and radar cause players to take rather unnatural actions (such as tracking targets through walls), the kill cam was seen as an interesting anti-cheating tool—allowing victims to detect their cheating killers from beyond the grave (or after the fight)7. Automated play, combined with full state information and the ability to simply edit the game’s state, can make for a devastating attack on a game. Real-time games, like first person shooters, MMOs, and real-time strategy games, are all particularly vulnerable to these attacks. After all, any game that favors speed over thought is always going to favor a computer player. Bots and game cheat tools are not just for fun; they are a serious business. Glider, the rather well-known automation tool for World of Warcraft, has an Elite version that costs $5 per month or $60 for a lifetime subscription8. There are several bots for NCsoft’s Lineage 2 that are sold on a subscription basis, including L2Walker and L2Superman that has a $7.50 per month subscription9 with upgrades that add features and keep the tool ahead of the game’s cheat detection system (for comparison, it costs $15 per month for a Lineage 2 subscription).

Chapter 15 Bots and Player Aids

149

Finally, it should be noted that serious game cheats have moved their hack tools off of the computer. In Korea, commercial game hack tools use a smart USB token that includes its own processor. This computer looks like a keyboard, mouse, and video card (all of which can use USB interfaces), but processes the screen and game data totally passively (at least from the PC’s perspective) to implement game cheats. Some of these devices cost as much as $20010. This type of bot could actually be used very effectively against console games as well because it relies purely on information from the game’s display and inputs from the game’s peripherals. Just as cybercrime has moved towards advanced infrastructures and custom products that put conventional IT security companies at a huge disadvantage, criminals, gold farmers, and other serious exploiters targeting games are already developing their own tools and methodologies to attack games more profitably. Advances in virtualization from Xen and VMware are going to make creating very advanced and virtually undetectable client-cheating tools easy.

CAPTCHA S : D ISTINGUISHING P LAYERS

FROM

P ROGRAMS

CAPTCHA (Completely Automated Turing Test To Tell Computers and Humans Apart) is a widely used computer security technique that attempts to distinguish people from computers11. CAPTCHAs are mostly used for login and registration authentication, but some game developers have moved to using CAPTCHAs to stop bots. CAPTCHAs work by providing words, math equations, or images that are difficult for a computer to solve, but easy for a person to distinguish. The problem has grown as hackers have gotten better, and the CAPTCHAs have become more difficult for even a human to use. On a troubling personal note, a regular reader of my blog, PlayNoEvil (http://www.playnoevil.com/), was unable to submit comments for a while because my CAPTCHA system relied on colors. However, he has impaired vision. (Fortunately, I could solve this problem by changing the system’s settings.) I am having more and more difficulty getting through some of these systems myself. Personally, I’ve found it more than a bit ironic that interactive entertainment systems like games are even considering using CAPTCHAs, as this seems to be the ultimate admission of a design flaw. Once you are in the situation where security is a serious problem (as opposed to my blog), CAPTCHAs tend to fall apart quickly. The simplest answer for an attacker is to hire someone to process the CAPTCHA or do so herself. Yes, you can outsource CAPTCHA processing for $1 for 1,000 CAPTCHAs and look at what you get12 (from B. Kreb’s “Web Fraud 2.0: Thwarting Anti-Spam Defenses”):

150

Protecting Games: A Security Handbook for Game Developers and Publishers

The quality of recognition is between 90 percent and 95 percent. We support two-word CAPTCHAs. We support mixed upper- and lowercase CAPTCHAs. The volume that we can accept at any moment from new clients is between 500,000 to 1 million CAPTCHAs in day. We automatically issue refunds for any CAPTCHAs that were solved in more than 60 seconds. We automatically return money for solved CAPTCHAs that include incorrect text. There is also the option to buy software that processes CAPTCHAs automatically13.

C HEAT D ETECTION S YSTEMS The dominant anti-cheating tools today are cheat detection systems. The most well-known commercial products are Even Balance’s PunkBuster, nProtect’s GameGuard, and AhnLab’s HackShield. Some game developers have chosen to create their own tools including Valve Software’s Valve Anti-Cheat (VAC) and Blizzard’s Warden. There are also several independent open source security projects. The single biggest advantage that these systems have is that they can be added to a game anytime, even after it has been completed. In fact, Electronic Arts contracted with Even Balance to add PunkBuster to its MMO Ultima Online nine years after the game launched, although it appears that the project was eventually put on hold14. Cheat detection systems are essentially operated as a service. They need to be constantly updated to identify the latest threats as well as to protect themselves against hackers who choose to target the security tools directly. In general, all of these tools work the same way. There is a security client installed with the game client and a central security server that runs in parallel with the game client and game server. The Security Client creates a client ID and may use hardware-fingerprinting techniques to identify the player’s computer. This client ID is used to register the game client/security client pair with both the game server and the security server. The security client has two major functions: It is responsible for analyzing the player computer to identify any sort of threat (such as the radar, aimbot, and other hacks, and, in some cases, key-loggers and other forms of malicious code that can target the game). It is also responsible for reporting its status regularly to both the

Chapter 15 Bots and Player Aids

151

FIGURE 15.1 Cheat detection system architecture

game client and security server—sending a “heart beat” signal that it is still alive and operating correctly (Note: The blind authentication technique discussed in Chapter 14 can also be used to verify the integrity of the security client.) In general, cheat detection systems use the same techniques as anti-virus programs: They scan the entire memory space of the computer looking for items of interest. Instead of looking for worms or virus-infected programs, cheat detection systems look for signatures associated with known cheat applications or malicious libraries loaded in memory. If a cheat signature is identified, the security client sends a notification to the game client and security server. The security client can use whitelist and blacklist techniques to help with the forensic analysis of potential cheat applications. Whitelists are known programs that have been determined to not affect the security of the game and blacklisted programs are known cheating applications. The problem, of course, is that there are hundreds of thousands, if not millions, of different programs that may be installed on a user computer. Also, game cheat writers, just like virus authors, use techniques to hide their applications and obscure their signatures. World of Warcraft hackers used the Sony BMG Rootkit to hide their attacks from Warden within weeks of the disclosure of the rootkit15. It would also be possible for these cheat detection applications to profile all of the programs installed on the player’s computer by scanning the PC’s hard drive, even if the programs are not apparently being run while the game is being played. Because these security clients often report back information about the applications on the player computer, there are some rather serious concerns about privacy that may create legal risks for the game operator or security firm. Most of the security clients do not return actual information back about the applications that are

152

Protecting Games: A Security Handbook for Game Developers and Publishers

running on a PC, but rather send a hash value signature back to the central server to minimize their privacy impact. Whether this is legally sufficient or not is a different question. Hackers do not actually need to stop the security client’s operation, however. Instead, they can spoof the security client’s communications to report that everything is okay to the game client and the security server, even if the security client has been shut down or has detected a hack. The game client is a particular target for this sort of attack: It is rarely designed with security in mind and the security client API (application programming interface—the connection between the two applications) was likely integrated into the game client very late in the development process. Because many games support player-to-player communications, it may be possible for a hacker to send data that looks like a cheat as part of regular game communications to trigger a penalty for another player16. After all, cheaters just want to win, they do not care how they do so. It is important that the security server and game server coordinate their actions. After all, the cheater is really targeting the game client and game server and if the cheater can somehow separate the security systems from the game systems, the cheater will win, even if cheats are detected. Thus, it is critical that the client ID is shared and used effectively by both servers. A cheat detection system is more than its technological platform; it is really a service. The security client is not a preemptive security tool; it only can profile known cheats, just like an anti-virus product. Unlike anti-virus tools, however, which can cover everyone with a Windows or OSX operating system, cheat signatures are almost totally game specific. Game publishers need to contract with the security provider for each game for as long as they want the system to be kept upto-date. For some licensed MMOs, the licensee also has to pay for the service. (I think this is a bad business practice; adequate security should be included as part of any licensing agreement.) The operational activities for a cheat detection system service are as follows: Surveillance—The CDS provider monitors cheater forums and hacker sites, as well as getting information from the game operator about the latest cheats. However, the criminalization of game hacking has meant that some of the most damaging cheats are not being used by many people. This implies that the most damaging cheats will not be found by this sort of surveillance. Anti-virus companies are having the same problem with viruses, worms, and other malicious code being targeted at single companies or even individuals. Collection—Once a new cheat is identified, the CDS provider needs to acquire a copy. Both surveillance and collection require CDS provider personnel to be able to infiltrate cheating communities.

Chapter 15 Bots and Player Aids

153

Analysis—The CDS provider will disassemble, analyze, and determine the risks for the cheat, whether it actually works, how the cheater attempted to protect it, and how to construct the best signature to identify the cheat. Signature Development—The CDS provider may either create a simple new signature to be added to the CDS security client signature database or require an update to the security client to add a new scanning capability. Distribution and Update —The CDS provider must then update the security clients and/or their signature databases. It is important for the CDS provider to ensure that all active security clients are fully updated. The distribution, updates, and operation of the security client all have an impact on network bandwidth and available CPU resources at the player computer. There have been a number of complaints, some quite serious, about the performance impact of these tools on the performance of the game that the tool is intended to protect. One real weakness of the cheat detection system strategy is that it is rarely used to improve the game, just patch over weaknesses. Once a cheat is identified, it should also be assigned to the game’s ongoing support team to see if there is a way to actually solve the underlying problem that allows the cheat. Some skill game operators use cheat detection systems. As skill games, online gambling, and other games-for-money businesses grow, this security strategy will likely fail. Highly targeted, limited distribution cheats can be very profitable in these games, just as they are for gold farmers. As attackers get more sophisticated, the cost for an effective CDS will rise. This may force game operators to bring the service in-house. The most costly portions of the CDS are surveillance and collection. It may make sense for game operators to carry out these activities themselves and only consider outsourcing the remaining CDS functions: analysis, signature development, and distribution. Philosophically, the cheat detection system strategy essentially encourages developer laziness. Rather than avoiding cheating problems from the beginning of the game development process (and, at this point in the evolution of the game industry, many of the cheating problems are quite well known), game developers simply leave cheating and the whole host of operational and support issues to those people unlucky enough to still be on the project after the game is completed. Lack of life cycle engineering and accountability for games is quite costly. The cheat detection system strategy does work very well as a “belt and suspenders” tool to augment strong security engineering throughout the design process.

154

Protecting Games: A Security Handbook for Game Developers and Publishers

As a final note, I have seen a couple of Asian online games experimenting with bundling traditional security software with their game security tools. This is an intriguing idea, as game businesses are hit hard and in their pocketbooks by keyloggers and other viruses and malware.

R EFERENCES 1. M. Shackleford (2008), “How to Play Blackjack,” http://wizardofodds.com/blackjack 2. Stoxpoker.com (2008), “The Second Man vs. Machine Poker Championship,” http://www.stoxpoker.com/man_vs_machine.html 3. Australian IT (2006), Bluetooth Chess Cheat Caught,” http://www.australianit.news.com.au/story/0,24897,20981444-15306,00.html 4. MDY Industries, LLC (2008), “Glider FAQ,” http://www.mmoglider.com/FAQ.aspx 5. B. Duranske (2008), “World of Warcraft Glider Litigation Update: Final Briefing On Blizzard’s Request for Injunction Filed,” http://virtuallyblind.com/2008/08/27/glider-blizzard-response-injunction/ 6. Smik3r (2008), “TF2 Hacks Aimbot NoSpread ArtificialAiming.net Scout Ownage,” http://www.youtube.com/watch?v=LWVqtzK0zf4 7. G. Kasavin (2003), “Call of Duty Review,” http://www.gamespot.com/pc/action/callofduty/review.html (page 2) 8. MDY Industries, LLC (2008), “Subscribe to Glider Elite,” http://www.mmoglider.com/Subscribe.aspx 9. GoGYGO (2008), “GoGYGO Products,” http://www.gogygo.com/products.php 10. Cho J. (2006), “Mouse Plays When Gamer’s Away,” http://search.hankooki.com/times/times_view.php?term=online+game++&path=hankooki3/times/ lpage/culture/200603/kt2006032619493065520.htm&media=kt 11. Carnegie Mellon University (2008), “What Is a CAPTCHA?,” http://recaptcha.net/captcha.html 12. B. Krebs (2008), “Web Fraud 2.0: Thwarting Anti-Spam Defenses,” http://voices.washingtonpost.com/securityfix/2008/08/web_fraud_20_defeating_anti-sp.html 13. CL Auto Posting Tool (2008), “CL Auto Posting Tool,” http://www.adsoncraigs.com/ 14. Electronic Arts (2006), “PunkBuster on Hold,” http://www.uo.com/cgi-bin/newstools.pl?Article=9619 15. R. Lemos (2005), “World of Warcraft Hackers Using Sony BMG Rootkit,” http://www.securityfocus.com/brief/34 16. Pansemuckl (2005), “The Unerring PunkBuster...,” http://forum.netcoders.cc/announcements/14061-unerring-punkbuster.html

16

Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions

he Internet is like the Wild West. Totally untamed and dangerous, we are all told. Hackers, thieves, and criminals lurk around every corner. No one seems to have told a lot of game developers, as they regularly leave their online games wide open to all sorts of attacks.

T

Network attacks target game applications from their network interface. Once again, attackers benefit from the habit of developers to start with a standalone, single-player game and then add online play as a feature. Building a safe online game requires a level of formality about time, transactions, and interactions that most programmers are not used to. Consoles and MMOs are the main targets. Typically, PC games are attacked more directly through the game application.

ACID, D UPES ,

AND

SQL A TTACKS

Games are transactional systems. Unfortunately, game developers often fail to build their games on a foundation of well-constructed transactions and attackers regularly exploit these poor implementations. Even simple stock market games can be vulnerable. Market games are very popular with aspiring investors and the genre has grown to encompass everything from celebrities to fashion and even the U.S. Congress1. Trading is an easy game mechanic to understand and reasonably easy to implement. Developers need to be careful, as CNBC found out with its “Million Dollar Portfolio Challenge” in 2007 where players determined that they could post virtual stock trades after the real market had closed. The technique was fairly simple—they entered their trades before the stock market closed at 4PM Eastern Time, but did not execute them until after 4PM when the companies announced their earnings and their stock prices jumped in after hours trading. If the stock didn’t pop, no problem, the player simply didn’t complete the order 2. The scandal was

155

156

Protecting Games: A Security Handbook for Game Developers and Publishers

eventually exposed and caused a delay in awarding the top prize and caused a black eye for what would have otherwise been a very successful promotion. These types of race conditions can also happen within a PC game, as Lionhead found with its Fable 2 pub games3. Mostly, however, these attacks occur over networks. Virtually every online game has been hit by some sort of dupe attack. Players use the game’s interface and controls to induce the game to duplicate virtual items or currency and can cause great difficulty for the game operator. Recently, the Philippine licensee of Ragnarok Online, Level Up!, had to roll back the game (costing players two weeks of game progress and leading the company to provide two weeks of extra game time and other bonuses in compensation) because of a severe dupe problem that resulted in nearly 500 percent inflation of the game’s currency 4. Dupe attacks are often caused by race conditions in different parts of the game application. Different parts of the application are updated at different times or “trust” data from unreliable, intermediate sources (often internal variables or cached information). In the CNBC case, it appears that permission to make an order was determined at the time the player chose the stock ticker rather than when they selected the number of shares and clicked the Order button. World of Warcraft apparently had a similar race condition in which a player could transfer all of her gold from one account to another, log off quickly, and then log back in again and the gold would still be in the first account5. The solution to dupe attacks comes from applying good database design principles to game transactions. ACID is an acronym for the properties necessary to ensure that transactions are properly processed 6: Atomicity—Either an entire set of transaction tasks occur or none do. Consistency—No bad data will be introduced into the system due to a transaction. Isolation—State or date affected by the transaction will not be visible to entities outside of the transaction until it is complete (or rolled back). Durability—Once completed, a transaction will persist. In MMOs, the server is typically the authoritative source for information and so there is a single database which, conceptually, makes implementing proper transactions easy. For peer-to-peer games, however, ensuring data consistency over a network can be very challenging from a technical perspective. It is also important to provide a clear player display and control process to handle rollbacks to a previous state and other problems.

Chapter 16 Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions

157

So far, we’ve discussed action-based networking and state-based networking. Some MMO developers have chosen a truly dangerous approach that lies between the two: SQL-based networking. SQL (Structured Query Language) is a widely used standard protocol for communicating with a database. I’ve heard anecdotally that there is at least one MMO that ships with a full SQL client embedded in the game client. Because SQL communicates directly with the database that stores the game state, SQL commands can be used to directly read, write, and edit anything about the game. In some sense, this is even worse than a state-based system. A malicious user with full SQL access to a database can create new items or player attributes or pretty much anything they can imagine. Some web applications are vulnerable to SQL injection7 attacks—where players can somehow bypass the server application to communicate directly with the database. There are tools and programming techniques to stop such attacks from happening by stopping web users from entering any SQL commands via the web interface. However, building a game that uses SQL for networking is almost impossible to protect because the player client application relies on posting player actions or state updates via SQL queries. The best way to protect against these attacks is to insert a proxy between the game client and database server that converts game actions into SQL queries that the database, server-side data store, or game application can process.

D EFENSIVE P ROXIES Proxies are a powerful security tool that, if implemented properly, truly provide “defense in depth.” A communications proxy takes incoming communication packets or streams and parses and validates its structure and content independent of the state of the underlying application. A proxy answers the question: “Is this a well-formed communication?” Once processed by the proxy, the game application determines if the message is appropriate to the game’s current state and that the message is from a valid source. Only if an incoming message is validated by both the communications proxy and the game application will the game application proceed and process the player action. Standard Internet firewalls and packet inspection tools are, essentially, generic proxies that can parse and validate a wide range of web protocols. The art of proxy design is to manage the trade-off between the functions of the proxy and the actual application (see Figure 16.1). Some proxy systems go an extra step and actually reformat incoming message data into an alternate format for internal processing to further isolate external from internal communications.

158

Protecting Games: A Security Handbook for Game Developers and Publishers

FIGURE 16.1 Defensive proxies

Proxies can also handle access control, source authentication, and they are a natural location to implement logging. Proxy servers can be implemented in front of game servers instead of, or as a complement to, conventional firewalls. Where possible, they should be designed to be stateless so that they can be replicated using low-cost real or virtual servers. A stateless proxy server design will make it easier for the game service to scale efficiently. An implicit advantage of a deep, powerful proxy design is that having a separate software application (and, ideally, a different development team) will likely tighten the implementation and security of the overall system’s interfaces by both groups. Problems such as buffer overflows and malformed messages will have at least two independent chances of being caught, as the two development teams should each be looking at the incoming data separately (simply replicating the message parsing code in the two systems will undo this security benefit, of course). Defensive proxies can be part of the architecture for peer-to-peer systems as well as client-server applications. They can provide performance as well as security benefits and can help cleanly decouple the networking subsystem from the core game application (local player actions could be processed through the proxy service as well so that the game engine has a single interface for all players).

H ACKER P ROXIES A hacker proxy is typically a computer that sits between the target platform (PC or console) and the remote server or other player platforms that is used as a means to attack games on their network interface. It is possible for the hacker proxy to be an

Chapter 16 Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions

159

additional application on a player’s PC that intercepts and alters network packets before they are sent to other players. Another hacker proxy technique is to simply insert a switch that disconnects the player’s PC or game console from the network8. A consistent, underlying problem with networked games is that game designers often assume that they have secure, reliable communications. However, it is sometimes still possible to attack a game even if its communications are fully encrypted. Halo 2 on the Xbox console had some serious proxy problems, as discussed in an entertaining and detailed article at GamesFirst! by Shawn Rider 9: The bridger is the center of power in a cheating setup. [The cheaters] use a fairly complex method to run the Xbox’s Internet connection through a personal computer. On the computer [the cheaters] use [commercial] software, including the popular Zone Alarm firewall program, to control what computers the Xbox can connect to. By using some tricky methods, [the cheaters] can completely control the hosting of the game. They can determine who can connect, they can lag out [induce sufficient network delays so that the player will be knocked out of the game] especially good players on the opposing team, and, most importantly, they facilitate the “standby” technique. The standby cheat is simple: Cheaters with cable or DSL modems will push the “standby” button on the modem [or in software on the bridger computer] to force everyone else in the game to be presented with the blue screen of “waiting.” During this time, the gamer who initiated the standby can move in the game world freely while all of the other players stand frozen in time. The cheater can blow away a flag holder, for example, return the flag, [and] then press his modem’s standby button again, resuming the game. It is easier to understand hacker proxies in terms of chess. Players A and B are playing chess online. The game developers didn’t really bother to understand the rules of the game, so they just implemented the game as a big blob of code and game state. The easiest way to network this game is to duplicate the game state over the network (here is where developers can fiddle with object synchronization and differential object synchronization, prediction, and all sorts of clever things). So, basically when Player A makes a move, the updated game board is sent to Player B. Then B moves (or, if they are playing Real-Time Chess, they both move) and the game board objects are synchronized. Viola—a “network” game. This is also why it is so easy to build these “network games” ... and why it is so easy to hack them.

160

Protecting Games: A Security Handbook for Game Developers and Publishers

This attack works by abusing the multitude of problems here. Evil Player B wants an edge. So, what she does is stop listening to Player A for a while and simply run the game (she can even add in suitably “helpful” moves on Player A’s behalf to get the results she wants). Once Player B gets the game “just right,” she reconnects to the network and sends the game to Player A... whose computer simply accepts the data. The problem is that with anything but the most trivial game, it is impossible for the receiving game object blob to validate the new game object blob against any form of rules. Think of looking at a chess game if you were allowed to move all of your pieces at once, but you are only able to do validation of the game board at Time 1 versus the game board at Time 2. There are two types of hacker proxies: White Box Proxy—A proxy application that can peer into the game data packets and edit them, control when they are sent, reorder them, as well as pass data on to either the local game instance or the remote game instances. This is the most powerful form of proxy and may not always be practical (for example, if hardware and cryptographic security work effectively on a game console, it may not be possible to edit packets or re-order them—your mileage may vary). Black Box Proxy—A proxy application that cannot peer into the contents of game data packets. A black box proxy can control game data packets externally: controlling when a packet is sent, the order in which packets are sent, whether packets are sent multiple times (replay), and whether a packet is sent at all. This kind of proxy can sometimes be implemented by simply pressing the Standby button on a cable modem, as noted previously. This type of proxy cannot really be prevented, but should be detectable and addressed in the game’s design and networking system. Hacker proxies can be used to implement a wide range of attacks on a game, purely from its network communications: Speed Hack—There are three types of speed hacks that work by accelerating or decelerating the pace of network communications. This can sometimes be implemented even if network communications are encrypted: Message Overflow/Speed Hacks—By driving messages/commands at a pace that is not expected by the remote system, a malicious user can perform substantially faster than permitted 10, 11.

Chapter 16 Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions

161

Lazy Communications/Telepathy—By slowing the apparent response and reception of messages by the recipient application, a malicious player can effectively “predict” incoming data and respond at an advantage. Late Bet—Wagers are a sure thing when you already know the outcome. Gambling cheaters target all sorts of games to figure out how to place a bet after the event has occurred. Late bet scams have shown up in “The Sting,” a real racing scandal in New York12, and at roulette, craps, and other casino games. Standbying: Lag/Resynch Attack—An extreme version of the lazy communications attack. It works by dropping the malicious computer out of the network/ game and proceeding with game play disconnected. Then the malicious player reconnects in a preferred state13, 14. The length of time that a game will tolerate a dropped or slow connection can vary widely. This attack is predicated on trusting data from a remote player. Typically, it requires a state-based resynchronization model. Packet Hack—The raw manipulation of network packets. It is the network equivalent of a memory editor. Good network manipulation tools will correct checksums, sequence numbers, and other non-secure message integrity features. Encryption might not always stop packet hacks, because some cryptographic modes allow linear changes to encrypted data to be undetected. This type of manipulation can be very effective if the hackers know what the underlying text is and what they wish it to be without breaking the encryption function. Bridging—A special, more common, case of a packet hack. It works by using a proxy, such as a firewall, to pretend to be a different server or computer. Bridging is typically done as part of another attack because the specified address, often a company server, is considered trusted by the client application. Game Injection—A wholesale synchronization attack. The hacker can save the state of a favorite game with the right number and type of players and push its state out to the other players. Note: This may require a proxy to facilitate the attack. Depending on the networking architecture, a malicious player could use a proxy to “push” a preferred game state to an accomplice who would then propagate it to the other players. Abandonment—Some players simply abandon a game to avoid losing or hurting their ranking or status. They break the connection to the remote players or server or simply turn off the platform. The challenge for the game operator and other players is to determine the difference between “natural disasters” and poor sportsmanship (this issue is discussed further in Chapter 20).

162

Protecting Games: A Security Handbook for Game Developers and Publishers

Well-constructed encryption and authentication systems at the network layer can stop many, but not all, of these attacks. Standbying and lazy communications, for example, do not require manipulating the content of the message packets. These attacks only require control of the physical and electronic network to slow down or stop the delivery of game data packets. Server-based games can address these problems by having a formal, unforgiving model for controlling network time, as discussed in the next section. At a low level, IT GlobalSecure’s SecurePlay Strobe and Act protocols were designed to fight many of these attacks for both client-server and peer-to-peer games. These protocols work by creating a logical network “tick” that all game players share. Essentially, the protocols require the players to all commit to their next action or state update and then reveal them as if they were playing an elaborate sequence of the rock-paper-scissors game: // Strobe Protocol Mi = {i,Ti = T(Ai)}; // each player i selects an action Ai and computes its // irreversible transform and builds a message package Mi Send(Mi); // each player sends its identity and the computed transform // to all of the other players Store Mi; // each player stores all incoming Mis from the other players if (all non-internal Mi’s received) { SendInternal {i,Ai}; // after receiving the transforms from all of the other players, // each player i sends his or her action to the others } for each {i,Ai} { // for each received action Extract (Ti from Mi); // extract the previously stored transform for that player’s action if (T(Ai) != Ti) then { do exception processing;} else { store (i,Ai) }; // accumulate players’ actions for network tick } if (all player actions received) { process all {i,Ai};

Chapter 16 Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions

163

// once all player actions are received and validated, update the game } repeat; // start next game tick

The protocol is structured so that all players contribute to updating the game (either actions or state) without knowing the activities of the other players. Therefore, it is impossible for a player to manipulate lag or benefit from prior knowledge of other player’s actions. The Act protocol extends this concept by integrating the collaborative random number generation process discussed in Chapter 13. There is a definite performance impact from using this protocol; it requires two sequential messages to update the game’s state from each player. This can be compensated for in the game’s design or by pipelining a parallel set of strobe protocol instances (see secureplay.com for additional information).

T HINKING A BOUT N ETWORK T IME : A CT , B UT V ERIFY Minute by minute and day by day, we tend not to think too much about time. It flows along unnoticed. Unfortunately, as you read previously, neglecting time can cause real cheating problems for game developers. Network lag and race conditions are often hard to test or replicate and cause problems for all sorts of general business applications. The default strategy for handling time has been to make it seem as smooth as possible for players. Errors are usually assumed to be accidental, not malicious. The trusted client problem often includes a substantial trusted client time component. Developers need to take a more formal view of time and create a systematic “time policy,” as follows: How out of synch should players be allowed to become? Where does a game roll back to? How do you present this to players? What are the consequences of a dropped connection? These questions and more must be addressed consciously by game designers or they will be handled implicitly in the hands of individual game programmers. Key factors that need to be considered include: Delay—What is the time interval after which the game must stop? Interaction—How “old” can an incoming action be and still be accepted by other players? Actions from remote players are always associated with some time in the past. How does the game play system integrate old remote actions with new local actions and somehow synchronize state between the players?

164

Protecting Games: A Security Handbook for Game Developers and Publishers

Tick—What is the basic “tick” of the game’s network clock? In some sense, there needs to be a notion of “minimum duration” during which each player can take only one set of actions. If the game’s internal temporal model for “ticking” and player interaction does not correspond with the game’s network model, game play can break down. Interference—The interactions of different player actions need to have reasonable and understandable consequences based on each player’s notion of state and action. Display Prediction and State Confusion—The interactions of the player display or presentation and the actual game state can become complicated by poor predictions by the game presentation engine and the actual actions of the remote player. Does a player have a shot available at a target? What does a maneuver really look like relative to another player? This is an important issue to ensure that real-time games feel responsive and that the display is accurate and smooth. These issues, obviously, only exist with real-time games. Turn-based games can be paused easily and rolled back to the last action. Although the trend in game design has been towards real-time games, another advantage of turn-based games is that they can be “played by mail” and so players do not have to reconnect in real time to resume play in case of an interruption. This makes game abandonment as well as many other network attacks almost irrelevant. It is possible to decompose players’ actions over networks into a series of discrete phases for which game developers need to define clear time policy choices: Decision—The instant an internal player’s action enters the game play engine. Commitment—The instant before which the action will be automatically aborted/changed to address new incoming information that was not available when the player made a decision. Success—The instant after which the action has some probability of resolving successfully. Resolution—The instant when the action triggers consequences in the game play engine. Conclusion—The instant after which the player is allowed to choose a next action. This is a sample time policy model. Different models are certainly applicable to different games and networking strategies. The key factor for a successful network game experience for players from both a game play and security perspective is to

Chapter 16 Network Attacks: Timing Attacks, Standbying, Bridging, and Race Conditions

165

systematically address how game state will be updated, how players’ actions will be resolved through the games rules, and how the game’s display will communicate state in a networked environment.

S ECURING T IME Handling time is probably the most difficult problem for multi-player and networked games. It collides with hard problems from computer programming for handling concurrency and simply handling lag and latency over wide area networks. Securely managing time in a game is aggravated by cheating players who are more than willing to abuse game time, network communications, and synchronization services to their own ends. Turn-based gaming is an easy answer, but it does not meet the needs of many developers who want to fully tap the power of gaming platforms and modern broadband communications.

R EFERENCES 1. A. Varney (2007), “Offbeat Sports Games,” http://www.escapistmagazine.com/articles/view/issues/issue_78/446-Offbeat-Sports-Games 2. T. Catts (2007), “CNBC’s Easy Money,” http://www.businessweek.com/bwdaily/dnflash/content/jun2007/db20070607_007145.htm 3. R. Miller (2008), “Fable 2 Pub Games Exploit Will Make You Very, Very Rich,” http://www.joystiq.com/2008/08/15/fable-2-pub-games-exploit-will-make-you-very-very-rich/ 4. Level Up (2008), “RF Online Economy Fix,” http://risingforce.levelupgames.ph/news_main_view.html?rid=155 5. Ryan A. (2006), “Players Found New Golden Exploit for WoW,” http://mmorpg.qj.net/Players-found-new-golden-exploit-for-WoW/pg/49/aid/75854 6. Wikipedia (2008), “ACID,” http://en.wikipedia.org/wiki/ACID 7. Wikipedia (2008), “SQL Injection,” http://en.wikipedia.org/wiki/SQL_injection 8. MFCrow (2008), “Xbox Live Lag Switch: JRG 11.5,” http://www.youtube.com/watch?v=jvIyAkQ49Qo&NR=1 9. S. Rider (2006), “A Bridge Too Far: The World of Halo 2 Cheating,” http://gamesfirst.com/?id=1342 10. T. Bramwell (2004), “Blizzard Bans World of Warcraft Cheaters,” http://www.gamesindustry.biz/content_page.php?aid=5800 11. CCP Wrangler (2007), “Rapid Fire Exploit,” http://myeve.eve-online.com/ingameboard.asp?a=topic&threadID=657524 12. J. Drape (2002), “HORSE RACING; Pick-Six Fix Admitted As Giuliani Steps In,” http://query.nytimes.com/gst/fullpage.html?res=9905E5DC1439F932A15752C1A9649C8B63 13. B. Kuchera (2006), “Saint’s Row Receives Quite the Patch,” http://arstechnica.com/journals/thumbs.ars/2006/10/31/ 14. N. Doerr (2007), “Insomniac Sets Up a Ban Policy for Resistance,” http://www.ps3fanboy.com/2007/04/27/insomniac-sets-up-a-ban-policy-for-resistance/

17

Game Design and Security

ame design is the foundation of a fun, successful, entertaining or educational game. One of the keys to making a great game is ensuring that the game design—the rules and framework for how the game is played—keeps the players playing by the game’s rules. Unfortunately, computer games can hide weak designs behind pretty graphics, stunning animations, and elaborate plots. At least, until there is more than one player involved.

G

This discussion of game design is not about creating a great or even a good game; it is about avoiding design traps that undermine the intent of the game design. There may be cases where it is desirable or necessary to build a game with a known security weakness. It is essential that when this choice is made, a game designer does so consciously with an appreciation for the consequences. Ideally, security constraints to stop cheating, piracy, and other forms of game abuse should spur game designers to create successful games that also avoid the problems or turn security problems into game play features.

D ESIGN E XPLOITS One category of game security problems should be entirely avoidable: exploits of game design flaws. As introduced in Chapter 13, a game design exploit is a weakness in the game design if it gives players who use it a substantial, unintended advantage over other players. Game design flaws are often the result of the rush to complete games and lack of focus on game design analysis. Within days of the launch of Age of Conan, for example, players with Demonologist characters found a way to reach the top level in the game with just four days of game play 1. Economic systems, combat, movement, and other game systems too often have serious flaws that arise from focusing on the graphics and the cosmetic “chrome” of gaming rather than proper design and thorough game play testing. Although analysis is useful, play testing using paper and pencil may be the best way to exercise game systems cost effectively and eliminate the worst design exploits. 166

Chapter 17 Game Design and Security

167

C OLLUSION Collusion, first discussed in Chapter 13, is one of the more pernicious problems for computer games. When players are playing online, there is no way to prevent players from communicating and coordinating their plans, especially if they do so outside the game. Simply making collusion against the rules, as Svenska Spel found at great expense with its flawed lottery game2, is futile. The easy answer, making collusion a legal game mechanic—cooperation—is a great option when it is possible. There are other design strategies. In-game betrayal is very effective. CCP Games’ space-based MMO EVE Online has numerous instances of players backstabbing each other. Cooperation is allowed, even encouraged, but the game’s deep economic systems mean that betrayal can be very profitable or just fun. In one example among many, a player set up a bank inside the game that a large number of other players used for a while earning interest and making loans—that is, until the bank operator ran off with the equivalent of $170,000 in virtual currency 3. Cooperation and competition dictated by the game mechanics is also an option. The Austrian card game, Königrufen (“The Calling of a King”)4, has an elaborate bidding system, similar to that in Bridge. The bids themselves determine player partnerships—with some hands being played solo and others with partnerships based on calling a king by suit, hence the game’s name. If you are the player with the called king, you are the partner of the declarer for that hand. Many games incorporate wagering as a game mechanic. For these games, unrestricted side wagers for or against any player can mitigate the benefits of collusion. The only two games that I have seen that use this approach are my favorite casual board game called “The Really Nasty Horse Racing Game” 5 and the dice game craps. Online poker services claim to detect collusion through extensive statistical analysis of game play and patterns. However, the weakness of online identity and the financial benefits of serious collusion make the effectiveness of such techniques suspect. Game operators can try to use platform fingerprinting, IP address information, account information, bank information, and basically anything else they can find to create enough identity information to look for teams of players. Without strong identity, any statistical analysis is going to be pretty weak. Even if you can somehow detect a player team, the real question becomes what to do about them.

T RIVIA G AMES Trivia games are terribly popular and terribly difficult to secure as online games. First, trivia games as a category are inherently weak in the world of modern computers and the Internet. Players can collude, research answers, and, most dangerously, build a catalog of questions.

168

Protecting Games: A Security Handbook for Game Developers and Publishers

The cataloging problem is expensive to fight. Basically, every time the game is played, the questions that are asked (and their answers, if revealed) can be added by malicious players to a catalog list that can be used by their comrades. Economics works against the game developers: It costs the developer more money to create each question than it does for cheaters to catalog the answers. Ideally, from a security perspective, a question should be used only once. In practice, questions will need to be used many times. How does one try to balance this essential inconsistency between security and business? Here are some ideas: Don’t Reveal Individual Answers—Only report the bare minimum amount of information to the players—whether they won or lost, got to the next level, won a prize, and so on—without revealing the individual answers to the questions. This does not prevent cataloging of questions, but it makes it more difficult to collect the answers. Cost of Entry—Create a cost to enter the game. This often creates a legal problem for trivia games where they can potentially become gambling games instead of contests for fun (see Chapter 31). Strong Identity—If the game operators can create a strong identification of each individual player, they can fight multiple entries by individual players. This does not stop team collusion. Split Question Pool—Once a player answers a question wrong (whether the answer is revealed or not), she is switched to a question pool that is not used for the “big prize.” This reduces the number of “important” questions that can be revealed to any given player. Analytics—It is important to track the number of times a question has been asked and how many times it has been answered correctly. Also, it would be valuable to track changes in any statistical changes in the likelihood that a player answers a question correctly, because this could be a good indicator of cataloging (if the observed daily rate for answering a question correctly jumps from 20 percent to 60 percent, the question has likely been compromised). Honeypot Questions—These questions are asked more often (not drawn from the ordinary random pool) and are used to help model cataloging efforts by players (by determining how quickly questions become “easy” for players). The question may be extraordinarily difficult or even have a wrong answer to help identify anomalous player behavior. False Game—The way that players actually progress through a contest is not tied to their answers in the trivia game, but based on some other criteria. For example, simply entering a trivia game during a day (or achieving a modest,

Chapter 17 Game Design and Security

169

minimum score) may be enough to be allowed to progress to a final drawing for an advergame. Multiple Tiers—Divide the game into multiple tiers that act as filters to reduce the number of questions that are exposed to a large game-playing population. Non-Traditional Question Presentation Methods—Use voice, imagery, and other alternative means to convey the questions to players. This makes cataloging harder; it does not prevent it. It may also drive up the cost to create each question, which can have a net negative impact on the game’s security. Face-to-Face Play—Switch players to a face-to-face competition after preliminary, online game rounds (this is essentially another multiple-tier system). The potential embarrassment of not being able to use a catalog or other cheating methods in public can act as an additional deterrent. Trivia games are essentially a resource battle between cheaters and developers. The developers want to reduce the effective cost of creating each question and maximizing the number of times that the question can be reused, whereas the attacker wants to acquire the answers to the questions as cheaply as possible. As noted earlier, from an ideal security perspective, each question should be used only once and the sequence of questions should work to rapidly filter players away from victory and exposing unused questions.

W ORD , N UMBER ,

AND

P UZZLE G AMES

Brain Age is a very successful and popular “self-improvement” game and it has a number of online imitators. However, games that rely on basic mathematical, word, or other puzzles are not very likely to work in an online multi-player, competitive environment. It is too easy to cheat at these games and impossible to protect them. The Scrabble Word Finder7 provides its users with all of those wonderful sevenletter words and the longest words based on their current tiles (the tool apparently does not do any analysis of the current game board looking for highest scores, but Scrabble players tend to do better by cycling their hand as quickly as possible). Scrabble Word Finder is an example of a “strong play” tool. These tools do not give optimal strategies or perfect play techniques, but rather are “good enough” to allow their users to defeat most opponents. Because there are opportunities to play more game sessions online than there are to play games face-to-face, these strong play tools are good enough to give a player that uses them a substantial advantage. The tool doesn’t necessarily need to find the actual answer, but needs to merely present a reduced set of good options that a human player can use to gain an advantage.

170

Protecting Games: A Security Handbook for Game Developers and Publishers

Word, number, and puzzle games are generically vulnerable to “catalog attacks,” where cheaters basically exhaust all of the game play options to find good or best solutions. A catalog attack can even work with a physics-based game if the range of player choices is sufficiently restricted. Basically, the catalog tool would rapidly model a whole series of different player choices and then pick the best options or further refine possible player choices based on the best results from the simulation. This may be substantially faster than attempting to algorithmically solve the game. A cheater may find it faster to search for good solutions by trial and error rather than attempting to derive an optimal, closed solution to the game. This is especially true if the game’s interface effectively restricts the granularity of player choices (for example, restricting distance to multiples of a unit value such as inches or direction to a multiple of two degrees).

A LGORITHMIC G AMES , P HYSICS F LAWS ,

AND

P REDICTABLE B EHAVIOR

Many games are based on underlying mathematical models. In the real world, modeling golf, darts, and pool would require including a massive number of variables and complex interactions. For golf they are daunting—the speed of the swing, the precise angle and position that the club hits the ball, the wind, the terrain from where the ball is launched, and certainly the topography of where the ball lands. Other games, such as blackjack and roulette, rely on the random deal of cards or the spin of a wheel to make them interesting. In some cases, there is less complexity than people thought. For decades, players have been counting cards in blackjack to try (mostly unsuccessfully) to get an advantage over casinos. There were no strong card counting systems until the publication of Dr. Edward Thorp’s “Beat the Dealer,” which described a counting scheme that would give the player a mathematical advantage over the table7. Initially, the casino industry was very concerned by Dr. Thorp’s technique. However, the casinos found that most players actually couldn’t follow the system—although many players tried and tried and tried and led to huge growth in blackjack revenues for casinos. Unlike most human players, computers can easily implement such counting systems (as can highly coordinated blackjack teams) and so are banned from casinos. Modern computers have been able to solve roulette and have been used covertly by cheaters in casinos. Interestingly, courts in the UK and Spain have ruled that such devices are not illegal (just as card counting isn’t illegal), and it is up to casinos to detect and control their use8.

Chapter 17 Game Design and Security

171

For standard computer games based on physics, the thousands of variables found in real life are commonly collapsed into a very simple mathematical model. Algorithmic attacks basically target the underlying mathematical model for the game to find the best solution. Even if the attacker doesn’t know the precise model that the game is using, physics is physics and is not a secret. By carefully running experiments and monitoring results, the attacker can reverse-engineer the game’s underlying mathematical model, or at the very least, the most sensitive parameters affecting an action’s outcome. Skill games based on “turn-based physics games” seem to be growing in popularity —darts, pool, pinball, pachinko, and, of course, golf. Because the games have a business model tied to competition based on the skill of the game’s players, there is a real concern that players might be able to use automated tools to optimize their play (after all, these games are really math problems and not based directly on human physical skill) and win money unfairly from the game operator or other players. How much risk is there in solving a math problem? Although the developers may hide the math behind a pretty interface, the players are really providing inputs to solve a mathematical equation. And, because the game is turn-based, a motivated cheater (or math student) should have plenty of time to figure out the best solution. One option is to put the mathematical model on the game server. This seems obvious, except that there are a number of game services today that still download the game’s mathematical model in the game client, Also, running the algorithms on a central server doesn’t necessarily stop cheating. A mathematically inclined cheater can still derive a “model of the model” on the server by accumulating data from a number of game plays, looking at the results, and developing a better and better local version of the server game model. For linear equations, if there are N unknown constants, it is going to take me N turns to fully determine the equations. Physics equations aren’t always linear, but the idea is the same. After all, the underlying physics models are available in high school or college textbooks; the cheater just doesn’t know how much they have been “tweaked” by the game’s developers. A studious mathematician can work to isolate variables. Such a person could run experiments in the game world to make it easier to determine the underlying model (making short putts on different types of terrain to figure out the game’s friction model, taking multiple shots in different directions to the wind to determine the windage model, and so on). And, the model just has to be good enough to provide superior play; it does not need to be perfect.

172

Protecting Games: A Security Handbook for Game Developers and Publishers

RANDOMIZE THINGS

A

BIT

Wind, different types of grass, and any other randomized feature can make building the model harder for the hacker. Unfortunately, random means the game is no longer a pure skill game (at least in some jurisdictions—see Chapter 31 on skill games). Developers may also “randomize things a bit” by altering the player’s input to prevent analysis and to fight botting. Randomness can also creep into the mathematical models unintentionally. The complexity of running the simulation in a general-purpose microprocessor, including its specific resource loading and timing, and even the behavior of the rendering engine, may introduce elements of chance into determining the game’s outcome. USE ABSTRACTION Although game developers talk about using physics to increase realism, the models in the game are still abstract equations. Altering game mechanics to utilize abstraction may create interesting and dramatic game play, particularly for player-toplayer interaction, which can often become very uninteresting (as seen by the button mashing of many fighting games). In addition to randomizing inputs to physical systems, abstract game mechanics can include table-driven results driven either by random inputs or by the interaction of discrete choices by multiple players (such as a combat result table based on cross referencing the tactics chosen by each player). LIMITATIONS

OF

ALGORITHMIC GAMES

Physics and algorithmically driven games have a lot of powerful advantages, but developers should use caution if cheating is a potential issue for the game: Physics Is Not Secure—The combination of the bouncing ball and spinning wheel is a fairly complicated mathematical model to attack (as seen in roulette). Most games that use physics are not nearly so sophisticated. Anything That Can be Modeled Will Be Automated—As discussed in Chapter 15, players will use whatever tools it takes to develop a superior or dominant strategy. The strategy doesn’t have to be perfect to give them a substantial edge. Unauthorized State Information Is Dangerous—Players don’t really need to see the spinning ball at a roulette table except as a confidence-building measure that the casino isn’t cheating. Similarly, in online games, it is risky to load data to a client that is not necessary. Of course, unlike roulette, computer gamers have exact state information, so it is much less difficult to collect the data needed to attack the system.

Chapter 17 Game Design and Security

173

Convenience Is a Trap—How would one stop this problem for roulette? Close wagering once the ball has been thrown. More bets placed means more money for the casino, but the ritual of roulette would work, and the game would be much more secure, if no bets were allowed once the ball was thrown. Security shortcuts are routine in computer games, yet they regularly cause problems. Some game models are fairly trivial. A number of MMO’s use “static spawning” techniques to generate monsters for players to fight. This technique, where specific monsters appear at specific locations at specific times, has led to a number of annoying problems. Players “camp” to await the spawn of certain high-value creatures. Gold farmers create highly efficient routes from monster to monster to maximize their productivity. In these cases, some randomization could be quite helpful—varying the location, nature, and even the activities of the creatures could undermine many abusive play tactics—and it might even make the game world appear more “real.” BOTS ARE HARD

TO

FIGHT

Anyone who has watched the tremendous deviousness of casino cheats would be reluctant to trust in the ability of game operators to detect data collection and analysis systems such as those used for roulette and card counting. These players are not breaking the rules of the game’s play, but rather the “house rules” of the game operator. The game’s internal security mechanisms don’t protect it from these attackers. Recently, many developers have embraced physics as a way of efficiently enriching game play. As with any sort of procedural system, developers should be careful: Things that are easy to make are often easy to break.

S PEED , T WITCH , T IMING ,

AND

P IXEL P RECISION

One of the wonderful things that a computer can do is run really fast with amazing graphics—and game developers have been pushing the limits of both as long as computers have been around. Games that rely on reflexes and precision work fairly well for single-player and social games. Once multiple players are competing over a network, however, the game is a perfect candidate for botting, as previously discussed in Chapter 15. A game like Guitar Hero, which uses a plastic guitar as a controller or Dance Dance Revolution, which uses a floor pad, or the Audition casual dancing MMO that uses the keyboard, are all at their core timing games. For a computer, it is easy to control simple button press indicators and, of course, the computer has very precise timing.

174

Protecting Games: A Security Handbook for Game Developers and Publishers

The main reason that console games that rely on dexterity have had limited problems with cheats is that they are played alone or socially with friends. This is not true online. There have been a number of attacks that have targeted Audition9. Because the game relies on timed button press in response to a simple pattern (left, right, up, down), it is a perfect candidate for automation. Although Audition can be attacked with a simulated keyboard, many first person shooters (FPS) are effectively attacked with a simulated mouse. Just as with physics games, there may be real game play (and security) advantages to looking at abstraction as a way to mitigate automation attacks. For an FPS, no matter how accurately the player’s mouse is positioned, the player’s accuracy could be a function of her speed, length of time in a given position, whether she is crouching and hiding from enemy fire, and so on. True reflex games, like Audition and Guitar Hero, may need to have their mechanics reconsidered for online play. For Guitar Hero, a webcam might be helpful. High-speed games also have problems because of network lag. The delay between player actions and game responses often force game developers to pre-position information that allows a player to cheat. A terribly simple option is simply to force players to slow down. One of the reasons for pre-positioning data is that players can and do move quickly in these games, which requires art assets to be loaded very quickly. However, this problem is really a function of game design choices that are quite abstract. Players are, generally, nearly invulnerable in these games and are often blessed with near infinite ammunition. They are hard to hit and, when hit, take very little damage, and, when they take damage, it has very little impact on their in-game abilities. This is not realistic. If you look at the TV news or film of real combat, people move very carefully when other folks are shooting at them. They do not want to die. Simply making games more lethal would eliminate a lot of the insane level of activity that is routine in games today and a source of security problems. Also in real life, if you are waiting in ambush for someone, you have a huge advantage. A defender who is dug in, has her ranges set, and targets selected will wipe out any fool who comes sprinting in front of her. Another option is to turn ambushes and other “quick” events into mini-games or even cut-scenes. It would be interesting to use “reaction shots,” where we see the face of our protagonist as she enters a room or turns a corner just as we are used to seeing in film, as a way to avoid pre-loading data as well as to accurately capture the disadvantage and risk of such actions. A more technical option could be to pre-load multiple data sets and only activate one at the time, when needed.

Chapter 17 Game Design and Security

S TRONG

AND

D OMINANT S TRATEGIES

AND

175

D EEP G AME P LAY

There are too many computer games that have strong or dominant strategies. This makes game play tedious and is ideally suited for automation, because the hacker doesn’t even need to think about how to play, just how fast to shoot and in which direction. Although many games provide a multitude of choices, most seem to have little impact. The stereotype of button-mashing for console games or madly clicking in MMOs is all too accurate. Recently, Age of Conan attempted to enliven MMO combat with a system that takes facing and direction of blows into account. It remains to be seen whether this will affect player satisfaction (or scripting or automation or other cheating problems). The “grind” that most players criticize about online games makes automation very tempting. First person shooters that rely on speed and reflexes rather than tactics are also vulnerable to optimal or strong strategies. Most hackers are not good artificial intelligence programmers, so if a game has deep strategic play, it is less likely to be vulnerable to automation attacks.

P OWER OF P EOPLE : R OCK -P APER -S CISSORS , P OKER , P SYCHOLOGY

AND THE

W ORLD

OF

“Interesting choices” are often associated with interesting games. It is not just that the player can make interesting choices, but his foes can as well. Tarn and Zach Adams’ Dwarf Fortress10 is a very highly regarded recent game. One of the things that makes it interesting is the richness of interactions and actions between the player and the game environment. The game is a study in innovative, deep procedural game design—so much so, that players delight in recounting their game play experiences whether successful or catastrophic failures11. Hampus Söderström’s Toribash12 has redefined fighting games with its combination of rag-doll physics with simultaneous non-real-time turns. Toribash takes physics-based game play in a new direction because players are interacting with each other’s choices, which can have virtually infinite variety and complexity. Strategic depth is very hard for a computer or player to fake or cheat (without a lot of effort—chess programs play very well after all). Games don’t need to be complex to thwart automated play. Rock-paper-scissors embodies the simple principle that every play can be trumped and every play choice has value. Poker succeeds as a meaningful game because of the psychological interaction of the players. Exception games, like Magic: The Gathering13, are interesting for players and hard to automate. Every card in the game changes the rules or breaks the rules in a different way. Cards can work in combination with each other and the game is continually being updated.

176

Protecting Games: A Security Handbook for Game Developers and Publishers

In some sense, this is the best news of all—a well-designed game with “good” game play is much less likely to have security problems than a poorly designed one.

G AME P LAY P ATTERNS : C OMBAT D EVOLVED Although there may be many kinds of games, there are actually very few actual game-play patterns. The patterns discussed here are not thematic (science fiction, fantasy, and historical) or genre-related (first person shooter, real-time strategy, MMO), but are the essential ways that players interact with each other and with the game’s rules. Many of the common game-play patterns that are used in computer games are an artifact of the history of the industry. Single-player computer games typically use an “Action, Randomized Resolve” game-play pattern. Traditional board and card games tend to sequence players since simultaneous play is difficult while some of these play patterns may be better suited for computer play. Each pattern has its advantages and disadvantages and, of course, different security characteristics: Action, Deterministic Resolve (Chess and Battleship)—Taking turns and moving or acting. A very simple pattern; if there are N potential actions, there are N possible outcomes. Strategy comes from choices of actions and when to take them. Random Input, Action (Backgammon and Many Family Games)—“Roll your dice and move your piece” and “draw a card”). A very simple variant on the Action, Deterministic Resolve pattern where randomization constrains player choices. Action, Randomized Resolve (Most Combat Results Table Games and Many Computer Games)—The combat results table (CRT) is a legacy of many board war games. Basically, a player takes an action, rolls a die, and the result is determined by cross-referencing the action with the die roll. The total number of possible outcomes is the product of the number of actions (A) and distinct die roll values (D) (AxD). As with all randomized results, the question is always how to generate fair random events. Player 1 Action, Player 2 Response, Deterministic Resolve (Magic: The Gathering)—Players take turns to act, but the results of their actions can be modified by the actions of other players. Usually, this pattern is associated with a finite resource that constrains actions and responses such as available cards or “action points” that are consumed and slowly replenished. Generally, Action, Response patterns modify only the initial action; they do not introduce new game-play elements.

Chapter 17 Game Design and Security

177

Player 1 Action, Response Chain (Each Player, Deterministic Resolve) (Magic: The Gathering, War card game)—See Player 1 Action, Player 2 Response, Deterministic Resolve. Players can continue to take additional contingent actions until they are unable to continue or choose to conserve resources for subsequent use. Action, Response, Randomized Resolve (Some War Games)—Players take turns to act. The main effect of responses by other is to alter the initial action. Simultaneous (Player 1 Action, Player 2 Action), Deterministic Resolve (Ace of Aces, Toribash)—Simultaneous action is well suited to computer-based play, but it has not been used very often, mainly, I think, because it is not familiar from either single-player computer games or multi-player traditional games (because of difficulties in implementation). The security challenge with this pattern is to ensure actual “logical simultaneity.” One of the interesting aspects of simultaneous action is that there is typically a rich range of outcomes that naturally flow from the intersection of player choices. Simultaneous Action (Player 1 Action, Player 2 Action), Randomized Resolve—See Simultaneous (Player 1 Action, Player 2 Action), Deterministic Resolve. Randomization perturbs a basic result from the intersection of player choices. Action(t), Deterministic Resolve (“Physics”-Based Games, Guitar Hero)— The interest in these games comes from the procedural complexity of physical systems. The problem, as noted previously, is that complex physical systems can be modeled very well by a computer. They are also very vulnerable to automation. The most common error for real-time game systems is neglecting to consider the “reset” time to recharge between actions, particularly when the games are implemented over a network. Action(t), Random Resolve (“Real-Time”-Based Games)—See the previous bullet. These games really replace the abstract model for a physical system with a set of game mechanics that are time based (and still are often tied to physical system modeling). Often, the only real random element is a damage model. Player 1 Action(t1), Player 2 Action(t2), Deterministic Resolve (Baseball and Other Real-Time Reflex Games)—Typically, these games are associated with physical systems. The main change is the potential for complex interactions due to the actions of multiple players. Network lag and time models can sometimes be abused to “see” remote player actions before they happen, as discussed previously. Player 1 Action(t1), Player 2 Action(t2), Random Resolve—See Player 1 Action(t1), Player 2 Action(t2), Deterministic.

178

Protecting Games: A Security Handbook for Game Developers and Publishers

Deterministic Update(t)—Timed or triggered events, often seen in physics games such as a dropping ball or weight or a timed elevator. The only concern with this pattern is whether the update to the game’s state is supposed to be hidden from the player(s). Random Update(t)—See Deterministic Update(t). Randomization is used to add complexity to the game experience. One could argue that some artificial intelligence systems for automated opponents are an example of this type of system, because their behavior is not quite deterministic. Definitions: Action—A decision and corresponding game play made by a game player (or piece of artificial intelligence code taking on the role of a player) that impacts the game. Actions can also be “secret”—where they are made at some time and not revealed until later. Response—A decision and corresponding game play made by a game player (or piece of artificial intelligence code taking on the role of a player) that impacts the game that is dependent on the action of another player. Simultaneous Action—A decision and corresponding game play made by two or more game players (or piece of artificial intelligence code taking on the role of a player) that impacts the game and occurs at the same time. Resolve—The basic change to the game state that is a result of one or more player’s actions, the pre-existing game state, the game rules, and any randomized resolution. This can be thought of the closing element of a “mini-game” or “gamelet,” basic player interaction, or rules that cause a change to the game state. Randomized Resolve—When the resolve is affected by some sort of randomization. Given a set of actions, responses, and game state, a situation where there can be more than one possible resulting game state. Deterministic Resolve—The opposite of randomized resolve. When there is only one possible resulting game state given a prior game state, player’s actions, and responses. Action(Time)—Player actions that occur at a specific time for “real-time” games. Action1(time1), Action2(time2)—A real-time interaction model that allows rich interaction between players. Random Input—This type of randomization is very typical for traditional games. These patterns can be assembled into a wide range of higher-level game-play patterns.

Chapter 17 Game Design and Security

D ESIGNING

FOR THE

179

M EDIUM

Computers are an amazing tool for gaming that we are just beginning to explore. The reemergence of multi-player gaming has provided opportunities for new types of game play. There are so many game types, business models, and ways to interact that it is impossible to neatly categorize computer games today. The key is to truly understand the implications of the entire design and its environment. Eye of Judgment for the PlayStation 3 took a paper collectible card game and combined it with a video camera to create a new form of game play. Unfortunately, the developers seem to have neglected to consider the possibility that players would scan cards and undermine the core collectible element of the game14. For many years, online games were metered by the minute, just as online access was. This meant “problems” like botting and gold farming weren’t nearly as big an issue, because the game operator could recover their costs better and ill-gotten profits were constrained by much higher connection costs. Game protection can take advantage of innovations in game design. True replay systems as found in the Prince of Persia series with its ability to rewind time or replay an entire game as with Halo 3’s Saved Films feature can serve both the game designer’s vision and become tools to strengthen security by helping detect cheaters. Careful consideration of security in game design may be the single most effective use of security resources. Many security problems can be avoided entirely through good design practices. Conversely, bad design choices may make good security impossible or exorbitantly expensive.

R EFERENCES 1. ferv0r (2008), “There Are Level 80s in Age of Conan,” http://ferv0r.wordpress.com/2008/05/25/there-are-level-80s-in-age-of-conan/ 2. J. Savage (2007), “Game Stopped After Cheat Allegations,” http://www.thelocal.se/6788/20070324/ 3. P. Pollack (2006), “Online “Banker” Runs Off with Cash, Avatars Cry Foul,” http://arstechnica.com/news.ars/post/20060828-7605.html 4. J. McLeod (2008), “Königrufen,” http://www.pagat.com/tarot/koenig.html 5. Upstarts! (1982),“The Really Nasty Horse Racing Game” 6. S. Fallon (2007), “Confessions of an Online Scrabble Cheat,” http://www.wired.com/culture/lifestyle/magazine/16-01/ps_scrabulous 7. E. Thorp (1962), “Beat the Dealer” 8. P. Lewis (2006), “For Sale for £1,000: Gadget that Means You’ll Never Lose at Roulette Again,” http://www.guardian.co.uk/uk/2006/sep/16/gambling.mainsection

180

Protecting Games: A Security Handbook for Game Developers and Publishers

9. YouTube (2008), “Audition Bot—61 Search Results,” http://www.youtube.com/results?search_query=audition+bots&page=2 10. T. Adams and Z. Adams (2008), “Dwarf Fortress,” http://www.bay12games.com/dwarves/ 11. B. Harris (2006), “Dubious Quality—Dwarf Fortress Articles,” http://dubiousquality.blogspot.com/2006/09/dwarf-fortress-1-prepare-for-journey.html 12. H. Söderström (2006), “Toribash,” http://www.toribash.com/ 13. R. Garfield (1993), “Magic: The Gathering” 14. M. McWhertor (2007), “Eye of Judgment Card Creating Easier Than Expected?,” http://kotaku.com/gaming/rumor/eye-of-judgment-card-creating-easier-than-expected-315714.php

18

Case Study: High-Score Security

igh-score systems are one of the easiest and quickest ways to turn a singleplayer game into a social game. Achievements, ranks, ladders, and badges can substantially increase interest in a game as well as foster player community, as seen at game portals like Kongregate. A high-score table is also an easy way to get marketing data, encourage repeat visitors, and otherwise make the game “stickier” than simply having a downloadable or simple online game. Many businesses are taking this strategy to the next level by adding contests into the mix, sometimes with large prizes.

H C HEATING

IN

H IGH -S CORE G AMES

Sadly, cheating rears its head the moment you introduce this new feature. Players will even cheat to get a high-score on an obscure website for the simplest Flash game. These cheaters can undo all of your community and interest building efforts—who wants to play a game with cheaters? Why compete for a high score if you don’t think you’ll have a reasonable shot at winning? Although this can be a nuisance for an independent game developer who is simply showing off a new game, the problem becomes more serious for an advergame or a commercial game. The reputation of the sponsor, site operator, and developer’s business and real money are at stake. Things get even more serious when high scores are used for a tournament or if there are contests or prizes involved. (Note: If you are running a contest, sweepstakes, or a game with prizes, please consult a lawyer. Even skill-based games are regulated in the US and internationally; See Chapter 31). Deloitte Touche Tohmatsu in the Netherlands did a study tracking 40 Dutch advergames over a four-month period. The games, almost all in Flash, were plagued by high-score hacks and leader board griefing (posting crude, malicious, or defamatory names as high scorers). Several of the marketing campaigns had to be shortened or canceled because of these security problems1; see2 for the English translation. 181

182

Protecting Games: A Security Handbook for Game Developers and Publishers

High-score games are typically developed as single-player games that then post the high score to a server. If the games are played in a browser, the security sandbox used by Flash, Shockwave (Director), Java applets, and DHTML/JavaScript put real limits on both the computing power of the game as well as its ability to access the resources of the computer. Often, the high-score feature is added as an afterthought. Because the high-score feature is often added late in the development process, it is often a separate part of the game architecture. As a consequence, making attacks on the “score” is easier. The security adage “if security is easy to add, it is easy to remove” shows itself again. What is the simplest attack on a high score? You simply send a better score to the high-score server, ignoring the game entirely.

E NCRYPTION , D IGITAL S IGNATURES ,

AND

H ASH F UNCTIONS

The first solution that game developers typically consider is to use encryption, hash functions, or digital signatures to send the score to the server. Often, the available SSL library that is used is the one provided by the browser. Although an encrypted or signed data stream on the network-side is safe, the problem is that the game attacker controls the computer. This is not the security assumption that most encryption and digital signature systems are designed for (including SSL). In a typical game scenario, the bad guy is an insider. So, how do you protect against him? Let’s quickly review the available tools. Hash functions are mathematical functions that, when applied to a data stream, produce a hash word. A good hash function, like MD5 or SHA1, will produce a wildly different hash word from even a slightly different data stream. An encryption function uses an encryption key to transform a data stream into a protected stream. Often, there is a decryption function that will use the decryption key to transform a protected stream back into the data stream. In private key or symmetric key cryptography, the encryption key and decryption key are the same. In public key or asymmetric cryptography, the encryption key and decryption key are different, and one is publicly known. Finally, a digital signature function combines a hash function with a public key encryption system to create a protected hash word. Another cryptographic tool is a cryptographic checksum. Cryptographic checksums are similar to digital signatures but they use private key cryptography to create a protected hash word. Computationally, private key cryptographic functions tend to be a lot faster than public key cryptography.

Chapter 18 Case Study: High-Score Security

183

What’s the problem with SSL? SSL, like any other external library or application extension (accessed as a DLL or SO), has a local interface that can easily be intercepted and modified. This form of interceptor is often provided with a software development kit (SDK) as a debugging tool or it can be implemented as a custom proxy. The interceptor allows data (in this case, the game’s high score) to be freely grabbed before the high score is sent to the encryption library. Because the attacker can get between the game and the encryption function, she can modify the game data or even send arbitrary data to the security library: Encrypted “bad data” is still bad. The fact that SSL is an external library is its biggest weakness compared to an internally implemented encryption (or digital signature) function. An internal encryption function will need to be attacked and reverse-engineered using a lowerlevel debugger. This is not impossible, just more difficult. The problem moves from one of API interception to reverse engineering. The same is true if the hacker wants to directly modify a game’s high score or internal state. In order to attack the game’s state, the hacker would require a memory editor (see Chapter 14). Most memory edit or map tools are pretty simple. They actually don’t reverse-engineer the game; they simply watch the player run the game for a while and isolate the changes that have occurred to the application’s memory footprint. The player then can read out the memory map of the game (or any other application). The technique is both generic and effective for virtually any application that runs locally on a specific computer. Attackers do not necessarily have to attack the game’s score. Instead, they can alter the score table constants associated with different actions that get rewarded. For example, if destroying a common item is supposed to be worth 25 points, the hacker could change that value to 2,500 in the game’s code image. Then, each time the player destroys the item, they will get 100 times the score they would have earned legally. A limited countermeasure for this type of attack is to post a vector that passes the components of the high score to the server: number of hits on item 1, number of hits on item 2, and so on. Encrypting or authenticating this value may make attacks a bit more difficult. The problem with encryption, digital signatures, digital rights management (DRM), and other software security solutions is that they are inherently weak against a local attacker because the hacker has control over its platform. Simple client-side security does not work because, for games, client software should be assumed to be malicious. After all of these concerns, if you still choose to use encryption or other clientside solution, do not hardwire the algorithm’s key. Hardwired keys are no different from a security perspective than a hash function. Instead, use the key as a part of a “challenge/response” system and send the client a key in real time to encrypt the score (see Chapter 14).

184

Protecting Games: A Security Handbook for Game Developers and Publishers

Digital signatures are of no more value than a regular encryption system, in this scenario. A signature is only useful if the data that it signs is accurate. By downloading the key in real time, the attacker will need to reverse-engineer your game. However, do not be fooled; if the hackers are motivated, they will succeed. These solutions are only a minimal fix to the simplest of attacks. If you choose to use internal cryptography, you will face the general problem of a lack of “interoperable” cryptography. Basically, it is necessary to find cryptographic libraries that work both with your client software (Flash and so on) as well as with the backend (often PHP). Using a common cryptographic algorithm suite does not guarantee interoperability and isolating implementation inconsistencies can be very difficult.

C LIENT -S ERVER O PTION The next option is to implement the game in an actual client-server configuration. This design approach implements the game as if the part that is downloaded is a “smart terminal” that provides a nice interface to a game that is hosted on the server—the same approach used in many MMOs. This actually stops most forms of client-side cheating, but potentially has a large overall system impact compared to a simple, downloaded client. After all, instead of a single download (a natural for web servers), the server needs to interactively update the game based on player actions. This will likely add many additional connections to the server as well as additional processing on the server. Also, the developers often have completed the game as a standalone game and the high-score system is added later, making this architecture change impractical in many cases.

R ANDOMLY S EEDED C LIENT A hybrid solution is to implement a randomly seeded client. This approach works for games that are not entirely deterministic (see the discussion of puzzles, later in this chapter). Basically, there are two components to this approach. First, the server periodically and non-deterministically updates the client’s random seed. Second, the client must store a log of the game action/state sequences. If players claim a high score, they need to post the game logs and validate that the game session could have yielded the posted high scores. This system is probably not adequate for contests, but is probably good enough for free, pure-entertainment games.

Chapter 18 Case Study: High-Score Security

185

A LTERNATIVE H IGH -S CORE S TRATEGIES There are other options to ensure the integrity of the game service, if not the high score itself: Buddy High Scores—Instead of having a single high-score system, it is possible to divide high scores into geographic, friends/social networks, and other ways to give more players a chance to earn a high score. A “buddy-high-score” system works well from a marketing point of view and makes cheating irrelevant (the benefit of cheating your friends is much lower than the ego reward of earning the high-score globally). Challenge/Response Score Posting—As noted previously, external encryption services are not effective in protecting against even a slightly motivated attacker. An internally implemented challenge/response system can be easily integrated with an existing game (in fact, we have a version for Flash and PHP at SecurePlay.com). As with many of these solutions, this approach is suitable for casual games, not for contests. Face-to-Face Competition—Depending on the business model being used, a local high score can be used as a gateway to face-to-face competition. The prospect of a face-to-face competition can be both a positive marketing tool and a substantial deterrent to cheating. Public humiliation is a powerful threat. False Games—Contests don’t need to have a truly functioning, public highscore system. Instead of using the game result and score for a contest, set a low, minimum threshold score to qualify for entry into a drawing. The benefits of cheating go way down, as any reasonably good player will be entered in the drawing (arguably, the game score gateway is simply a way to convince players that they should disclose their personal data to be entered into a drawing). Faux Multi-Player Gaming—It may be difficult and expensive to move the game onto the server and implement real client-server gaming. However, in some cases, it might be much easier to use other game players as “faux servers”—where the game and game state is coming from another player’s computer. This might be easier to implement, as platforms like Flash include object-replication tools. Basically, each game client runs two or more game instances: one instance that drives the local display and captures player actions and another instance that acts as a server engine for another, remote player. The players either use the central game server as a relay or communicate peerto-peer. There are numerous, tricky details to this approach, but it may be worthwhile for higher-value games where a developer does not want to move to true server-based gaming.

186

Protecting Games: A Security Handbook for Game Developers and Publishers

Implicit Score and Player Data Authentication—The game developer can include implicit features in the game design that are not “known” at all on the client, but can be checked only on the server. For example, a race may have a certain hardwired minimum time or certain delays that are implicit to the game design. These features can provide a way to detect illegitimate scores; however, these techniques are also very vulnerable to detection and analysis by a motivated foe. Replayable Game Logs—Traditional computer games are increasingly using true game-play logs that allow the game to be recorded and replayed. Although some lightweight browser languages like JavaScript and Java do not allow applications to store data on the platform, others like Flash do. Even without the ability to save a game, it is still possible to store a game log during play. If a player submits a suspect high score, the game server can then request the game to upload its full game log to be verified. Ideally, the game log should be able to be fed into another copy of the game and used to drive the game instead of the mouse, keyboard, or controller. This can be used to visually detect game anomalies, but is no guarantee against a serious cheater. The biggest challenge for protecting high-score games is not the lack of available options. Rather, the problem is that high scores are an afterthought in many of the games; this fact makes it difficult to add effective security features retroactively.

P UZZLES , S KILL -B ASED G AMES ,

AND

O THER D ETERMINISTIC G AMES

As discussed in Chapter 17, puzzles and games that have strong or dominant game play strategies or are dependent on physical skill are poor candidates for games with a high-score or competitive element because they are often automatable. Malicious players can create bots or support programs to have a superior game-play strategy, speed, or solve the puzzle optimally. These games are fine in “for fun” settings without high scores, but once high scores or multiple players are involved, they are often attacked. There are tools to detect bots or even try to discern the use of game aids, but it is ultimately impossible to distinguish between optimal play from a human and optimal play from a machine. Also, bots will be able to be hidden in a manner that is undetectable (see the sidebar in Chapter 13 on virtualization).

Chapter 18 Case Study: High-Score Security

187

I NAPPROPRIATE P LAYER H ANDLES The full discussion of griefing comes later (see Chapter 21). However, simple highscore games are beset by annoying at best, or disturbing at worst, inappropriate player handles associated with players’ high scores. Most high-score games let players choose how their name will appear on the high score list—their player handle. Unsurprisingly, many of these handles are obscene, insulting, or infringing on copyrights and trademarks. The problem is even worse if the high-score system has been hacked. I was told about a case where a bank had an online game which was hacked and the pranksters used the opportunity to mock the bank and its poor security practices via the compromised high-score table. Filters, notifications, and voting schemes can be used to cost-effectively remove inappropriate names. However, it is likely that any such system run by a company should include some level of human review. Contests do have a slight advantage, as inappropriate player handles can be grounds for disqualification.

S UMMARY High-score systems are a great way to build the popularity of your game. Unfortunately, cheating follows right behind. The problem may be simply a nuisance if the game is provided for entertainment purposes. In some cases, it may be better to forgo the advantages of a high-score system than deal with potential adverse consequences. Also, the level of threat against a game jumps dramatically once there is any sort of prize or cash involved. Sadly, it takes very little motivation to bring out the cheats and vandals.

R EFERENCES 1. Deloitte Touche Tohmatsu (2008), “Advergames op Grote Schaal Gehackt,” http://www.deloitte.com/dtt/press_release/0,1014,sid%253D13354%2526cid%253D202819,00.html 2. S. Davis (2008), “Serious Advergame Hacking Problems: Deloitte Touche Tohmatsu Netherlands Survey Findings,” http://www.playnoevil.com/serendipity/index.php?/archives/2107-Serious-AdvergameHacking-Problems-Deloitte-Touche-Tohmatsu-Netherlands-Survey-Findings.html

This page intentionally left blank

Part

IV

Social Subversion: From Griefing to Gold Farming and Beyond with Game Service Attacks In this part, you’ll find the following topics: Chapter 19, “Overview of Social Subversion” Chapter 20, “Competition, Tournaments, and Ranking Systems (and Their Abuse)” Chapter 21, “Griefing and Spam” Chapter 22, “Game Commerce: Virtual Items, Real Money Transactions, Gold Farming, Escorting, and Power-Leveling” Chapter 23, “To Ban or Not to Ban? Punishing Wayward Players”

189

19

Overview of Social Subversion

ou’ve made your game and designed it carefully. You’ve considered cheaters and hackers, avoided exploits and engine problems, and yet, after your game goes “live” online, everything falls to pieces.

Y

Welcome to the world of game service attacks.

Cheaters and hackers are increasingly attacking the “game around the game”— not the game itself, but the other features of the online service. These attacks violate the social norms and social context of the game and, often, its “terms of service.” Some people will call many of these activities cheating. The main difference between game service attacks and traditional cheating is that these attacks cannot be detected by the game itself as rule violations. They are slipperier and more difficult and costly to control and they rarely can be stopped completely. Most of these problems stem from weak identity and accountability—if no one knows who you are, there is nothing to stop you from behaving badly. Tournaments are growing rapidly in popularity. These services take basic highscore systems and add richer competition for multi-player games. Tournaments and various forms of in-game competition wrap a game with a lobby or matchmaking service and track game results. Just as players will cheat at a free Flash game to get a high score, they will abuse lobbies and competition services for their own purposes. Griefing and spam exploit communications systems as well as the rules of the game. Communications abuse ranges from commercial spam, in many cases for gold farming or other game commerce services, to verbal abuse, cyberbullying, and sexual harassment. Griefing players take advantage of game play systems, reputation systems, and, in some cases, the anti-griefing systems themselves that are put in place to handle customer complaints. Griefing behaviors can range from theft of other players’ assets or experience (ninja looting and kill stealing), to disrupting the game play of others (corpse camping), and exploits of game system quirks (spawn camping). Certain games allow players to create content, such as Second Life and IMVU, and, inevitably, players have found ways to abuse these services with attacks ranging from fairly standard griefing and abuse to denial of service attacks. 190

Chapter 19 Overview of Social Subversion

191

There are people with more time than money, and others with more money than time. In persistent games, this has resulted in unauthorized game commerce. Trading is a powerful social tool. Unfortunately for many game developers, players use in-game trading and gifting systems for real economic purposes. Gold farming is probably the most widely discussed of these problems (wherein players buy and sell virtual items and characters), but there are also outsourced services that will play on behalf of a player (power-leveling), and escort services where paid, skilled players play along with players to help boost their skills or acquire certain items. Once a cheater or game service attacker has been caught, the standard impulse is to ban the person from the game. There are other options and some negative consequences from banning and there are real questions as to banning’s effectiveness in deterring game abuse. There are quite a range of game service attacks and, fortunately, corresponding countermeasures. However, there are few standard solutions to these problems, as the game service security weaknesses often are closely tied to specific business, implementation, and operations choices.

20

Competition, Tournaments, and Ranking Systems (and Their Abuse)

istorically, computer game developers have focused more on single-player games than multi-player experiences. This is largely an artifact of the evolution of personal computing and network technology. For thousands of years, games have been predominantly multi-player experiences with the exception of solitaire card games and puzzles.

H

Although cooperation is sometimes an element of gaming, competition is deeply ingrained into its rules and language. There are very few games that don’t have some sort of notion of “winning,” even if the game has only one player. Wagering and rewards have long been tied to games—after all, the Bible’s Book of Job is centered on a proposition bet between God and the Devil. Players are encouraged to earn the most points, finish the game most quickly, and get the high score. With the emergence of online computer games, competition and tournaments are rapidly growing in popularity. As discussed in Chapter 18, high scores can invigorate the audience for a single-player game, but they can also inspire abuse. Multi-player game competitions are more interesting and varied than singleplayer high-score services. Lobbies, ranking systems, and tournaments are varied in form and targets of a wide range of attacks.

U NDERSTANDING T OURNAMENTS

AND

R ANKING S YSTEMS

In order to understand the attacks on game competition, it is worth reviewing how a variety of these systems work. Although most game players are familiar with sports competitions, the growth of online play has introduced several new types of ranking systems. There is surprisingly little good discussion about how these systems work from a practical perspective, but Christopher Allen and Shannon Appelcline have put together a number of excellent articles on the subject at Christopher Allen’s blog, Life with Alacrity1.

192

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

193

There are two essential types of ranking systems: Closed Ranking or Tournaments—These ranking systems are built around a limited pool of entrants (restricted either by total population or a specific registration period). They use some process to rank the entrants or determine one or more victors. There are a number of types of tournament formats, including2: Single-Elimination—A tournament where players are removed from the tournament as they are defeated. Only the top player is ranked, not any of the other participants. Consolation—A tournament where players are moved to a “consolation” single-elimination tournament after they lose once. Once they lose a second time, they are eliminated. Double-Elimination—Very similar to the consolation tournament, but players enter more senior brackets, based on how far they proceed through the brackets in the single elimination tournament. If a team successfully won three rounds, but then lost its match, that team would enter at the third round of the consolation tournament, rather than at the first round. Up and Down/King of the Hill—Participants all play for a fixed period of time. The leader or victor at the end of the interval progresses “upwards” toward the top position and the losers move “down.” Swiss—Participants all play in a set number of rounds. Players play against others who have done comparably well, but the final result is based on a total score, with victories worth 2 points, ties worth 1 point, and losses worth 0 points. Round Robin—Participants play all other participants a fixed number of times (rarely more than two), with the participant with the most victories crowned the winner. There are numerous variations on these competitive schemes. A tournament can also combine different tournament schemes, such as an initial round robin phase, followed by a single elimination tournament for the top performing round robin players. For tournaments with gambling, there are also variants where players can buy back in to the tournament again or purchase additional chips to continue to play 3, and as well as take advantage of other options4. Open Ranking or Ladders—These ranking systems can accommodate an unlimited number of participants or a limited participant pool over an extended period of time to establish the participant’s relative status. Open ranking systems are used in applications outside of gaming, most notably for reputation and rating systems5. Well-known ranking systems include ELO and Glicko for Chess; Xbox Live’s TrueSkill; and eBay’s rating system.

194

Protecting Games: A Security Handbook for Game Developers and Publishers

The two types of systems can be used together and interact over time. Most professional sports teams are ranked from year to year, but also compete through some sort of tournament system for a final victory. In U.S. college basketball, there is an ongoing ranking system on a national basis that determines invitations to the NCAA or NIT tournaments (sort of)6. There are four major purposes for ranking systems: Ranking/Serializing—Placing the participants in some sort of order and, for ranking systems, tracking that order over time. Grouping/Grading/Thresholding—Grouping the participants into categories (one to five star systems, grades A to F, and so on). This is the dominant approach used for rating and thresholding systems. Matchmaking—Competitive systems need a way to match different participants and reward victors and penalize losers. Matchmaking systems determine who competes. They can be structured in different ways. In a single-elimination tournament, participants with higher ranking are matched with players with lower ranking to increase the likelihood that the highest ranked competitors will compete in the final match. Thus, the top ranked participant initially competes with the bottom ranked participant, the second ranked participant, with the second lowest ranked participant, and so on. Additionally, the highest ranked and second ranked participants are in different brackets so that if they win all of their matches, they will reach the finals and compete with each other. Conversely, ongoing ladder systems tend to match participants with comparable skills to try to ensure a fair competition (each competitor having a nearly equal chance of victory). Handicapping—These systems typically give increased rewards for players who defeat higher-ranked foes. Conversely, in systems like golf’s, a handicap is a balancing system to basically allow a lower-ranked player to compete with a higher-ranked player. The attacks on tournament and ranking systems, discussed later in this chapter, are highly dependent on the specific purpose of the system. Careful design can avoid many problems. For example, the online game A Tale in the Desert first used the eGenesis Ranking System7, which attempted to limit the ability of players to create free accounts to boost their ranking by minimizing the effect of competing with players with new accounts (basically, you could earn a maximum of eight points from a new player, but could earn substantially more from an experienced player), but later moved to a very different approach with its Tournament Ranking System8.

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

195

This latter system works in a similar manner to the “master points” system used in Bridge where players really only compete with other players at the same rank and compete to earn additional points towards advancing towards the next rank. The only real differences are that a player cannot compete multiple times at a given rank and tournament with another player. Also, it is possible for a player to lose too many competitions, in which case she can either start again at the lowest rank or no longer compete within that specific tournament.

L OBBY A TTACKS Before players enter a game, they use a lobby service to set up matches—either with opponents of their choosing, or, for tournaments, based on algorithms and procedures provided by the game service. Hackers attack the matchmaking service itself or its underlying ranking or handicapping system to position themselves to gain an unfair advantage: A hacker could try to boost her chances of winning cash or prizes by entering a contest an excessive number of times or create multiple accounts that “compete” to boost the rank of a chosen account. Conversely, the cheater could appear to be incompetent and lose often to set up suckers for a sting in a game for money—just like a pool shark. TOURNAMENT

AND

LOBBY SPIKING

Although randomized match-ups are theoretically strong, it is an interesting question whether teammates, or opponents for that matter, could collude to enter the matchmaking lobby within a narrow time window and thus increase substantially their chance of being matched together. After all, if ranked games are being run continuously, there are going to be times when the game lobby is going to be relatively empty. Or, even with a relatively popular game, highly synchronized lobby entry can overwhelm the matchmaking system’s randomization process. The larger the team, the more effective this tactic will be. A weighting system that adds an anti-correlation component (to ensure that players haven’t played together before) and a measure that considers how many games someone has played (to address disposable identities) added to the tournament ranking system could help reduce the effect of team play. Another strategy may be to allow all players to play multiple games concurrently (this strategy works better with thoughtful and leisurely games, as opposed to fast, reflex-based games).

196

Protecting Games: A Security Handbook for Game Developers and Publishers

ENTRY SPREADING For continuous tournaments or ladder systems, players can “spread out” their entries to move more rapidly up or down a ranking system. A closed tournament matches players based on seeding or a random draw. However, it is possible, in an open ranking system or a tournament that allows players to join over a substantial period of time, to disperse a team of players uniformly across a large population. Depending on the ranking scheme, these anti-correlated players can build “good” reputations independently of each other and subsequently coordinate and play together to accelerate the ladder performance of a few selected members. RANK BOOSTING

AND

BUSTING

Once players have been able to be matched with whom they wish, they can then “boost” the rank of a designated player or group of players. This is possible if the tournament uses an open lobby, the game has a ladder ranking system, or they overwhelm the lobby. An NBA player, Gilbert Arenas of the Washington Wizards, was caught colluding with another player by taking turns winning game events to boost his rank in Halo 3 9. Players can also achieve the same objective by using bots rather than finding other colluding players for some online games. It is a good idea to test your tournament structure against various rankmanipulation strategies to see how many cooperating players it would require to be effective. Although players may attack tournaments just to get a high rank, tournaments with cash or prizes are the prime targets for boosting. The other goal of a cheating player may be to rank higher in a less competitive tournament—becoming the “best of the worst” in a junior or amateur tournament rather than having to fight and likely not win in a more seasoned competition. This is especially appealing for games where money is involved—a tournament variant of a pool shark. These attacks are all quite difficult to counter. They are all, effectively, varieties of collusion and take advantage of weak identity systems, particularly when games are online. Clever design of a ladder system or tournament may minimize the impact of several of these attacks. For tournaments, bringing players in for face-toface competition will often make it much more difficult for players to hide their identities. Platform identities and signatures may be effective in determining patterns of play that can help uncover these groups of players or accounts.

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

S YNDICATES

AND

197

B OTS

Tournaments and ranking systems create a structure on a social group. There are two ways to undermine these structures: with an organized team of individuals (a syndicate) or virtual individuals (a set of bots). Svenska Spel’s lottery game, Limbo, was undermined by groups of players colluding to select different entries, a variant of the entry spreading attack where the players ensured that their lottery entries had different values to increase the group’s chance of winning10. The online game OutWar was targeted by a massive botnet of at least 30,000 compromised computers to help boost two players’ ranks11. Tournament cheat bots fall into two categories—winbots and lossbots—and are the direct counterpart to human syndicate members helping boost or bust a teammate’s rank. In 2005, Blizzard banned 4,000 players from Battle.Net for using lossbots and ladder abuse in Warcraft III12. Of course, bots can also be used to simply cheat against other players in a tournament or boost a player’s rank, as discussed in Chapter 15.

T OURNAMENT

AND

L ADDER G AME P LAY A TTACKS

There are certain attacks that can occur against a game because it is being played in a tournament or as part of a ladder-ranking system. These are not really attacks on the game itself but on the game’s context. Although Brain Age may be a fine singleplayer mental skill game with its mini-games based on basic mathematics and logic, it would fail utterly in an online, multi-player, competitive environment where players could use calculators and other player aids. COLLUSION Players can cooperate together when it is forbidden by game rules to gain a competitive advantage. This is a problem for multi-player games in general, but can be even more problematic when tournaments or rankings are involved. For example, collusion in a two-player game is meaningless unless there is a larger group ranking system that can be attacked. Usually, boosting and busting rankings can be easily carried out by groups of colluding players; the larger the colluding syndicate, the better.

198

Protecting Games: A Security Handbook for Game Developers and Publishers

GAME CONFIGURATION Games played with small groups of competing players are very common in online gaming. There are a couple of very practical reasons for this: It is easier to design a competitive game that works with a smaller number of players rather than a large number. Also, it is very difficult to bring together a large group of players and keep them playing at the same time, particularly online. First person shooters, racing games, sports games, and strategy games are usually played with modestly sized groups (rarely more than 16 players, often 8 or fewer players). For a game service provider, these sorts of games can be operated very inexpensively, especially when the players use a local computer to act as the game server or when the game operates as a pure peer-to-peer network. Player-operated servers and peer-to-peer architectures have the substantial advantage of pushing all of the computing and networking resources onto the game’s players while only leaving a small lobby, status, and persistence service at the game operator’s location. Sometimes, game operators let too much control devolve to the players. In Battlefield 2, players cleverly configured their local game servers to give them an unfair advantage in the game’s overall ranking scheme (the exploit was really a flaw in the game’s scoring system that ranked players much higher if they used “lowertech” weapons like knives rather than guns)13. All players need to be able to independently authenticate a game’s configuration and state, whether the game is configured as client-server or peer-to-peer architecture. The game developer or operator should also be able to extract an audit record of a game from any and all players. This may not prevent all ranking system manipulation, but could help identify gross abuse by players who post scores for game wins or losses that were not actually played. GHOSTING Increasingly, game developers are adding an “audience mode” to their games. This mode allows the game to be viewed from a number of perspectives and often supports replay and recording features. This is due largely to the rise of cybersports and machinima and has mostly been a boon to the industry. Additional game observers can create security problems, however. In the real National Football League, the New England Patriots were caught using cameras and electronics to read the communications between players and coaches of their gridiron foes14. Audience mode tools can be used by colluding players or players who hack into a game server to achieve the same objective. The best countermeasure is probably introducing a communications delay before sending information to the game’s audience. This will almost certainly not be effective if a player is hosting the game server.

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

199

More sophisticated blackout systems are likely to be technically difficult to implement and tempting for hackers to circumvent. These attacks are basically exploits of the tournament or ranking system and need to be countered as such. Although technical countermeasures may sometimes be able to detect these hacks, they are difficult to isolate, by their nature. Ghosting weaknesses are best thwarted by changing the tournament or ranking scheme and rules, just like game exploits.

A BANDONMENT : T HE “G AME O VER ” G AME One part of the game code is of particular concern for both the game operator and the game developer—the “game over” game code. Networked games can end for a number of legitimate reasons, but also for illegitimate ones. Dropped connections and computer failures are too common to be simply ignored or arbitrarily punished. Game developers and providers also need to be concerned about players abandoning a game to avoid a loss and reduction in ranking (called stat guarding). This has been seen in the Ultimate Online Baseball MMO. Certain players (derisively called stat babies) in Netamin’s game abandon their games when it looks like they may lose and damage the statistics of their pitchers or hitters15. Malicious players can abuse a game’s “game over” logic, and even the game abandonment code to their advantage. Depending on how the “game over” logic is implemented, malicious players may be able to force the game to end when they have an advantage or to use their preferred scores as the authoritative source for the game. Players may even abuse the game abandonment system to make it look like the other player has abandoned the game—and trigger the game score system to punish the other player accordingly. The ideal approach is for the game to periodically establish a “certified game state” that can be used to replay or finish the game at a later date (ideally, this would be done continuously). Players can also attempt to report false scores and delay reporting of undesirable game results to manipulate a ladder or tournament system. A final problem occurs when players make side wagers on game results. This is not something that a game operator can handle directly, but it is an issue that they should be aware of, because these side wagers can substantially alter the behavior of the players. It may be more profitable for players to lose the game and distort the ranking system if the side bets are large enough (or there is little value in having a high rank in the ladder). Unfortunately, there are no magic bullets for these problems. Trustworthy game logs may help, but games need to be examined on an individual basis.

200

Protecting Games: A Security Handbook for Game Developers and Publishers

ZERO-SUM SCORING Abandonment is a particularly tricky problem for online games. The essence of any solution is to make it more advantageous for a player to complete a game, whether or not they win. A metric that simply rewards players for completing more games may help. One also needs to look at how a game is scored internally. Games that have asymmetric scoring systems (a term I’m making up as far as I know) are particularly vulnerable to this form of attack. An asymmetric scoring system is one whereby one player can score independently of the other players. Baseball is a good example. Runs are earned by a given team, as are individual statistics, without direct corresponding consequences for the other team or players. Many games can be configured so that the game’s scoring system is “zero-sum” or symmetric scoring. Each positive event for one player is balanced by a negative event for the other player(s). Thus, a game will have a net score at all times of zero. In many cases, this allows the game to end at any time and still be considered valid. One game that uses this type of scoring system is the Austrian tarot card game called Konigsrufen. The problem we encountered when playing the game was that we never had the exact right number of players for the game. The game requires four players, but we often had five or six, but never enough for two full tables. This was a group of mathematicians, so, of course, they had a mathematical solution to the problem: zero-sum scoring. If I scored 300 points in a hand, each other player lost 100—making the hand net out to zero, so that the odd-mathematician-out could play the next hand while keeping the game score working for the whole evening. This is a powerful and flexible concept. So, if there are W winning players and L losing players, and the total reward is R, then: R = W*r = L*(-p)

Thus, each winning player will receive: R/W = r reward points

and each loser will lose: -R/L = p penalty points

Overall standings are based on players’ individual scores. Although the sum of the players’ scores is zero, their individual scores can vary widely. This technique may not always be applicable but it can be an effective technique to minimize the consequences of game abandonment. Also, because the game is always at “net zero,” the game service may more easily support late player substitutions or replacement players joining a game session to improve the game play experience while not punishing (or excessively rewarding) late players.

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

201

G AME O PERATOR P ROBLEMS Game operators don’t like to think of themselves as a source of game problems, but players certainly do. The most important asset a game provider has is her reputation. In order to avoid damaging public relations, game service providers should be prepared for accusations from disgruntled players. BIAS Because of the nature of the games that they are offering, game providers often have insider knowledge that would give a favored player a real advantage in a game. Also, if there are games played in competition with the game provider, there can be tax advantages to reducing apparent winnings by colluding to lose to a cooperating player. (This is a concern that regulators sometimes have with casinos. Casinos are taxed on their winnings, so sometimes a greedy casino will arrange to lose to a player and thereby reduce its taxes. The casino then arranges to share the ill-gotten winnings with the corrupt player.) The MMO EVE Online faced accusations that members of the game developer’s staff were giving their team (corporation) an unfair advantage in the game16. The best strategy to avoid this problem is to simply not allow developers, their friends, family, or anyone else personally or professionally associated with the game to play. I’ve had this debate with several developers who’ve objected strongly. If developers must play, it should be separately and they should clearly identify themselves. Also, they should be subject to quite rigorous logging. Even the appearance of impropriety can be quite expensive. The loss of only 100 subscribers due to damaged reputation for virtually any MMO would likely exceed almost any employee’s annual salary. INSIDER PLAYERS/SHILLS This is a problem associated with closed tournaments, skill games, gambling games, or other games for money. It is a more extreme version of the bias problem, whereby the game provider intentionally seeds the game with insider players and alters the game for the game provider’s benefit. PAYMENT ABUSE/TILL FRAUD/RAKE ABUSE If the game service has payments involved, there are opportunities for payment abuse. A game company that shaves a nickel here, a penny there, and a dime somewhere else can easily and stealthily earn substantial undeserved revenues (the general term for this in the computer security field is a “salami attack,” in which many individuals do not notice very small amounts of fraud but the aggregate amount stolen can be quite large).

202

Protecting Games: A Security Handbook for Game Developers and Publishers

Game providers should provide clear payment tables that are always available to players and full and detailed accounting records for the player’s review. It would be optimal to provide an independent audit on the player’s platform, but this is not always practical. An outside auditing firm in support of well-documented processes and procedures and other measures can help build a reservoir of trust. This type of attack could easily be implemented in virtual asset games by providing smaller amounts of virtual currency than promised to players, removing a small amount of virtual currency or items from a player’s existing virtual holdings, or altering virtual asset prices for non-observant players. This can happen with real items, not just virtual assets. The use of electronic point-of-sale software has made it possible for crooked business owners to take funds, without reporting income, by using programs called zappers17. Basically, zappers create fake transactions from a malicious company’s business partners for the purchase of items or they alter the price of items. The zapper manipulates the entire accounting system to allow a crooked business owner to extract cash without ever reporting it as income but still have clean books for auditors and tax collectors. ULTRA-VIOLENCE/ACTION HANDS In games where variable rewards or payments are involved, the game provider may be able to make the game more “interesting” and hence increase payments by players to the game operator. In this case, the game provider doesn’t really care who wins, just that there is more activity than would be occurring normally under the game’s rules. There have been accusations that some online poker sites have a bias towards dealing hands that will encourage a lot of player wagers, thereby earning the game operator more money from increased wagering. Reputation is critical for a game provider. Anything that can damage the game operator’s reputation can be very costly very quickly. It is important for game providers to avoid even the appearance of impropriety. Also, as the (online) game industry grows, it will be important for companies to cooperate and develop best practices and perhaps even certifications to protect the whole industry from flawed practices or individual bad apple companies that could turn into government regulation or result in lawsuits.

I DENTITY P ROBLEMS Identity becomes much more important once one moves to a rich online game service (see Chapter 29). The simplicity of developing a casual single-player game and hosting free standalone games becomes substantially more complicated when other

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

203

players become involved. Undermining identity is a critical part of many of the attacks discussed so far. There are many ways to weaken identity and some of the problems can have particularly serious impact on tournaments and ranking systems: Invalid Licenses/IDs—Both paid and unpaid games often use a license key or platform ID as part of their identification system. For performance, storage, and business reasons, these keys are sometime not issued and validated individually, but generated by an algorithm. Malicious players can steal keys, duplicate them, or break or reverse-engineer the ID authentication algorithm (see Chapter 5). As discussed previously, there are ways to ensure the security of license keys and recover from compromises—but the techniques are game service specific. “Alt” IDs—Free online game services often permit, or do nothing to stop, the creation of multiple identities. Players can use these additional identities to increase their chances of winning or boost their rank with lossbots. Positive incentives can be used to encourage honest registration of identity, such as prizes or loyalty programs. Outsourcing—Players sometimes recruit or hire other players who are good at a game to play for them to boost their score. This is offered as a commercial service, just like gold farming, for several massively multi-player online games including World of Warcraft, but it has also been reported with players hiring other players to boost their rank in ladder systems for casual games. There is not much that can be done to prevent identity outsourcing (see the section in Chapter 22 on power-leveling). Game Save Sharing—Some games store the state of the game or other persistent information locally. This data is sometimes exchanged with other players to boost statistics or otherwise enhance play. This has occurred on the Xbox 360 console to boost achievements in the Xbox Live service. If the game or console needs to support storing these files, the files should be cryptographically tied to a specific platform or user account (see Chapter 14). Strong identity can mitigate many online game security problems, including those associated with tournament and ladder hacking. Interestingly, cash and prizes are great tools to encourage better reporting of identity information by players and can easily be tied to competition and ranking systems. At the same time, cash and prizes substantially increase the value and likelihood of attempted attacks. There are advantages and risks with either approach. Strengthening identity is generally quite useful and there are often solutions to reduce the effectiveness of attacks on games, as discussed in Part III.

204

Protecting Games: A Security Handbook for Game Developers and Publishers

C OUNTERMEASURES There are numerous ways to protect tournaments and ranking systems against attack. What follows is a list of tactics that may (or may not) be applicable to your specific environment: Buddy List or Guild High Scores—Rather than having a single, global highscore system, use buddy list high scores. In order to implement this tactic, the online service will need to keep track of all the pair-wise scores and reporting status in a localized buddy list or guild. Because scores are only published within a local community, spurious accounts and results will not cause meaningful problems. Buddy list scores can serve as a recruiting tool. Likewise, giving players the ability to track their relative status with their friends may help build the online community and virally expand as players recruit their friends. Buddy list scores can also be used for guild versus guild or team competition, tournaments, and so on. Paid Versus Unpaid High-Score Systems—If there is an economic or other model tied to the game, you publish only the high scores for those who are actually helping your business by paying. This can even be tiered based on how much money the person has spent. Levels of Competition/Bridge Style Rankings—The card game Bridge has a ranking structure based on multiple tiers. Thus, one moves from player to master to grand master, and so on. For an online game with weak identity, this structure can be used to radically drive up the cost and effort to spoof the highscore system (and is similar to the approach used in the tournament ranking system in A Tale in the Desert, discussed previously). For example, in order to move from player to master, the player must defeat 10 other players; in order to move from master to grand master, the master must defeat 10 other masters. (You can add more levels as desired; martial arts rankings have a “belt” system that supports quite a number of levels.) For a legitimate player, the minimum number of games to move from player to grand master would be 20. But for a spoofer who was creating phony losing accounts, the number of games would be 120 (10 fake players to move to master, 100 fake games to create 10 more masters, and 10 more fake games to get to grand master). As always, strategies can be combined and there could be a conventional leader board at the top level (the grand master). Additional twists can include: 1. Uncount scores if the opponent becomes inactive for 30 days. 2. For server-based games, you can track the duration of games to see if they are unusually short (for time-based games) or fewest turns (for turn-based games). You can then throw out games that are too short, once you have data on typical or expected game lengths.

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

205

Cash and Prizes—As noted several times already, the possibility of winning something tangible is a powerful incentive to disclose identity. The prize doesn’t even have to be very large. The downside, also as noted previously, is that valuable rewards encourage hackers. Natural Achievements—For games that have achievements, rather than hiding achievements like Easter eggs around the game, have these achievements based on natural game activities and spread them out smoothly throughout the game to reflect thorough and masterful play. Some games have used “unnatural achievements,” such as playing an excessive number of times, that may wind up costing the game operator money if the player overuses the service. Impersonal Global High Scores—Global high scores can be listed, but not globally attributed to the player. Thus, only a player’s game friends would know their score (if used in conjunction with buddy lists). This may weaken the urge somewhat to cheat, because the player needs to work harder for notoriety. The downside is that this may reduce the value of the high-score service. Randomized Matchmaking—There are real benefits to randomizing players for ranked games. Player teams, such as clans or guilds, can add complexity to this, as individual performance could add to the group’s ranking. Game operators need to be careful about lobby-stuffing tactics. Face-to-Face Play—There is no reason that the only way to earn scores is online. It can be a powerful marketing tool, and a deterrent to some attacks, to invite local and regional high scorers for a face-to-face tournament where additional rewards can be earned through live, face-to-face competition. Server Scoring—Move the technical score accumulation process to the server to certify the scoring process for the game. This should cause a lot of trouble for a number of the exploits discussed so far, particularly game save sharing. Time-Based Rank—It may be possible to thwart some players who use lossbots or other methods to lower their ladder rank by including an additional attribute for how many minutes of play or total game sessions the player has participated in. Apparently, Microsoft and Bungie are incorporating this technique to help fight leader board cheating in Halo 3 18. Grouping Cheaters Together—Segregate rankings for cheaters and non-cheating players into separate systems. Neither group really needs to see the other. Blizzard incorporated a variant of this tactic into Diablo II on Battle.Net19.

206

Protecting Games: A Security Handbook for Game Developers and Publishers

R ETROFITTING G AMES

FOR

T OURNAMENTS

AND

S KILL G AMES

Many games are not really suitable for tournament or skill-based play because of their poor security. This is both an issue and opportunity because tournament and skill-based play extend the life and may increase revenue for game developers and publishers. Game fans and secondary game businesses have tried to build tournaments and skill-based games businesses around a number of games. Many of the games that people have tried to convert to a “for-money” business model are vulnerable to standard hacks, including proxies and state hacking. Whereas cheating is somewhat tolerated in a “for-free” or “for-fun” environment, when cash or prizes and payments are involved, cheating becomes a central concern for the business. The typical architecture for these online services would include a central game server with multiple game clients. Legitimate operations require that each player has a licensed version of the game. In order to improve security with these legacy games, the game can integrate a real “action log” for each participating player. For this approach to work, the game needs to be able to be accurately replayed from a log file consisting of the sequence of player actions, timestamps, and, optionally, one or more random seeds. The random seeds would be provided by the game server or the collaborative random techniques discussed in Chapter 13. At the end of the game, the players submit their action logs to the server. This can be done after every game, at a random time, or when there is a dispute between players or an unusual result. The server then uses the logs from all of the players to reconstruct the game and see if it matches the observed results and game play behavior in its own action, state, and visual logs. Discrepancies can be used to identify problems and take suitable action. This approach stops many, but not all, security problems for legacy games. One problem the “action logging” approach does not stop is the use of automation tools or player aids. These attacks will always be hard to detect because they don’t alter the game; they just improve the player’s performance.

S UMMARY Game service providers are moving to provide richer player experiences to complement their games. These richer game play systems, such as tournaments, ladders, and reputation systems, bind the players to the service and inspire the players to continue playing. Tournaments can be great marketing tools. NCsoft has run a number of tournaments for Guild Wars with substantial prizes 20.

Chapter 20 Competition, Tournaments, and Ranking Systems (and Their Abuse)

207

Hackers do not have to attack individual games to undermine these valueadded services. The hackers can attack the entire game service fabric. These attacks can be costly to the game operators. Microsoft and Bungie shut down the leader boards for Halo 2 21 and one can only speculate how many sales might have been lost compared to the cost for improving the security of the ranking service. Player reputations and rankings are sometimes sufficient reward themselves to inspire hackers to exploit these competition services. Fortunately, malicious players are more interested in the fame of breaking a game’s security (and publicizing the fact) than running up a high score. The threats to a game service change fundamentally when a game service provider begins to support real rewards and prizes—hackers and cheaters will stop sharing and publicizing their exploits. This results in a substantially greater burden on the game service provider’s built-in security and security team.

R ESOURCES 1. C. Allen, S. Appelcline (2006), “Collective Choice: Competitive Ranking Systems,” http://www.lifewithalacrity.com/2006/01/ranking_systems.html 2. GoldenToken (2008),”Types of Tournaments,” http://www.goldtoken.com/games/wiki?wiki=Types%20of%20Tournament;ref=Wiki%20Start%20Page 3. Full Tilt Poker (2008), “Rebuy Tournaments,” http://www.fulltiltpoker.com/rebuy-tournaments.php?ck=ftp213758551084424 4. Pokervariations.org (2008), “Types of Tournaments,” http://www.pokervariations.org/types-of-tournaments.php 5. C. Allen, S. Appelcline (2006), “Collective Choice: Rating Systems,” http://www.lifewithalacrity.com/2005/12/collective_choi.html 6. Wikipedia (2008), “National Invitation Tournament,” http://en.wikipedia.org/wiki/National_Invitation_Tournament 7. A. Tepper, J. Yelon (2002), “eGenesis Ranking System,” http://wiki.atitd.net/tale1/EGenesis_Ranking_System 8. ATITD (2004), “Tournament Ranking System,” http://wiki.atitd.net/tale1/Tournament_Ranking_System 9. L. Frederick (2007), “NBA Star Caught Cheating at Halo 3,” http://www.escapistmagazine.com/news/view/77998-NBA-Star-Caught-Cheating-at-Halo-3 10. J. Savage (2007), “Game Stopped After Cheat Allegations,” http://www.thelocal.se/6788/20070324/ 11. J. Leyden (2004), “Botnet Used to Boost Online Gaming Scores,” http://www.theregister.co.uk/2004/12/21/randex_botnet_fun_and_games/ 12. Blizzard (2005), “Accounts Closed for Ladder Abuse,” http://www.battle.net/news/0503.shtml 13. N. Maragos (2005), “Battlefield 2 Security Holes Exploited, Login Problems Reported,” http://www.gamasutra.com/php-bin/news_index.php?story=6033

208

Protecting Games: A Security Handbook for Game Developers and Publishers

14. J. Joyner (2007), “New England Patriots Cheating Scandal,” http://www.outsidethebeltway.com/archives/new_england_patriots_cheating_scandal/ 15. M. Lafferty (2006), “Stat Babies Cropping Up in Online Games,” http://www.gamezone.com/news/08_07_06_01_49PM.htm 16. J. Blancato (2007), “Jumpgate: EVE’s Devs and the Friends They Keep,” http://www.escapistmagazine.com/articles/view/editorials/op-ed/847-Jumpgate-EVE-s-Devs-and-theFriends-They-Keep 17. R. Furchgott (2008), “With Software, Till Tampering Is Hard to Find,” http://www.nytimes.com/2008/08/30/technology/30zapper.html?_r=1&oref=slogin 18. Michiel Meijs (2006), “For All You Halo Fans Out There #3,” http://www.xboxic.com/news/2045 19. A. Park (2002), “Battle.Net Cracks Down on Cheating...Again,” http://www.gamespot.com/pc/rpg/diablo2/news_2871872.html 20. A. Rose (2006), “Guild Wars Goings-On,” http://www.joystiq.com/2006/05/31/guild-wars-goings-on/ 21. Frankie (2005), “Bungie Weekly Update: October 14th, 2005,” http://www.bungie.net/News/content.aspx?type=topnews&cid=6864

21

Griefing and Spam

“Hell is other people.” 1

f being trapped in a room with three other people for an eternity is Hell, one has to ask what is the name for the place where you are trapped with millions of people who can do what they want and say what they want with impunity for even a day?

I

The Internet, of course. The two are easy to confuse. And, just like No Exit’s characters Garcin, Inès, and Estelle, we all have the opportunity to escape and turn off the computer, yet none of us do. There are a wide range of ways that we inflict grief on each other: Through game play. Although “emergent game play” is often seen as a good thing, there is a dark side where players take advantage of game systems to disrupt the experience for others. Interestingly, a number of these game play exploits grew out of a desire to make game play “safer.” Communications, the tools that enable community, are routinely turned into weapons wielded to harass, abuse, and annoy others. Players also turn the very management tools for reporting griefers into griefing tools themselves. They can even take advantage of the simplest game services, like high scores, to disrupt the game and attack the game developer. User-created content is seen by many game developers as something of a “Holy Grail.” Such content enables developers to provide a sandbox in which players can create and play. Unfortunately, players sometime use these tools to abuse and harass others and have gone so far as to implement denial of service attacks against the game itself.

209

210

Protecting Games: A Security Handbook for Game Developers and Publishers

There are consequences for these actions. Some in-game harassment rises to the level of legal harassment; off-color remarks and content can be considered obscenity; and certain activities, such as “age play” (where adults use avatars of children in sexual situations), can create serious legal and business problems for a game service provider.

C OMMUNICATIONS G RIEFING

AND

S PAM

Insults and harassment are virtually routine for many online games. The anonymity afforded to online game players has given rise to widespread and increasingly aggressive harassment. The hardcore gamers who are otherwise prized by game companies are often the worst offenders and taunt the newest players (derisively called “n00bs”). This, of course, is the riskiest time for a game operator—new players are liable to abandon a game that they find hostile. There is often a perception by players of a “right to anonymity.” There is no legal basis for this and, in fact, the Privacy Act in the US did not come into being until 1974 and mainly addresses an individual’s privacy in relation to the government. Sexual and racial harassment also, regrettably, occur too often. Additionally, the rise of gold farming in MMOs has led to a corresponding increase of in-game spam marketing that touts these services (see Chapter 22). As games become more and more mainstream, it will not be surprising to see the same kind of spam we all suffer from in our email. The Facebook social network is increasingly being targeted for spam, virus and worm delivery, and phishing attacks2. A recent survey showed that spam was effective—nearly 30 percent of individuals surveyed had purchased a product based on a spam message3. Response rates are surprisingly high, considering that the bulk of spam is blocked by filters. There are 10 sales per million spam messages sent; a good return on investment since botnet spam only costs $5 to $10 per million messages. Even worse for game operators, some of this spam can be used for phishing for account information or otherwise attacking the game service directly. IN-GAME, COMMUNITY,

AND

CUSTOMER SUPPORT

To fight these problems, as well as to address other issues, game companies provide customer support and community and forum features. Apparently as many as 25 percent of customer support calls are due to griefers4. This direct avenue for filing complaints is also a direct cost to the game company. In 2002, Alan Crosby of Sony estimated that his 60-person customer service staff each spent one hour out of an eight-hour shift handling griefing for the EverQuest MMO5.

Chapter 21 Griefing and Spam

211

The most common “griefer counter-measure” is to put in place a strong set of community services. Depending on the game, these community services provide clan features (tools to form and support player groups or teams), friends lists, reputation systems, and other services both to tie players more closely to the game and to create an environment that reduces anonymity for misbehaving players. One of the best features of a strong community service is that it can provide substantial security benefits at modest marginal cost. After all, the game developer is putting the community system into place for primarily business growth and marketing purposes. There are two main limitations of community systems from a security perspective. First, malicious players can often create new accounts (especially for game services that are free), thus removing the effective social stigma of griefing. Several games attempt to fight free-account griefers and spammers by requiring players to have reached a certain level (implying a fair number of hours of game play) or pay to be able to broadcast messages in the game. Second, malicious players can use the anti-griefing system to cause further grief by wrongly accusing other players of griefing. This is an excellent and unfortunate example of griefers using the game system against itself and other players. Player accountability is the key to controlling griefing. Some online game services, such as Battle.Net, X-Box Live, and Valve’s Steam have the capability to tie a product license key or other unique tag to a player and can use that identity to punish or ban abusive players. The other major form of customer support is found in persistent world games. In-game game masters provide live monitoring of the game play environment. This gives the game provider the ability to respond in near real time to griefing incidents. This solution is quite powerful, but it does come at a cost. Consider the Sony EverQuest example. Crosby estimated that one eighth of each of his 60 employees’ time was spent handling griefing. So, basically, he had the equivalent of 7.5 employees devoted to griefing full time. If we assume a modest salary of $40,000 per year (this is really cheap, as it wouldn’t include additional fees for shift work, health and other benefits, or management overhead), Sony was spending approximately $300,000 per year, at least, and probably closer to $500,000 on the griefing problem (2002 was in EverQuest’s heyday, so the game probably had approximately 425,000 subscribers at that time6). Although this may not be a huge portion of the game’s revenues, it comes directly from profits and, even worse, there are likely additional costs that are hard to measure directly in terms of lost subscribers or non-renewals by existing subscribers. The cost of managing griefing can grow rapidly for a game service provider and can lead to lost subscribers, redirecting staff from other assignments, reducing player satisfaction, or increasing the total staff costs for the game by simply adding

212

Protecting Games: A Security Handbook for Game Developers and Publishers

staff to handle the complaints. For a small game, the cost of managing griefers can be the difference between success and failure. For a large game, these costs are a continual drag on the bottom line. Given these numbers, a game company can make a rational decision as to whether a new security solution is needed. If griefing is at all a problem in a game, it is probably costing hundreds of thousands of dollars, minimum. The question is: are there solutions and what do they cost? ANSWERS

TO THE

GRIEFING PROBLEM

A security solution is not likely to be able to stop griefers, but should detect, and hopefully deter, them. A common, but usually unsuccessful, approach to stop griefing is to use “dirty word” lists. “Dirty word” systems basically operate an ever growing list of “banned” words and phrases that will cause a message to be blocked or the offending words or phrases removed. A very different approach is to (mostly) eliminate open communications as Disney has done with Toontown Online. Disney’s children’s MMO has a communications architecture that eliminates “chat” except among trusted friends7, and this approach has been followed by other children’s games. These games use totally structured communications for most players with all text and even sentence structures provided by the game company. If friends have shared a code outside of the game environment, they can communicate through a monitored chat service (see Chapter 30). Monitoring communications can be expensive. Another children’s game, Club Penguin, has 100 real-time employees monitoring player communications and adds 500 to 1,000 words per day to its “dirty word” filters for its 12 million total users and 700,000 subscribers8. For most games, a general-purpose communication capability—either via text chat or voice or increasingly video—is integral to the game experience. Real “dirty word” lists are very vulnerable to “misspelling” attacks that will thwart the security system while effectively conveying the harassing message. Live license keys are fairly effective in using platform identity to deter griefing (by the threat of banning), but these keys do not have a strong binding mechanism to an individual message or person. Similarly, credit card controlled accounts for massively multi-player games can strongly identify an individual player during a session, but they also cannot be bound to a potentially offending message. One tool that binds the actual communications to an individual is a digital signature. Digital signatures can support both client-server and peer-to-peer communications. This is especially important as games grow larger and the cost of simply relaying messages grows rapidly for voice and video communications to the point where a central service cannot log and monitor all communications.

Chapter 21 Griefing and Spam

213

Although there are numerous references that can explain how digital signatures work, the important feature they support is non-repudiation. Non-repudiation is defined as the property that only one individual could have signed a message. This works by taking advantage of the unique characteristic of public key cryptography, namely, that knowing the public key (P) “half” of a public-private key pair will not allow the reconstruction of the private (secret) key (S). This feature allows an individual to broadcast their public key to everyone and they will be able to decrypt my messages, but only the individual who knows the private key can encrypt them. The player can then use her private key to “sign” a message by encrypting a hash of the message (or the message itself). Then, anyone can use the public key to validate the message’s signature. The signed message is formatted as follows: S(message) or message,S(hash(message)); // where only one person knows how to compute S(x)

The verification process works as follows: P(S(message)) = message or P(S(hash(message)) = hash(message); // where everyone knows how to compute P(x) and hash(x) /* if the hash of the message received does not match the hash included in the signature, then the message is not verified */

Now, if you build the communication system (voice, video, or text) and add a digital signature service, players will not be able to deny that they created the messages that they have sent nor will other players be able to misrepresent messages from the actual sending player. At least, this is so as long as there is reasonably good identity information for the players (see Chapter 29). If a player can store all of the messages that she receives and forward them to the game operator when she wants to file a complaint, the operator will have an undeniable record of the conversation that cannot be manipulated. This has several benefits. First, the potential griefers will be deterred, knowing that their actions are neither non-deniable nor spoof-able. This is probably the most important characteristic of the system. Deterring griefing (like crime) has a much better return on investment than hunting down and catching the troublemakers. This technique actually can be extended to regular in-game actions to deter spawn camping and other griefing problems by utilizing logs stored by players for evidence of abuse.

214

Protecting Games: A Security Handbook for Game Developers and Publishers

Second, the game operator can reduce the live team and customer support staffing for grief-management. Because there are reliable logs of alleged griefing, real-time response by the customer support team is less critical. Players can post messages for reliable adjudication and both players’ versions of a conversation can be used as reliable evidence—which leads to the third benefit of this approach— fewer customer disputes and complaints. Digital signatures do nothing to stop spam. Unfortunately, spamming players usually have found a way to acquire an account that can broadcast messages and they are willing to risk being banned from the game after sending even a single message. The simplest solution is to remove broadcast communications services from the game, but these services can be very useful for many reasons such as helping players form ad hoc groups to ask for help. Another approach is to phase the distribution of broadcast messages. Most of the time, this type of spam is sent via text, not voice or video. Broadcast voice and video are just too disruptive, so players tend to only use them with much smaller groups and can simply “mute” or blank out anyone who annoys them. Phased distribution works by dividing the active players into a (binary) tree structure at random. When a player sends a broadcast message, it is first sent to the players in the same low-level branch, and then sent to the players in the same higher-level branch, until eventually, it is sent to everyone (see Figure 21.1).

FIGURE 21.1 Anti-spam phased message propagation system

Chapter 21 Griefing and Spam

215

The pacing of this distribution system should be set up to give players a chance to mark the message as spam before it is sent to the next tier in the system. This technique will disturb the fewest players from any given spammer. As with many other challenges for gaming, weak identity aggravates griefing and spamming security problems. Strengthening identity is always helpful. For games that want or need to support fairly anonymous players, the key is to minimize the impact of spam and grief-related activities either through structured communications or other measures that reduce impact on legitimate players and effort for customer support personnel.

HIGH SCORE OR PLAYER NAME GRIEFING Players often choose inappropriate or obscene names for their online personae or characters. Often, this is simply acting juvenile, but sometimes these names are chosen with malicious intent. In the previously cited advergame security survey 9, 10 , some players used the games’ high-score lists to criticize the sponsoring company. Such incidents can be particularly troubling when they occur in a marketing campaign with high visibility. Player reputation systems and alert processes to help flag inappropriate user names are fairly effective. However, it may be advisable to take the further step of manually verifying new high scores before they are available publicly. In order to minimize player impact, the game operator can structure the game to show the player her proposed username, but not reveal the name publicly until it has been verified.

G AME P LAY G RIEFING Just as players use weaknesses in a game’s rules implementation to gain a competitive advantage, a number of players use these exploits simply to abuse other players. One of the most common such tactics is “spawn killing,” whereby players kill another’s character just as the character enters the game before the player can take any action or protect herself11. Often, the countermeasure is to allow players to be briefly invulnerable as they enter the game, invisible, or vary where they appear. These tactics have to be used with caution, as they can, in turn, be used to grief other players. Another game play griefing tactic is when players sometimes kill the characters belonging to their allies, the gaming equivalent of “friendly fire,” which is called “team killing”12. Typically, there is very little that can be done about this problem without seriously distorting a game’s design.

216

Protecting Games: A Security Handbook for Game Developers and Publishers

After murder, theft follows naturally in the hierarchy of sins. “Kill stealing” is the practice of taking items or experience that another player should rightly have earned13. Depending on the game’s design, players can sometimes join a battle very late but still share equally in its rewards. The extreme version of this tactic is “ninja looting,” whereby a player seizes unearned items or items that her group had agreed to share in a different fashion, and finally, there is “scavenging,” whereby a player accumulates items or resources left behind by other players14. Some games have addressed these issues by making the entire combat process more structured. Once players have joined a battle, no one else can participate in the fight or earn a share of its rewards. Often, the problems come from a mix of formal and informal game play systems, as is often found in PvE (player versus environment) MMOs. These games often have game rules in place to prevent conflict between players (called PvP); however, the developers want the game to be “real,” and this is where the trouble occurs with inconsistencies in the various game mechanisms.

DON’T DROP (LOOT) Many online games have monsters that “drop” items when defeated. Players then “pick up” the items either individually or allocate them based upon a predetermined arrangement. The “ninja looting” problem described previously arises from this design. A simple approach to fighting this sort of abuse is that the players who participated in the combat or other action that resulted in the loot drop handle the allocation of items abstractly. Nothing is “dropped” physically to be picked up by the fastest or most devious player. Instead, items appear in a transactional window with each item to be allocated among the participants in the combat. Allocations are proposed by the players; however, nothing is released to anyone until all of the participants “vote” on the result. The default system would be a unanimous vote with nothing allocated until everyone agrees. Players can still cause grief by refusing their vote, but they don’t get any benefits either. The game can retain the transaction for a week or other interval and then the items disappear. For an organized party of players or guild, loot can build up and be allocated by a number of different systems. This is an opportunity for a game developer to provide flexible player interactions and an effective “contract enforcement” tool.

Chapter 21 Griefing and Spam

217

If the game is very formal, the rules will tend to prevent problems, and if the game is very “real,” abuse has consequences. This latter approach is seen in the science fiction MMO, EVE Online. EVE Online is a largely player versus player game, although certain parts of the universe are more secure against inter-player aggression. When players can attack players, these forms of griefing tend to take care of themselves. Players will simply get revenge on the other players for theft. Interestingly, EVE Online has taken a different approach to theft griefing in the parts of the game where players are not supposed to fight each other (high security space) with a space-based police force called CONCORD. The CONCORD system will essentially destroy anyone breaking the game’s anti-griefing rules in “high security space.” CONCORD is not immediate, and so some players can carry out their crimes and not get destroyed. Also, players have sometimes used throw-away ships to carry out suicide attacks and used other ships to steal loot. This technique, called “suicide ganking,” is being addressed through changes to the game rules15. Basically, game developers need to be quite careful and test their designs to identify both potential cheating and griefing exploits.

U SER -C REATED C ONTENT The ideal game is one where developers can just sit back and let the players create the game using some developer-delivered building blocks. Social networks do this by providing a communications framework with numerous features to encourage user action and interaction. Dating sites are the most obvious example. Players add information to their own profiles, rate, and communicate with other members, take tests, fill out surveys, send virtual gifts, and so on. For game services, some games go beyond simply providing high scores, multi-player lobbies, and the standard apparatus of social networks to allowing players to create, and in some cases, buy and sell, virtual items. Second Life and IMVU are probably two of the best known online services that use this model. Metaplace goes a step further by allowing users to create their own games. Some MMOs do support “crafting,” but this is not really user created content, but simply a portion of the game’s economy. Once a game allows users to create items or change the game’s rules, there are massive opportunities for abuse. “Time to Penis” is a tongue-in-cheek metric for the time from when some level of user creativity is permitted until someone creates a penis. Electronic Arts (EA) released a Creature Creator for its much anticipated, family-friendly title Spore. The immediate, inevitable response was widespread creation of obscene creatures, called Spore porn or Sporn16. EA is managing user content by allowing players to report inappropriate material as well as by allowing users to restrict the material that they receive from other players to creatures from no one, only their friends, or the general public.

218

Protecting Games: A Security Handbook for Game Developers and Publishers

This in-game graffiti is only one concern. Players can simply use their virtual presence to disrupt the experience of others as IBM found when Italian union workers moved to protest a reduction in their “productive results benefit.” Instead of a traditional strike, they protested in IBM’s online space in Second Life with 2,000 sympathetic avatars resulting in substantial, global media coverage (and, apparently, victory for the workers)17. Also in Second Life, a CNET interview with Anshe Chung was disrupted for 15 minutes by “animated flying penises”18. The griefing incident was followed by a copyright brouhaha when Anshe Chung’s company sent DMCA takedown notices to YouTube and media sites for posting copies of the video of the griefer disruption of the interview19. Second Life faces unique challenges because of the pervasive ability of players (called “residents” by Second Life’s creator Linden Lab) to modify themselves and their environment. Second Life has been moving to add more controls to its environment in the wake of these attacks. Because Second Life is structured around the notion of controlled virtual real estate, security controls really need to be matched to the game’s ownership model. Public spaces in the game have had a number of problems over the years with denial of service attacks that used the ability to create and animate items to overwhelm the virtual world’s servers. Neither IMVU nor Metaplace are likely to have the same sort of concerns in that neither have the same notion of a shared, public space that is also highly programmable. However, it does seem that IMVU has had some problems with players griefing the flagging system for inappropriate virtual items20. Lying somewhere between spam and user-created content was a stunt pulled by a gold farming company in World of Warcraft (WOW). In WOW, when a player’s character dies, it stays in place where the death occurs until the player starts over (respawns). The gold farming firm arranged to have a number of gnome characters die in a large pattern on the ground to spell out the company’s website address21. Rating and reporting systems are probably the best tools for managing abuse of user-created content systems in online games—especially when used in conjunction with an effective identity system (see Chapter 29). The power and potential for creativity of a service like Second Life makes it particularly exciting for those who are enamored with virtual worlds. However, balancing player creativity with griefer crudity and abuse is a huge challenge.

L IABILITY

AND

B USINESS R ISK

with J. Price Certain forms of griefing can create real legal and business risks for a game operator. Player-to-player communications and user-created content can be considered

Chapter 21 Griefing and Spam

219

obscene or harassment and trigger legal actions that affect both the individuals involved and the online service. Players can create virtual items that infringe on trademarks or alter a game to damage its reputation. OBSCENITY National, state, and local laws and ordinances classify most sexually oriented material as either obscene or indecent. It’s a serious issue. Criminal laws apply and there is a possibility of going to jail. But figuring out what is obscene and what is indecent is often complicated. The difficulty of defining obscenity was memorably summarized by U.S. Supreme Court Justice Stewart Potter in a concurring opinion when he said “I know it when I see it.” There are no objective standards. Even worse, because of the number of jurisdictions involved, a game operator may be in jeopardy without knowing it. The game operator can be sued where the game’s audience is located, not just where the company or servers are housed. In the US, the answer depends upon how the content is being viewed. Different obscenity standards apply to broadcast television, subscription television (cable/satellite), and the Internet. Offline, anyone sending sexually oriented material might avoid liability by controlling the point of delivery of their material to avoid areas with strict obscenity laws. Almost by definition, online services are accessible in the most conservative as well as the most liberal communities. Potentially, the most conservative contemporary community standard applies to any online service on the Internet when considering obscenity and indecency standards. In order to be completely safe and avoid prosecution of violating obscenity laws, the contemporary community standard of the Internet is (essentially) the most conservative community where the service is available. Even if the game operator’s provided material raises no concerns, user communications and user-created content can be an issue. Most troubling are the portions of the criminal code that apply liability to the game operator for any “knowing” use of the “interactive computer service” to transport and transfer obscene material. If a game operator receives complaints about inappropriate content, the operator must take prompt action. The game operator faces the risk of being charged if there is evidence that the operator received complaints regarding criminal content, such as obscenity, and ignored it. The U.S. Supreme Court has held that a prosecutor need not show that the defendant knew that the material was obscene, but “that he knew the character and nature of the materials.” The best practice is to maintain control of the online environment and users: Have online user policies that give you wide discretion to examine what is happening within your game and that enable you to work with law enforcement at your discretion. Take down content for whatever reason you feel is appropriate.

220

Protecting Games: A Security Handbook for Game Developers and Publishers

Don’t put your head in the sand. If you hear of something fishy, go after it and take down any content that can’t be viewed on prime-time television. If adult or other potentially risky (or risqué) content is important to your service, you’ll need legal advice tailored to your specific situation. HARASSMENT If you offer a service online that permits user communication, odds are likely that you will have a harassment case arise at some point. Law enforcement agencies have estimated that electronic communications are a factor in from 20 percent to 40 percent of all stalking cases22. Forty-five states now have laws that explicitly include electronic forms of communication in stalking and harassment laws. State laws that do not include specific references to electronic communication may still apply to those who threaten or harass others online, but specific language can make the laws easier to enforce. A number of federal laws also are relevant. Authorities will work actively to pursue harassment cases. In a widely reported incident, a woman was accused of bullying a neighborhood teenager via MySpace, which may have contributed to the 13-year-old girl’s suicide 23. Federal prosecutors charged the woman with one count of conspiracy and three violations of the antihacking Computer Fraud and Abuse Act. They accused her of violating MySpace’s terms of service by providing false information to open a fake MySpace account with her daughter and another teen in September 2006. In doing so, authorities say, she obtained unauthorized access to MySpace’s servers. TRADEMARK

AND

COPYRIGHT INFRINGEMENT

Trademarks only stay in force when the trademark owners actively protect them. Copyright protects the authors of original creative works against unauthorized use. As such, trademarks and copyright-protected material that find their way into games via player actions can create real issues for game operators. Trademark infringement is a violation of the exclusive rights attached to a trademark. It occurs when one party, the “infringer,” uses a trademark that is identical or confusingly similar to a trademark owned by another party, in relation to products or services that are identical or similar to the products or services that the protected trademark covers. Trademark infringement is not covered under the Digital Millennium Copyright Act (DMCA) and is not subject to DMCA takedown notices. DMCA was used to inappropriately remove 3D models of cars and airplanes from the Turbo Squid 3D art-sharing site. This was allowed until a lawsuit was filed (and won), based on the inappropriate removal of a B-24 model, which was supported by the Electronic Frontier Foundation24.

Chapter 21 Griefing and Spam

221

Alteration of game content is another matter. Tecmo fought and won an out-of-court settlement against a website that provided a patch to its games Dead or Alive 3 and Dead or Alive Xtreme Beach Volleyball that removed the clothing from the games’ scantily clad models. The company charged the website, Ninjahacker, with unauthorized modification of game assets and circumventing the game’s copy protection system. Because the case was settled, the legal status of player modification of the material from a purchased game is still unclear25. Turbo Squid’s final comment on the matter probably serves as a good summary of the challenges that griefing and user-created content present for game operators: Turbo Squid solely provides infrastructure for vendors around the globe to post their models and creations for sale. By accepting our End User License Agreement when vendors sign up, they warrant that they have all rights to the models and other digital assets they sell. Turbo Squid is a Digital Millennium Copyright Act (DMCA)-compliant operation, and when we receive valid takedown notices from (copyright) or (trademark) owners we act accordingly, and remove any infringing models brought to our attention. That said, because of how the DMCA Safe Harbor provision works, and because of the realities of any large open marketplace, we do not pro-actively police (trademark) infringement to any degree that Turbo Squid might guarantee that any particular model is not infringing. We can only work in a responsive mode. The burden to not infringe falls to Turbo Squid’s vendors, the individuals who create these assets and place them for sale on our site. No matter what game operators do, it is likely that they will need to deal with harassment, abuse, obscenity, and exploits. They just need to be prepared. Although “Hell is other people,” there wouldn’t be much in the way of business or games without them, either.

R EFERENCES 1. J.P. Sartre (1944), “No Exit” 2. P. Kafka (2008), “Facebook Spam Getting Worse?,” http://www.alleyinsider.com/2008/8/facebook-spam-getting-worse3. J. Milne (2008), “Sex and Software Diet Fuels Spam Growth,” http://www.cbronline.com/article_news.asp?guid=781A882F-926F-47F0-B96F-962F5EFAF5E4 4. D. Becker (2004),“Inflicting Pain on Griefers,” http://news.com.com/Inflicting+pain+on+griefers/2100-1043_3-5488403.html

222

Protecting Games: A Security Handbook for Game Developers and Publishers

5. A. Pham (2002), “Online Bullies Give Grief to Gamers,” http://articles.latimes.com/2002/sep/02/business/fi-grief2 6. B. Woodcock (2008), “MMOG Active Subscriptions 70,000 to 700,000,” http://www.mmogchart.com/Chart2.html 7. M. Goslin (2004), “Postmortem: Disney Online’s Toontown,” http://www.gamasutra.com/features/20040128/goslin_01.shtml 8. P. Elliott (2008), “MMO Week: Club Penguin,” http://www.gamesindustry.biz/articles/mmo-week-club-penguin 9. Deloitte Touche Tohmatsu (2008), “Advergames op Grote Schaal Gehackt,” http://www.deloitte.com/dtt/press_release/0,1014,sid%253D13354%2526cid%253D202819,00.html 10. S. Davis (2008), “Serious Advergame Hacking Problems: Deloitte Touche Tohmatsu Netherlands Survey Findings,” http://www.playnoevil.com/serendipity/index.php?/archives/2107-Serious-AdvergameHacking-Problems-Deloitte-Touche-Tohmatsu-Netherlands-Survey-Findings.html 11. Wikipedia (2008), “Camping (Computer Games),” http://en.wikipedia.org/wiki/Spawn_camp 12. Wikipedia (2008), “Team Killing,” http://en.wikipedia.org/wiki/Team_killing 13. Wikipedia (2008), “Kill Stealing,” http://en.wikipedia.org/wiki/Kill_stealing 14. Wikipedia (2008), “Looting (Gaming),” http://en.wikipedia.org/wiki/Looting_(gaming) 15. J. Egan (2008), “Era of Suicide Ganking in EVE Online Coming to a Close,” http://www.massively.com/2008/08/06/era-of-suicide-ganking-in-eve-online-coming-to-a-close/ 16. M. Simon (2008), “Video Game’s User Content Spawns Naughty Web ‘Sporn’,” http://www.cnn.com/2008/TECH/07/30/spore.sporn/index.html 17. UNI (2007), “Breakthrough at IBM Italy,” http://www.uniglobalunion.org/uniibitsn.nsf/2e8743df5acf1602c125701f00464774/867567557e8242f2c12 57387005342d1?OpenDocument 18. D. Terdiman (2006), “Newsmaker: Virtual Magnate Shares Secrets of Success,” http://news.cnet.com/Virtual-magnate-shares-secrets-of-success/2008-1043_3-6144967.html 19. A. Reuters (2007), “Anshe Chung Studios Cracks Down on Griefing Photos,” http://secondlife.reuters.com/stories/2007/01/05/anshe-chung-studios-cracks-down-on-griefing-photos/ 20. Virtual World News (2008), “IMVU to Exit Beta This Summer” (comments), http://www.virtualworldsnews.com/2008/03/imvu-to-exit-be.html 21. A. Sliwinski (2007), “Gnome Corpse Advertisement in WoW by Gold Farmers,” http://www.joystiq.com/2007/07/05/gnome-corpse-advertisement-in-wow-by-gold-farmers/ 22. National Conference of State Legislatures (2008), “State Computer Harassment or ‘Cyberstalking’ Laws,” http://www.ncsl.org/programs/lis/cip/stalk99.htm 23. Associated Press (2008), “Report: Grand Jury Probes MySpace Suicide,” http://abcnews.go.com/TheLaw/wireStory?id=4107005 24. J. MacNeill (2008), “First They Came for the Fords, and I Did Nothing,” http://www.johnmacneill.com/WWII_Bomber.html 25. D. Jenkins (2005), “Tecmo Settles Nude Patch Lawsuit,” http://www.gamasutra.com/php-bin/news_index.php?story=5591

22

Game Commerce: Virtual Items, Real Money Transactions, Gold Farming, Escorting, and Power-Leveling

oney makes the (real and virtual) world go around. In some sense, money itself is the oldest, most widely used virtual item. Because money is so universally understood, virtual currencies are widely used as incentives in online games. Whatever one’s views are about “consumer culture,” we all seem to have a Pavlovian response to accumulating more things.

M

Game developers know this and draw on it to reward players. However, once you create a system where more is better, people respond creatively. Where there is a gap between those with more time than money and those with more money than time, someone will come along to close that gap. Welcome to game commerce. It is worth noting that game commerce is not applicable to all games—after all, there are games of pure mental or physical accomplishment like chess or baseball. Although people do cheat in both, there is no way that most of us will ever be a Chess Grandmaster or in the Baseball Hall of Fame. Anyone can be rich, however, especially in a game. Game commerce encompasses legitimate transactions where players buy, sell, trade, and exchange items, skills, or characters, as well as unauthorized transactions. The most visible, and notorious, form of game commerce is gold farming, where players purchase currency or items for real cash and don’t earn them by playing the game. The other major categories of unauthorized game commerce include powerleveling, which involves hiring other people to play on one’s behalf, and escorting, in which players hire other people to play along with them as partners. The problem for game developers is that, from a strict game play perspective, these activities are completely legal. In fact, many games that loathe game commerce are built expressly to support the very activities that make it possible. Game developers want players to be able to give items to each other and they strive to make it easy for players to group together with others and play the game socially.

223

224

Protecting Games: A Security Handbook for Game Developers and Publishers

THE DARK SIDE: FOUR MORE CATEGORIES OF GAME PLAYERS There are many reasons people play games. Dr. Richard Bartle proposed four basic categories of game players (as modified to suit my purposes)1: Achievers—Players who seek to maximize their score or items or status in the game. Explorers—Players who want to experience and understand the game world and its design. Socializers—Players who use the game as a mechanism to form and expand their social circle. Competitors—Players who want to compete with and excel over other players. Dr. Bartle seems to take a more negative view of this category than I do in that he includes abuse of other players as an implicit part of this category. To his four categories, I would add a set of mirror categories. The dark side of gaming: Earners—Players who seek to earn the most wealth in the game for real-world reasons. These are the gold farmers and power-levelers. Exploiters—Players who carefully study, explore, and analyze the game world and its mechanics to identify weaknesses that give them a substantial advantage, usually due to flaws in the game design and implementation. Harassers—Players who use the social mechanisms of the game to make the experience as miserable for others as possible. Dominators—Players who use the game’s mechanics to make other players miserable. These players are not really interested in doing better than other players, but in making other players know that they have been beaten. Figure 22.1 illustrates these player types. Exploiters and Earners are often closely tied to game commerce. Exploiters help optimize the earning potential of the game. Harassers and Dominators cover two of the main categories of griefing.

Chapter 22 Game Commerce

225

FIGURE 22.1 Game player categories As a game-design note, the existence of the four Bartle categories of players (see Figure 22.1) is probably one of the reasons that game commerce exists. Game developers are often Achievers and Explorers. They want players to work through the game and experience all of the developers’ carefully crafted content. The problem is that many players are not similarly motivated. Socializers want to be able to play with whom they want when they want. Some Achievers are more interested in status than achievement and they may not have as much time to play as the developers want them to devote to the game. Competitors are interested in competition, not resource gathering or exploration. Explorers may want to be able to go everywhere and do everything without “achieving” everything necessary to unlock all of the game’s doors. Game commerce is the shortcut for all of these players to achieve their goals in spite of the game designers’ wishes.

When game commerce is not explicitly permitted by game operators, it creates problems for the game operators because players will engage in game commerce activities, whether officially allowed by the game operator or not. In 2005, Nick Yee surveyed 1923 EverQuest players and found that 22 percent admitted to buying gold2. These gold buyers purchased an average of $135 per year in gold: fairly close to what they were paying in subscription fees to the game. Considering the fact that players are likely to under-represent the rate at which they do something that is frowned on, like gold buying, and under-report the amount that they spend on such items, it is very clear that gold buying is very widespread. Players pay for convenience.

226

Protecting Games: A Security Handbook for Game Developers and Publishers

Game commerce causes problems because it creates a mechanism where players can bypass parts of the game or the “effort” that the game’s developers, and a number of its players, feel that everyone should achieve (see the sidebar called “The Dark Side – Four More Categories of Game Players”). The other problem comes from when players engaging in game commerce activities interfere with day-to-day game play for ordinary players. This can range from monopolizing game resources in order to farm them most efficiently to broadcasting annoying advertising announcements for their services and clogging up the game’s communications channels (see Chapter 21). The biggest problem with game commerce is that it is lucrative. Some estimates place total gold farming revenues at over $1 billion worldwide3. Unfortunately, this kind of money creates problems both within the industry and outside it. There have been a number of cases of employees using their access to online games to fraudulently create virtual items for sale. There is also the growing problem with online criminals targeting MMOs because of the ability to convert stolen account information into cash with little to no risk.

A MUSEMENT P ARK E CONOMICS Many game-commerce problems are due to the simple, abstract economic systems that are found in many online games. Though these systems are called “economies,” they are really amusement parks. There is no supply and demand. Players “ring the bell and win a prize!” In some sense, problems arise because the games do not fully embrace their amusement park “nature”: assets can’t be stolen, but they can be bound to the player who picks them up; resources don’t have weight or size, but players have limited inventories; players can teleport or fly around quickly, but can’t take their characters to another game server or shard; the games are supposed to be “fun,” yet are designed around a treadmill or “grind” to force players to forever accumulate resources and repair “worn” items. In some sense, these game’s economies are not really meant to be played for fun. Rather, they act as surrogates for the long lines and height restrictions that one finds in a traditional amusement park. After all, what is the requirement to accumulate resources but a way to delay players from entering “high-value” instances or dungeons? And what are level restrictions, but ways to limit when a player can access certain adventures? For many players, game commerce gives them a way to “cut to the front of the line” and “grow a couple of inches” so they can ride the roller coasters instead of being stuck on the kid’s rides.

Chapter 22 Game Commerce

227

By this measure, gold farming, power-leveling, and the other forms of game commerce are symptoms of game design failures. After all, gold buyers and other game commerce consumers are giving money to someone else instead of the game operator in order to have the entertainment experience that they desire.

A LTERNATIVE M ODELS For a long time, the dominant business model for the online game industry has been “purchase and subscribe,” whereby a player would buy a shrink-wrapped game box and pay a monthly subscription to play. (It should be noted that before Internet Service Providers (ISPs) moved to flat monthly fees, many games and ISPs had a metered service where players paid by the hour or minute.) World of Warcraft, Lord of the Rings, and most other “major,” traditional MMOs follow this model with a standard retail price of around $50 for the game box and between $10 and $15 for a month’s subscription. A number of companies have tried variants of this basic model. The most familiar alternative is to provide the game as a free download with a monthly subscription, as found in EVE Online and some of the older, larger Asian MMOs. Conversely, ArenaNet’s Guild Wars is purchased, like a standard game, but there is no fee to play online. No one else has really adopted this model for a persistent world game even though it was very successfully pioneered by Blizzard’s Battle.Net for the Starcraft, Warcraft, and Diablo games. A free online service combined with a purchased game is found routinely with first person shooters and real-time strategy games. However, for these games, the online service is often little more than a lobby. Also, publishers have been quite willing to shut down the online service, almost on a whim. Subscription games with a persistent world or economy are the primary victim of game commerce problems. Over the past several years, the “free-to-play” (F2P) model has rapidly emerged. This business model is usually based on a game that requires no subscription to play, but collects revenue by the sale of individual virtual assets (the virtual currency is purchased in a number of ways, such as credit cards, debit cards, phone-based payments, wire transfers, or pre-paid cards). The F2P business model grew popular in Asia with the tremendous success of games like Nexon’s KartRider, MapleStory, and Audition. Recently, the F2P model has grown in Western markets because of the popularity of Asian games as well as the development of original game titles such as EA’s Battlefield Heroes.

228

Protecting Games: A Security Handbook for Game Developers and Publishers

Interestingly, some of the earliest adapters of the F2P were US-based text MUDs, such as Iron Realms’ Achaea, which launched with virtual currency purchases in 1997 and had its first virtual item auction in 19984. Iron Realms uses a dual currency system with one currency based on time in-game and the other based on direct purchases. The only type of trading that this system allows is between the game’s two currencies5. It should be noted that some games earn revenue from advertising or other marketing activities like surveys which are, in turn, linked to virtual item purchases. There are seemingly endless variations on these models. Jagex’s RuneScape is free-to-play, but has a low-cost monthly subscription option that gives a number of advantages ($5.95 per month)—a strategy that is also used in Disney’s Club Penguin. Linden Lab’s Second Life’s primary revenue comes from selling virtual items and renting virtual real estate. Many F2P games still include an actual ingame economy just like the subscription games discussed here and are vulnerable to the same sorts of game commerce problems for this portion of their business. Finally, there is the “broker” model—where an online game earns funds by brokering transactions between buyers and sellers of virtual goods and earns a transaction processing fee. Linden Lab earns some money from this model and IMVU does as well. In some sense, Apple’s App Store and iTunes use this same strategy. The challenge for the broker model is that the transaction processing margins need to be relatively large to handle any payment problems that occur, such as charge backs (see Chapters 27 and 28 on money and payment security issues) and bandwidth for large digital items. For Apple’s App Store, the company takes 30 percent of the transaction6.

O N V IRTUAL I TEMS Who owns your virtual assets? The game developer or operator? The player? This question has vexed the online game and virtual world industries from the days of MUDs. The general perspective of most developers is that the company owns all of the assets and that the player is simply renting access to them—much as they would a subscription to HBO. The assets and characters are non-transferable, have no intrinsic economic value, and can be altered or removed at the whim of the developer (as can the player).

Chapter 22 Game Commerce

229

There are excellent reasons for this. Game developers have been reluctant to invest in the effort needed to build highly robust, transactional, and reliable systems to store virtual asset information. Online games are in a constant state of flux and so the developers are also concerned that any alterations to the value of virtual assets (nerfing) might incur a liability for the company because players had already “invested” in those assets. Other questions include addressing what happens when the game comes to an end and issues related to gambling arise, as many online games include a chance element (see Chapter 31). Others, most notably Raph Koster7 and Erik Bethke, have argued for what many call an “Avatar’s Bill of Rights” 8. Tony Walsh has argued for further “rights” related to data9. The term “avatar” is more than a bit misleading. They are really arguing more about the rights of players in online games and virtual worlds. They make many excellent suggestions from a best practices perspective and many of the issues that they raise are far beyond the scope of this book. A couple of issues that are relevant include the ownership of virtual assets and avatars and the rights of players in relation to banning and punishment (see Chapter 23). The essential insight highlighted by the “Avatar Rights” movement is that players ascribe substantial value to their game characters and virtual assets. The willful denial of this fact has facilitated the growth of gold farming and criminals who target online games, in some sense. Because developers don’t consider the value that players put in their virtual “stuff,” customer service is often not responsive to player complaints about lost items. Also, the game systems are not built to easily log, track, remove, and restore these items in case of loss or theft. In some sense, this is ironic—the same game companies that argue vigorously that the virtual items have no value, at the same time are extraordinarily reluctant to restore players’ characters or virtual items after alleged theft. The argument is typically made that the players are abusing the system by allowing their items to be stolen (or, actually, selling them) and then making a complaint to the game operator. If the items have no value, restore them. However, this is not a matter of rights; it is a matter of good business. Bethke proposes a “Better EULA” 10, not some sort of formal and universal declaration of rights. The real key to this issue for online game businesses is to maximize their revenues and minimize their costs. The extent to which expanded ownership of virtual items by players increases the popularity of a game or the revenues earned from each player is the extent to which online developers should extend rights and control of virtual items.

230

Protecting Games: A Security Handbook for Game Developers and Publishers

G OLD F ARMING Gold farming is almost certainly the most serious game commerce problem for most online games. After all, gold farmers are playing the game for money and are therefore much more highly motivated than ordinary players playing for fun. From a game-play perspective, these players are not (usually) cheating; they are simply playing the game the wrong way (gold farmers are almost always violating the game’s terms of service, but not exploiting or breaking the game play mechanics). The major irritations that gold farmers cause for other players include: Resource Monopolization—Gold farmers ruthlessly optimize their game play and actively seek out the highest-value activities and items in the game. After all, these items are worth the most to the less-motivated players, who are the farmers’ customers. Anti-Social Behavior—Generally, gold farmers have no time or interest in communicating with other players. They are playing to make money. Interestingly, the growing practice of using “instances” (a portion of the virtual world that is only available to an active group of players, like the people riding on the same roller-coaster car) could help minimize this problem by allowing gold farmers to self-segregate and no longer annoy other players. Aggressive Marketing—The best place to sell items is when and where people use them. Gold farmers are very creative in flooding available communications channels with their sales pitches. It would be interesting to see the effect on gold farmer marketing of separating game play from “inventory adjustments.” ArenaNet’s Guild Wars has a limited number of skill slots that are set at the beginning of a play session and the game is highly instanced. This may reduce the value of intrusive marketing. Some games have restricted communications to “shouting distance”—a more realistic option, but many do support the ability to broadcast messages, which definitely amplifies this problem. Most of the countermeasures today are targeted towards the gold farmers, not their customers. One could make an analogy to the proven futility of this approach as seen in the “war on drugs.” After all, if there are no customers, there will be no gold farmers. The main objections to gold buyers are: Unearned Rewards—Players who buy virtual currencies, items, or characters are perceived to not have “earned” them. In some sense, this is a problem for Achievers and Explorers who view accomplishment in the game in terms of their acquired assets and knowledge.

Chapter 22 Game Commerce

231

Incompetent Play—Players who buy items or characters have not experienced the portions of the game that allowed them to know how to use the items or characters and are thus unable to play at the same level as traditional players. This is one of the main arguments against power-leveling, discussed later in this chapter. Gold farming’s main impact is on customer service and retention. If players are unhappy and complain, it costs the game operator money for additional customer support and if players are sufficiently angry with the gold farmers and quit playing, there is a serious problem. Interestingly, Sony set up the Station Exchange in late 2005 to legitimize these real-money transactions between players and bring them in-house. Sony found that this change reduced their customer service call minutes related to virtual item trading from 40 percent to 10 percent11. The reduction in customer service expense was probably substantially more valuable than the almost $275,000 that Sony earned in sales commissions during the first year of the service. Unfortunately for game companies, players will call and complain about problems with their virtual item trading—whether the transactions are permitted by the game or not. The general challenge for game developers is that the value they put on fighting gold farming and other game commerce activities is far less than the value that gold farmers put on their own business. From the perspective of the game developer, gold farming is a customer service problem. Blizzard, the developer and operator of World of Warcraft, claims to have spent only $200 million in upkeep since the game launched in 200412 or just $50 million on average in each of the last four years. As the most popular game in the world during this period, World of Warcraft is likely responsible for a majority of the estimated $1 billion in gold farming revenues per year. The huge disparity between $50 million for total annual operations (including everything from customer support to technical support, hardware, and bandwidth) and any significant fraction of $1 billion clearly shows the huge resource disadvantage of any game developer compared to the gold farmers. Gold farmers will use anything and everything to support their business. If the game allows free or introductory accounts to recruit new players, the gold farmers will use them as “mules” to pick up, transport, and store collected items and virtual currency so that the real farming accounts are less visible to the game. Gold farmers will also use these free accounts to broadcast marketing messages until the accounts are banned. After all, if the account is free, there is no real cost for the gold farmer... a topic that will be of particular importance when I discuss gold frauders, later in this chapter.

232

Protecting Games: A Security Handbook for Game Developers and Publishers

All hope is not lost. There are countermeasures that can be taken to help control or stop gold farming and other forms of game commerce. Many of the techniques are used by game companies already. Some may change the game-play experience in an unacceptable way and a number are far from perfect. Hopefully, however, they will give game developers some additional tools to add to your anti-gold farming arsenal: Eliminate Character and Item Exchange—This is the “nuclear” option. The problem is that players really like to be able to exchange game items and currency. Eliminating the exchange of characters or accounts is very difficult, as it is problematic to implement and enforce a strong, effective identity system (see Chapter 29 on identity). Soul-Binding—This technique is fairly common. An item is bound to a character once it is found or earned. This is a limited case of the eliminate trading option. Player-Binding—Instead of binding items to a character, simply bind them to a player’s account. This may also encourage players to horde items for later use by additional characters created later, potentially extending their duration as a customer. No Private Exchanges: Internal Open Market—All items (and, potentially, characters) are exchanged via an internal open market like eBay or a stock exchange. Players bid using in-game currency for the items. The lack of private transactions or gifting will force all gold farming transactions to devolve into power-leveling, a much more limited business. Gold Farmer Targeting—Instead of banning gold farmers, griefers, or other game system abusers, simply turn off any game protections that protect the characters. Make the characters and their items “fair game” for other players. Gold farmers then need to decide whether to start another character, which costs time and therefore money, or deal with the risk of losing their loot to other players during conflict. Also, gold farmers may think that they have closed a legitimate financial transaction and find that the player decides to steal the item from the farmer. This could force gold farmers to use high-level characters to execute or monitor transactions, making their business more costly. Loot Detection—Large concentrations of game currency or items could be detectable via a spell or skill, making gold farmer treasure stores or players targets. This could be used in conjunction with gold farmer targeting. Pure Barter Economy—The lack of a standard in-game currency will force gold farmers to spread their efforts over the entire range of game items. This also makes the game economy more dynamic and vulnerable to legitimate player manipulation.

Chapter 22 Game Commerce

233

No Gifting, No Dropping—The ability to give an item to another player is the primary mechanism for gold farmers to complete their transactions. Jagex implemented a variation on this system for RuneScape that stopped “unbalanced trading,” whereby players were using the game’s trading mechanism as a “covert gifting channel” by trading items of vastly unequal value13. They also restricted the ability of a player to drop items so that others could retrieve it. Leveling Premium—Power-leveling is particularly difficult to stop, as discussed later in this chapter. Players can always find ways to exchange account information. Instead, make it really inexpensive for players to buy their way up to a higher level. Charge a nominal amount per month for a higher-level character: add $.10 per level. So, to start at level 2, the game subscription would be only ten cents higher, but to start at level 50 would add $5.00 per month. Buy Everything: Pure Free-to-Play—If you want an item, you have to buy it with real currency. This is the purest form of the “free-to-play” business model discussed previously. Again, power-leveling is the only remaining game commerce concern. Dual Currencies—Support a time-based currency, based on game play and in-game activities, and a money-based currency. Allow players to trade between the two via a blind, open auction. This is the method pioneered by Iron Realms5. Item Exchange Aging—Items “decay” the more often they are traded. This reduces the in-game economic value of farmed items. It also creates a dilemma for a gold farmer: The fewer trades, the more valuable an item is. However, the fewer trades, the easier it is for game developers to back-track item exchanges and detect the gold farmers. The decay process can affect the item’s performance or simply consume the item. Once an item has been exchanged (for example) three times, it simply disappears. Badging: Pure Experience-Based Play—Players gain the ability to use items based on completing different quests, dungeons, or other in-game achievements, not based upon finding the items or accumulating currency. More complicated variations can require multiple badges to use certain items with the ability to mix and match badges to configure a character as the player wishes. The only currencies in such a game are time and effort. Real Game Economy/Corrupt Game Commerce—Having a rich economic system with extensive trading and market manipulation options will allow regular players to engage in economic warfare. If items have weight and size and there is no teleportation and player versus player conflict is allowed, gold farmers face risk and competition from regular players. Many abstractions of a game’s economy and game play mechanisms to make game play “safer” also make gold farming much easier.

234

Protecting Games: A Security Handbook for Game Developers and Publishers

Merchant Account—Have players pay a premium for a legitimate merchant account that allows in-game trading and gifting. These accounts would have additional features to support some level of transaction transparency. The game operator would not become involved in the transaction, but might provide a simple rating system. Conquer Online announced such an option in April 200814. Gift Tagging—Permanently mark items and currency as having been exchanged or traded. There may be a humiliation factor associated with having such items visible to other players in your inventory. The Purist Badge—Create a player badge for players who have never accepted (or, optionally, given) gifts. Every player starts with this badge until they lose it by participating in a transaction. Conversely, players who have given or received items could be given a “trader” badge. Virtual Item Honeypots—This is a dangerous tactic. Consult an attorney. Game operators seed third-party sites that support gold farming transactions with items for sale and then ban the customers after a period of time if they’ve made a several purchases. This may also create a lot of ill will with your customers. Obviously, the game company could make a fair amount of money this way. Frictionless Player Transactions—Fully support inter-player transactions, but only for purchasing additional game currency (for free-to-play games) or additional subscription time. This keeps money in the game operator’s system and basically allows players to play an economic game whereby they have an advantage over gold farmers, because the transactions should be much more efficient as there is no risk. The game company will reduce its regular revenues as players convert game assets into subscription time or currency. Penalize Gold Buyers—Instead of targeting gold farmers, target gold buyers. However, instead of banning the players, fine them enough so that they will have lost more than if they didn’t buy gold. Reset their account to a check point prior to the transaction. If a player buys 200 gold from a gold farmer, fine the player 400 gold. There is no need to correlate the time of the punishment with the crime. This means that once a gold farmer account is identified, it can be used to target gold buyers; and the gold farmer won’t know that their account has been compromised. Slow Trade—Once an item has been traded, it cannot be traded or transferred again for some period of time. This can be helpful in detecting account looting by online thieves. Also, it slows down the gold farming pipeline, if there are multiple transfers between players’ characters.

Chapter 22 Game Commerce

235

Usage Limitation—China and some other countries have instituted usage limitations where players are allowed to play only for a couple of hours. If they play longer, they will earn reduced experience and rewards. After five hours, they will earn no experience or gold15. This effectively turns games back into a metered play system which will substantially increase costs for gold farmers, while having little practical impact on regular players. If a game’s usage limit is set at five hours, costs are increased more than a factor of five (as the reduced experience after two hours could potentially drive a gold farmer to need 12 accounts to provide 24-hour coverage at full experience). Deep Logging and Analysis—Fully track the history of each individual item from the time it is created until it is destroyed. Track the transactions that move the item from the game system to a game creature or spawn point or quest through each and every character that has involvement with the item. Even helping kill the monster that drops an item without picking up the item would result in a logged event. This should help identify all of the accounts involved in gold farming, even indirectly, as well as help isolate exploits and other game problems. Good logging is not useful without corresponding analysis tools. Virtual Salary—Give players the option of earning a virtual salary through time of play, level, or even direct additional subscription payments. This would allow players who don’t have as much time to play to bypass “the grind” without resorting to buying from gold farmers. This is essentially an alternative way of presenting the free-to-play model to players. Delayed Banning—Valve Software has long instituted a delay in the time between when a player has been caught cheating and when they are banned16. Recently, Blizzard has used the same strategy for World of Warcraft 17. The advantage of this approach is that it makes it much more difficult for a game cheater or gold farmer to isolate the method used to detect their activities. Booster Decks/Personal Treasure Chests—Instead of selling specific items, sell packages of randomly allocated items or have them dropped as treasure. Then allow players to buy and sell the items via an in-game service and let the players set the prices (see the section called “Potential Solutions,” later in this chapter). Identity Tokens/Improved Authentication/Strong Identity—A strong identity system creates improved accountability. Recently, Blizzard added support for a low-cost identity token ($6.95 each) for players of World of Warcraft 18. This will certainly help reduce fraud by online criminals and make it much more difficult for players to assert that their accounts have been stolen. Such a scheme probably has more benefit for the company than the players.

236

Protecting Games: A Security Handbook for Game Developers and Publishers

These measures do not have to be used in isolation. In fact, many will work better when combined. Specific game designs and the preferences of the developers may make several of these solutions impractical. However, it is possible that the unique character of a game may also allow other anti-gold farming measures that fit particularly well with the game’s specific environment.

G OLD F RAUDERS , O NLINE T HIEVES ,

AND

I NSIDERS

In early 2008, it appears that there was a turning point in the battle between game operators and gold farmers. It seems that the game operators’ efforts in 2007 to suppress gold farmers were succeeding. However, instead of driving gold farmers out of the industry, gold farmers changed their way of doing business—and really began to hurt the game operators: I think the issue of farming is higher on the radar now than it ever has been. The behind-the-scenes things are really frustrating. A lot of these farmers are essentially stealing from us. What they do is they charge us back all the time. They use a credit card—sometimes stolen, sometimes not—to buy an account key. They use the account for a month, and then they call the credit card company and charge it back. We have suffered nearly a million dollars just in fines over the past six months; it’s getting extremely expensive for us. What’s happening is that when they do this all the time, the credit card companies come back to us and say “You have a higher than normal chargeback rate, therefore we’ll charge you fines on top of that.” We’re really trying to get on top of that. We’re taking our current efforts up about five notches to Defcon 1 on this issue. They bug us even more than they bug our customers, and we’re definitely taking steps to implement rigorous anti-farming efforts. It’s actually really amazing to sit and watch these people work. I’ve personally sat with [our customer service team] as they’re tracking a farmer, and you’ll see a mob spawn—this [the gold farmer’s] got a bot that within half a second [and] has them moving towards the creature even if it’s halfway across the zone. It’s a serious problem. —John Smedley, CEO, Sony Online Entertainment [emphasis added] 19 Gold farmers no longer buy the game and pay their subscriptions until they are banned; they now are using stolen credit cards or legitimate cards and charging back their purchases. After all, this substantially reduced their costs, particularly as the game companies became more effective in their banning efforts.

Chapter 22 Game Commerce

237

“We’re seeing a lot of stolen credit cards. Say you buy gold from a service in China—you may not know it’s in China, but you give them your credit card and buy gold only once. They use these credit card numbers to set up new accounts in these games. They buy an EverQuest account key, farm for a month, and then charge it back to the stolen credit card.” —John Smedley, CEO, Sony Online Entertainment 20 It is unusual and notable for anyone at any company to speak out on security issues, especially when they are costing the company, and Mr. Smedley should be commended. And the problem is not limited to Sony. Halifax bank in the UK decided to stop accepting payments for World of Warcraft because of rising levels of fraud21. Although gold farmers pay their employees a low, but living, wage of as little as $142 per month22, the cost of a game ($50) and subscription ($10 to $15 per month) can be a major cost factor if an account is banned regularly. Of course, things don’t end there. Why even bother gold farming? A gold frauder could use a stolen credit card to buy gold from a player or gold farmers, and then turn around and sell it. Online criminals are getting into the game as well. The value of a stolen World of Warcraft account is $10, whereas stolen credit card account information goes for only $6 according to researchers from Symantec23. Hackers seeded 10,000 web pages with malicious code to steal game passwords24 and even created a web ad slipped onto some World of Warcraft community sites that required visitors to simply roll over the ad to install a Trojan on their computer that stole their account information25. EVE Online had a similar problem with a website involved in real money trading26. Viruses that target online games are now routinely in the “Top 5” list of threats from anti-virus vendors. Account theft and looting is not solely the providence of organized criminals. Players sometimes share account information and those “friends” sometimes take advantage and loot the account27. The final, quite serious, problem that game developers face is with corrupt employees. Insiders have access to the game’s systems and data and can manipulate it to their advantage. In 2006, three employees of Shanda Interactive, including a vice president, were caught duplicating and selling very rare weapons28. This made it very easy to detect their crime. If they had duplicated more common, but valuable, items like game currency, it is a fair question as to whether they would have ever been caught. It is possible for a hacker to attack the game from the outside (see Chapter 32), but, unfortunately, employees are the biggest threat. Online games offer a lucrative target with little to no legal risk. What prosecutor is going to try to argue about the value of virtual items when the game companies’ themselves don’t consider the transactions legitimate?

238

Protecting Games: A Security Handbook for Game Developers and Publishers

Even if game companies do not value virtual items, they are going to need to take virtual item theft seriously. At a minimum, they need to be able to track virtual items and transactions in great detail to be able to undo virtual theft from a customer service perspective. Several of the other techniques listed previously, such as slow trading, can also help minimize the effect of virtual theft. In Asia, some game companies have moved to using cell phones as authentication tokens (by implementing a challenge/response system) as well as for payments. This could be extended to verifying virtual item transfers. Cell phones generally also have an advantage, as they provide reasonably good identification information about their owners.

P OTENTIAL S OLUTIONS The gold farming problem is a serious customer service problem and gold frauding is shaping up to be a real threat to the game industry. There are options. Pure free-toplay games, where players can purchase every item in the game, are much less appealing to gold farmers and frauders. There is still risk that someone can steal an account, but without a market for individual items, it is much easier to restore an account without tracking item trades because this only requires changing a password. Another approach without trading is to move to a pure “badge” system, as mentioned previously. In many online games, currency is really an afterthought and the games’ economic systems are tacked on to core systems tied to experience and adventuring. Rewarding players for their adventuring prowess with badges or achievements is quite natural. These badges can then be used as the currency to “buy” various items. Developers can allow players to earn multiple copies of the same badge by repeating an adventure; they can also make items freely convertible between an item and its constituent badges, and even have multiple combinations of badges that can yield a given item. One system that supports trading and gifting, but has not been plagued by gold farming, is the virtual Collectible Card Game, Magic Online, and other games of its ilk. Magic: The Gathering is one of the most significant games in recent memory. Both the face-to-face and online versions are sold via basic game decks and booster decks. These decks contain random sets of the game’s various cards, but are all sold at certain fixed prices. Players set their own value for the items. The game company does not. The company does, however, collect a percentage of any exchanges of cards between players. This approach allows a game operator to profit from real money transactions without many of the risks. To date, developers have only used this method with cards (real or virtual), but there is no reason to restrict the system in this manner. A game could easily issue treasure chests as its only reward with truly random items to be found in each. Each treasure chest would be the equivalent of a booster deck and so the only design

Chapter 22 Game Commerce

239

variable would be how the treasure chests were issued or earned or purchased. From a design-management perspective, the game developers simply have to concern themselves with the rate at which players can earn treasure chests in the game and make these rewards fairly uniform to eliminate efficient “runs” for gold farmers.

P OWER -L EVELING Power-leveling sounds more exciting than it is. It is also a problem that is very difficult to stop. There are two basic types of power-leveling. A power-leveling individual or company plays the game legitimately to build up a character until it is considered valuable. These firms can also boost a player’s status—players have even paid to boost their achievements on Xbox Live $300 for 3,000 gamer points29. The power-levelers then sell the character. Individual players will sometimes also sell their characters or accounts when they are bored with the game. The other scenario is when a player hires a power-leveling firm to develop a character to spec. This involves outsourcing the game play to the power-leveler so that the purchasing players don’t have to take the time (or, some would argue, develop the skill) needed to create the characters they want. The reason that power-leveling is so difficult to fight is that it only requires the exchange of a user name and password to implement. Although this is most often associated with MMOs, it can occur in any game—a woman arranged to have another player replace her in an online poker tournament at PokerStars. The surrogate player won, but the company refused to pay the $1.2 million prize because only the designated account holder is supposed to play in a tournament30. Strong identity systems can be an effective deterrent to power-leveling, but they may create a cost and convenience barrier for games seeking to be widely accessible to potential customers. It is also possible to identify potential powerleveling by using IP address tracking and monitoring individual instances of the game. This approach is less effective in Asian markets and other locations where players play in Internet cafes. Also, a motivated power-leveling firm (and foolish customer) could use remote control software to operate the game client from the customer’s own computer. Conceptually, a game that requires a credit card would be more secure if the player was able to purchase other (expensive) items using the game account, since a person (hopefully) would be reluctant to share such information. This seems like a bad idea, in practice. There are more serious problems associated with power-leveling. Because power-levelers have access to the players’ accounts, they could break back into an account after they have finished leveling up the player’s character and loot it, use it to market gold farming until it is banned, or otherwise take advantage of the users.

240

Protecting Games: A Security Handbook for Game Developers and Publishers

For example, in a free-to-play game, power-levelers could purchase additional virtual items using any credits the player has in her account and transfer the items out while the player is not logged in. (Humorous Hypothesis: Is the definition of an ethical power-leveling firm one that reminds a player to change her password once they have completed their service?)

E SCORT S ERVICES , S UBLETTING ,

AND

V IRTUAL P ROSTITUTION

This final grab bag of game commerce activities are virtually impossible to detect or control. They all entail players’ intent as opposed to their behavior within the game. Escort services are a more expensive and limited version of power-leveling. Players hire other players to play along with them to be more successful more quickly. Cybersex is often a part of online games. Even a benign kid-friendly game like Habbo Hotel has had difficulties with virtual prostitution where players have engaged in cybersex to earn the game’s currency, furniture31. More disturbing still was the potential involvement of a minor providing virtual sexual favors for real money, allegedly $50 per “encounter,” in The Sims Online32. The legal implications for any game operator are quite serious (see Chapter 30 on protecting kids). Finally, when it seems like you’ve seen every permutation of game commerce tactics, a game player was recently solicited to “timeshare” her online game account. Basically, because her character was already at level 60 in World of Warcraft, the gold farmer was willing to power-level her for free to level 70... an idea that opens up all of the risks of power-leveling33 with the promise of easy money. One can only imagine how many people would be duped by such a service.

S UMMARY Generally speaking, game commerce activities are considered a serious customer service problem at minimum and, with the rise of gold frauding, a potentially serious threat to the online game industry. However, game commerce has one interesting security advantage—it ties players to the legitimate game service, making server piracy much less appealing. The growth of the free-to-play business model does have an impact on gold farming, as the game operator can essentially undermine any secondary market in game items and currency if she wishes. There has been an interesting move by game companies to take advantage of the revenues associated with game commerce. Game companies who consider this route should carefully consider the potential for their game being considered an illegal casino.

Chapter 22 Game Commerce

241

I am personally concerned that the move to partner with third-party companies that provide these secondary market services is quite risky. These legitimate firms can always be undercut by unauthorized transaction services and gold farming operations while the business itself is fraught with high rates of fraud and charge backs. Although the total transaction volumes associated with game commerce may be large, the fees for processing the transactions are hard to protect in the face of unofficial competitors and the fees required for payment processing. The problem of gold frauders and other criminal activity directly targeted at online games does need to be taken seriously. Game companies need to put in place mechanisms to make their games a much tougher target—whatever their view of the value of virtual goods. Although earning $275,000 over a year in virtual sales commissions is nice, the impact of $1 million in charge-back fees in just six months combined with increased processing fees, longer payment hold times, and potential cancellation of service is costly. Some will argue for stronger user education; however, at the end of the day, the game company is the one at risk. These risks may be the real engine that drives changes to the underlying business models and practices used in online games. The “facts on the ground” are that players consider game assets to have real value and courts are beginning to uphold this position. Avoiding the issue opens up criminal opportunities and may not provide the companies with the liability protection that they have asserted.

R EFERENCES 1. R. Bartle (1996), “Hearts, Clubs, Diamonds, Spades: Players Who Suit MUDs,” http://www.mud.co.uk/richard/hcds.htm 2. N. Yee (2005), “Buying Gold,” http://www.nickyee.com/daedalus/archives/001469.php 3. R. Heeks (2008), “Current Analysis and Future Research Agenda on “Gold Farming”: Real-World Production in Developing Countries for the Virtual Economies of Online Games,” http://www.sed.manchester.ac.uk/idpm/research/publications/wp/di/di_wp32.htm 4. S. Davis (2007), “The World of Text MMOs/MUDs: An Interview with Matt Mihaly, CEO of Iron Realms Entertainment,” http://www.playnoevil.com/serendipity/index.php?/archives/765-The-World-oftext-MMOs-MUDs-An-Interview-with-Matt-Mihaly,-CEO-of-Iron-Realms-Entertainment.html 5. M. Mihaly (2008), “Using Dual Currency Systems Is the Best Way to Sell Virtual Goods,” http://lsvp.wordpress.com/2008/02/06/using-dual-currency-systems-is-the-best-way-to-sell-virtual-goods/ 6. Apple (2008),”iPhone Developer Program,” http://developer.apple.com/iphone/program/distribute.html 7. R. Koster (2000), “Declaring the Rights of Players,” http://www.raphkoster.com/gaming/playerrights.shtml 8. M. Zenke (2008), “AGDC08: On Avatar Rights and Virtual Property,” http://www.massively.com/2008/09/15/agdc08-on-avatar-rights-and-virtual-property/ 9. T. Walsh (2006), “‘Data Bill of Rights’ vs. ‘Avatar Bill of Rights’,” http://www.secretlair.com/index.php?/clickableculture/entry/data_bill_of_rights_vs_avatar_bill_of_rights/ 10. E. Bethke (2008), “Better EULA,” http://www.bettereula.com/index.php?title=Main_Page

242

Protecting Games: A Security Handbook for Game Developers and Publishers

11. D. Terdiman (2007), “Real-World Success with Virtual Goods,” http://news.cnet.com/Real-world-success-with-virtual-goods/2100-1043_3-6156925.html?tag=st.num 12. K. Pigna (2008), “‘World of Warcraft’ Costs Just $200 Million,” http://news.yahoo.com/s/zd/20080916/tc_zd/232075 13. Jagex (2007), “Trade and Drop Changes,” http://news.runescape.com/p=kKmok3kJqOeN6D3mDd ihco3oPeYN2KFy6W5vZUbNA/newsitem.ws?id=1007 14. K. Cross (2008), “Recent Headlines for Conquer Online: New Security Features,” http://www.mmorpg.com/gamelist.cfm?loadnews=10547&bhcp=1 15. Shanghai Daily (2005), “Online Games Set Time Limits Against Addiction,” http://english.hanban.edu.cn/english/Life/146200.htm 16. Wikipedia (2008), “Valve Anti-Cheat,” http://en.wikipedia.org/wiki/Valve_Anti-Cheat 17. B. Holloway (2008), “Blizzard’s Gold Farmer Bans Send World Economy into Tailspin,” http://www.massively.com/2008/07/05/blizzards-gold-farmer-bans-sends-world-economy-into-tailspin/ 18. Blizzard (2008), “Blizzard Authenticator FAQ,” http://us.blizzard.com/support/article.xml?articleId=24660&rhtml=true 19. M. Zenke (2008), “A CES Interview with SOE CEO John Smedley (pt. 2),” http://www.massively.com/2008/01/14/a-ces-interview-with-soe-ceo-john-smedley-pt-2/ 20. L. Alexander (2008), “Q&A: SOE, Live Gamer Reveal ‘Live Gamer Exchange’ Service,” http://www.gamasutra.com/php-bin/news_index.php?story=17268 21. J. Leyden (2008), “UK Bank Blames Fraudsters for World of Warcraft Ban,” http://www.theregister.co.uk/2008/02/15/halifax_blizzard_block/ 22. R. Heeks (2008), “Current Analysis and Future Research Agenda on “Gold Farming”: Real-World Production in Developing Countries for the Virtual Economies of Online Games,” http://www.sed.manchester.ac.uk/idpm/research/publications/wp/di/di_wp32.htm 23. BBC (2007), “Cursor Hackers Target WoW Players,” http://news.bbc.co.uk/1/hi/technology/6526851.stm 24. R. McMillan (2007), “10,000 Web Pages Infected by Password Hack,” 25. E. Cavalli (2008),”Trojan Attack Targets WoW’s Info Sites,” http://blog.wired.com/games/2008/03/trojan-attack-t.html 26. J. Egan (2008), “EVE Online Currency Sellers Rip Off Players (Shocker),” http://www.massively.com/2008/07/24/eve-online-currency-sellers-rip-off-players-shocker/ 27. C. Kagotani (2005), “Japan: MMOG Crime Rising,” http://www.edge-online.com/news/japan-mmog-crime-rising 28. A. Xu (3006), “Three Men Tried for Selling Online Game Weapons,” via http://www.playnoevil.com/serendipity/index.php?/archives/763-Insider-Virtual-Asset-Crime-inShandas-Legend-of-Mir-2-IMPORTANT.html 29. V. Cole (2006), “$300 for 3,000 XBL Gamer Points?!,” http://www.joystiq.com/2006/10/03/300-for-3-000-xbl-gamer-points/ 30. A. Darbyshire (2008), “Woman Withdraws Claim to $1.2m PokerStars Winnings,” http://www.iomtoday.co.im/news/Woman-withdraws-claim-to-12m.4382619.jp 31. BBC (2002), “Furniture Strumpets and Debit Card Toilets,” http://www.bbc.co.uk/dna/h2g2/alabaster/A680014 32. P. Ludlow (2003), “Evangeline: Interview with a Child Cyber-Prostitute in TSO,” http://www.secondlifeherald.com/slh/2003/12/evangeline_inte.html 33. T. Baribeau (2008), “Hit Monsters and Get the Gold,” http://www.cuppycake.org/?p=415

23

To Ban or Not To Ban? Punishing Wayward Players

o ban or not to ban, that is the question. In order to maintain order in an online game, virtual world, or social network, it is necessary to do something about troublesome participants. Usually. There is a huge temptation to consider player behavior in light of some notion of civil behavior, just as game companies often view piracy.

T

But game companies are not governments; their goal is to maximize revenues and keep their customers satisfied, not mete out “justice.” There are a number of different areas to consider player punishments. Theft of service via piracy is very different than griefing or cheating. As discussed in Chapter 22, the costs associated with gold farming and game commerce come from customer service issues until the gold farmers transform into gold frauders and online thieves.

C RIME , C REDIBILITY ,

AND

P UNISHMENT

For punishment to be effective, it must be credible. One of the biggest challenges for online games is that it is very hard to make punishments stick. Banning is, in some sense, the least credible form of punishment because identity is so weak in online games (see Chapter 29 on identity). In some sense, player punishments should be ABB—Anything But Banning. After all, what is really being banned is a specific account or identity, not the actual person. In an online environment, the real goal of most punishments is to deter problem behavior, not drive away customers or, in some sense worse, encourage them to create alternative identities. The other danger of driving away players is that at some point their population grows to a size to support a viable “black market service” that can compete with the game operator’s legitimate service. The larger the population of banned or otherwise disaffected players, the larger the potential

243

244

Protecting Games: A Security Handbook for Game Developers and Publishers

customers for a guerrilla, competing service. (There is, of course, the obvious scenario where these players migrate to another online service and help boost its population so that it will grow faster than the banning service.) The other question that has to be addressed is whether the right person is being punished. As noted, for virtually all games, an account or identity is being punished, not an actual person. Console games can use both a player account for punishment as well as the ID of the console, itself. If the account is used for punishment, it may be easy for a player to set up another one using a new credit card or other payment method for authorization. If the console ID is used, there is some question that the player actually owns the console and then there are a number of issues related to the transfer or sale of a console to another person. Finally, there is the question as to whether the punishment fits the crime. Xbox Live took action against players who had boosted their Gamerscores (achievements), most likely via a game save exploit (see Chapter 14). The players had all of their achievements to date removed and any achievements that they had previously earned were made unavailable to the player. In addition, the player’s account was publicly flagged as a “cheater”1. In the future, the player would be able to earn new achievements, but it does not appear that the “cheater” flag could be removed. Although this is almost certainly a clear case of abuse, the question is—how much harm did the player do to the service? There are mostly no prizes or awards for achievements2. The main social power of Xbox Live comes from multi-player gaming, where cheating certainly would be an issue. If anything, this form of cheating would be a great opportunity for a private punishment—letting the players know that they’ve been caught, but not sharing it with others. The cheater’s achievements could be marked “Suspect,” for her eyes only. The player could then be given the opportunity to delete or re-earn the achievement or simply leave the “Suspect” flag in place.

T HE C OST

OF

P UNISHMENT : W HO ’ S B EING P UNISHED ?

Ironically, the richer and more expansive the service, the more costly punishment is for the game provider. Wide-ranging services like Steam and Xbox Live are true “long tail” revenue generators. An Xbox subscriber with a Gold account delivers $49.98 in revenue per year for Microsoft3. This is in addition to any game sales, peripheral sales, and downloadable content sales. Given that many game troublemakers are also highly motivated customers, the annual cost of a banned player could literally be hundreds of dollars. After all, if a player is banned, she is not likely to buy any more games or anything else from the banning company. This also is true for Steam, even though it doesn’t charge a subscription. If banning is effective, a player is highly unlikely to buy additional games

Chapter 23 To Ban or Not To Ban? Punishing Wayward Players

245

The scenario is different when dealing with players who have stolen or pirated goods. Perhaps. If the player is effectively banned, there is no additional revenue that will be earned and, if anything, it may encourage further piracy (see Part II). Another interesting question comes from games with purchased virtual assets or MMOs where players have developed their characters over an extended period of time. Players do feel substantial ownership of these characters and items. Will game companies continue to be allowed to ban players in these circumstances? In China, Shanda Interactive was sued for 11,000 RMB (around $1,600) because the company banned a player. In an earlier case, The9 was forced to restore a banned player’s account and items and even pay court costs4. China has been at the forefront of cases legitimizing ownership of virtual items in games. Most game companies in the US have tried to avoid addressing this issue in court for fear of establishing precedent. There is real risk that at some point in time, courts will decide that game items have value, which seriously restricts potential punishments (or may require the use of third-party arbitration).

P OSSIBLE P UNISHMENTS

AND

C REDIBLE D ETERRENCE

There are many potential ways to punish wayward players. The goal is really to deter troublesome activity, whether it is piracy or cheating or griefing or hacking, or any other misbehavior. Anything that qualifies as an actual crime should be taken to the authorities. Although there has been a reluctance to pursue individuals for computerrelated crimes, online businesses need to be at the forefront of encouraging the prosecution of these individuals and groups. This also means that game companies should build their games to collect evidence that will be useful in identifying criminals as well as make sure the evidence is of sufficient quality and accuracy that it can be used in court. The industry would do itself a service by educating government and law enforcement about the seriousness of computer crime and encouraging vigorous enforcement. The goal for non-criminal players should be to minimize the punishment as much as possible. It is costly to deal with player complaints from a customer service perspective. This applies to both the victims of the various forms of game abuse as well as the perpetrators. The most important question for the game operator is whether to terminate the player’s service and if this will actually credibly deter the player. There are numerous options that a game operator should consider, including the following:

246

Protecting Games: A Security Handbook for Game Developers and Publishers

Game Termination—Ending a game session to avoid further problems. This can be an issue with tournaments or ranked games, as players will use such mechanisms, as seen in Chapter 20, to manipulate the results of the competition. Kicking—Simply removing an offending player from a game session. This can be done by players as well as by game systems. This can either be handled within the game session or as a first stage for more serious action by the game operator. Personal Blacklist—Giving players the ability to personally “ban” others so that they will no longer be able to play together provides an easy way for players to manage troublesome individuals directly. Reputation Systems—These systems can help flag troublesome players. However, the systems are only as effective as the underlying identity system for the game service and the extent to which players can attack the reputation system itself. Game Termination with Prejudice—Ending a game session and giving the offending player a loss or penalty. Care should be taken so that players cannot use the “with prejudice” system to grief other players. Slow Down—Reducing the rate at which the player can play or benefit from playing the game or games at the game service. Suspension—Denying the player partial or full use of the game or game service. Probation—This option can be used either alone or in conjunction with other penalties as a warning or notification of detected abuse with no specific penalty. Instead, the player is “put on notice” that she has misbehaved and further abusive actions will be dealt with appropriately. Status Penalty—Reducing the player’s status, rank, or achievements in the game service for some time period or even permanently. Account Reset—The most severe version of a status penalty would be to completely reset a player’s account and empty it of all earned status, rank, achievements, and virtual items. Public Humiliation—Marking the player’s account when viewed by other players as an abusive player of the appropriate type. The other option is to have a public list of offenders and their crimes. Virtual Fine—An interesting option, for at least gold buying and even gold farming, is to penalize the account by creating a virtual financial penalty. If a player bought 100 gold, penalize her 300 gold. Real Fine—A player could have her account suspended until some actual payment is made either to the game operator or the offended individual or group. This mechanism may be effective as long as the penalty is such that it is preferable to pay it than to quit or start over.

Chapter 23 To Ban or Not To Ban? Punishing Wayward Players

247

Invisibility—Some game services are very loose communities. In these environments, it may be effective to penalize a player by making her invisible to others for many services, like matchmaking. Such players could initiate contact with others, but as a default they would not be presented for matchmaking or other services that expand social networks. Abuser Grouping/Segregation/Exile—When an online game or social network has identified a player as some type of troublemaker, the system can preferentially or exclusively group the troublemakers together. This is more effective with larger communities, as troublesome players may not notice that they have been isolated from the main population. Full or Partial Banning—Banning probably needs to be more than just a user account. In order for banning to work, the game service must be able to reliably identify the offender. For game consoles and PCs, the ban may extend to the equipment, an IP address or range, a physical address, a credit card number, and so on. Game Company Blacklist—As noted much earlier in the discussion of the rich interaction system (see Chapter 9), the larger and more extensive the system, the more incentive that a player has to participate in it legitimately. When the game operator decides to remove a player, credibility is complemented by range. If a player is at risk of experiencing a serious penalty, far beyond just a single game, she may be less likely to cause trouble. Game Industry Blacklist—The casino industry is somewhat notorious for its blacklist of known cheats. The regular game industry could put a similar service in place to ban real troublemakers from all online gaming. This would require addressing some legal issues, but it may be possible for game companies to collaborate to truly ban certain individuals. Arbitration—Today, game companies are judge, jury, and executioner. However, as games grow and players become more vested in their gaming experience, a player who has been banned or otherwise punished may take legal action to reverse her penalty, as noted in the Chinese virtual property cases. By incorporating an arbitration clause in the game service’s terms of service, game operators may be able to avoid such appeals going to court. An arbitration system by a neutral third party may also minimize customer complaints about player penalties. Trial by Jury—Another option for meting out justice in a game is to use the players themselves as the judicial system. Depending on the nature of the game and the crime, it may be possible to select a random “jury of your peers” to determine guilt and assess penalties. This adds legitimacy to the process and has the added benefit of reducing costs for the game developer.

248

Protecting Games: A Security Handbook for Game Developers and Publishers

This is by no means an exhaustive list of player penalties. Game developers can even integrate penalties into the game experience. For a while, Second Life had a cornfield where players were sent if they got in trouble with Linden Lab administrators5. Even more thematically accurate, the Rome-themed MMO, Roma Victor, used virtual crucifixion for punishment6. The only danger with some of these public, in-game penalties is that certain players are more interested in attention and so these penalties turn into rewards and achievements. Knight Online penalized players who were found using exploits by causing them to suffer double damage from other players and creatures as well as having their character’s level reduced substantially below the level it was when they were caught7.

S UMMARY The most severe punishment that can be meted out against a player is banning his or her account; actually banning a person is almost impossible. There are also very legitimate questions as to whether the game company is actually punishing itself by removing future revenues. Even worse is the potential for an aggrieved player to sue the game company to restore her status or service. Some problems, like gold farming, may not even be amenable to banning as a penalty. A ban may be considered simply part of the cost of doing business. A number of games and social networks refer to dropping the “BanHammer” when they ban a number of participants. This is probably an apt description. Banning is a rather blunt instrument for punishing troublemakers and it might not even deter its targets. Also, the game operator may hit her own “thumb” instead of the intended miscreants. The use of lesser punishments is promising. Gaming is an entertainment industry. The goal is to entertain customers and earn revenue from them. It is certainly important that companies do something to address players’ misbehavior, but the real goal is to keep them (and as many other players as possible) playing.

Chapter 23 To Ban or Not To Ban? Punishing Wayward Players

249

R EFERENCES 1. Microsoft (2008), “Gamerscore Corrections,” http://www.xbox.com/en-US/support/systemuse/xbox360/gamerprofile/gamerscorecheating.htm 2. Johnathan (2008), “The Old Spice Experience Challenge: Earn Achievement Points to Win Fabulous Prizes,” http://news.filefront.com/the-old-spice-experience-challenge-earn-achievement-points-to-winfabulous-prizes/ 3. Microsoft (2008), “Xbox Live Subscription Cards,” http://www.xbox.com/en-US/live/memberships/subscriptioncards.htm 4. S. Fu (2008), “Shanda Gamer Sues for Emotional Damages After Game Account Sealed,” http://www.pacificepoch.com/newsstories?id=130010_0_5_0_M 5. T. Walsh (2006), “Hidden Virtual-World Prison Revealed,” http://www.secretlair.com/index.php?/clickableculture/entry/hidden_virtual_world_prison_revealed/ 6. J. Lees (2006), “Virtual Crucifixion Punishes Bad Behaviour Online,” http://www.joystiq.com/2006/03/23/virtual-crucifixion-punishes-bad-behaviour-online/ 7. MMORPG (2007), “Recent Headlines for Knight Online: Accounts Penalized for Exploits,” http://www.mmorpg.com/gamelist.cfm?bhcp=1&loadnews=7098

This page intentionally left blank

Part

V

The Real World

In this part, you’ll find the following topics: Chapter 24, “Welcome to the Real World” Chapter 25, “Insider Issues: Code Theft, Data Disclosure, and Fraud” Chapter 26, “Partner Problems” Chapter 27, “Money: Real Transactions, Real Risks” Chapter 28, “More Money: Security, Technical, and Legal Issues” Chapter 29, “Identity, Anonymity, and Privacy” Chapter 30, “Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers” Chapter 31, “Dancing with Gambling: Skill Games, Contests, Promotions, and Gambling Again” Chapter 32, “Denial of Service, Disasters, Reliability, Availability, and Architecture” Chapter 33, “Scams and Law Enforcement” Chapter 34, “Operations, Incidents, and Incident Response” Chapter 35, “Terrorists” Chapter 36, “Practical Protection”

251

24

Welcome to the Real World

elcome to the real world. After all, games do not exist in isolation: they are built by companies with employees, partners, and customers. This part of the book focuses on a number of security issues that affect games during development and after their deployment into the real world. There are issues that affect the security and essential health of a game and a game business that are not traditionally considered “security issues.” I asked a long-time colleague and attorney Joseph Price to help address some of the legal issues that can affect a games business and brought in Marcus Eikenberry to discuss some of the problems with money and payments that can bring any business to its knees.

W

“The Insider Problem” is widely perceived to be the single largest security issue for any organization. After all, employees need to be trusted if they are going to be able to do their jobs and sometimes that trust is misplaced. For game companies, the three most critical insider problems are code theft, data disclosure (both of which can affect any game), and fraud against online game services. Increasingly, games are too big to be built, marketed, and operated solely by internal company employees. Working with partners raises additional issues. One especially common problem is that security requirements and responsibilities are not adequately addressed in the contract between the parties. There are also interesting issues related to the licensing of games to, and from, other companies. Money is perhaps the oldest “virtual asset” and the economy is the one game that almost everyone plays with great enthusiasm. I have closely followed ecommerce and the evolution of online services for years, but I have never seen a good explanation of how payments really work for businesses and what it can mean for a company. My own experiences in this regard have been fairly painful and eyeopening. Because of the topic’s importance, there are two chapters on money issues.

252

Chapter 24 Welcome to the Real World

253

Establishing strong identity has been a theme and a security topic from the very beginning of this book—identity affects piracy, cheating, griefing, gold farming, and all of the other topics discussed so far. Knowing your customers are “who they say they are” is very powerful, but it is difficult to maintain a good balance between convenience and strong identity. If it is inconvenient or time-consuming to join a game, many potential players won’t participate. Conversely, people often behave very badly when there is no accountability for their actions. Anarchy reigns without a strong identity relationship with your customers. The market for children’s games and online services has grown explosively in the past several years. Protecting children is a unique challenge for developers and game operators because there are laws and expectations for security that do not exist for players in general. Often, game companies and online service providers avoid children as a market that is “too hard.” This is a bit extreme; I’ll argue that there are some benefits to the children’s market that do not exist for other consumers. The popular perception is that only children play games. There is one aspect of the games industry that the general public does not associate with children: gambling. There are many ways that game companies can stumble into gambling and as people innovate with game business models as well as advergames and contests, their legal risks are growing. Although there is no inherent problem with the gambling business per se, you don’t want to create a casino or lottery by accident. Governments carefully regulate all legal gambling businesses and there are severe penalties for companies and individuals who don’t follow these rules—accidentally or not. One could not have a security book without addressing some traditional IT security issues and there are a number of these issues that are particularly relevant to game businesses: Denial of service and availability are key requirements for any online service. The growth of the IT and IT security industry has made addressing these concerns much easier than it used to be. We should not forget that there are villains—the hackers and online criminals who may attack a game or use your game to prey on your customers. Law enforcement has not been a very effective ally in this fight and the attitude of game companies towards the security issues in their games may make the security situation worse. Things go wrong. Security incidents will occur. We are often judged by how we respond to adversity. Most security incidents occur during the operational lifecycle stage, but developers and security professionals spend very little time focusing on handling real security incidents when they occur. Although it is nice to think that security measures will always succeed, it is essential to plan for failure and recovery. Finally, the topic of terrorism and virtual worlds has gotten the attention of the mainstream media. One could hardly write a book on security and games without discussing the issue, at least briefly.

25

Insider Issues: Code Theft, Data Disclosure, and Fraud

mployees are in the best position to do damage to any company. They have legitimate access to a company’s valuable assets. Such insiders are of particular concern for any company whose value is tied to its intellectual property and online services. Game companies are particularly vulnerable, as their value is tied to both.

E

In many cases, insider security issues are inadvertent: caused by negligence or ignorance or simple laziness. Part of this is an artifact of the history of game development as an informal, garage-based business. Formality, procedures, and controls are often seen as anathema to the creative souls of game developers. The industry has changed. Computer games now regularly cost millions of dollars to develop and can generate tens or hundreds of millions of dollars in revenues. There is a lot that is worth protecting. There have been a number of cases where the code for a game has been compromised during the development process. This can result in months-long delays while the game is reworked. There have also been incidents where a finished game has been lost or stolen. These cases are particularly costly, as a game’s anti-piracy system is often incorporated at the end of the production process and therefore there are no security measures in place to protect the game from being widely distributed. In contrast, online games are particularly vulnerable to insider fraud. Virtual items are just entries in a database and can be trivially duplicated by a user with access to a game’s servers. Insider fraud concerns are as much about preventing the perception of abuse as reality. The perception of fraud or bias by a game operator can undermine the service’s reputation with its customers. This perception is one of the reasons that game companies need to be very careful about allowing employees to play their own games on public servers.

254

Chapter 25 Insider Issues: Code Theft, Data Disclosure, and Fraud

255

There are technical solutions that can help manage insider threats and errors. However, technology is only a complement to hiring the right people, training them well, and holding them accountable for their actions.

C ODE T HEFT

AND

O THER D ATA D ISCLOSURES

with J. Price The process of developing and supporting games has grown steadily more complex. Localization, audio, and art may all be developed by different studios around the world. This requires increased formalization of security processes to protect the game project. Code theft has become a notable, and highly preventable, security vulnerability for the games industry. The “garage engineering” mentality is still too prevalent in an industry with multi-million dollar development budgets and gross revenues for individual games over one hundred million dollars. A game’s code-base and art assets are just too valuable to be left easily accessible on the Internet—especially in an industry that regularly complains about losing many millions in sales to piracy. HalfLife 2 was compromised by hackers breaking into an employee’s computer from the Internet during the game’s development, allegedly resulting in a four-month delay 1. There are two sets of costs in cases of code theft or data disclosure to consider. First, it costs tens of thousands of dollars (if not more) to extend a game’s development by a single month. One month’s delay would probably pay for a substantial suite of IT security tools and, perhaps, the IT staff to run them. Second, many major game titles earn tens of millions and, in some cases, more than $100 million within the first month of launch. The cost of a delay and piracy are both substantial. Microsoft earned over $300 million in the first week after Halo 3 launched 2. Although Halo 3 was not the victim of a security leak, Halo 2 3 and Grand Theft Auto 3 4 were both compromised prior to launch. There is also the issue of compromising other companies’ code: The physics engine from Havok was allegedly part of the compromised source code for Half-Life 2 and, as licensed software becomes more common in the game industry, this risk could grow substantially. For such major titles, each day of delay could “cost” tens of thousands of dollars in interest alone. FutureValue / Revenues = $300 million; // The chosen sample total game revenues Interest = 5% per year or .05/365 per day;

256

Protecting Games: A Security Handbook for Game Developers and Publishers

The formula for present value is: PresentValue = FutureValue/(1+InterestRate)^(number of days); See 5

For the current scenario, this would result in pure interest costs for a delay of: $41,090 after one day $287,514 after one week (7 days) $1,230,263 after one month (30 days)

This very simple model ignores the costs associated with rescheduling other resources, such as marketing, as well as any lost sales due to piracy. Even worse, these problems are largely preventable. Traditional information security practices such as firewalls, intrusion detection systems, good configuration management systems, or even isolating high-value systems and data from the Internet are easy to implement and inexpensive. A notable complicating factor is the rise of distributed development and outsourcing in the games industry. More sites, more companies, and more people inherently create more risk. In the US there are a variety of criminal laws addressing code theft and related circumstances6. The specific section of the criminal code, in the US or elsewhere, that applies depends on the circumstances of the crime. A common criminal law prohibiting most types of hacking is the US Computer Fraud and Abuse Act (CFAA). Most of the CFAA’s provisions prohibit unauthorized “access” to a “protected computer” coupled with other conduct7. A proactive security strategy is needed to manage these risks. First, do not provide full access to high-value data to everyone. Avoid any connections to public networks that are not absolutely necessary. If people, or companies, cannot access data, they cannot compromise it. Second, make people and organizations accountable. Implement tracking and logging mechanisms: If a problem occurs, it should be possible (and preferably easy) to find the culprits. Fire people. Fine companies. Publicly. Finally, have a recovery plan in place in case of theft or disaster. Games are major businesses; they should implement good back-up strategies and have disaster recovery plans in place, as well as have adequate insurance and other measures to manage business risks8. Hackers and other data intruders are subject to criminal and civil liability. There are at least 40 federal statutes that can be used to prosecute cybercrime; in addition, victims can sue under a variety of civil (money damages) theories. For example, if a hacking victim is attacked by a hacker who works for a company, and

Chapter 25 Insider Issues: Code Theft, Data Disclosure, and Fraud

257

the hack was launched from a company computer (or in some way involved the company), the victim might sue the company and file a range of charges such as negligence, negligent hiring, or negligent supervision. Hackers are often difficult to identify or be made subject to the jurisdiction of the US. Even worse, they are typically what lawyers refer to as judgment proof: They are not worth suing because they do not have enough money to pay damages. It is alleged that a disgruntled former employee at Electronic Arts was responsible for leaking the game Black9 and Ubisoft accidentally posted 2GB of screen shots, videos, and concept art to a publicly accessible server10. In the first case, there is not likely much that can be gained from prosecuting the ex-employee and in the latter case, the company has only itself to blame. A better target for a lawsuit is an entity that failed to prevent the security breach, or otherwise covered up an issue causing more damages in the long run. Ubisoft is suing the company that reproduced disks for its game Assassin’s Creed and who was allegedly responsible for the game being leaked online. These entities have deeper pockets for plaintiffs, and are sometimes easier targets11. In general, courts will impose some form of liability on the person in the best position to prevent losses, particularly if they are aware of the security issues. The best legal defense, therefore, is to avoid security breaches. Security bonding and insurance (if available) may also help. However, most standard insurance polices that companies have for liability and “errors and omissions” protection are written so as to avoid or minimize payouts for computer-security related offenses. Code losses typically occur accidentally or due to the actions of individuals: the source code from Lineage III was allegedly stolen by a group of company employees and sold to another game company. NCsoft claimed losses of $1 billion12, which it is hardly likely to ever collect from anyone. Issues will arise, however, and there are specific laws meant to protect intellectual property and network integrity. Owners of intellectual property (such as game code) can seek protection through trade secrecy, patents, copyrights, and other legislation tailored to their particular industries. In the DeCSS13 DVD security circumvention tool cases, for example, the DVD Copy Control Association tried to stop distribution of DeCSS through state trade secret law, whereas Universal and other studios invoked the DMCA, a federal copyright and anti-circumvention statute. These techniques only supplement good business strategies and effective technical measures. It is an open question whether the DVD industry “won” the war against the DeCSS or whether the decreasing prices of DVDs had a more significant impact on reducing piracy.

258

Protecting Games: A Security Handbook for Game Developers and Publishers

O FFICE IT I NFRASTRUCTURE Many security problems come from accidental disclosures. One of the simplest ways to avoid such problems is to physically isolate high-value data and computers. Although many IT security professionals advocate firewalls, intrusion detection systems, and such, the cost, effectiveness, and simplicity of physical isolation cannot be overstated. A hacker cannot compromise a computer that she can’t connect to. This is especially true as the cost of computers and networking equipment continues to plummet: meaning that it is easier to have some computers dedicated to development and others with access to the Internet. Some inconvenience can be a good thing. Having to change computers or go to a different room to access certain data or services, such as the Internet, removes the temptation to browse or collect unneeded data or waste time. There was merit to the earlier physical security systems where important information was kept in locked file cabinets. Permission was required to access any information and usage was tracked (often under the wary eye of an archivist). I used to work on classified systems, sometimes in a big vault. When we wanted to use the Internet, we went into a different room and logged in from a public computer. Our real work was physically separate. A collateral benefit of this arrangement was that we had much less gratuitous web surfing by employees. I have had access to network logs at a number of large commercial and government sites and the amount of non-work-related web surfing was appalling. Sports, news, shopping, and a surprising amount of pornography was being “consumed” on company, or government, time. My business partner and I had to fire an employee for excessive Internet use. Inappropriate Internet use is a real problem and very costly in dollars and time. It is also a huge security risk. I have had discussions with several individuals at game companies who have implied that certain staff “need” Internet access. If so, the cheaper, more secure solution is to give them a separate computer. Anything that needs to be brought into the internal development or operational system is then introduced via “sneaker net” on physical media, preferably through a software library or configuration management group. This can have an additional benefit of helping track the source of material in case of copyright disputes. The other common, contentious issue is related to remote access. If remote access is necessary, it should be done via dedicated computers provided by the company. Under no circumstances should these systems be used for other purposes (surfing the Internet, playing games, whatever). There are good hardware and

Chapter 25 Insider Issues: Code Theft, Data Disclosure, and Fraud

259

software security tools to help ensure that only specific machines and individuals can access a company’s sensitive networks and computers. This sort of segmentation can also be extended to internal networks; programmers can be isolated from artists and business and marketing people separated from everything. Formal build and test systems should certainly be separated from the general office IT infrastructure, as should anything having to do with money or real operations (see the section called “Sample Game Operations Architecture” in Chapter 32). If utterly necessary, this separation can be implemented via VLANs or other “virtual” technologies. However, human behavior will often tend to unravel these easy isolation technologies. At the end of the day, management and the company as a whole need to believe in and “own” the security strategy, not just the IT guys.

I NSIDER F RAUD There is no worse problem for any organization than a malicious insider. Insiders are already behind the scenes and underneath all of the protections that you have built in to protect your game against troublesome players. This is most obvious for gambling games. Casinos have layers of monitoring to try to stop this problem: Dealers watch players, pit bosses watch dealers, floor managers watch pit bosses, and security and regulators watch everyone. Even so, every so often, the lure of easy money draws in employees. Recently, at the Lakeside Casino in Iowa, a dealer colluded with some mini-baccarat players to alter the cards and help them win at least $12,000. All were arrested thanks to video surveillance14. Two online poker sites, AbsolutePoker.com15 and UltimateBet.com16, have been embroiled in cheating scandals where players, perhaps company employees, used access to the sites’ computers to cheat by seeing the hidden “hole” cards of the other players. Although the stakes are particularly high for online gambling, other games have had notable insider fraud problems. A vice president at Shanda Interactive and two accomplices were found guilty of fraudulently creating and selling virtual items for the MMO Legend of Mir II17. The group earned 2 million Yuan (over $254,000). As discussed in Chapter 22 on gold farming, there is a large market for illicit virtual goods and fraud is particularly tempting for company insiders. There have been many similar incidents reported at other game companies and, no doubt, quite a number that were either handled privately or remain undetected. Insiders can also cause other problems. A Halo 2 developer “for fun” added a picture of his behind into the Vista version of the game’s map editor18. Although this may seem humorous, Microsoft had to re-label all of the copies of the game with the “Partial Nudity” ESRB label, which delayed the product’s launch by one week.

260

Protecting Games: A Security Handbook for Game Developers and Publishers

There are other potential problems. Identity theft (see Chapter 29) and payment fraud (see Chapters 27 and 28) as well as other forms of fraud are often easier within online services, especially those where security concerns were not a core part of the design.

P LAYING Y OUR O WN G AME Online games are no longer a “garage” business. MMOs cost millions to tens of millions of dollars to develop and are designed with the goal of generating many more millions revenues (except for wild independents). Although game developers love their games, the adverse consequences of developer’s cheating at their own game so far outweighs any game design benefits that it just needs to stop. In 2007, CCP Games, developer, publisher, and operator of the science fiction MMO, EVE Online, found itself at the center of a controversy over the disclosure that employees of the company had been cheating to help their corporation (a “team” of players in EVE Online)19. This was not the first time such accusations had been levied against CCP Games employees, but the scale of this incident was quite embarrassing for the company. Fortunately for CCP Games, the incident has had little long-term impact. Game integrity is paramount. There is nothing more important to business than the trust of your customers, especially if everything that you provide is virtual. I have heard (repeatedly) the argument that “Developers need to play the actual game to really be able to support it.” Developers need to find another way. The consequences are just too dire and the temptation is too great. In 2001, the McDonalds Monopoly promotion (an instore ticket-based promotion) was hit by a scandal when it was discovered that an employee of the marketing firm that ran the promotion had been secretly giving winning tickets to his friends and family starting in 1996. That fraud earned the conspirators $13 million and some serious jail time and cost the marketing firm, Simon Worldwide, its contracts with McDonalds and Philip Morris20. It is very hard to estimate the real costs of these types of security incidents. For subscription games, some players may simply not renew; for a free-to-play game, they may simply stop buying as many items. Suppose an MMO has 100,000 subscribers and charges $10 per month. Further, let’s assume a developer (or group of developers) cheats or abuses the game for their own advantage and therefore causes 0.1 percent of the subscribers to cancel immediately. Then, the immediate cost of the security incident would be: 0.1% x 100,000 x $10/month = $10,000/month or $120,000 for Year 1

Chapter 25 Insider Issues: Code Theft, Data Disclosure, and Fraud

261

In a subscription game, suppose this increases the chance that players don’t renew from 20 to 25 percent (again simplifying the subscription model so that everyone leaves at once and had just renewed... the most favorable model from a revenue perspective). The increased loss of subscribers would be: 5% x 100,000 = 5,000 lost subscribers after 1 year

Therefore, the Year 2 loss would be an additional: 5,000 x $10/month = $50,000/month or $600,000 in Year 2 (in addition to the $120,000 who left immediately)

So, the Year 2 losses would be $720,000. One should also model the opportunity cost of new subscribers who decide not to join the game because of their concerns about perceived cheating. This is harder to model. There are players who decide to enroll “for free” because of the recommendation of their friends and then there are those who enroll because of marketing. Both may be reduced in the wake of any cheating scandal. Assume 10 percent of players ordinarily would recommend the game to their friends and this number is reduced by 10 percent (meaning the recommendation rate is only 9 percent). However, the total population of players has been reduced by those who left immediately, so the total population is 95,000. Therefore, the additional lost subscribers (for Year 2) total: 95,000 x 10% x 10% = 950... costing an additional $114,000 in Year 2

Finally, in the wake of the bad publicity, any marketing to “cold” prospects would be less effective, perhaps by 20 percent. One can model this in terms of increased marketing costs to maintain population or by reduced additional revenues; either way, it is expensive. There are many ways to model the consequences of such incidents. Although the immediate cost of an insider scandal may not be that great, even using fairly conservative numbers for a small MMO, one could easily suffer million dollar losses in the second year for these types of incidents. More severe incidents that are handled poorly will drive these costs substantially higher. Free-to-play games that depend on players making virtual asset purchases are likely to be even more vulnerable, because they do not have the inertia of ongoing, and often automatic, subscription renewals to maintain revenues.

262

Protecting Games: A Security Handbook for Game Developers and Publishers

Also, as games mature and move to a steady population, an incident of this sort can tip the game into a death spiral where lost subscribers outnumber new players and drive the game towards collapse.

P RIVILEGING

AND

I SOLATION

The very features that cause problems with developers playing their own games and insider fraud are necessary to the successful operation of an online game. Developers need to be able to create items and exchange them. They need to be able to fully test the game play experience in as realistic an environment as possible. Developers also need to be able to modify a game’s code and its databases. In order to allow payments to be made, customer data needs to be stored somewhere and be accessible. Because these functions are required, they need to be implemented in a secure fashion. In this case “security” means that they are only used when, where, and how they are intended to be used. The first level of control is privileging and (application) user roles. Game operators and customer support staff are separated based on experience and trust with senior personnel given more capabilities than junior staff. These capabilities may be based on job function or individual needs or experience. The main benefit of using a person’s job for privilege control is that it is typically easier to manage. The security industry also has a nice term for it—Role-Based Access Control (RBAC), in contrast with Identity-Based Access Control (IBAC). The other general tactic is to isolate or split functions or operations from each other. The most familiar example is that a business will require two signatures when writing a large check. This strategy can be very effective because multiple individuals need to collude for the system to fail. The notion of a signature/ counter-signature system can be easily implemented for any critical function. Fully automated functions in software can even be split in this manner to protect against failures. There are a number of additional methods that can be used to help address insider security issues: Outside Investigations—If anything goes wrong, use an independent, outside investigator to ensure credibility of the results. This is a standard damage control tactic in other industries and it is equally applicable to games.

Chapter 25 Insider Issues: Code Theft, Data Disclosure, and Fraud

263

Controlled Key Item Creation—First, high-value items, like the blueprints that were the problem for EVE Online as well as the rare items from Legend of Mir II, should probably only be created with the authorization of more than one developer/game master. This would make it notably more difficult for a single individual to abuse the system. Separate Server/World for Developers, Friends, and Families—Set up a separate server or virtual world for developers and their friends and families. This allows them to play, but removes any appearance of impropriety related to any benefits in the public game. No Rewards for Developers, Friends, and Families—If the game has any incentives or awards that have any real value, no employees, associates, or friends or families should be eligible to win or earn them. Key Item Logging—High-value items should probably have a life history that is logged so that their ownership can be tracked back to their creation. Executive and Oversight Alerts and Reports—Any activities that could alter or disrupt the game—item creation, game parameter alteration, and so on— should be regularly tracked and reported to both game operations executives and whatever independent oversight system is used to ensure game integrity. Strong Configuration Management/Split Teams—Developers should not have access to the live system and, conversely, the live team and testing personnel should not have access to the developmental code base. Careful configuration control needs to be in place to ensure the integrity of the code. Employee Game Logging—Although one can debate the merits of developers playing the live game endlessly, it should certainly be clear that developer accounts should be flagged and logged at a much deeper level than regular players. This may include the use of a distinct client version. It should go without saying that developers should not be playing the game from a development system workstation. Independent Logging System—The system logs and auditing systems should be truly independent of the regular game play and data storage servers. It would be best that the auditing systems be developed and maintained by a different team. Take Game Integrity Seriously—MMOs lifeblood is the integrity of their game operation. This is a multi-million dollar business. With over 120,000 subscribers paying $15 per month, any damage to the game’s credibility or out and out corruption could literally break the bank. The consequences for a failure of game integrity could be fatal.

264

Protecting Games: A Security Handbook for Game Developers and Publishers

Insider problems are a particular challenge because they require the developer to look at her own team with suspicion. Business processes need to be understood and shaped to reduce opportunities for fraud or abuse. Logging (with active review of the audit logs) is necessary to provide credible deterrence and support for legal action. Often, little time is spent figuring out how the back-end systems (user management, payments, customers service, game master systems, and so on) of a game service will operate. As a result, all employees are allowed to do everything, just to keep the game running. Careful back-end system design will likely have substantial benefits far beyond addressing insider problems. It will likely improve supportability and reduce operational costs.

Chapter 25 Insider Issues: Code Theft, Data Disclosure, and Fraud

265

R EFERENCES 1. C. Morris (2003), “Playable Version of Half-Life 2 Stolen,” http://money.cnn.com/2003/10/07/commentary/game_over/column_gaming/index.htm 2. Microsoft (2007), “Global Entertainment Phenomenon ‘Halo 3’ Records More Than $300 Million in First-Week Sales Worldwide,” http://www.microsoft.com/presspass/press/2007/oct07/10-04Halo3FirstWeekPR.mspx 3. D. Becker (2004), “Stolen ‘Halo 2’ Hits Pirate Sites,” http://news.zdnet.com/2100-3513-5409959.html 4. R. Fahey (2004), “Grand Theft Auto San Andreas Leaked by Pirates,” http://www.gamesindustry.biz/articles/grand-theft-auto-san-andreas-leaked-by-pirates 5. Wikipedia (2008), “Time Value of Money,” http://en.wikipedia.org/wiki/Time_value_of_money 6. See, for example, 18 U.S.C. §§ 1029 (fraud and related activity in connection with access devices), 1030 fraud and related activity in connection with computers), 1343 (wire fraud), 1831 (economic espionage), 1832 (trade secrets), and 2701 (stored wire and electronic communications and transactional records access) 7. 18 U.S.C. § 1030 8. Insurance Journal (2007), “Fireman’s Fund Launches Product for Video Gaming Industry,” http://www.insurancejournal.com/news/west/2007/06/14/80820.htm 9. T. Spot (2006), “Angry Ex-EA Staffer Leaks Black?,” http://www.gamespot.com/news/show_blog_entry.php?topic_id=24344800 10. K. Kelly (2006), “Ubisoft ‘Accidentally’ Leaks Tons of Assets,” http://www.joystiq.com/2006/09/21/ubisoft-accidentally-leaks-tons-of-assets/ 11. B. Sinclair (2008), “Ubisoft Sues Over Assassin’s Creed leak,” http://www.gamespot.com/news/6195570.html?sid=6195570&part=rss&subj=6195570 12. The Chosun Ilbo (2007), “Game Programmers Suspected of Stealing Code,” http://english.chosun.com/w21data/html/news/200704/200704260026.html 13. Wikipedia (2008), “DeCSS,” http://en.wikipedia.org/wiki/DeCSS 14. Lynda (2007), “Arrests Made at Terrible’s Lakeside Casino,” http://www.essentialestrogen.com/2007/07/arrests_made_at_terribles_lake.html 15. S. Levitt (2007), “The Absolute Poker Cheating Scandal Blown Wide Open,” http://freakonomics.blogs.nytimes.com/2007/10/17/the-absolute-poker-cheating-scandal-blown-wideopen/ 16. M. Brunker (2008), “Poker Site Cheating Plot a High-Stakes Whodunit,” http://www.msnbc.msn.com/id/26563848/ 17. C. Li (2007), “Three Jailed in Online Gaming Scam,” http://www.chinadaily.com.cn/cndy/2007-03/27/content_836887.htm 18. Edge (2007), “Nudity the Cause for Halo 2 Vista Delay,” http://www.edge-online.com/news/nudity-cause-halo-2-vista-delay 19. S. Jennings (2007), “Eve Blows Up. Again,” http://brokentoys.org/2007/05/25/eve-blows-up-again/ 20. P. Patsuris (2001), “Simon Marketing Gets Fried in McScandal,” http://www.forbes.com/2001/08/24/0824dog.html

26

Partner Problems with J. Price

“Si vis pacem, para bellum” (“If you want peace, prepare for war”)1 ame companies are rapidly moving from doing everything in-house to contracting or outsourcing a substantial portion of their work. Third-party game developers build games for publishers, developers outsource art asset creation, and publishers license games internationally or hire foreign firms for localization. The foundation of these relationships is contracts and one area that is often neglected in contracts is security.

G

If you want a good business relationship, write contracts that assume everything will go wrong. Prior to working with the game industry, I spent many years working for the U.S. government with IT contractors and for contractors working with the government and with other companies. Although my work was technical, I rapidly learned that my success was highly dependent on contracts. If the contract was well-structured and thorough, we rarely had to resort to it. If it was not well-structured, life could become a nightmare. My co-author for this chapter, Joseph Price, is an attorney who lives and breathes contracts, and often gets paid to deal with the consequences of poor contracts.

C ONTRACTING S ECURITY ? In some sense, contracts are very much like software. The standard rule of thumb is that 80 percent of software code is written to handle errors. Most of the terms in a contract are there to handle when things go wrong. If implemented properly, a good contract will keep you out of court and, hopefully, help keep the project on track. Save some money while writing a contract and you may be in court for years. 266

Chapter 26 Partner Problems

267

The common answer to almost all of the security issues that we discuss in this chapter is a good contract and structuring the business relationship so that a good contract can be created and its results measured. A contract is the security tool of last resort and is a supplement to good security design and business practices. “Security,” like quality, is quite tricky from a contract perspective because it is so hard to measure. You can’t write security into a contract; what you can do is carefully define what you are doing for protection and, if possible, create measures for accountability when things go wrong. Security is of particular concern to publishers contracting for games from third-party developers and game developers that incorporate outsourced services or products. Whether it is the compromise of the game code during development or the customer support costs associated with game exploits, security failures are exacerbated by the nature of third-party relationships in the game industry. Outsourced products and services can introduce additional security risks. Finally, online games have a unique challenge with both official and unofficial community sites that are associated with a game, but not owned or operated by the game’s publisher. These sites are often the source of malicious code, phishing attacks, and other security problems that target game players.

S ECURITY A CCOUNTABILITY

IN

T HIRD -P ARTY D EVELOPMENT

Third-party developers are motivated to get their games out as quickly and as inexpensively as possible and are typically held accountable for delivering a “great game.” Because the bulk of the fees that these developers earn are typically on completion of a title, their motivation to address lifecycle and operational issues like security and other support services is low (quite reasonably). Publishers and developers need to cooperate to ensure that security issues are adequately addressed during the development process. The computer game industry is changing: A flashy box and fancy graphics will not guarantee success. Games no longer have a 30-day sales cycle, but are moving to a long-term relationship between publisher and player via an online service; game-development licensing needs to catch up with these changes. Although the only security issue that used to be of concern was fighting piracy, now, cheating, griefing, and other issues are comparably important. The game publisher needs to provide an ongoing operational infrastructure to support a game. Customer support, server operations, and ongoing engineering, patching, and maintenance have changed games into services. The nature of the business relationship and deliverables between a game developer and publisher

268

Protecting Games: A Security Handbook for Game Developers and Publishers

must change to match this model. Solid engineering, good design, infrastructure costs, lifecycle costing, and management now matter. Publishers must rethink their relationship and contracts with developers so that contracts match business needs. Factoring security issues into the game-development process is one way to reduce lifecycle costs and risks. Game publishers should engage a layered approach when working with developers and end users. Security risks (which translate into costs) should be considered at each stage of game development. The later security is included in the game-development process, the more expensive it is going to be, particularly considering piracy and code theft that may occur even before the game is released. It is the publisher who will ultimately pay for security failures one way or another. Today, for games from third-party developers, the software is typically provided “as is,” in terms of security. During my discussions with a number of developers, many have said “security is the responsibility of the publisher.” For console games, developers and publishers have often relied on the security provided by the platform; a strategy that has not had good results so far. So, with everyone placing the security responsibility on everybody else, the security “ball” simply gets dropped. If the publisher insists on a security solution, and is willing to pay, developers will apply resources to security, just as they do for animation, art, and game play. In the game contract, the publisher could ensure that its developers agree to appropriate indemnification (acceptance or transfer of liability) for security issues. If this is not possible, the publisher could insist that the developer deploy security that the publisher has rights to and prefers, as part of the game (this is the most common approach today for anti-piracy technology). In other words, the developer should consider incorporating its own security solutions that the developer believes are good enough to warrant tight indemnification or give the publisher the option to require the publisher’s preferred security solution to be incorporated as part of the game. Developers should also consider making security more of a priority as more games are adding downloadable content, virtual asset sales, and other monetization strategies. These may result in substantially larger royalties for the developers, but only if the game is successful.

S ECURITY A CCOUNTABILITY

IN

T HIRD -P ARTY L ICENSING

Online games are increasingly seen as good licensing opportunities. Potential game publishers or game operators get a completed title with the potential for a prompt return of their investment and the game developers can earn substantial royalties in numerous regions. However, licensees are obliged to operate and support these

Chapter 26 Partner Problems

269

games and security problems can turn a potentially profitable license into a costly customer support and marketing nightmare. Griefing alone, much less other security problems, can consume 25 percent of monthly service costs2 and suck the profits out of a licensed online service. In Sony Online Entertainment’s report on its experiment with real money transactions (RMT), SOE found reductions in overall customer support costs of 30 percent simply by supporting these transactions internally3. A key part of the due diligence process for licensing any game should be to determine support costs and risks. Games developed in sophisticated markets like China, Korea, or the US are likely to be thoroughly “tested” by griefers, cheaters, and hackers. It is highly worthwhile to research the “security state of the game.” Most games are not going to be wildly successful. Good control on operational costs including griefing, cheating, gold farming, and RMT may be the difference between success and failure. Another question that is important when licensing games is accountability for security, which can affect both parties. The game developer may be concerned that the licensee does enough to protect the game source and executable code that they provide, while the licensee may be rightly concerned about who will fix security problems and how promptly (and, of course, who will pay to fix those problems). NCsoft’s Lineage 2 server code was compromised, apparently in China. Later, this turned up in several places, including a pirate service in the US that was eventually shut down by the FBI but potentially cost NCsoft millions in subscriber revenues4. Similarly, Cryptic Studios was the victim of a hacker who compromised the server code for City of Heroes as well as knocking several game servers offline5. Security and technical support problems turned into a contentious dispute between Korean game developer, MGame, and the licensee of its MMO Yulgang, CDC Games, in China6. Because of the problems, CDC first stopped paying licensing fees and MGame revoked the game license. Eventually the two companies settled, although one suspects that lawyers were the sole beneficiaries in the dispute. In Korea, a number of game companies outsource security to specialty security service providers, most notably Inca Internet Co. (GameGuard) and AhnLab (HackShield). In the US, the only major game security service provider is Even Balance with its Punkbuster security service. Many companies who license games from Korean developers are required to negotiate a separate license with the security provider. This is almost certainly a poor way to structure a contract; especially from the perspective of a licensee. When licensing a game that uses such a service, it is probably preferable to include the security service in the prime contract with the game company to have unified responsibility for security (and, since the total payments are larger, this gives the licensee a bigger “stick” to push for better security support).

270

Protecting Games: A Security Handbook for Game Developers and Publishers

How does the new game operator control this risk? Here are some options: If the game has been previously deployed, the licensee should do extensive due diligence to determine whether there are known problems with the game. The licensee should also audit the game’s forums and internal trouble tickets (and the time that the company takes to close those tickets) to determine the pace of security problems. This is critical for being able to estimate support costs. If the game company is using a security service or product, this should be bundled with the license cost and the technical security support responsibility should stay with the game developer. A new game operator should not have to initiate a contract for security support. In the terms and conditions for the contract, a maximum pace for security incident trouble tickets should be budgeted with a clear escalation process if serious weaknesses are not corrected. If this pace is exceeded, the game developer should have to pay penalties or give discounts to the licensee. Also, the developer should be obliged to promptly report new security problems found in other regions to the licensee. An interesting collateral issue is the challenge of replacing a licensee. The long saga of The9 and their battle with Blizzard over the licensing of the Burning Crusade expansion to World of Warcraft in China is an interesting example. The companies worked out their issues, but Blizzard was quite unhappy for a long time with the quality of service that The9 was providing to World of Warcraft’s Chinese customers7. The termination of an online game license is especially tricky, because there could be questions about ownership of the customers and any modifications or localization to the game carried out by the licensee. Although many developers license their games as an executable without source code, I actually think that it would be wiser for developers to license or lease pre-configured servers as an appliance (see also sidebar in Chapter 8). This increases control over the licensee and reduces the effort required for support because the developer has full control over the game appliance platform.

S ERVICE P ROVIDER

AND

P ARTNER S ECURITY I SSUES

Games are no longer just sold in boxes at a store. There are electronic distribution services, online game services, payment processors, game arcade operators, and even security service providers. The security performance of these companies can have serious implications for the success of your game. Outages, such as that experienced by Valve’s Steam online game distribution service8, as well as more conventional security problems, can affect the revenues of all of the businesses that use these

Chapter 26 Partner Problems

271

services. The situation can be complicated further by having many companies, subcontractors, products, and service providers involved. When there is a security problem, they will all be pointing their fingers at each other or at you. If someone is thinking about security, the relevant legal issues are raised right before a contract is signed for software or services. Typically, however, security becomes a consideration only when a breach occurs. The French version of Halo 2 was compromised during the manufacturing process9 in 2004 and in 2008 Ubisoft launched a $10 million lawsuit for contract breach and negligence. Ubisoft filed the suit against its U.S. disk manufacturing company for allegedly allowing an employee to compromise Assassin’s Creed10 (resulting in 700,000 illegal downloads). In a perfect world, every contingency will be considered when initially negotiating the contract. In reality, a breach will occur in a way not entirely anticipated, and will be complicated by everyone’s confusion about what actually happened and further aggravated by split responsibilities between the affected parties and other product and service providers. Given these circumstances, it is wise for the licensee and licensor to keep four issues in mind when licensing software or services: Licensee Rights—The licensor will want an assurance, and the licensee should also confirm for its own purposes, that the licensee has the rights to what it is licensing, including all of the elements it relies upon to deliver the product (for example, consider sublicenses when relying on other licensed work). Damages—Consider worst case scenarios and who you are dealing with; a licensee that cannot (or will not) provide monetary relief should be expected to provide its product at an appropriately discounted rate because the licensor will have to spend money elsewhere in anticipation of a breach (if a security software firm, for example, is a small company with few or no assets, its breach conditions or warranty might only be as good as its insurance policy, if any, which should be requested to be part included as part of the contract). Warranty—Anything short of an express warranty, created by an affirmative statement, description, or promise in the license (such as an express warranty as to the security capabilities of hardware or software) will give a licensor pause. Breach and Termination—Consider how you can get out of the license agreement, particularly when a breach occurs, and also consider what damages might be available upon breach. Reviewing the license in the context of a security breach will likely be a complicated effort when the agreement is initially negotiated. There are few laws and regulations that apply in this area of law. Liability will likely rest with the entity that is contractually liable, if there is one.

272

Protecting Games: A Security Handbook for Game Developers and Publishers

If there is a lawsuit, it will need to be crafted based on how the security breach occurred. Good logs and tracking mechanisms are necessary to even begin such a suit. These records need to be created, stored, and handled in a manner such that they can be used in court. It is important to consider forensic issues before an incident occurs. If the license grants rights for software or services “as is,” there are no guarantees, such as the existence of an express or implied warranty (this is often buried in a contract paragraph in which all the words are capitalized and extra difficult to read). If there is any available warranty, it will be, at best, in a legal grey zone; the license may provide a degree of a warranty, complicated by limited indemnification rights, maximum payout restrictions, and subject to third-party licenses that no party to the agreement has ever actually reviewed. Damages and causes of action in court for breach of warranty are generally different than breach of contract. It is common to have exclusive remedies applicable to contractually promised express warranties if, for example, the hardware, software, system, or service fails to comply with an express warranty. For these reasons, the breach of contract and breach of express warranty claims are generally treated as separate claims, even where the express warranty claim arises under a contract between the parties. Service providers (for example, ISPs, social networks, and online games) may find themselves part of a lawsuit involving their customers whether or not they “should” be included. The quickest way to get out of the lawsuit is to have something clear to give to the court that cannot be attacked by the plaintiff or other defendants. Service providers will want to take full advantage of a legal immunity available to them11, and reaffirm that immunity in their service agreement and other contracts. The model to engage is the “conduit.” With the law and typical service contracts on their side, ISPs will escape liability, which will likely lead to another party. A slight warning is warranted to those ISPs and other service providers that move from the conduit role and add functionality. A recent case in California confirming the broad application of immunity included a footnote indicating that any involvement by the ISP that resembles the actions of a publisher could void the immunity: Delfino v. Agilent Technologies, Inc., 145 Cal.App.4th 790, 808 n.25 (Ca. App. 6th Dist. 2006) “We recognize that there is an existing debate concerning whether immunity under the CDA [Communications Decency Act of 1996] applies equally to both publishers and distributors of information authored by third parties and disseminated over the Internet.” (citing Doe v. America Online, Inc., 783 So.2d 1010, 1018-28 (dis. opn. of Lewis, J.) (Fla. 2001)).

Chapter 26 Partner Problems

273

This case leaves the door open for potential liability (for example, if a service provider provided security functionality and those mechanisms were to fail). The contract should be the security measure of last resort. First, design the business so that it has robust security; second, have clear accountability for any external parties; third, have a solid technical solution; and finally, paper it over as well as you can with good contracts and licenses.

C OMMUNITY

AND

F AN S ITES

One of the great things about the game industry and for the game industry is that its customers are often fans who set up websites, community sites, and other online forums. Players set up these sites on their own initiative and can have audiences of tens of thousands or more. However, many of these sites are run by amateurs and are easy prey for hackers and online criminals. Some are set up by criminals to lure players in to collect personal information and passwords or even download malware onto visitors’ computers. These sites are totally beyond the control of game companies and the threat is serious. Thirteen percent of the malware in Asia is targeted towards online games12 (key-loggers and other tools that help break into player accounts). Sometimes online sites do strange things that can create security problems. The Chinese Internet portal Sina ran an online poll about casual games, which was fine, except that there were questions in the survey that asked for player’s account names and passwords13. Improved identity systems, like World of Warcraft’s identity token or systems that use cell phones to log in, can minimize the potential risks from player errors. A lot of people have argued strongly for user education as an effective countermeasure against phishing or accidentally installing malware, but a game company can’t bank on changes in player behavior. One potential option is to include or provide free security software with a game. Another option is to certify and monitor fan sites to help them with their website security.

274

Protecting Games: A Security Handbook for Game Developers and Publishers

R EFERENCES 1. Vegetius, “Prepare for War: Latin Quote from Vegetius,” http://ancienthistory.about.com/od/warfareconflictarmor/f/PrepareforWar.htm 2. D. Becker (2004),“Inflicting Pain on Griefers,” http://news.com.com/Inflicting+pain+on+griefers/2100-1043_3-5488403.html 3. N. Robischon (2007), “Station Exchange: Year One,” http://www.gamasutra.com/features/20070207/SOE%20Station%20Exchange%20White%20Paper%201. 19.doc 4. FBI (2007), “Cracking the Code, Online IP Theft Is Not a Game,” http://www.fbi.gov/page2/feb07/iptheft020107.htm 5. B. Crecente (2005), “City of Heroes Hacked,” http://kotaku.com/gaming/city-of-heroes/city-of-heroes-hacked-144399.php 6. L. Alexander (2007), “CDC Sues MGame for Security, Tech Support Failures,” http://www.worldsinmotion.biz/2007/10/cdc_sues_mgame_for_security_te.php 7. S. Burns (2006), “Warcraft Game Makes $10m a Month in China, But Blizzard Expansion Dispute Still Not Resolved,” http://www.vnunet.com/vnunet/news/2162262/world-warcraft-makes-10m-china 8. M. McWhertor (2006), “God Hates Steam, Too,” http://kotaku.com/gaming/god/god-hates-steam-too-222329.php 9. D. Becker (2004), “Stolen ‘Halo 2’ Hits Pirate Sites,” http://news.zdnet.com/2100-3513_22-139103.html 10. B. Sinclair (2008), “Ubisoft Sues Over Assassin’s Creed Leak,” http://www.gamespot.com/news/6195570.html?sid=6195570&part=rss&subj=6195570 11. 47 U.S.C. § 230 12. M. Hines (2008), “Online Game Malware Takes Off in June,” http://securitywatch.eweek.com/exploits_and_attacks/online_game_malware_takes_off_in_june.html 13. DoNews (2008), “Sina Online Poll Asks for Game Account Passwords,” http://www.marbridgeconsulting.com/marbridgedaily/2008-09-11/article/19520/sina_online_poll_asks_ for_game_account_passwords

27

Money: Real Transactions, Real Risks by M. Eikenberry

Author’s Note: Although money can’t buy happiness, lack of money can cause your business to collapse. Handling payments and fighting financial fraud are profoundly important issues for online services, especially game companies. The lack of physical product delivery makes digitally distributed games and online game services targets for fraud. There are also serious risks associated with payment processors that many individuals, experienced only with the consumer side of the payment business, are completely unfamiliar with. I asked Marcus Eikenberry, who has lengthy experience with these types of transactions as a game code and virtual item reseller, to provide his insights into the payments process and fighting fraud. am Marcus Eikenberry and I’m a serial entrepreneur. I make a living dealing in intangible goods and services within online video games. My companies sell huge volumes of game registration codes and game time codes, as well as providing anti-fraud solutions for other sellers within these online gaming markets.

I

I started in 1997 selling virtual items within the game Ultima Online. I noticed a couple of sales of UO items on eBay and wanted to try my hand at making a sale there. I took two extra game accounts I had that were about three months old and put them up on eBay with full details of all the virtual loot that would be included on them. When I sold the accounts for a combined total of $2,400 I knew I was onto something. I thought to myself, “I could make a full-time job of this and do very well.” I have done so ever since. Now more than 10 years later, I no longer touch in-game goods when it violates a game’s terms of service. I focus on selling game codes and providing anti-fraud services for other companies. After being taken for a lot of money by scammers and thieves and not understanding how to process payments over the years, I’ve developed methods for some of the more popular payment services to greatly reduce fraud and overhead costs. 275

276

Protecting Games: A Security Handbook for Game Developers and Publishers

You will find information here that will help you improve your own payment processing and anti-fraud practices to help you to keep more of your profits in your pockets.

P AYMENT P ROCESSING Payment processing in its simplest form is getting the money your customer wants to give you for goods or services into your account. There are several types of payments. I will cover some of the ones that are more popular with video game players. In North America, credit cards are king. PayPal is also very popular. In Europe, there is a smaller percentage of people who use credit cards. In Europe, the culture in many areas is that if you are purchasing with a credit card it is because you do not have the funds to make the purchase. This may account for their lower use in Europe and why bank transfers are the preferred payment method. Moneybookers is a very popular payment method for Europe, as it supports multiple types of bank transfers as well as credit cards. Another method that is very popular across the globe is prepaid cards. These cards can provide credits into your games or subscription time. These are very popular because of their low barrier to entry for purchasing. In the US, you can walk into any Target store and find 30 or more types of prepaid game cards. In Europe, the cards can be found in many supermarkets. If you are selling services or intangible goods that are not delivered to the customer’s physical address, you will not have any seller protection in the event of a dispute. When accepting payment by credit card, you must accept the fact that you will lose 99 percent of all disputes. Credit card companies do not track digital goods delivery. Nor does it appear that they will offer any support for this in the near future. Depending on your volume of sales, you can expect to pay 1.9 to 2.4 percent, plus a transaction fee of $0.25 to $0.35 per transaction. Most credit card companies will not allow you to charge the customer directly for these fees. Additional fees can be levied on the vendor for chargebacks (Author’s Note: A chargeback is when a consumer reverses an existing credit card purchase and the vendor is responsible for returning the funds to the credit card company and, ultimately, to the consumer unless the vendor can successfully dispute the chargeback). Chargeback fees are commonly $10 per disputed charge. You can also be fined heavily if you have a high percentage of chargebacks. If you have greater than five percent fraud you may need to worry about these additional costs. The threshold will depend on the merchant service you are using. If you are planning to have higher than five percent fraud, this threshold may be one of the questions to ask when looking for a merchant account.

Chapter 27 Money: Real Transactions, Real Risks

277

Credit card companies will commonly do a credit check on you or your company before approving a merchant account. They also will have caps on transaction volumes in dollars per day, week, or month. These caps can be directly related to your personal or company income. I have known company owners who have told me horror stories about having great growth in a market only to have your merchant account held for reviews when the credit card company starts to get nervous about your volumes. For this reason, I suggest having multiple merchant accounts. Use a round robin method of cycling through the accounts with each new payment that comes in. Using a round robin method is helpful for multiple reasons. The first might be obvious: If you have four merchant accounts, the volume will be split across the four accounts. Thus you will have fewer chances of hitting your limits. The other issue is when funds get held by the payment processor. These funds are most commonly held for disputes but sometimes the entire account can be frozen if the credit card company is nervous for any reason. If you do have multiple accounts and one of them gets tied up, it will not kill your business. You will still have other accounts and will still have access to their funds. This is important because if you look in your merchant contracts you will see that they can hold your funds for far longer than you can go without them. (Author’s Note: They can hold your funds for months and you have no way to dispute the delay… or even earn interest on the funds.) I recommend starting with four different accounts from four separate payment processors. Even if you have really great credit and very high limits, I still suggest starting with at least two companies. USING PAYPAL PayPal is very popular in North America. It is also available in many European countries. PayPal accounts are funded in three different ways. The first is that one PayPal account holder can send funds to another. Those funds are held within the account. The accounts can also be credited from bank accounts and or credit cards. Fees for PayPal are 1.9 to 2.9 percent of each transaction, plus a $0.30 fee. If you are accepting funds from all over the world, there can also be a currency conversion fee of up to 1 percent on top of this. Other fees that can appear are credit card chargeback fees of $10. Other disputes that are not credit card funded do not have extra fees. Depending on your volume and your credit score, PayPal may also elect to insure your transactions against your going out of business. In most cases when you reach volumes of more than a quarter million dollars per month you will be subject to this, and PayPal will place a temporary hold that is a percentage of your daily sales.

278

Protecting Games: A Security Handbook for Game Developers and Publishers

In my dealings with PayPal, we have had a “hold” like this placed on one of our high volume accounts. The percentage that they told us they would “hold” was only 1 percent lower than our previous year’s profit percentage. I found this to be a threatening request as they stated that they were doing it to insure the “good health” of our company. I did renegotiate the percentage to something that we felt was much more acceptable. So if you get hit with this by any company, do attempt to negotiate your fees. PayPal originally started this process and a rolling hold on our funds when my credit score dropped (this was occasioned when we launched a new company and we financed part of its launch). PayPal as well as merchant account providers will check your credit every six months or so, and if your score gets too low for the volume of sales you are doing, you may be faced with one of these holds. As an additional note, my credit has returned to where it was prior to the holds, but the holds are still in place. I would hope that they would release these funds but who knows. Now that this is in place they may just keep it for the life of the account. PayPal offers a wide range of features that are good for merchants. They offer small companies easy development of payment buttons for their websites as well as automated communications with their online stores for big companies. They also have fairly good multi-user accounts where you can give access to staff without giving them full control over the account. Many other payment methods have no support for this, which means you to have to give the master login to your staff to process transactions. (Author’s Note: This kind of single login system creates serious risks of insider fraud that is difficult to detect, as there is no individual accountability for actions.) You can also sign up for the PayPal money market account, which tends to pay higher interest than most banks on the daily funds within your account (currently, the account pays up to 6 percent). For most companies there will be no reason not to participate, even if you sweep all of the funds out of your account nightly you will still earn interest. Make your funds work for you. (If you get any funds “held” on a rolling 90-day cycle, do insist that those funds be included. Because you cannot use those funds for anything else, you should demand it; I did and PayPal has included them.) PayPal offers multiple levels of account managers. As you increase in volume your account gets transferred to higher and higher levels. The highest levels will give you direct access to your account manager 24/7. To reach the highest level, you need to be doing an average of over $500,000 per month in a rolling three-month average. Lower-level accounts will be supported only during standard business hours. PayPal, in my opinion, is a very good payment method.

Chapter 27 Money: Real Transactions, Real Risks

279

USING MONEYBOOKERS Moneybookers supports many different bank transfer methods as well as accept credit cards. In Europe, Moneybookers is more popular than PayPal. The European method of bank transfers has a much lower cost than it does for us in the US. As Europeans tend to like to use bank transfers more, Moneybookers is providing a service that is needed and wanted. Moneybookers takes a different approach to fraud. They guarantee no chargebacks or reversals on any payments. There is, of course, a catch to this. If you start accepting too much fraud they will close your account. They use this “no fraud” as a big selling point. You still have to do your due diligence to screen funds coming in. Moneybookers has one item that I feel has a high risk. They do not have multiuser accounts. This requires you to give out your master login and password to any staff that needs to perform functions within the account. Moneybookers is working on allowing multiple logins and permissions levels for the future. But as of writing this, that option is not yet available. PRE-PAID CARDS/GAME CODES Pre-paid cards are becoming more and more popular. By moving to a code redemption system, you can allow others to resell your products and use their existing payment methods and infrastructure. This also allows you to let the merchant take all of the risks on whom they sell to. The complexity of implementing a code redemption system is much less than if you were to implement several payment methods. The down side to this system is that resellers will need to be able to earn their normal retail markup rate. OTHER PAYMENT METHODS Many carriers offer billing to telephones or cell phones as an option. There are several companies out there that can help with this service. This method has two major pitfalls. The first is that it is not uncommon to have carrier charge 50 percent of the transaction amount for their fee (in the US). The second is that the volume your customers can purchase via this method can be $100 or less. This is not a very profitable method unless you have very high margins. Are more payment methods better? The simple answer is yes. I have seen a direct increase in sales with several stores once I added additional payment methods. I would suggest the following methods for tracking what is needed and wanted:

280

Protecting Games: A Security Handbook for Game Developers and Publishers

Know where your customers are coming from. Identify their countries. Take your top countries and focus on their available payment methods first. Credit cards are nearly universal but you can also be leaving a lot of money on the table if you do not include other payment services. I would focus on providing at least one alternative payment method for each country to start. Track your payment gateway abandonment rates. To track abandonment, you will want to monitor when a customer brings a cart of items to checkout and then fails to make a successful purchase. If you track this by country this can be a great tool for knowing where to focus your efforts. An example of this is when I put PayPal into one of our stores and PayPal was the only option. The store did sales primarily to North America and Europe. We had a payment gateway loss for North America of 20 percent, but for Europe it was much closer to 40 percent. This would be an indication that we should look at a more preferred payment method for our European customers. You will never reach a 0 percent abandonment rate. But the closer you are, the better you are doing. Some of the more popular international games are supporting as many as 200 payment methods. If the demand is there, you may as well take advantage of it. For getting started I suggest going with companies that can offer multiple payment types. PayPal and Moneybookers both offer a wide range of options. As you get more sophisticated with your payment acceptance, you can move to work directly with more region-specific methods. You will save on your processing charges but you will also increase complexity.

I NSIDE

THE

P AYMENT P ROCESS : P AY P AL

Let’s talk a little bit about how PayPal works. It works by funding orders through PayPal funds (funds in the actual PayPal account), which are typically given from a bank account, credit card, or having received money from someone else through a transfer. Another method is e-check. This is when money is funded by an attached bank account only. E-checks can bounce. Do not trust them until they have cleared. Once they have cleared, you can still run the chance of a bank reversal, but this doesn’t often happen. Then there are credit cards funded by PayPal accounts. Whether or not they have funds in their account, the credit card allows them to do instant payments. You want the instant payments because the customer wants instant satisfaction. With payments coming from PayPal funds and credit cards (not e-checks), you’ll find that about 80 percent of the orders are good after 24 hours. In the first 24 hours, there is an 80 percent chance that the payment you received is good.

Chapter 27 Money: Real Transactions, Real Risks

281

If you get to 7 or 8 days or more, there is about a 90 percent chance that the payment is good. When you hit 11 days, you’re at a 98 percent chance of that payment being good. At 30 days it’s approximately 99.8 percent. These figures are based on statistics with our payment acceptance and how long before the payment gets held. PayPal will hold payments for several reasons. One is that they watch for funds being shifted around from account to account to account, all by the same person. They will monitor these actions. Within a few minutes of the payment coming in, they will place a temporary hold for investigation. If you are not planning on talking to your customer, you may want to give them a 30-minute delivery expectation. Wait about 25 minutes and then send the product. This investigation will trip internal checks at PayPal within a few minutes of the payment being sent. By delaying the delivery of the first order by 25 minutes, you can reduce your fraud by 0.5 percent or so. This may not sound important, but we did $6,000,000 in sales in one of our stores last year and that short delay saved us $30,000 in potential profit (profit margins are often lean for resellers). I have talked with PayPal many times about why they flag a payment and hold it a minute or two after it’s done. If they are that fast, why can’t they prevent the payment being sent to us in the first place? PayPal can be frustrating to work with. You just have to know how to work with them. They will hold funds for many reasons, even if it’s just general suspicion. I’ve seen this many times. There’s nothing you can do about it other than build it into your costs that they will do this from time to time. I usually refund the order if I haven’t delivered the product. If I have delivered product, I may place a few notes in the order so they know the details I have of the order. This may provide them with the information they need to release the order if it is legit. I always wonder what happens to the funds that PayPal holds. Do they give those funds back to the customer? Do they keep them? I certainly don’t get it. I’ve talked with people some time later and they said their money wasn’t refunded. PayPal states that the funds will always go to the buyer or seller after any hold. They also state that they are audited and are required to account for all funds. It makes me wonder if the buyer is being honest with us in these situations or if they have misunderstandings about how the system works. I’m betting that, most of the time, the customer funded their payment with a credit card and they do not have access to online statement. Thirty days later they will receive their statement and see that a credit was in fact given back to them. Also with PayPal, they will hold in situations when the customer has no funds in their account to send in the first place. When an order is funded by a credit card, the credit card company does a hold on the payment to PayPal. It’s frustrating how this works. PayPal will first send you an email saying they are disputing this on your behalf; please provide information. When they dispute it, they also charge $10.

282

Protecting Games: A Security Handbook for Game Developers and Publishers

This $10 fee is in many cases non-negotiable. Although, I do such a high volume I have negotiated that they not charge us this fee because we have told them we will never dispute a credit card chargeback. So, we do not require this service from them for disputing charges on our behalf. The credit card chargebacks typically do not appear for at least seven days. This process differs in that it requires forms to be filled out and most of them are not electronic. The last one I dealt with was from a furniture company. They called me two weeks after the order and told me that two months prior to my purchase they had gone into bankruptcy. Why wasn’t I told this when I made the purchase? They said I was not getting the funds back. I had to do a chargeback if I wanted my funds returned. I had to sign documents saying that I attest this was true, had to fill out other forms, and copy receipts. It was a lot of work; it took me several days to organize and gather the paperwork and then fax it all in. These holds are not disputable. You cannot fight a credit card chargeback through PayPal. I have never won that battle unless the customer was making a chargeback on something else and they did this one by mistake. I have had them reverse a couple of times in that instance, but it is not worth your time even if it is a thousand dollar chargeback. The odds of you getting one back are very low. You will spend more than a thousand dollars worth of time to get that one chargeback released. Don’t even worry about it. If you have a lot of profit on certain items, then you may want to study where your highest profits are. It can sometimes be more profitable to allow a low amount of fraud, though, as it will make it easier for your honest customers to make purchases. With this information you can get as hard-core with anti-fraud as you want; or just use a few of these items to enhance your current anti-fraud policies.

A NTI -F RAUD Why are anti-fraud measures so important? My experience is that about five percent of first-time customers are using a stolen PayPal account, credit card, or another online payment method (whereby they’re not the legitimate owner of the account). Typically, they have acquired it from phishing. Thus, if you blindly accept payment from just any PayPal or credit card account, you’ll end up with at least five percent fraud. If you sell virtual items that can be (licitly or illicitly) resold, they will make multiple purchases. When they make one successful purchase, they will be back again to make more purchases and, if left unchecked, you’ll go up to about an 18 percent loss rate from their numerous purchases before they get shut down.

Chapter 27 Money: Real Transactions, Real Risks

283

With products that are not re-sellable, such as registration keys or add-ons, you can still occasionally get fraud. Because I have those registrations “call home” (they send a request to our servers to verify they are active in good standing), as soon as the payment is reversed or there is an issue, I block their registration. The next time they try to log in to that application, it will become unregistered again. After that, I use one of two methods. First, I allow them to purchase again at regular price and hope that it doesn’t get reversed. This is an acceptable method. The other method, which I prefer, is to charge a penalty price to re-register the product. If they reverse the payment but come back again and want to re-register the product, I increase the price substantially, typically up to three to five times the original purchase price. The way I identify those who attempt multiple purchases is by having the registrations tied to the actual account names for the games or by another way of identifying which computer or person is making the purchase. I find this to be a good deterrent. If they know that they can only connect to a specific account with the purchase, they typically don’t reverse charges, lowering fraud a bit. I have found this approach has about a 2.5 percent fraud rate. For most products, this would be acceptable. For those who come whining to us that they got their registration key banned, we’ll sell them the banned version for a greater price. Because five percent of first-time customers are attempting a fraudulent payment, the key is to catch them immediately. If you don’t, they start running rampant. I figured this out the hard way. Several years ago I was running an online store. I sold game codes and other items such as currency in some games (it was legal, not the grey-market terms-of-service violation items). This store would do automatic delivery of the codes or currency. I had a system in place that checked if their IP address, PayPal account, or email address had been fraudulent in the past. If it passed those checks, the system would allow the purchase to go through. However, this limited the amount of purchases a person could make. I restricted purchases to five in a 24-hour period. If any fraud appeared, I would lose five purchases. These losses would be pretty limited, or so I thought. In this store there was $18,000.00 worth of stock. One morning I woke up, checked the computer, and saw that I sold out of everything! At first I was really happy. Then I was really scared. I realized that someplace really popular had linked to our site or something had happened and someone had found a way to exploit our systems. In fact, the latter was the case. Someone figured out that only so many purchases per day were allowed. They bought a domain with a stolen credit card and immediately purchased

284

Protecting Games: A Security Handbook for Game Developers and Publishers

email hosting. They then set up email addresses on this hosting account. They would make five purchases with the credit card on a PayPal account then our system would cut them off. Then they create a new email address and make five more purchases. They did this until the store was empty. They managed to do this within a couple of hours. That’s when I decided that I had to do something. I wanted to have an automated solution. The best kinds of sales are the ones that are replicated—those that require no more effort. The reality is that this just doesn’t work for items that have resale value. A human element is required. That human element can come in several different forms. When humans do anti-fraud they can review orders and check on suspicious purchases. They assess orders looking for patterns. You can look at their IP addresses and for large amounts of fraud from certain ISPs. You may have a human review a transaction if it’s a high dollar order or just review all of the transactions right off the bat. Thieves are always looking for a new loophole to get through. So there needs to be someone always watching the transactions. You may want to consider automation for performing searches of email addresses or for searching the names of the people to identify those who are going to steal from you. This may sound really crazy, but it’s my belief that some criminals want to be caught. A prime example is this story: I had an email address that read imatheif @******.com. He placed an order and our staff did not notice the email address. When they approved the order, the order went out just fine and a couple days later I get a hold on the funds for that. Looking it over, I realized this person was telling us they were going to steal from us—they told us so in their email address. We have since started tracking this kind of information. There are many different payments that should be held. If they have the words such as thief, steal, cheat, or hack—these are some examples where you can have your system automatically hold those orders for review. In fact, you may just want to turn them down. I have found that their email addresses actually told us what they were going to do. (Like imathief. What does a thief do? He steals.) Half of these customers did actually reverse charges. I tested that by allowing several such orders through and waiting to see if charges were reversed. Customers can give you their intentions. That’s one of the ways that can be automated. Other ways cannot be automated, like your interactions with customers. Sometimes they tell you things. Like I said, thieves want to be caught. They will give you hints. It’s a game and a thrill to them.

Chapter 27 Money: Real Transactions, Real Risks

285

In fact, when you identify a thief, you can even call to speak with some of them and they will actually tell you what they’ve been doing. They will explain what has been successful and what hasn’t. That may sound crazy but that’s been my experience. Some thieves like to brag about their exploits, about the people they’ve tricked or stolen from. You can learn a lot from that. We’ve seen payments that were going to the XXX game company (I’ll just call them XXX so as not to embarrass them). Although we were not involved in their payment processing on this, I realized that in one of the markets (where I was selling game codes), a lot of game codes were appearing on the market for sale at a discounted price. I knew the game codes were being sold for below cost. I was sure of that because I was probably one of their highest volume resellers of these codes and the prices they were selling them for was just incredible. I decided to figure out what was going on. I contacted some of these sellers who were selling the cheap codes. I bought some of them and, low and behold, they did work. I was halfway expecting that they wouldn’t work; that the codes would have been used or they would just be fake. They, in fact, did work. When I spoke with them and listened to them brag, they told me they were Russian carders. A Russian carder is someone who phishes credit cards or gathers them by some other means. They use those credit cards to make purchases of other items such as game codes. They then resell those game codes. They have, in effect, laundered these stolen funds. They were selling the game codes for 50 cents on the dollar and were making a lot of money. This turned out to be huge for XXX. I am not sure of the total losses, but it took me forever to get XXX’s attention on this. I was adamant about getting XXX to do something about this because it was affecting our sales of their codes (because the market was flooded with these cheap codes). When they finally did something about it, they got the FBI involved. Since the thieves were in Russia, there was really not much that could be done. They got away with it. Nothing ever happened to them. These are the exact kind of organized criminals you need to weed out immediately. If not because of the costs of fraud, then because U.S. Homeland Security will review transactions to make sure terrorists are not laundering money through your company. All of the IP addresses of the carders at that point were coming from Russia so we had flags on all Russian orders. They all had to be reviewed because of the country’s high fraud rate. I’m going to tell you a story about a guy who placed an order with us. Keep in mind that I know where our orders originate.

286

Protecting Games: A Security Handbook for Game Developers and Publishers

The deal on this is that even though we know what city and state they’re from, we ask them anyway when we confirm purchases by phone. We can see this particular customer is from Nashville, TN. He had a non-regional accent that isn’t necessarily a red flag but can be sometimes. I asked him what city and state he was from. His answer: “Nash-villey, Tennasis.” Right then we knew that there was a huge problem and we say, “Thank you, we’re sorry but we’re not going to be able to process your order.” You’ll receive a refund from us shortly and an email.” Somebody who cannot pronounce his or her own city and state is typically not from that area. Other examples: People from the East coast say “Orygon,” people from the West coast say “Oregun.” Then there is “Illinoy” (correct), and other people say “Illinoise.” There are different ways to gauge whether or not someone is from a region by asking them where they’re from. That’s pretty easy if you know how words are pronounced in a local area. Don’t let them use the excuse that they just moved to the area.

I NTEGRATION

FOR

A UTOMATION

The hardest thing about all of these payment methods is the integration into your systems. All of these systems offer integration but this can be very complex. I recently worked on integrating Moneybookers into one of our stores. I would have thought it would take just a couple of weeks to get set up, but it took several months. Each service has different requirements for integration. This is an area where you will want to have a highly skilled technical person doing this work. If you take the easy route and just get it working you will be open to exploits. I recently found this out the hard way—we took substantial losses from a hacker who was able to fake our system into thinking that every item for sale was just one cent. We found that we had left one check in our system unused and they exploited this fact. Taking the time and resources to do this right the first time is worth it. Our losses had we not caught it right away would have been higher than the costs of integration. We were lucky, but luck should not have anything to do with it. We should have done it properly the first time.

Chapter 27 Money: Real Transactions, Real Risks

287

P AYMENT F RAUD

by S. Davis Credit card fraud1 is a massive problem. The FBI estimated that credit cards were responsible for the majority of the $315 billion in U.S. financial fraud losses in 2005 while French credit card losses were $319 million2. In the UK, “card-not-present” fraud was £212.6 million (almost $350 million) in 2006. Although consumers may see these losses hidden as part of their interest rates and fees, the credit card companies and payment processors have successfully passed most of the risks to merchants. The burden is on you to protect your revenues and the health of your business.

R EFERENCES 1. Wikipedia (2008), “Credit Card Fraud,” http://en.wikipedia.org/wiki/Credit_card_fraud 2. J. Conlin (2007), “Credit Card Fraud Keeps Growing on the Net,” http://www.iht.com/articles/2007/05/11/news/mcredit.php

28

More Money: Security, Technical, and Legal Issues

here is always more to say about money. The PCI-DSS (Payment Card Industry Data Security Standard) initiative by the credit card industry has been put in place to reduce fraud at merchants. Unfortunately, PCI-DSS compliance is not the same as “security,” as the Hannaford Brothers grocery chain found when 4.2 million customer credit cards were compromised even though the company’s operations had been certified PCI-DSS compliant1. PCI-DSS compliance is an important issue, however, because most online services are likely to need certification in order to be allowed to accept payments.

T

Fraud is one of those things you really have to keep an eye on. As we were celebrating revenues in Q1, it was being tainted by fraud. We didn’t know what acceptable levels were. And the detection is delayed. Revenue is scalable, but so is fraud. Revenue clouds your ability to identify and fight fraud. You see money coming in and you don’t want to tighten your grip. And fraud leads to fines, incrementally and if you hit a certain level they can hit you with a big one. Increased fraud leads to expulsion from credit card processing. Some companies have been dealt six-digit fines. If you have over a 1 percent chargeback rate, you get hit with a fine. … You lose the revenue of the purchase and an additional [chargeback] fine. Merchants can fight the chargebacks, but it’s difficult and costs a lot of manpower. We learned you have to stop fraud before it happens and identify future chargebacks. You need a firm user policy and education. …We had users selling their time for existing fraudsters to level up characters. And that came back to hit us. … We set spending limits and educated the user base. We created a fraud [team] and joined the Platinum Members List in the Merchants Business Council. Chargebacks have been drastically decreased and controlled. —Min Kim, Director of Operations, Nexon America 288

Chapter 28 More Money: Security, Technical, and Legal Issues

289

Increasingly, online services are portals to a wide range of entertainment services. Player accounts allow players to purchase everything from virtual items to real goods. This makes these accounts targets for fraud by both insiders and hackers. Finally, even though virtual currencies have become a key part of the growth of the online game industry, there are some real risks. In addition to gold farming, the ability to convert some of these synthetic currencies back into official currencies raises the potential for their use for money laundering.

PCI-DSS

AND

S ECURITY

The rise of ecommerce and explosion of corporate IT and networking has created a huge problem for the payments industry. Poor internal security systems and procedures created huge opportunities for fraud. TJX Companies, owners of a number of major retailers including T.J. Maxx and Marshalls, compromised 45 million credit card numbers during a multi-year security breach2. This compromise cost the company well over $100 million in losses. The credit card industry established the PCI-DSS standard and certification3 to help protect credit card data, because these large-scale compromises were costly for the payments industry as well. As seen with the Hannaford Brothers case, PCI-DSS compliance is not the same as being secure. It is a minimum standard and may affect your transaction fees and terms as a merchant. Game companies and other online service providers should thoroughly investigate their options for practices that can directly reduce transaction costs as a matter of good business (such as joining Platinum Members List in the Merchants Business Council). Good system design should make it possible to move beyond PCI-DSS and reduce your practical risks. Online service providers should also investigate insurance and even consider not taking payments directly by working with third parties to further reduce potential threats.

A CCOUNT S ECURITY , V IRTUAL I TEMS ,

AND

R EAL M ONEY

Online game accounts are becoming much more than a way to pay a monthly subscription. Players can purchase downloadable content (DLC) for existing games, purchase additional games, buy virtual items, and will soon, no doubt, be able to purchase physical items. Microsoft’s Xbox Live is a pioneer in turning a game service into an all-encompassing entertainment portal, but Apple’s iTunes and App Store as well as Valve Software’s Steam and Amazon’s growing suite of Amazon

290

Protecting Games: A Security Handbook for Game Developers and Publishers

Web Services, among others, are joining in. In China, Tencent’s Q-coins have grown in popularity to the point where the Chinese government considered them a threat to the nation’s currency4. These accounts are rapidly becoming much more than a subscription payment method. As these capabilities of online game services grow, they will become more “interesting” targets for thieves. There are even greater risks if the virtual currencies that many of these services use can be converted back into “real” money. Convertible currencies raise the risk that game-like incentives and rewards can be construed as gambling. Also, the ability to “cash out” makes the currency a tempting target for internal fraud and outside hackers. Until a weakness in the QuickTime player was patched, Linden Lab’s Second Life was vulnerable to a hack that allowed thieves to transfer virtual currency from one player’s account to another player’s account without their consent5. At NetEase, a company employee identified 30 accounts and sent in faxes of counterfeit identity cards claiming that he had “lost his password” that transferred the accounts to his control. He then proceeded to loot the accounts6. The amount involved was not large by U.S. standards, around 4000 Yuan (around $500), but this is equivalent to several months’ wages in China. These types of services are vulnerable at three key points: the game or other systems that can reward players, payment systems that move between real and virtual currencies, and customer service systems. Customer service applications are a critical security target, because they are the means for handling any sort of problem that customers have. Potentially, they are an easy way to compromise user information, steal accounts, add unauthorized credits or bonuses, or carry out actual transactions for real money.

M ONEY L AUNDERING

AND

I LLEGAL P AYMENTS

Rampant payment fraud is a nightmare for any online business and an increasingly important issue for online games. One alternate payment processor, Flooz, had created a virtual currency for micro-transactions (similar to that used in many games). Unfortunately, Russian organized crime groups used Flooz and stolen credit cards to launder funds7. This resulted in an FBI investigation. [T]he rate of fraudulent purchases spiked from less than one-twentieth of one percent to 19 percent of consumer credit card transactions in June and July 2001. Chase Merchant Services, which processed credit card transactions for the company, then imposed tens of thousands of dollars per month in fines

Chapter 28 More Money: Security, Technical, and Legal Issues

291

for the excessive fraud rate. Chase also attempted to hold $2 million in company credit card deposits to cover the fraudulent transactions. Credit card fraud was already a major concern for online shoppers, and digital currencies were attractive to fraudsters due to its instant delivery and potential anonymity. Eventually, Flooz was shut down. Convertible currencies can pose a risk, if there is enough value that can be transferred. There has been speculation about criminals or terrorists using online games as a way to launder money, but typically the amount of value that can be moved easily in these games is too small to be of interest. This is yet another reason that companies should be careful with their transaction systems. Online poker, skill games, sports wagering, and pari-mutuel wagering do have the potential to be used for money laundering, however, because of the larger amounts of money involved. Criminals are using online wagering services for money laundering with wagers of 100,000 Euros on third-string Romanian soccer matches or even a Czech women’s league game. There are apparently around 15,000 online wagering sites with only 2,000 being legitimate and together they handle around $23.6 billion in wagers a year8. Internet sports wagering also is threatening the integrity of many traditional sports. Several suspicious matches at Wimbledon and elsewhere have led to investigations9. Perhaps unsurprisingly, the ban on Internet gambling in the US has led to criminal innovations. A payment processor in Utah miscoded credit card transactions to allow them to be used for online gambling; see10 and11. In Korea, illegal online gambling has grown with the rise “cyber-money dealers” who handle the conversion between virtual currencies and hard cash12. These types of “covert payment channels” can be used for other criminal applications. Gift cards, because they are not considered “real currency,” have been used by criminals for payments for drug deals and money laundering13. Gift cards are compact, flexible, and do not have to be reported when crossing borders. Crooks don’t need great graphics or immersive worlds to create real problems for individuals, governments, and the online game industry.

M ONEY L AUNDERING : L EGAL I SSUES Law enforcement throughout the world is well aware that money laundering is not limited to money transfers between typical banks or other financial institutions. They know that games, especially online games, have increasingly become the vehicle of choice of many looking for unique ways to transfer money “under the radar.”

292

Protecting Games: A Security Handbook for Game Developers and Publishers

Those that take advantage of a game for the purpose of laundering money are often crafty, and a game operator could unsuspectingly find itself in the crosshairs of an investigation or, worse yet, a prosecution. The unsupervised electronic funds transfers inherent in online gambling, for example, are exploited by criminal interests to launder large amounts of money14. It is an issue that cannot be ignored. First, know what money laundering is; then, know how to address potential issues when you discover them. Money laundering is a process by which a person takes money, potentially illegally gained cash, and then transfers the money, perhaps distributing it among others or back to himself, with the goal of keeping any governmental body from finding out the source of the funds. In this manner, “dirty” (questionable) money goes through a “laundering” process to become “clean” (deceptively lawful) because the new source of the money is not in doubt and the path of where it came from is intentionally untraceable. Any process that moves cash without asking a lot of questions about the money (and does not have governmental reporting obligations) will be a candidate for a money launderer. If a person uses a bank or financial institution to transfer money, the bank or financial institution will have a record of the transaction, and is likely required to report the transfer to the government. In the United States, for example, cash transactions and deposits of more than a certain dollar amount are required to be reported as “significant cash transactions” to the Financial Crimes Enforcement Network (FinCEN), along with any other suspicious financial activity that is identified in “suspicious activity reports.” Other jurisdictions have similar requirements that obligate financial services employees and firms to report suspicious activity to the authorities. When suspicious activity is discovered by authorities through FinCEN, or some other means, most countries have broadly written laws at hand to prosecute those who launder money, as well as those who aid and abet the launderers. In the US, law enforcement principally relies on a law called the “Illegal Money Transmitting Business Act of 1992,”15 which makes it a crime to “conduct, control, manage, supervise, direct, or own all or part of a business, knowing the business is an illegal money transmitting business”16. This law covers the transfer of money by “all means,” which includes the Internet and any other online service such as a game, social network, or virtual world17. The scope of this law gives prosecutors the tool they need to go after each person in even the most creative money laundering scheme. Each state in the US also has the capability to investigate and prosecute crimes within their boundaries. If consideration (such as money) is an element of the game, the game operator will have to be well aware of potential issues relating to money laundering. Money laundering can also occur in some other manner, such as sales made with virtual and actual currency. Issues will occur that the game operator truly has no knowledge of, and that may be a defense. But prosecutors will often have suspicions about what

Chapter 28 More Money: Security, Technical, and Legal Issues

293

the game operator knew and when the game operator knew it based on their investigation. If you have the slightest suspicion that something illegal is occurring, contact law enforcement. You may consider contacting legal counsel first, but do not delay. Assume you will encounter some sort of incident and have practices in place to quickly respond to work with law enforcement. You do not want your business shut down like Flooz.

R EFERENCES 1. R. Mogull (2008), “Picking Apart the Hannaford Breach: What Might Have Happened,” http://securosis.com/2008/03/18/picking-apart-the-hannaford-breach-what-might-have-happened/ 2. J. Vijayan (2007), ”TJX Offers Settlement in Wake of Massive Data Breach,” http://www.networkworld.com/news/2007/092407-tjx-offers-settlement-in-wake.html 3. PCI Security Standards Council (2008), “About the PCI Data Security Standard (PCI DSS),” https://www.pcisecuritystandards.org/security_standards/pci_dss.shtml 4. Wang X. and Wang S. (2006), “Virtual Money Poses a Real Threat,” http://news.xinhuanet.com/english/2006-12/26/content_5531905.htm 5. D. Terdiman (2007), “Report: Hackers Say They Can Steal ‘Second Life’ Currency,” http://news.cnet.com/8301-13772_3-9827500-52.html?tag=tb 6. China View (2006), “More Attention Paid to Virtual Property Protection,” http://news3.xinhuanet.com/english/2006-04/03/content_4377645.htm 7. D. Cotriss (2008), “Where Are They Now: Flooz,” http://www.thestandard.com/news/2008/07/21/where-are-they-now-flooz?page=0%2C0 8. F. Chaptal (2008), “Sports Credibility Caught in Tangled Web of Gambling,” http://www.thestandard.com.hk/news_detail.asp?we_cat=9&art_id=66491&sid=19097230&con_type =1&d_str=20080529&fc=2 9. J. Calvert, B. Flatman, N. Fleming (2008), “Wimbledon Fears Match-Fixing Scandal in Massive Betting Scam,” http://www.timesonline.co.uk/tol/sport/tennis/article4187780.ece 10. KUTV (2007), “Mob 3.0: Covert Channels in Online Gambling in the US and the Expansion of Organized Crime,” http://www.playnoevil.com/serendipity/index.php?/archives/1261-Mob-3.0-CovertChannels-in-Online-Gambling-in-the-US-and-the-Expansion-of-Organized-Crime.html (original article at KUTV no longer available) 11. B. Hansen (2007), “BetonSports—Again?—and BetUs Indicted in Latest DOJ Bust,” http://www.theregister.co.uk/2007/05/12/betonsports_doj_betus_indicted/ 12. M. Ha (2008), “Online Gambling Sites Mushrooming,” http://www.koreatimes.co.kr/www/news/nation/2008/06/117_25599.html 13. D. Birch (2007), “Moral Panic or Genuine Worry?,” http://digitaldebateblogs.typepad.com/digital_money/2007/01/moral_panic_or_.html 14. S. Coates (2006), “Online Casinos ‘Used to Launder Cash’,” http://www.timesonline.co.uk/tol/news/politics/article620834.ece 15. “Illegal Money Transmitting Business Act,” Pub. L. No. 102-760, § 1512(a) (1992), codified at 18 U.S.C. § 1960 16. 18 U.S.C. § 1960(a); also refer to 31 U.S.C. § 5330 17. 18 U.S.C. § 1960(b)(2)

29

Identity, Anonymity, and Privacy

dentity is a severe problem for almost all online services, including games. Games can operate as anonymous services, but usually identity becomes important at some point. The U.S. online game industry seems to be moving towards an environment where identity will tend to be very weak. Although credit and debit cards provide reasonable identity information, prepaid cards (see Chapters 27 and 28) are rapidly becoming the preferred payment method and they are naturally anonymous (to the game company).

I

Other countries have a very different view of online identity. Both China1 and Korea2 are moving towards requiring registration for many online services via some form of national identity number. It is likely that this approach will be adopted in many countries. Korea has gone so far as to create a separate online identity number for its citizens3. The first problem that any identity system faces is how to register users. The “registration problem” does not get nearly the attention it deserves. The biggest challenge is assigning an actual person to some sort of number or token or collecting a biometric signature. Once registration is completed, the operation of an identity service is fairly straightforward. (As almost everyone knows, it is much more difficult to get a driver’s license than to use one to verify your identity and age.) Age verification is a particularly thorny aspect of the identity problem. In the US, the only place where there is a legally acceptable definition for online age verification is to identify younger children under COPPA4. Another area where there has been increased interest in age and identify verification is the development of usage controls to address public policy concerns about game addiction. Whether game addiction is an actual problem or not, game companies need to address public perceptions of the issue. Compromise of user information and identity theft is a problem that has been gaining increasing public awareness over the past several years. In the US, California’s Data Disclosure law has been critical in raising awareness as to how

294

Chapter 29 Identity, Anonymity, and Privacy

295

often and how much personal information is compromised5. Korea has gone one step further with substantial civil penalties being assessed when user data is lost— as much as $100 per person6. There are legal requirements that any online service needs to meet in order to collect and retain user information. However, the US has some of the weakest privacy protections in the world. Most other countries require notably stronger protection for individuals’ information. Online businesses that are considering international markets need to be particularly sensitive to these issues, because acceptable practices in the US are not permitted elsewhere. Identity has an important internal role to play in online services. Identity management systems need to collect and retain sensitive user information. They also need to handle login, account recovery, compromise management, and other issues. Identity is particularly important for game companies that are concerned about player accountability.

T HE S TATE

OF

I DENTITY

AND

A NONYMITY

Identity is probably one of the most important problems of the 21st century. Although businesses and governments have always collected data on individuals, until the explosion of computing power and networking, this sensitive data sat relatively safely in file cabinets spread all over the world. Today, this multitude of identity records can be accessed and linked together to provide more information about ourselves than any of us would really care to share. Online services make it trivial to track user actions in great detail. At the same time, it is almost trivial to steal an identity. Stolen identity information, including name, social security number, and address, can be purchased for as little as $2 per identity, whereas a credit card name and number can be had for 40 cents7. These are for American identities; European identities go for more. There has been no real growth in identity security and the need for digital identity or any serious debate of the issues as a matter of public or business policy. Sadly, there has been depressingly little discussion of the implications of the pervasive access to all of our identity information and the overall lack of security of online identity. For a business, in addition to the growing requirements for data that must be retained to meet legal and regulatory requirements, there are also legal risks from data disclosure. There are other challenges—hate speech and harassment, obscenity, liability and government access, parental controls, and community standards and jurisdictional issues—all of which have an identity component. One strategy may be to move an online service to an offshore jurisdiction, which has a more amenable legal environment to your specific business. This may

296

Protecting Games: A Security Handbook for Game Developers and Publishers

appear to increase operational costs, but could be a powerful tool to reduce the threat of litigation (Note: This will certainly not solve all problems as the online gambling industry has found with the UIGEA. One firm, Party Poker, lost 90 percent of its poker revenues due to this law which applies to companies outside of the US 8.) Anonymity is an interesting issue for online services. On one hand, anything that reduces barriers to entry increases participation by potential customers. On the other hand, anonymity seems to encourage bad behavior. Many people see anonymity as the right to act with impunity. For games, strong identity helps fight cheaters and griefers by making them accountable for their actions and it helps with piracy by making it difficult to use pirated games online. One real challenge for most identity systems is that they are not designed with malicious individuals in mind. Almost all the systems are built on the implicit assumption that the individuals using the system actually want their identity to work properly and be secure. When this assumption is incorrect, as it is when criminals and even minor miscreants in games are involved, the security of the systems often comes crashing down. Digital signatures and public key infrastructures just don’t work if a private key has been compromised or the user is willing to lie during registration or share or steal a key. The best available approaches build on positive identity relationships such as existing relationships with customers, security tokens, some payment systems, or active incentives that reward accurate identity. Game developers and operators need to assume that their identity system is constantly under attack and that some of their users are always trying to defraud their online service. Until recently, Xbox Live players who had been banned could use promotional cards that provided minutes and pre-paid cards to set up new accounts and get back into the system9. Games should explore building highly specific identity systems that take advantage of their unique service offerings. Fan clubs, loyalty programs, incentive programs, and anything else that rewards honest identity is very valuable. The larger and richer the identity system and online service, the more effective it is. This is one of the real advantages of services like Valve Software’s Steam. The more they add to the service, the more costly it is for a player to “defect” and cheat, pirate, or otherwise damage the game ecosystem.

T HE R EGISTRATION P ROBLEM

AND

I DENTITY M ANAGEMENT S YSTEMS

Identity is a profoundly important problem. The biggest problem for identity systems is identity itself: knowing that who you are talking to is who you think it is. If you look at many discussions about identity, they completely ignore this most essential issue. There are three main components of an identity system:

Chapter 29 Identity, Anonymity, and Privacy

297

Registration and Association: Linking the Person to an “Identity”—This consists of both initial registration process and the real-time login or access control system for some sort of identity-based session. Transport: Communicating an Identity (over a Network)—This is usually implemented via cryptography, but the transport service often needs to address identifying the people and the application and platform that they are using to contact each other. Policy: Linking Identity to a Specific Business Problem—Identity is not an end, it is a means to solving some problem. An identity system policy captures information about the individuals and what they are allowed to do based on who they are, their role, or other criteria. An unfortunate habit in the IT security industry is to define policies for systems that may, or may not, reflect the actual business needs of their clients: organizations own policies, not technologists. There are several critical supporting issues that need to be addressed as part of a complete identity system: Compromise Recovery—What do you do when things go wrong? This issue is critical, yet is rarely addressed. What happens if the identity service’s data is compromised (look at the seemingly endless data disclosures in the news if you think this issue isn’t important)? What if the user compromises her identity information? How does the system recover? For game systems, it is also important to address the scenario where a user intentionally compromises her own identity data. I would argue this is the key failing of biometric systems— they have no meaningful recovery mechanism when biometric data is lost either through compromise of the biometric database or subversion of a biometric reader. Initial Registration—How do you enroll a person or system in your identity service? This has been the killer for public key infrastructures (the big security fad of the 1990s) before biometrics (the current security fad that is winding down). Initial registration is often costly. In some sense, the Postal Service and its private competitors are in the best position to handle this function, because they periodically get physical signatures from individuals face-to-face. Acceptability—What is legally good enough? Although there are many cases where there is no need for identity to meet a legal standard, it is an important and sometimes critical feature of many identity systems. It can also be a trap. There are a number of age verification services that provide some age and identity information, but none of them, to date, can accept or transfer liability from the actual service provider (except for COPPA). This is also important when considering the growing identity theft problem.

298

Protecting Games: A Security Handbook for Game Developers and Publishers

What are the de facto identity systems today? Usernames and passwords are used both for association and registration.* Email addresses are used for registration.* Credit card numbers with other identity information such as names and addresses are used for registration and for association when making a payment. Essentially, identity systems can tap existing payment processing and authorization services for a fairly strong sense of identity.* National identity numbers are used in Korea and China for identification. The problem with these systems is that it is possible to generate an “authentic” identity number, because the algorithms that each country uses are known10. In some cases, these numbers encode personal information such as gender, age, and location of birth, making the identity numbers tools for identity theft themselves. In the US, the use, until recently, of social security numbers by a wide range of entities for identification caused similar problems. Because these numbers are used to access a number of online services, compromises of the databases for these sites have resulted in millions of identification numbers being disclosed. Privacy advocates in Korea have raised concerns with requiring the use of any sort of national ID. They are concerned about the rise in cybercrime from easier identity theft and about the loss of privacy11.* The use of online identity numbers. Korea has recently created a separate number, called an i-PIN, for online identity12. It is not correlated with the country’s national identity number. This system doesn’t seem to address a couple of important issues: Because the number can be changed, it would make a lot of sense to support a global “compromise” notification system so that sites and services that use the ID number could cancel it and replace it with the new number. Also, although it is important to tie an identity to a specific individual, there are probably a number of benefits to allowing a person to have multiple ID numbers for improved privacy and speedier compromise recovery.*

All of these systems (the ones marked with an asterisk) are vulnerable to compromise. They are dangerous to enter in a public computer and can also be stolen via keyboard loggers and phishing scams. Except for passwords, these identity systems do not recover easily from compromises. Even issuing a new number does not necessarily or promptly invalidate a compromised identity number.

Chapter 29 Identity, Anonymity, and Privacy

299

Faxed Identity Card or Drivers License—This approach is sometimes used by services for adults and seems to be fairly widely accepted. People are not particularly likely to lose control of their identity cards and there are existing legal sanctions for misusing, altering, or forging official documents. The “fake ID” problem that plagues control of underage alcohol purchases does show the limits of this approach. Also, this system is relatively costly and slow and, technically, as vulnerable to database compromises as identity numbers. Registered Mail/Signature Required Delivery—Postal offices and other delivery services typically provide some mechanism for requiring a signature to accept an item. This form of identification and authentication is fairly effective, if slow and somewhat costly. It can wind up having little marginal cost if there is an actual physical delivery to a customer. It also has an advantage of fairly solid legal status. Security Tokens—There are a number of time-based and challenge/response security tokens used for identification and authentication. They do not address the initial registration problem, but are useful for day-to-day authentication. Blizzard managed to bring the price of an authentication token down to $6.50, which should make it fairly widely acceptable13. Interestingly, Blizzard is the real beneficiary of the token, but it has managed to pass the cost of the device on to its customers. Mobile Phone Messaging—Asian games are increasingly using mobile phonebased authentication. Because mobile phone numbers are personal items, they may have available identity information for registration purposes. Players are presented with a challenge code that they then must send to a specified number (usually via SMS text messaging) to log in to the service. Biometrics—Some organizations have considered biometric authentication for remote access. The problem is that the biometric signature is vulnerable to compromise as regular computers cannot be considered trustworthy devices. Keyboard loggers or other malware could easily capture the biometric information for use by a malicious user. Public Key Credentials—This is another system that looks better on paper than in the field. Unless there is a physically secure device that holds the private key, it is no better than a username and password. Challenge/Response Card—NHN in Korea came up with a fairly clever idea of using a paper card with a set of challenge/response number pairs (that is, Challenge: 435, Response: 813) listed on the card. The challenge value is provided by the server and a response given by the player14. This system has most of the benefits of a security token at a fraction of the cost.

300

Protecting Games: A Security Handbook for Game Developers and Publishers

There are other identity strategies available. The adult social network, Naughty America, provided an online background-checking service for its customers to help find out if potential partners have a criminal record15. Shanda Interactive’s King of the World MMO requires players who wish to play female characters to “prove their biological sex via webcam”16! There are also identity systems such as web cookies and computer fingerprinting. These are better at identifying platforms than their users (this difference is something that U.S. online service providers tend to forget; in the rest of the world, the Internet is usually accessed via a public terminal at an Internet cafe, not a personal PC). Computer fingerprinting systems use various values that can be accessed by software on a computer including: serial numbers for hard drives, MAC addresses for network cards, and license keys to attempt to create a unique identify for each platform. This technique works much better if the subject does not know her computer is being fingerprinted, as the signatures can be changed by a motivated hacker.

THE MORRIS TRAP Robert “Bob” Morris invented and implemented the widely used scheme of using irreversible transforms to protect passwords. The huge advantage of this approach was that the transformed passwords could be stored in the computer’s main memory back in the days when memory, hardware, and software were all expensive. The first part of the Morris Trap is the misuse of the irreversible transform technique. Because people are people, we tend to use highly structured, predictable passwords. A hacker can test these passwords easily if he has a copy of the “hashed” or transformed passwords stored in a computer (which Morris’ technique allowed). If every password is processed with the same irreversible transform function, it becomes very efficient to run a dictionary attack against all of the different user passwords at once. This is not an error on the part of the actual transform technique as defined by Morris, but how it is incorrectly implemented by many, many programmers. To avoid the efficient dictionary attack, each password needs to have a distinct seed. Sometimes, the username is used, but it is better to actually generate a distinct seed value associated with a username. The second, and more serious, part of the Morris Trap is that hardware and storage are no longer expensive. Rather than relying on a mathematical technique that still allows fairly efficient dictionary attacks, it would be better to physically isolate passwords in a separate system that can only be queried at a relatively slow pace. In practice, relatively few attackers do have physical access to the target systems. If passwords are in a separate machine that is hard to attack, passwords are not nearly as weak a security mechanism as they are when the memory of the machine is remotely accessible. Buy a separate computer, give it a painfully simple, secure interface, and physically protect passwords and other sensitive data.

Chapter 29 Identity, Anonymity, and Privacy

301

It is very hard to have true anonymity online. People tend to forget that they are sending out a “return address” every time they do anything online via the Internet. Yes, there are services that can hide online users, but the performance and effectiveness of these services in reality should be questioned. Anonymity is kind of like cheating—everyone wants to be the only one who has/does it. Some online services do not want to support a strong identity management system, often to allow them to reach a larger audience, but still would like some level of accountability. Social networks, blogs, and web forums that authenticate users via username and password or email address are a good example. The standard solution is usually some sort of “web of trust.” The problem with a web of trust in an anonymous environment is that there is no cost or penalty for lying or creating additional identities. The classic way to attack a “web of trust” is to build your own large collusive web of untrustworthy people who “trust” each other. This is most easily implemented by all of them being you. Many individuals create multiple identities at a single online service for perfectly legitimate reasons. Because there is no tie to a real identity or any cost for creating an identity, it is possible to build an arbitrary reputation by generating enough identities and relationships to feed your “hero” identity. These anonymity architectures (like many mathematical systems) seemingly are designed by mathematicians for mathematicians. They exist in a world of equations and protocols, but tend to have real problems when “real life” intervenes. Little details, like implementing the system in hardware or software (much less the involvement of less-than-honorable people) can bring the security of these systems crashing down. Anonymous systems need some sort of cost for creating additional identities and motivating people to be honest about whom they are. The best method is a real financial cost to create an identity, but this often conflicts with the other goals of the online service that was considering anonymity in the first place. Even if a working anonymous system could be put together, would it be desirable? The data to-date on anonymous behavior online is pretty abominable— griefing, cheating, harassment, abuse, spamming, phishing, ID theft, and so on— and it is not like “free speech” is really protected by these systems. There is no “right to anonymity.” If the government (or, more likely, a motivated hacker) wants to find out who you are, they will. They will start tracking down IP addresses, read actual logs of systems, and find you.

302

Protecting Games: A Security Handbook for Game Developers and Publishers

So, at best, we have a veneer of anonymity that encourages bad behavior without protecting those rare instances where anonymity might have some positive social value. Bravo! What people actually can live with (I think) is a system of strong privacy (in the ordinary sense of the word) and strong identity. Thus, I may be free to explore alternative experiences with confidence that, as long as I don’t break the rules, very few folks will need to know who I am. This can be done. Technical systems need to be combined with good business practices and sensible laws and regulations.

A GE V ERIFICATION

with J. Price A variety of online problems could be resolved if a user’s age could be confirmed quickly, reliably, and under a consistent legal framework. Even better, how about a law with a “safe harbor” from liability for those who play by the rules and make a good faith effort to weed out underage or other inappropriate individuals from content they should not be able to access? Unfortunately, we’re not completely there, yet. Progress is being made. Age verification and identity verification are important “gateway services” necessary for a large number of online businesses. Today, unfortunately, there is no way to provide these services in a way that completely addresses liability concerns. The Adult industry uses click-agreements and payment systems as a “best practices/ best effort” solution. On the children’s front, we have COPPA, which does provide an actual means to verify the age/identity of a child (but not of an adult). Several companies offer general age verification services, including IMVU17 and Second Life18. Because both companies allow businesses to operate within their environment, should these virtual businesses trust IMVU or Second Life’s age verification or, for that matter, to what extent should IMVU or Second Life trust their age verification service providers? Not if the business faces any real liability for failing to accurately verify the age of a user. Neither IMVU nor Second Life nor the actual age verification providers offer any sort of insurance or liability protection to a business or individual who trusts the service and uses its result to make a business decision. IMVU ’s service only claims 90 percent accuracy, which is not very comforting in the world of rampant litigation.

Chapter 29 Identity, Anonymity, and Privacy

303

These new age certifications do have the advantage of being inexpensive, but they provide limited value to consumers or businesses. Ironically, one of the “features” of these new systems is really a weakness—their claim that no information is retained. If the “evidence” of identity was maintained, it could, at least, be used as the basis of a fraud investigation and action against any individuals who have misrepresented their identities. Instead, all we will know is that at some time some data was provided that the company assumed was associated with a specific individual. If you are going to target your game to children, follow the law. Know why certain laws apply or why they do not apply. Do not go halfway and kinda-sorta target children and then discover you “accidentally” have data on children. The rewards from following laws and regulations will far outweigh the risks of building your service and taking a chance that the government won’t notice. And, if you are going to hire a third party for this service, make sure you know where the liability falls if the system fails. The age verification provider may have a “safe harbor” clause that covers you, and they might not. One law that is important in this area is the “Children’s Online Privacy Protection Act,” frequently referred to as COPPA (often confused with “COPA,” the “Child Online Protection Act,” which has been successfully challenged in court). COPPA applies to the online collection of personal information from children under 13. The Federal Trade Commission (FTC) implements the law through a variety of regulations and suggested “best practices.” The FTC also sends out warnings to industry when it cracks down on those that violate the law. COPPA provides a “safe harbor” from liability for those who follow its guidelines. Industry groups or even individual businesses can create self-regulatory programs to govern compliance with COPPA. These guidelines must meet a checklist of legal requirements and then be submitted to the FTC for approval. Before approval, the FTC will make the guidelines public and ask for comments on whether the guidelines should be approved. If the FTC approves your guidelines, then you will generally have a “safe harbor” from any enforcement action for violations of COPPA. Although the “safe harbor” is tempting, it might not be the solution if your service targets children under 13 and collects information about the children. In most cases, those service providers avoid COPPA violations by adhering to strict rules. First, know whether your service is covered by COPPA. To determine whether a website is directed to children, the FTC considers several factors including, subject matter, visual or audio content, the age of models on the site, language, whether advertising on the website is directed to children, information regarding the age of the actual or intended audience, and whether a site uses animated characters or other child-oriented features.

304

Protecting Games: A Security Handbook for Game Developers and Publishers

Next, you need a carefully crafted and prominently placed privacy policy. Do more than post a compliant privacy policy—adhere to it. Also, note that the FTC’s regulations also require, among other things, that you obtain verifiable consent from the child’s parent before collecting data. Although COPPA does address legal liability for online identity for children under 13, solving online identity for everyone is a key problem for the future of advanced online services. The solution to this problem is important. Companies will need to be able to get a legal safe harbor for certifying identity and individuals will need to be held liable for identity fraud or theft. Unfortunately, it will require more than a technical solution. Someone is going to have to engage government to establish a legal safe harbor for online identity.

U SAGE C ONTROLS

AND

G AME A DDICTION

There is a wide perception that people can become addicted to computer games in the US19, in Europe, and in Asia. Whether this is true or not is beyond the scope of this book. What is relevant is that the perception that games are addicting is creating a public policy problem for the computer game industry. As of late 2008, there has been little public response of any kind to this issue from industry associations or individual companies. Asia, China20, Korea21, and Vietnam22 have all taken similar steps to restrict game usage. These controls are different than ordinary parental controls (see Chapter 30) in that they are not adjustable by an adult. In general, the response from the industry has not been very supportive, but most companies do not seem to be actively fighting regulation. No business lives in a vacuum and the failure of the games industry to respond to social concerns about game addiction reflects poorly on the industry and its maturity. It is also good business for an industry to lead public policy for issues that affect the industry’s livelihood. On the other hand, there is a real concern for governments seeking to control game companies and address game addiction: The global nature of the Internet makes it easy to move offshore and successfully avoid undesired regulations. This could give domestic companies a disadvantage compared to their less regulated, offshore counterparts. To understand usage controls, it is instructive to look at what the actual restrictions are. China has established limits on game usage that are far from onerous:

Chapter 29 Identity, Anonymity, and Privacy

305

Limits play of minors (only). Play up to three hours per day is not restricted. Play from three to five hours is penalized at 50 percent of normal in-game benefits. Play over five hours has no in-game benefit. Players must provide valid identities to play. These are not difficult restrictions. In the US, where games are largely based on monthly subscriptions, it would have no negative impact on revenues (and there may even be an upside with some players purchasing additional accounts). In Asia, where subscription games are typically metered hourly, the impact would be really only on extreme players. In both areas, “professional” players, like gold farmers, would feel the impact the most because these users are playing full-time (eight hours a day or more). Many of the “industry concerns” are based on the notion that the system can be circumvented. Of course it can, but it does not matter. The company is providing due diligence to protect minors with usage controls. The individual player would have to take positive action to subvert the security system. The game company has done its part, and it is up to the individual to also obey the law. For games with a U.S.-style subscription system, this scenario is probably “money in the bank.” After all, gold farmers and other heavy players would wind up buying multiple accounts—meaning more subscriptions—so a game company can probably match revenues to usage better for extreme players. The game industry worldwide probably should move to usage controls for players of all ages. The system would be closer to metering and would largely answer public policy concerns about game addiction and excess game playing. Finally, the real gem in this program is the requirement for the use of real identities. Although this may place an additional burden on companies in the short term to adequately protect privacy, strong online identity is necessary to the growth and vitality of the industry as a whole. In China, gold farmers increased the prices of their virtual items in anticipation of the implementation of the “anti-fatigue” usage controls. Whether this was due to projected loss of business due to fewer hours of play or because the gold farmers were concerned about an increase in the cost of their operations is unclear23. Griefing, fraud, unauthorized gold farming, and so on should become much, much more manageable with a strong identity system in place. This should lower the cost of operations for everyone.

306

Protecting Games: A Security Handbook for Game Developers and Publishers

The game industry would benefit from leading on issues such as usage limitations instead of simply reacting and focusing on the (alleged) short-term financial aspects of these legitimate social issues. The endless battles over age restrictions and success of anti-gaming activists in the US like Jack Thompson (and he has been a success in putting the entire U.S. video game industry on the defense in the matter of labeling and restricting game sales) should show the costs and risks of letting government and society get “ahead” of the industry on policy matters.

A CCOUNT C OMPROMISE , I DENTITY T HEFT ,

AND

P RIVACY

Millions and millions of personal records have been compromised due to negligence and malice. I’ve received at least two notifications that my personal data has been compromised: One time from a large defense contractor I hadn’t worked for in years (why was my information even in a “live” database?) and the other I just received from some firm that apparently has my information because of some stocks that I own. They all reassure me that there is “no evidence that your personal information has been misused.” What kind of “evidence” are they actually looking for? Welcome to the world of data disclosure, account compromise, and identity theft. Goodbye privacy. If you want to understand why there is so little concern about protecting your data, in the US, the standard fine for data disclosure is pretty low. The SEC recently fined a brokerage firm $275,000 for compromising the data of at least 10,000 customers24 and leaving the data unprotected for over a year. Approximate fine per person: $2.75 or less. Conversely, in Korea, NCsoft was fined 500,000 Won (around $500) per person for leaving a log file with 8,500 user IDs and passwords unprotected for just five days25. These cases raise some interesting questions: If the company can show that it keeps data protected so that a single incident does not lead to any meaningful compromise, can it avoid liability? This is certainly possible from an engineering perspective (via encryption, split data storage, and other techniques). Also, if the company has a strong logging system in place, it may be able to determine the scope of an incident in sufficient detail to reduce costs and better inform customers of whether they are actually at risk of identity theft (determine if the data has actually been accessed as opposed to just exposed and if the data has been accessed, by whom.).

Chapter 29 Identity, Anonymity, and Privacy

307

Should this be a payment to the consumer or a fine? If the compromise was of a username and password and no other information, the password compromise should be considered insignificant, if the company acted promptly and reimbursed users for any lost data during the period of the compromise. In this case, a fine is reasonable to encourage companies to avoid these compromises. The simple loss of a password for an extended period of time could arguably result in a fine and a payment to affected players for “losses.” Consumers need to be responsible and encouraged to use passwords in such a manner that the compromise of one does not affect their other accounts (thus, a company fine). Losses at the site are one matter, but the compromise of personally sensitive information is different. Credit card numbers, ID numbers, and so on, are sensitive, and have a long term value, can be used for other crimes, and are expensive and time-consuming to recover (once you figure out that identity theft has occurred, which is difficult in and of itself). Standards for prompt disclosure combined with an established schedule of fines and payments would encourage companies to take appropriate actions promptly and exercise better care with this information. Conversely, consumers should not be rewarded for irresponsible behavior on their part. Game companies have compromised data: A Japanese MMO compromised the full account information (excluding payment information) for nearly 300,000 customers because the data was accidentally placed on a download server26 and hackers gained access to Second Life’s entire user database, including usernames, real names, and encrypted passwords and encrypted payment information27. There are also cases of real malicious insiders. A database administrator at a consumer reporting agency in Florida stole 8.4 million data records and sold them for $580,00028. The list of incidents goes on and on. In 2007, Microsoft has had several problems with customer service representatives for Xbox Live succumbing to social engineering to provide passwords for other users accounts29, 30. What is frustrating about the Xbox case is that the customer service representatives should have been able to use the player’s Xbox console ID, which, presumably, is known to Microsoft but not to other players, to help confirm a player’s identity. Also, Microsoft should have had procedures in place to restore the integrity of the players’ accounts in cases where the accounts are compromised (all security systems need to be designed to recover from failures).

308

Protecting Games: A Security Handbook for Game Developers and Publishers

The costs for game companies can be serious. In 2006, K2 Networks estimated that they lost $1 million in one year due to hacking, account compromises, phishing, and identity theft31. The loss was not of direct revenues, but from lost “customers: “It’s not lost money generated daily, but lost customers that wouldn’t come back.” —David Lee, K2 Network Senior Director of Infrastructure and Engineering If these were lost customers, it is likely that the total losses would actually be a good bit larger. After all, online gamers tend to stay with the games they enjoy for a number of years. The game industry’s experience with personal data disclosures is consistent with other businesses. The typical cost to a company for a lost record was $197 for each customer record that was compromised in 2007—up from $182 in 200632. Game companies are high value targets. Identity thieves stole 230,000 identities from a number of online sites in Korea and many of them were used to create dummy accounts for gold farming in NCsoft’s Lineage games33. These costs clearly indicate that it is worth investing in improving information security technology and practices for any business that holds customer data. This investment should include protections against external hackers, errors, and internal crooks. Phishing attacks are a particular problem for online games. Forged emails that direct players to sites that download malware or solicit usernames and passwords are an ongoing problem for the industry. Virtually everyone has been hit, from World of Warcraft, Xbox Live, Steam, EverQuest II, EVE Online, Tibia, and probably everybody in between. Tools like Blizzard’s Authenticator security token and NHN’s challenge/response cards as well as the phone-based authentication systems being used in Asia are probably the best approaches to fighting these attacks (see the section “The Registration Problem and Identity Management Systems,” earlier in this chapter). Customer education and training can help, but social engineering attacks have a long, consistent history of success34.

L EGAL R EQUIREMENTS

FOR

P RIVACY P ROTECTION

by J. Price Privacy is a growing concern. Consider what type of data you actually need to retain. You do not have an obligation to secure any data that you do not keep. This is not a minor point. Keeping data—no matter how securely—means that the data

Chapter 29 Identity, Anonymity, and Privacy

309

is susceptible to being stolen or misused in any number of ways. If you require personally identifiable information from someone to play a game—such as a name, address, credit card number—you have security obligations, and must respond in specific ways if a data breach occurs. Issues arise with non-personally identifiable information, but the obligations are less serious. LEGAL REQUIREMENTS

IN THE

US

Most privacy protection issues occur in the context of online services, although the collection of personal information about people is not limited to online service providers, and the laws relating to protecting that information and appropriately reacting to data breaches are applicable to anyone who holds personal data. Data breaches can lead to state and federal enforcement actions and result in serious fines. In 2006, the U.S. Federal Trade Commission (FTC) settled charges with ChoicePoint, Inc. in connection with a breach involving the personal information of 163,000 persons. ChoicePoint was required to pay $10 million in civil penalties —the largest civil penalty in FTC history at the time—and to provide $5 million for consumer redress35. These potential fines are in addition to other laws that require you to notify all individuals whose records were lost if you suffer a data breach. As of August 2007, approximately 39 states have enacted legislation requiring notification of their citizens in cases of misappropriation of their personal information36. California is in the forefront with its tough requirements that require such notification5. Most states have followed California’s lead. Federal law will not likely be far off, but (as of the writing of this book) no law has yet been passed, although many drafts have been circulated. LEGAL REQUIREMENTS

FOR THE

EU

In the US, privacy controls include a mix of legislation, regulation, and self-regulation. The European Union, however, relies on comprehensive legislation that, for example, requires creation of government data protection agencies, registration of databases with those agencies, and in some instances prior approval before personal data processing may begin. The two fundamentally different approaches to regulating privacy can cause issues for companies engaging in trans-Atlantic transactions. To bridge these different privacy approaches and provide a streamlined means for U.S. entities to comply with the EU requirements, the U.S. Department of Commerce, in consultation with the European Commission, developed a “safe harbor” framework. The safe harbor is a voluntary means for U.S. companies to avoid facing prosecution by European authorities under European privacy laws.

310

Protecting Games: A Security Handbook for Game Developers and Publishers

Certifying to the safe harbor assures consumers that EU organizations certify that your company provides “adequate” privacy protection, as defined by the European Commission. Organizations that decide to participate in the safe harbor must comply with the safe harbor’s requirements and publicly declare that they do so. To be assured of safe harbor benefits, an organization must self-certify annually to the U.S. Department of Commerce, in writing, that it agrees to adhere to the safe harbor’s requirements. These requirements include elements such as notice, choice, access, security, data integrity, and enforcement. The game operator must also state in its published privacy policy statement that it adheres to the safe harbor. Further details can be found at the U.S. Department of Commerce Safe Harbor website37.

R EFERENCES 1. F. Dai (2005), “China: Real Name Registration for Instant Messenger,” http://www.globalvoicesonline.org/2005/07/21/china-real-name-registration-for-instant-messenger/ 2. Kim Y. (2007), “KOREA: Busy Websites Need Real Name Registration,” http://www.asiamedia.ucla.edu/article-eastasia.asp?parentid=60686 3. Korea.Net (2005), “Foolproof ID to be Adopted for Online Registration,” http://korea.net/news/news/NewsView.asp?serial_no=20051031013&part=109&SearchDay=&source= 4. Federal Trade Commission (1998), “Children’s Online Privacy Protection Act of 1998,” http://www.ftc.gov/ogc/coppa1.htm 5. California (2002), “SB 1386,” http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html 6. Kim T. (2006), “Internet Operators Face Suit Over Privacy Infringements,” http://search.hankooki.com/times/times_view.php?term=online+game++&path=hankooki3/times/lpage/ nation/200605/kt2006052516592810510.htm&media=kt 7. J. Robertson (2008), “ID Thieves Drive Down Prices for Stolen Data,” http://www.usatoday.com/tech/news/computersecurity/infotheft/2008-04-08-internet-securitymarket_N.htm?csp=34 8. S. Bowers (2006), “Players Walk Away as US Law Wipes Out 90% of PartyGaming’s Poker Revenue,” http://www.guardian.co.uk/business/2006/oct/17/usnews.gambling 9. S. Davis (2006), “Payment Card Spoofing: Subverting Identity & Cheating,” http://playnoevil.com/serendipity/index.php?/archives/791-Payment-Card-Spoofing-Subverting-IdentityCheating.html 10. Xinhua (2006), “Fake Identities Open Up Games, Blogs, Websites,” http://www.chinadaily.com.cn/china/2006-12/27/content_769097.htm 11. Kim T. (2006), “Teenage Porn Case Fuels Online Identification Debate,” http://search.hankooki.com/times/times_view.php?term=porn++&path=hankooki3/times/lpage/tech/20 0610/kt2006101619305711780.htm&media=kt 12. S. Burns (2006), “Korea Guards Against Online ID Theft,” http://www.pcauthority.com.au/News/61055,korea-guards-against-online-id-theft.aspx

Chapter 29 Identity, Anonymity, and Privacy

311

13. Blizzard (2008), “Blizzard Authenticator (United States Only),” http://www.blizzard.com/store/details.xml?id=1100000182 14. Wohn D. (2006), “NHN, NCsoft and Identity Security in Korea,” http://playnoevil.com/serendipity/index.php?/archives/872-NHN-NCsoft-and-identity-security-inKorea.html (original article at JoongAng Daily no longer available) 15. J. Wyss (2006), “Sentry to Play Cop, Chaperon Online,” http://playnoevil.com/serendipity/index.php?/archives/282-Mom,-Hes-Not-A-Convicted-Felon-TheNew-Standard-For-Online-Dating-Games-in-Naughty-America-The-Game.html (original article at Miami Herald no longer available) 16. R. Hsu (2007), “Shanda’s Aurora Bans Transsexuals,” http://www.pacificepoch.com/newsstories/106627_0_5_0_M/ 17. IMVU (2007), “Age Verification FAQ,” http://imvu.com/catalog/web_info.php?section=Info&topic=age_verification_faq 18. Virtual World News (2007), “Second Life Adds Identity Verification,” http://www.virtualworldsnews.com/2007/08/second-life-add.html 19. J. Wagner (2008), “Addiction to Video Games a Growing Concern,” http://health.usnews.com/articles/health/2008/05/07/addiction-to-video-games-a-growing-concern.html 20. S. Davis (2007), “China: Anti-Fatigue System Regulation Translated,” http://www.playnoevil.com/serendipity/index.php?/archives/1510-China-Anti-Fatigue-SystemRegulation-Translated.html 21. Kim T. (2006), “Bill to Limit Time for Online Games,” http://search.hankooki.com/times/times_view.php?term=online+game++&path=hankooki3/times/lpage/ tech/200605/kt2006051918332111780.htm&media=kt 22. B. Hayton (2007), “Vietnam Restricts Online Gaming,” http://news.bbc.co.uk/2/hi/asia-pacific/6225505.stm 23. H. Lee (2007), “Fatigue System Pushes Up Virtual Item Prices,” http://www.pacificepoch.com/newsstories/95096_0_5_0_M/ 24. G. Risling (2008), “Brokerage Firm to Pay Fine for Security Breach,” http://www.forbes.com/feeds/ap/2008/09/11/ap5414745.html 25. Chosun Ilbo (2006), “Landmark Ruling Against ‘Lineage’ Maker Over Data Leak,” http://english.chosun.com/w21data/html/news/200604/200604280026.html 26. W. Wyman (2006), “Japanese MMOG Suffers Privacy Leak,” http://www.gamespot.com/news/6153299.html 27. V. Cole (2006), “Second Life’s User Database Breached,” http://www.joystiq.com/2006/09/09/second-lifes-user-database-breached/ 28. D. Goodin (2007), “IT Pro Admits Stealing 8.4M Consumer Records,” http://www.channelregister.co.uk/2007/12/04/admin_steals_consumer_records/ 29. J. Evers (2007) “Microsoft Probes Possible Xbox Live Fraud,” http://news.cnet.com/Microsoft-probes-possible-Xbox-Live-fraud/2100-7349_3-6169060.html 30. R. Lemos (2007), “Account Pretexters Plague Xbox Live,” http://www.securityfocus.com/news/11452 31. L. Sullivan (2006), “Thieves Targeting MMOGs Prompt Tighter Security,” http://www.techweb.com/wire/security/192700321 32. R. Blitstein (2007) “Cost of Compromise: a Customer Record Costs a Company $197 each in 2007,” http://www.playnoevil.com/serendipity/index.php?/archives/1776-Cost-of-Compromise-a-CustomerRecord-costs-a-company-197-each-in-2007.html (original article at San Jose Mercury News no longer available)

312

Protecting Games: A Security Handbook for Game Developers and Publishers

33. S. Burns (2006), “Identity Theft Victims to Sue NCsoft,” http://www.vnunet.com/vnunet/news/2151224/identity-theft-victims-sue 34. J. Timmer (2008), “Fake Popup Study Sadly Confirms Most Users Are Idiots,” http://arstechnica.com/news.ars/post/20080923-study-confirms-users-are-idiots.html 35. Federal Trade Commission (2006), “ChoicePoint Settles Data Security Breach Charges; to Pay $10 Million in Civil Penalties, $5 Million for Consumer Redress,” http://www.ftc.gov/opa/2006/01/choicepoint.shtm 36. Consumers Union (2007), “Notice of Security Breach State Laws,” http://www.consumersunion.org/campaigns/Breach_laws_May05.pdf 37. Export.gov (2008), “Welcome to the Safe Harbor,” http://www.export.gov/safeHarbor/

30

Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers

nline games and virtual worlds whose primary customers are children are probably the fastest growing portion of the online game industry. It is gratifying that many of these services take the issue of protecting children seriously. Protecting children online is an increasing concern to mainstream media—it has even been the lead letter to “Dear Abby”1. Parents and public officials worry about pedophiles and stalkers harassing their children. The available data actually indicates that cyberbullying and harassment by other children is a much more significant problem.

O

For example, the media often cites a claim that one in seven children has been contacted by a sexual predator. The more accurate number is that 1 in 25 children received an online sexual solicitation from someone (not necessarily a predator) that includes an attempt to meet in real life. Interestingly, most adults flatter youth, they don’t lie, and they don’t misrepresent their age or interest in sex. The young people involved are not pre-teens, but typically 13-15 years of age and the (potential) crime is statutory rape, not forcible rape2. The details of this issue are important enough to quote at length; see the following quotation. 1) These solicitations did not necessarily come from “online predators.” They were all unwanted online requests to youth to talk about sex, answer personal questions about sex, or do something sexual. But many could have been from other youth. In most cases, youth did not actually know the ages of solicitors. When they believed they knew, they said about half were other youth. 2) These solicitations were not necessarily devious or intended to lure. Most were limited to brief online comments or questions in chat rooms or instant messages. Many were simply rude, vulgar comments like, “What’s your bra size?”. 3) Most recipients did not view the solicitations as serious or threatening. Twothirds were not frightened or upset by what happened.

313

314

Protecting Games: A Security Handbook for Game Developers and Publishers

4) Almost all youth handled unwanted solicitations easily and effectively. Most reacted by blocking or ignoring solicitors, leaving sites, or telling solicitors to stop. 5) Extremely few youth (only two) were actually sexually victimized by someone they met online. This number was too small to be the basis of a reliable estimate of how many youth in the population get sexually victimized from online meetings. …. 1 in 25 youth (about four percent) got “aggressive” sexual solicitations that included attempts to contact the youth offline. These are the episodes most likely to result in actual victimizations. (About one-quarter of these aggressive solicitations came from people the youth knew in person, mostly other youth.) 1 in 25 youth (about four percent) were solicited to take sexual pictures of themselves. In many jurisdictions, these constitute criminal requests to produce child pornography. * 1 in 25 youth (about four percent) said they were upset or distressed as a result of an online solicitation. Whether or not the solicitors were online predators, these are the youth most immediately harmed by the solicitations themselves. —Crimes Against Children Research Center (December 2007) Some more recent data has shown that online harassment (cyberbullying) has risen to nine percent of children who go online, substantially less than the 17 percent who are bullied in real life3. The Internet, in general, and online games, in particular, are easy targets for child protection advocates. Symantec recently completed a study of online behavior. Some of the most interesting data shows how ignorant parents are of what their children are doing online. In many cases, the parents underestimate the length of time their children are online by a factor of 10 and only a third of parents take advantage of available parental controls4. Good parental controls could be a real business opportunity, not a burden for game companies. Incidents such as the case of an 11-year old New Zealand boy who used his mother’s credit card to spend $1500 on virtual items in There.com5 are not the sort of attention the industry needs. Parental controls can even become powerful marketing tools: T-Mobile, AT&T, and Verizon have all announced initiatives to give children an “allowance” for mobile phone minutes and SMS messages6. The game industry has taken some steps to address these issues. Microsoft launched its Family-Safe Gaming Initiative7 and NCsoft has a similar PlaySmart

Chapter 30 Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers

315

Initiative8. What the game industry really needs is to launch and sustain an industrywide campaign to educate parents about appropriate and safe gaming, as well as provide parents with useful tools. Monitoring inter-player communications and game play is particularly important for children’s games, but is also a sensitive topic in games for general audiences and for adults. Game operators need to balance providing a safe, functional game environment with addressing privacy and legal concerns. One of the most misunderstood subjects for children’s games is The Children’s Online Privacy Protection Act (COPPA)9. COPPA has been misinterpreted and caused many game creators to steer away from creating online games and virtual worlds that allow children to play. In fact, COPPA can provide a legal safe harbor for those online services that comply with its requirements. Increasingly, there are third-party companies that offer services to help game providers protect children. With the exception of certain providers certified under COPPA, these third-party firms can only provide a “best effort” or “best practices” service and cannot really help a game company reduce its liability if problems occur. The ultimate goal for the game industry would be for online games and other online services to effectively protect children globally through a standard and accepted combination of procedural and technical measures. Today, it is a daunting challenge to determine adequate, let alone best, practices.

D EALING

WITH

C YBERBULLIES , P EDOPHILES ,

AND

S TALKERS

As noted previously, public perception is that the online pedophiles and stalkers are a much worse problem than is actually the case. The fact that it is newsworthy when such incidents occur is a tribute to their relative rarity. Cyberbullying, on the other hand, is relatively widespread—25 percent of girls and 11 percent of boys in middle school reported being harassed electronically at least once in the previous two months, according to a 2005 study of cyberbullying by Clemson University researchers10: Psychological studies show that people will do more, go further, than they would normally, if their identity is obscured. Online, it is easy to remain anonymous, and the normal frustrations of daily life can lead to what psychologists call disinhibition. Cyberbullies, pedophiles (or child molesters), and stalkers all take advantage of the relative anonymity of the Internet to pursue their goals. [see the following for additional details on the topic: 11, 12, 13, 14].

316

Protecting Games: A Security Handbook for Game Developers and Publishers

Although there are some technical tools that an online service can use to automatically filter online communications looking for behavior associated with bullying, grooming, or stalking, the key is human oversight, preferably by the children’s parents. Although such technologies may be helpful, it is unlikely that they will transfer liability from the online service. The Clemson research recommended the following guidelines for parents: Teach your kids that, although your identity can be hidden when you’re online, you still should treat people with respect. Make sure your children have no online secrets from you, and that they never share private information over the web or meet with someone they only know from an IM session. Put their computers in a space, such as a den, where you can see what they’re doing. You should know the passwords for all their accounts and check on what they are posting. —Dr. Robin Kowalski, Clemson University Technically, online games should provide tools to make it easy to report griefing or other suspicious behavior and support extensive logging both for the company and for parents (see the next section for more information). Again, this is an area where the industry has an opportunity to provide leadership through advocacy and by public awareness and education.

K IDS ’ C OMMUNICATIONS , P ARENTAL C ONTROLS ,

AND

M ONITORING

The security issues related to protecting children’s communications are, essentially, the same issues that exist for adults—with substantially increased visibility and sensitivity to failures. For adults, the problem is nuisance griefing (see Chapter 21); for children issues of cyberbullying, stalkers, and pedophiles raise the stakes much higher. There are several strategies companies commonly use to secure “kidfriendly” online services: Menu-Driven Communications—Menu-driven systems allow only certain words and phrases to be constructed based on user selection from a list. The advantage of this system is that it essentially requires no monitoring, as the participants are incapable of expressing any inappropriate phrases. This is often the default communication service supported by many kids’ game sites. These systems are not perfect. Children and adults have created “covert channel” communications systems on these services, or even used decorations in any

Chapter 30 Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers

317

personal, customizable space in the game (or even clothing, I’d guess), to exchange data and allow expanded chat (see the “Friend Codes” bullet)15. Whitelist Chat—These services allow players to use only specific, preapproved words for communication. Site moderators have to continually monitor game slang to identify new euphemisms for inappropriate topics such as cybersex. There are also issues where motivated players can use legal phrases to signal inappropriate information. Blacklist Chat—This type of chat service blocks words and phrases that are inappropriate. It needs to be constantly updated as new “problem words” are identified. In practice, this should not be difficult. A real-time monitoring team can be alerted whenever a new word arrives and it can be added to either a whitelist or blacklist. In practice, relatively few words are used, even with misspellings, so this is not a challenge for an automated filter. Club Penguin has 100 moderators who add 500 to 1,000 words per day to the site’s filters16. Personal Blacklist—Sites can be concerned about personal information, such as addresses, phone numbers, and email addresses, when children attempt to share the personal info. This information may not be sensitive to everyone, but when associated with a specific child, it indicates a potential problem—often innocent, sometimes not. Silent Filter—Club Penguin created this innovation for their Standard Safe Chat system. Many sites will filter a specific word or phrase only if it is deemed inappropriate. Some sites will also notify users that they have said something wrong. Club Penguin’s system fails silently: The sender does not know that the system rejected her message. The goal of the system is to not give the offender any positive feedback—either from the recipient or from the security system— so that she does not have information to “tune” her abuse strategy17. Friend Codes—These sequences of letters and/or numbers need to be exchanged outside of a game or online service before communications can occur. They are most closely associated with Nintendo’s DS and Wii consoles. Many users criticize them, but most children’s online games use the technique. Because this technique forces a communication outside the game, the participants need to have some sort of independent, hopefully pre-existing, relationship of trust. Monitoring—Many children’s games use manual monitoring by company staff to look for troublesome behaviors of all sorts. These people act as supplements to the automated filters and can intervene in various ways when they identify a suspicious communication. The content of the communication does not need to trigger intervention, only the fact that it is a new or an anomalous pattern of behavior. Strictly speaking, monitoring does not always need to occur in real-time; it can be slightly delayed or even used for simple review of logs.

318

Protecting Games: A Security Handbook for Game Developers and Publishers

These strategies can be used either in isolation or together. Many children’s sites have different tiers of service with menu-driven communications available to all and more flexible chat options for paying customers or individuals who have provided detailed information about their identity. As with other online services that have relied on text-based communications, the rise of audio and video communications can pose a real challenge for protecting children. Filters, word lists, and the other strategies that have been effective so far for protecting children online are not really viable for video or audio communication services. In addition to protecting communications, some games implement additional parental controls, but typically, these are quite remedial. Games like World of Warcraft, Lineage, and the Xbox Live service all have basic time limits, schedules, and payment status tools. There are a number of additional capabilities that could be useful for children’s online services and would make the services even more appealing to parents: Time Limits—An overall time allowance for hours of play per day or per week. Schedules—Hours during which online activities are permitted or prohibited. “Grounding”—The ability to prohibit a child from playing because of misbehavior. Special Reward—The ability to temporarily add hours, open up a schedule, or otherwise alter the game usage for the child. This could even be implemented by a separate interface to a cell phone, allowing the parent to be “untethered” from the playing child. Payment Status—Current funds in the players account. Allowance—A rate at which the child can spend money in the game account. This is particularly applicable for free-to-play games or multi-game services. Message and Activity Log Review—John Smedley, CEO of Sony Online Entertainment, noted that it would be helpful for parents to be able to review the full logs of their children’s messages activities in an online game18. Actually, there is no reason that parents should not be able to review the activities of their child online beyond just messaging, perhaps even a full game or online session replay feature. Approved Friends List—Parents could have the ability to approve friends or move them into different categories. This could be beyond the basic “communication type” limitations that many services support today.

Chapter 30 Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers

319

Event Notification—Alert parents of notable events in the game. These do not even need to be relevant to child safety (although it is probably unwise to abuse them too much for marketing purposes). This would be another opportunity to directly contact parents via SMS messages to cell phones or email and create a strong, direct relationship with the parents. Ratings System Support—Online games are going to need to develop their own ratings system or become more involved in the traditional games rating process. The more information parents have, the more comfortable they will feel with these online services. Rich Family Structure—It would be very beneficial to support multiple children and parents/guardians under a single account with appropriate privileges and capabilities for each. The service could even support temporary access for baby sitters and for friends of the children, which could also be good for business. Parent-Child Contract—Barbie Girls came up with an excellent idea for its Parents’ Place service: a tool that helps parents and children build a contract for when, where, and how the child can use the online service19. One feature that many parents would likely appreciate would be a “parental dashboard” that would allow a parent to centrally manage all of the online activities of their child or children at all of the sites that the children use. It often seems that game developers view parental controls as a burden instead of an opportunity to take care of the real customer. After all, it is usually the parent who pays for the service. A market is beginning to develop for security products and outsourced services related to protecting children20. In addition to technical capabilities and costs, companies that are investigating such services should consider whether they can transfer any liability to the service provider. Monitoring is not used solely for children’s games. There are additional issues related to monitoring, particularly privacy, that should be considered regardless of whether the participants are children or adults (see Chapter 29).

COPPA

with J. Price Children are often the direct or indirect audience for many games, including online games. Providing the game to them, and collecting various data associated with their use of the game, will require game companies to adhere to the Children’s Online Privacy Protection Act of 199821 (COPPA). (COPPA should not be confused

320

Protecting Games: A Security Handbook for Game Developers and Publishers

with COPA, the Child Online Protection Act, which addresses the exposure of children to online pornography.) COPPA applies to websites and online services operated by persons or entities under U.S. jurisdiction for commercial purposes that are either directed to children under 13 or who have actual knowledge that children under 13 are providing information online. COPPA is not optional. It is the law and companies have been fined substantially, in one case, $1 million for violating the statute22. Online game developers seem to be petrified of children using their services. The prospect of complying with COPPA and not marketing to kids seems to have driven many companies to restrict their market to children 13 and up or adults. It is interesting to note that parents are very active in children’s games. In the social network and doll “dress up” game, Stardoll, a survey found that 80 percent of surveyed children and 54 percent of surveyed parents visit the site daily. Parents seem heavily involved: 75 percent visiting the site along with their daughters at least once a week, 64 percent visiting on their own, and 60 percent having their own accounts23. COPPA does not ban marketing to children; it provides rules on how to do it. The law details, for example, what an online game operator must include in a privacy policy, when and how to seek verifiable consent from a parent or guardian, what responsibilities an operator has to protect children’s privacy and safety online, and includes restrictions on marketing to children under 13. An important element of COPPA is potential legal immunity. The Federal Trade Commission (FTC) implements a “safe harbor” designed to encourage increased industry self-regulation. To take advantage of the safe harbor, the FTC must approve the set of compliance guidelines that the company employs.24

C HILDREN

AND

I DENTITY

Protecting children’s identity is a particular challenge. In the US, a child’s privacy is protected under COPPA, and as a practical matter mishandling children’s identity information is bad business and worse public relations. Kids don’t see identity protection this way. They want to play games, and there is nothing like saying “no” to encourage devious behavior. When a player registers, even an adult, the goal of the registration process is to deter bad behavior, but some parents will also collude with their children to “game” the system. A good system should include both carrots and sticks for establishing and protecting identity: rewards and punishments. Verifying identity online is a hard problem; face-to-face identity verification is not. However, verifying face-to-face identity is not cheap. One answer is to get the users to pay to have their identities verified.

Chapter 30 Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers

321

How about a T-shirt? One way to get users to pay for identity verification is through the physical delivery of goods. Delivery services (such as UPS and FedEx or even the Post Office) offer the ability to confirm identity via signature receipt. It is fairly expensive to pay for this service purely as an identity verification method. However, consumers will often pay to receive a T-shirt, poster, or other items (“carrots”). The marginal cost of adding signature verification is low to a product delivery and, of course, the consumer is now actively engaged in marketing your game. The worst-case scenario is that you might have to convince your marketing department to subsidize the shirts or items. An approach to handling identity misrepresentation is assessing an obvious, serious financial penalty for misrepresenting information and the threat of legal action (the “sticks”). For example, the game provider could levy a $250 charge for handling and revoking a fraudulent identity. And, because identity theft and credit card theft are both crimes, the service provider should be willing to pursue legal action and do so conspicuously and publicly. Both of these threats would be highlighted during the registration process with a clear, explicit acknowledgement by the user when completing the process. If an incident does present itself, the company should be willing to follow through by enforcing the fine or taking legal action, or both. If the service provider does take legal action, it should do so publicly. Publicity will aid the company’s credibility and deter future problems.

C HILD P ORNOGRAPHY

with J. Price Players may create or post child pornography onto your online service, unfortunately, and it must be dealt with quickly and appropriately. Federal law imposes significant penalties for the online (and off-line) distribution of child pornography. Any entity providing any online service, including a game, must report any facts or circumstances around possible violations of federal child pornography laws to a law enforcement agency25 or the Cyber Tip Line at the National Center for Missing and Exploited Children (1-800-843-5678—see also http://www.missingkids.com/ cybertip/). Any person who knowingly and willfully fails to make a required report will face serious consequences, including fines of $50,000 for the first offense and $100,000 for subsequent offenses26. The legislation does not require an online service provider to monitor any user, subscriber, or customer, or the content of any communication of any user, subscriber, or customer, and immunizes game operators and ISPs from civil lawsuits if

322

Protecting Games: A Security Handbook for Game Developers and Publishers

they take good-faith actions to comply with the legislation27. But game operators must respond quickly to any report of child pornography and involve law enforcement just as quickly. Turning a blind eye to an end-user complaint regarding content, especially if it is—or could be—child pornography, will very likely result in prosecution.

R EFERENCES 1. Dear Abby (2007), “Online Video Game Threat Catches Parents Unaware,” http://www.uexpress.com/dearabby/?uc_full_date=20070915 2. Crimes Against Children Research Center (2007), “1 in 7 Youth: The Statistics About Online Sexual Solicitations,” http://www.unh.edu/ccrc/internet-crimes/factsheet_1in7.html 3. Crimes Against Children Research Center (2007), “Internet Safety Education for Teens: Getting It Right,” http://www.unh.edu/ccrc/internet-crimes/safety_ed.html 4. Symantec (2008), “Parents, Get a Clue!,” http://www.marketwire.com/press-release/Symantec-NASDAQ-SYMC-820494.html 5. R. Markby (2006), “New Zealand Boy Runs Up $1,500 Debt in There,” http://playnoevil.com/serendipity/index.php?/archives/962-New-Zealand-boy-runs-up-1500-debt-inThere.html (original story at Stuff no longer available) 6. B. Tedeschi (2008), “How to Give Your Child an Allowance, the Mobile Way,” http://www.nytimes.com/2008/07/31/technology/personaltech/31smart.html?em 7. Edge (2006), “Robbie Bach Fronts Safe Gaming Campaign,” http://www.edge-online.com/news/robbie-bach-fronts-safe-gaming-campaign 8. S. Davis (2006), “NCsoft Launches ‘PlaySmart’ Information Program to Advance Online Gaming Safety, Security,” http://playnoevil.com/serendipity/index.php?/archives/764-NCsofts-PlaySmartInitiative-Hopefully-Just-the-Beginning.html (via PlayNoEvil: original article at Yahoo! no longer available) 9. Federal Trade Commission (1998), “Children’s Online Privacy Protection Act of 1998,” http://www.ftc.gov/ogc/coppa1.htm 10. B. Levine (2006), “Taking On the Cyber Bullies,” http://www.toptechnews.com/story.xhtml?story_id=02300000L9FA&page=1 11. D. Stang (2008), “How Pedophiles Groom Victims,” http://sexual-abuse.suite101.com/article.cfm/how_pedophiles_groom_victims 12. K. Lanning (2001), “Child Molesters: A Behavioral Analysis,” http://www.missingkids.com/en_US/publications/NC70.pdf 13. CyberBullyHelp.com (2007), “The Facts About Cyber Bullying,” http://www.cyberbullyhelp.com/whatis.html 14. P. Agatston (2007),“Cyber Bullying Quick Reference Guide for Parents,” http://www.cyberbullyhelp.com/Cyber%20Bullying%20Guide%20for%20Parents.pdf 15. The Good Reverend (2007), “How to Chat in Chatless Disney Online Game,” http://thegoodreverend.blogspot.com/2007/06/how-to-chat-in-chatless-disney-online.html 16. P. Elliot (2008), “MMO Week: Club Penguin,” http://www.gamesindustry.biz/articles/mmo-week-club-penguin

Chapter 30 Protecting Kids from Pedophiles, Stalkers, Cyberbullies, and Marketeers

323

17. S. Davis (2007), “Feature Article: Inside Club Penguin and its Child Safety Program—Updated Club Penguins purchased by Disney,” http://www.playnoevil.com/serendipity/index.php?/archives/1461FEATURE-ARTICLE-Inside-Club-Penguin-and-its-Child-Safety-Program-UPDATED-Club-Penguinspurchased-by-Disney.html 18. J. Smedley (2006), “Be Vigilant,” http://stationblog.wordpress.com/2006/08/21/be-vigilant/ 19. Barbie Girls (2008), “Barbie Girls Parents’ Place,” http://www.barbiegirls.com/parent_home.jsp 20. Virtual World News (2008), “Xivio Signs Crisp Thinking for Online Child Protection,” http://www.virtualworldsnews.com/2008/06/xivio-signs-cri.html 21. 15 U.S.C. §§ 6501–6506 22. Federal Trade Commission (2006), “Xanga.com to Pay $1 Million for Violating Children’s Online Privacy Protection Rule,” http://www.ftc.gov/opa/2006/09/xanga.shtm 23. N. Mitham (2008), “Stardoll: Fame, Fashion and Friends…and Mothers?,” http://www.kzero.co.uk/blog/?p=2140 24. Federal Trade Commission (2006), “How to Comply with the Children’s Online Privacy Protection Rule,” http://www.ftc.gov/bcp/conline/pubs/buspubs/coppa.shtm 25. 42 U.S.C. § 13032(b)(1) 26. 42 U.S.C. § 13032(b)(3) 27. 47 U.S.C. § 230; 18 U.S.C. § 2702(b)

31

Dancing with Gambling: Skill Games, Contests, Promotions, and Gambling Again

here is one place where playing games purely for fun collides hard with the real world: when gaming becomes gambling. Although game violence and game addiction have recently been the focus of media attention and public policy concerning the game industry, gambling is an area where game companies can rapidly get into very serious trouble.

T

I am addressing gambling, contests, and related topics in a book on game security for two reasons: Game companies can get into a lot of difficulty by veering into the gambling industry unintentionally. Once cash or prizes are involved, games are not just for fun, and the threat level to a game’s integrity goes up dramatically. The gambling gaming industry and the non-gambling gaming industry rarely seem to acknowledge the other’s existence. However, the explosive growth of online gaming and the wide range of business model experiments within the gaming industry are creating “accidental casinos” and “unintentional lotteries.” Governments have no sympathy for companies that make these kinds of mistakes. The temptation for game developers to edge towards gambling is pretty obvious. The potential to win cash or prizes is a huge incentive to participate in a game and substantially increases a player’s willingness to pay to play. Designing a casino game seems very simple: a deck of cards, a couple of dice, a wheel and ball, some green felt, and you’re in business. All legal U.S. gambling (including casinos, Indian casinos, charitable games, bingo, card rooms, and lotteries) generated $90.93 billion in gross gaming revenue in 20061; certainly enough money to catch anyone’s attention.

324

Chapter 31 Dancing with Gambling

W HAT I S G AMBLING

AND

325

W HAT I S N OT

In general, a game must have three elements to be considered “gambling”: (1) consideration to play (often money); (2) an element of chance; and (3) a prize. If the game lacks any one, it is not a gambling game…usually2. Game business models can be broken into the following categories (if you are considering gambling and related legal issues): No Prize: No Gambling, No Problem—Even if you charge to play or have an element of chance, if there is no prize, there is no gambling. No Consideration: Contests and Sweepstakes—As long as you do not have to pay to enter and all entrants have an equal chance to win all prizes (equal dignity is the legal term), the game is not gambling. There are certain U.S. states that are more restrictive in this regard. Personally, I use the “McDonalds Test.” Go get a McDonalds prize ticket and look where the contest is “Void Where Prohibited by Law.” This is a good list of the places where you can’t run contests. Consideration, No (Little) Chance, and Prize: Skill Game—If the game does not contain an element of chance, it is a skill game and not considered gambling. Typically, in the US, about 30 states use a “preponderance of skill” standard, another 10 have a “pure skill” standard, and the rest don’t allow skill games (contact your lawyer). Consideration, (Mostly*) Chance, and Prize: Gambling—A game that includes all three elements is not necessarily prohibited, but it is almost certainly regulated in most jurisdictions. For example, in the US, fantasy sports leagues, horse racing, and certain online lotteries are excluded from the Unlawful Internet Gambling Enforcement Act (UIGEA)3. There are also different rules for charitable gaming. (*)Interestingly, the law in Canada is reversed; if there is an element of skill in the game, it is not considered gambling 4. Nations and states may treat the gaming/gambling transaction as occurring where the player is, not where the server or business is located. This is an issue that needs to be explored more carefully from both the perspective of protecting a gaming company and as a matter of public policy. Some jurisdictions, most notably the US, France, and Israel5, have stated that if either party to the transaction is in their jurisdiction, the government has jurisdiction over both parties. The risk for a gaming company is that it may be operating in a jurisdiction where gambling is legal, but be at risk of prosecution in another jurisdiction because one of its players is located there.

326

Protecting Games: A Security Handbook for Game Developers and Publishers

Game designers can work their way around these issues, if they do so carefully. Trading card games allow players to create value for the cards independently of the value set by the game company. Games can also be redesigned to remove an element of chance. For example, Duplicate Bridge6 eliminates chance from a card game by having all partnerships play the same hands. The bottom line is that if you have any questions or doubts about whether your game is a gambling game, contact an attorney knowledgeable in this area of law.

A CCIDENTAL C ASINOS User-created content and emergent game play are usually wonderful things when they are part of your game. Players have taken online games and expanded them and transformed them far beyond the initial plans or intent of their creators. Game companies can experiment with new rewards and incentives for playing. All of these factors can sometimes cause a game to stumble into gambling: Linden Lab’s Second Life has been at the forefront of player creativity. One of the obvious, and, for a while, quite popular, options for players was to create a virtual casino that used the game’s currency. In 2007, Linden Lab asked the FBI to review these inworld services7 and shortly thereafter banned both advertising for gambling8 and all of the virtual gambling sites inside the virtual world9. In Korea’s intensely competitive online gaming market, the Lohan MMO, was launched and was surprisingly popular. It had a Baccarat “mini-game” that became very popular and which was of sufficient concern that Korea’s Media Rating Board (equivalent to the U.S. Entertainment Software Rating Board) asked that the game be removed10. Even more challenging to the boundary between gaming and gambling is the case of Sony’s Station Exchange. As discussed in the gold farming section of Chapter 22, Sony launched this online sales service as part of its strategy to fight gold farming. However, because Sony seems to have profited from the transactions and many of the virtual items had an element of chance involved in their acquisition, there were questions raised as to whether the UK’s new Gambling Act would require Sony to get a license11. Sony could perhaps avoid this potential problem if it set a flat listing or processing fee instead of a commission-based transaction service. NHN’s game Reign of Revolution embraced a more direct form of capitalism by allowing players to tax all of the transactions in regions that they controlled. This could potentially be quite lucrative, given the wide availability of real money trading sites in Korea12. As a world leader in online gaming, Korea is struggling with clarifying the distinction between gaming and gambling online. They have large-scale gold farming and, at the same time, casual gambling games (such as the card game Go-Stop and

Chapter 31 Dancing with Gambling

327

poker) that are widely played for large amounts of virtual currency. The government is considering penalizing players who trade more than 300,000 Won (around $290) in virtual currency per month13.

S KILL G AMES Typically, contests are pretty safe and non-controversial. There is no legal problem as long as players don’t have to pay to enter and they have an equal chance of winning the prizes. It is pretty easy to determine whether the game is a contest. Skill games are more problematic. Because payments are required to play, the boundary between jail time and a good business is based solely on the game design and implementation. Governments are not always helpful: The UK recently determined that poker was a game of chance14, whereas Denmark decided it was a game of skill15. Game developers have adapted a number of casual games to use the skill games business model16. Developers have even converted first person shooters into skill games, although to date, none of these endeavors has been financially successful17. There are a range of issues that game developers should consider when designing a skill game or converting an existing game to the skill game business model: Does the Game Have Enough Skill—There are a lot of games that are quite fun that don’t require much skill. The entertainment comes from the graphics, animation, and sound, simple game play, and substantial rewards. Because of the legal issues, developers have to be quite careful to ensure that the game will pass the “preponderance of skill” or “pure skill” test, depending on where the game company plans to operate and for which customers they wish to make the game available. Vulnerability to Attack—Many games are fun but not secure or even able to be secured. Single-player games often have optimal solutions that can be exploited and many multi-player games are very vulnerable to bots (see Part III on cheating). These design flaws may, in fact, be part of the appeal of the nonskill variants of the game, as players often enjoy the satisfaction of victory, even if it is gained easily. Single Player Game Design Issues—Very few online games for single players are designed to be implemented on the server. All of the game logic is on the player’s computer and the sole interactions with the server are to download the game and upload a score. These games are virtually impossible to protect, although they are commonly used for advergames and skill games.

328

Protecting Games: A Security Handbook for Game Developers and Publishers

Migration Issues—If a developer is working with an existing game, it is very tempting to reuse the already built and tested code. Because security is much less of a priority for a (non-skill) game, the existing game may have serious architectural and game design issues that could make it difficult to port securely. Skill Dominance/Sufficient Audience—Some games have very high learning curves and some players are substantially better than others. First person shooters often fit this profile, as do deep, strategic games like chess. These games make poor skill games because many typical players will have no confidence that they can win or improve enough that they can ever win. One reason that poker is so successful is that pretty much everyone thinks that they are an above average player. Another issue for skill games is that players do not necessarily trust the game service. Because money is on the line, players are likely to be concerned about insider cheating, shills (players paid by the game site to play the game), and other problems.

M ISCELLANEOUS S ECURITY I SSUES Contests, skill games, and gambling games are potential targets of all of the security threats discussed elsewhere in this book. Players will cheat, hack, gold farm, abuse tournaments, grief, and subvert their identities. In other words, some players will do pretty much anything to win cash or prizes. There are several potential security issues that are worth discussing further. GAME SERVICE SCAMS Online casinos and skill game sites can be intentionally criminal enterprises. Because they accept player payments and are potentially rewarding players with cash or prizes, there are many ways to defraud customers. Unfortunately, reputation is not very effective as a mechanism for preventing fraud because it is so easy to launch a new site and so easy to market it. Lack of regulations and the ability to shop for favorable jurisdictions makes it easier to set up and profit from a scam. Game scams can be fairly subtle since players expect to lose a portion of the time that they play. A slight change in the payout odds at a casino can turn into a huge amount of profit. Having shills (players affiliated with the game site) periodically win or defeat players can sustain their trust in the game. One of the reasons that we created our SecurePlay anti-cheating software was to help players be able to independently check that games are fair18. Of course, the easiest scam is to simply refuse to pay out winnings.

Chapter 31 Dancing with Gambling

329

The growing popularity of online games has also brought out some pyramid schemes tied to games. No doubt other forms of fraud will emerge. POKER, CONTEST,

AND

SKILL GAME BOTS

Bots are a hard problem for game developers to stop. At the end of the day, it is impossible to tell the difference between a human player using a mouse and keyboard and an automated program driving a mouse and keyboard. Gold farmers use bots against MMOs and are successful because it is economically worthwhile. Any time there is money involved, there is real potential for someone to figure out how to automate game play undetectably. As these types of online services grow, it would not be surprising to find “poker farmers” and “skill game farmers” using automated tools to exploit these games. These automation tools don’t need to be perfect, only sufficiently good that they can reliably make money without being easily detected by the game sites. There are really only two solutions—you can build games that are not “bot-able” and design game play so that it has a substantial psychological element. This is what has kept pokerbots at bay, so far19. The other option is to combine online with face-to-face play. Face-to-face competition in a controlled environment will keep bots out by definition. Public humiliation for failing in front of a large audience may further deter otherwise anonymous botters. LIVE PLAY Video feeds of remote, live games have been part of the online gambling industry for a number of years. Some players believe that these systems are more secure. But it is well known that traditional, regulated casinos periodically have problems with cheaters and an ordinary player with a webcam is highly unlikely to be able to detect any suspicious activity. Wholesale fraud by game sites is also possible. After all, the same technology that allows the virtual “first down line” to appear on your television screen during a football game20 could be used to present whatever cards or dice values you would like to a player.

L EGAL C ONSIDERATIONS

with J. Price Even small changes or additions of new features to a game could unwittingly trigger a host of laws and regulations. With a single change, a game can go from not being regulated at all to being subject to the same laws and regulations as the largest

330

Protecting Games: A Security Handbook for Game Developers and Publishers

casinos in the nation or being outright illegal. To complicate matters, laws change and courts often interpret provisions differently depending upon the jurisdiction of the court and specific application of the law. As noted previously, there are three elements in games that make a game a gambling game: (1) consideration to play (often money); (2) an element of chance; and (3) a prize. There are limitations to this shorthand rule, however. This is an industry with a variety of interweaving laws and regulations. It is often difficult to make a clear, legal distinction between various types of games. Definitional issues arise, in large part, because the laws and regulations are often purposely vague (to encompass present, future, perhaps currently unknown issues), and vary widely from one jurisdiction to the next. Not knowing whether your game incorporates gambling is not a legal defense against charges of running an illegal casino or lottery. Just as with speed limits, law enforcement will not care whether you were aware of the law when a potential offense occurs. Of course, one way to decrease the number of legal issues you have to handle is to make an effort not to create problems and to avoid pitfalls. The easiest way to keep your game out of the gambling category is to simply remove one of the three elements—not just tweak an element so it is arguably not part of the game, but completely remove it. For example, a game without any type of prize is not gambling, anywhere, anytime. If you develop a game that includes elements of gambling, you must be aware of criminal and civil laws and regulations that exist at both the federal and state level. Worldwide, gambling is often slightly less regulated than in the US, where there are very specific laws and regulations. There are also a variety of federal and state laws and regulations that do not specifically relate to either gaming or gambling, but are highly relevant to game developers, such as laws regarding privacy, consumer protection, fraud, money laundering, online content, as well as other laws and regulations that might be triggered depending on the type of game, where it is offered, and where it is played. You also should consider that the federal (and state) government will not be shy when it comes to prosecuting something it considers a crime, even if it seems obvious to you that its reading of the law is incorrect. Whether they win or lose in a lawsuit against you, it will be a distraction and may set your business off course. It will also likely be a costly, time-consuming experience. All of these different parts operate in a legal machine that includes something referred to as “prosecutorial discretion.” Under U.S. law, government prosecuting attorneys have broad authority to choose whether or not to bring charges, and what charges to bring, in cases where the evidence would justify charges.

Chapter 31 Dancing with Gambling

331

“Prosecutorial discretion” is typically the answer to the question: “Well, if it’s illegal, why is so-and-so doing it?” The fact that someone else is “doing it” does not mean that “it” is legal, or a prosecutor is not interested in the conduct; it simply means the person has not been prosecuted for it—yet. FEDERAL LAWS

AND

REGULATIONS

The most important law used by federal prosecutors for gambling is the Interstate Wire Act of 1961, (often called the Wire Act)21. This law addresses those engaged in the business of gambling and transmitting information relating to gambling by a wire (or wireless) communication device. There are exceptions written into the law, and not all courts agree on its breadth. The U.S. Fifth Circuit Court of Appeals, for example, has ruled that the Wire Act applies only to sports betting and not other types of online gambling22. In contrast, the law has been interpreted by some, including the U.S. Department of Justice, to mean that all online gambling is illegal. Another important federal law, the Illegal Gambling Business Act of 1970, prohibits gambling businesses, in general23. This law is particularly interesting because it is one of a few that intersect with state law. For a game business to be illegal under this law, the federal government must first establish that it is a gambling operation in violation of state or local law. This federal law exempts Las Vegas casinos, for example, where gambling businesses are legal under state law. But most online games are not regionally offered or limited to one state. In fact, the very success of a game can be the result of revenues in jurisdictions you never considered. A successful game could also trigger this and similar laws if a state law is violated, even unwittingly. Caution is warranted, especially if your game is of the type that might be considered gambling in some jurisdictions, and a legal game in others. If a problem arises in one of the more conservative jurisdictions, you could have an additional problem under federal law. A federal prosecutor can literally “make a federal case out of it.” Another federal law, referred to as the Travel Act, also may cause issues for unsuspecting game operators, and is another example of how an isolated act can turn into a much larger issue. This law is aimed at prohibiting interstate travel or use of an interstate facility in aid of an unlawful business enterprise such as illegal gambling. Similar to the Illegal Gambling Business Act, the Travel Act first requires a violation of another law to trigger the federal law. If the game is defined as illegal gambling in a jurisdiction, or if there is some other legal issue, that initial violation—or attempt to violate the law—will lead to further issues if interstate facilities were used to further the unlawful activity.

332

Protecting Games: A Security Handbook for Game Developers and Publishers

Similarly, the subject matter of a game can cause problems. For example, the Professional and Amateur Sports Protection Act of 199224 makes it unlawful for any government (including states and tribes) to authorize legal wagers that are based on sporting events. Exceptions to this law exist for some states, such as Nevada, which has its own specific laws concerning sports wagering. STATE LAWS

AND

REGULATIONS

In addition to laws that “make a federal case out of it,” states can cause plenty of difficulties. Worse yet, any number of states can sue simultaneously, and force you to defend yourself in multiple jurisdictions at once. Every state has laws to distinguish between games and gambling, and otherwise address issues that arise with games and gambling. Each also has laws in place to protect its citizens in a variety of ways that do not directly relate to games, and may not have been drafted with games in mind, such as laws requiring appropriate disclosures, tax laws, data security statutes, and catch-all laws that are used to protect consumers in any number of circumstances. Although each state regulates games in some way, two states stand out— California and New York. Each has aggressive laws covering games and gambling. New York provides a good example of a state that bars gambling in its constitution25, and prosecutes cases vigorously. Under New York law26, “games of chance” are separately addressed, including a specific exception for bingo for senior citizens27. Similarly, California has laws regulating the difference between gambling and gaming28 and very aggressive consumer protection laws. When you consider a state’s tolerance for any type of game or related activity, it is instructive to look first at the state’s statutes and regulations, and then at the state’s court cases with a focus on: Jurisdiction (whether the state laws apply to a particular game and entity or person providing the game). The elements that distinguish gaming from gambling (reviewed previously) that are often interpreted differently by different states. Even if two states have similar laws, they might apply their laws differently. This happens because each state has a myriad of cases that have gone through the court system that interpret important elements of games in the context of varying facts. For example, at least one court in Washington state has found that consideration does not have to be defined as money. Consideration could be someone’s time and effort to obtain prize slips, even though the game pieces were available without

Chapter 31 Dancing with Gambling

333

purchase and therefore might be gambling in Washington29. In contrast, another court, in a different state (Michigan), found that any effort that is a mere inconvenience to the participant is insufficient to qualify as consideration and therefore the same type of game was not determined to be gambling30. To avoid any confusion about the legal status of different types of games, some states simply prohibit all pay-for-play skill games that include prizes. Other states use a sliding scale, with what is referred to as a “predominance test.” If the element of skill in a game predominates over chance then the game is permitted. For some games, such as chess, the distinction is clear; for other games, such as poker, the answer is more ambiguous because poker includes both chance and skill elements. Skill games are allowed in about 30 U.S. states if the games have a preponderance of skill; in 10 states a skill game is legal only if it is a pure skill game; and in the remaining 10–12 states, skill games are illegal. Unfortunately, there is no standard, simple process to determine which legislation or regulations are applicable to a given game within the US. You need to look carefully at court precedent and applicable laws and regulations.

R EFERENCES 1. American Gaming Association (2007), “Gaming Revenue: Current-Year Data,” http://www.americangaming.org/Industry/factsheets/statistics_detail.cfv?id=7 2. Direct Marketing Association (2008), “Sweepstakes Advertising: A Consumer’s Guide,” http://www.dmachoice.org/Sweepstakes/ 3. Wikipedia (2008), “SAFE Port Act,” http://en.wikipedia.org/wiki/SAFE_Port_Act 4. S. Davis (2008), “Notes on Skill Games and Contests from the Next Generation in Gambling Conference,” http://playnoevil.com/serendipity/index.php?/archives/2150-Notes-on-Skill-GamesContests-from-the-Next-Generation-in-Gambling-Conference.html 5. B. Hansen (2007), “Israel Bonds with US Over Online Betting Ban,” http://www.theregister.co.uk/2007/02/08/online_betting_israel/ 6. Wikipedia (2008), “Duplicate Bridge,” http://en.wikipedia.org/wiki/Duplicate_bridge 7. A. Reuters (2007), “FBI Probes Second Life Gambling,” http://secondlife.reuters.com/stories/2007/04/03/fbi-probes-second-life-gambling/ 8. Linden Lab (2007), “Advertising Policy Changes,” http://blog.secondlife.com/2007/04/05/advertising-policy-changes/ 9. Linden Lab (2007), “Wagering in Second Life: New Policy,” http://blog.secondlife.com/2007/07/25/wagering-in-second-life-new-policy/ 10. Jun S.H. (2006), “Virtual World or Virtual Vegas?,” http://gamestudy.org/eblog/2006/05/03 /virtual-world-or-virtual-vegas/http://gamestudy.org/eblog/2006/05/03/virtual-world-or-virtual-vegas/ 11. Virtual World News (2007), “UK Gambling Act: How to Protect Your Virtual World,” http://www.virtualworldsnews.com/2007/07/follow-up-on-uk.html

334

Protecting Games: A Security Handbook for Game Developers and Publishers

12. Cho J. (2006), “Jungle Law and Taxes Apply in ‘R2’,” http://search.hankooki.com/times/times_view.php?term=online+game++&path=hankooki3/times/lpage/ culture/200605/kt2006051418022511710.htm&media=kt 13. Bae J. (2008), “‘Habitual’ Online Item Buyers Face Sanctions,” http://www.koreatimes.co.kr/www/news/nation/2008/06/113_26515.html 14. BBC (2007), “Man Guilty in Poker Skills Case,” http://news.bbc.co.uk/1/hi/england/london/6267603.stm 15. Online Poker News (2007), “Danish Court Rules Poker Skill Game,” http://www.onlinepoker-news.com/20070723/danish_court_rules_poker_skill_hjb.aspx 16. FUN Technologies (2007), “WorldWinner and PlayFirst Team Up to Create Diner Dash Online Cash Competitions,” http://www.marketwire.com/press-release/Worldwinner-763678.html 17. P. Elliot (2008), “Kwari Shuts Down,” http://www.gamesindustry.biz/articles/kwari-shuts-down 18. IT GlobalSecure (2008), “SecurePlay,” http://www.secureplay.com/ 19. J. Woo (2008), “Poker Bots: The Future of Online Poker is Doomed!,” http://www.gambling911.com/poker/poker-bots-online-poker-doomed-081008.html 20. S. Brannan (2008), “How the First-Down Line Works,” http://entertainment.howstuffworks.com/first-down-line.htm 21. 18 U.S.C. § 1084 22. United States v. McDonough, 835 F.2d 1103, 1105 n. 7 (5th Cir. 1988) 23. 18 U.S.C. § 1955 24. 18 U.S.C. § 1955; Pub. L. No. 102-559, 106 Stat. 4227-4229 (1992) 25. New York Constitution, Article 1, Section 9 26. New York Penal Law, Article 140, 225.00 (“Gambling Offenses”) 27. New York Penal Law, Section 213-23 “License Required; Exemption for Senior Citizen Games” 28. Gambling Control Act, California Code, Chapter 5, sections 19800–19958 29. Washington v. Safeway Stores, Inc., 450 P.2d 949 (Wash. 1969) 30. ACF Wrigley Stores, Inc. v. Olsen, 102 N.W.2d 545 (Mich. 1960)

32

Denial of Service, Disasters, Reliability, Availability, and Architecture

ou’ve got to keep things running. If there is no game service, there is no game to play, no players, no money coming in, nothing to pirate, no one to cheat, and no gold to farm. If one looks at IT protection purely from a budgetary and business impact perspective, this chapter should have been first. I’ve had close encounters with two IT disasters and one near-miss during my career (so far).

Y

W HAT C AN G O W RONG , W ILL G O W RONG First, an “operational” service was “back-hoed” when my employer had a cable cut that took down a critical secure mail server. The email service was actually a prototype, but it was being used by senior executives across the federal government, so no matter what our contract said formally, we were operational. We had purchased our data lines from two separate telecommunications companies and so we thought we were safe against single points of failure. We were wrong; the connections were redundant, not independent. The two telecommunications carriers had both purchased space on a single physical cable on one segment of their connection to our site. Second, we had a contract to operate the main Internet access point for a large government department. Our building’s roof was being repaired and we had a rain storm. This would have only been a minor problem, except there was a huge amount of rain and the massive roof was flat with a single six-inch hole in the center, down which the water spun through like a whirlpool. I have never been in a building before where it was raining inside. Of course this hole was right on top of our equipment room. Water streamed down over numerous, brand new, high-end servers and networking equipment (the folks in the network operations center didn’t see, hear, or notice a thing).

335

336

Protecting Games: A Security Handbook for Game Developers and Publishers

Finally, in another rain-soaked incident some number of years ago, the alreadysaturated District of Columbia had four inches of rain in 45 minutes and the water rapidly backed up through a large portion of the city (and totally drained away 30 minutes later). Some areas of the city were six to eight feet deep in water. Our office was lucky. There is nothing like walking through six inches of water to go turn off the main power and hoping that nothing really bad is going to happen. Nothing did, or else I wouldn’t be writing this, and we lost surprisingly little IT equipment. All sorts of things can go wrong. Whatever you plan for, something else will come along that you haven’t considered. Nature will try to get you, your service providers will try to get you, your customers will try to get you, and hackers and other intentional trouble makers will try to get you. Planning for natural and manmade disasters is totally thankless before it occurs because of the “unnecessary” cost. But, it is totally necessary (whether a disaster occurs or not), even if you don’t cover every contingency. There are books on contingency planning, but a lot of the needed planning is very procedural and specific to your business. However, it is increasingly easy for online services to scale rapidly and, at the same time, reduce their vulnerability to failures. Virtualization technologies like Xen1 and VMware2 and cloud computing as well as the commoditization of data center services are good for business as well as good for security. Designing your system architecture to be deployed rapidly on leased servers or virtual services, such as Amazon’s EC23, saves money, improves scalability, and ensures availability. (As a side note, the continuing rapid evolution of server technology makes leasing hardware compelling for most applications as well as a great way to control cash flow. This is a huge change in basic IT thinking from just a few years ago.)

D ENIAL

OF

S ERVICE

Denial of service attacks can be done just “because” or with serious intent: In 2004, hackers threatened online bookmakers with a denial of service (DoS) attack during the Grand National horse race and the Super Bowl (American) football events. These blackmail attempts, assumed to be from Eastern European criminal groups, targeted the huge portion of annual sports wagers that are placed for these competitions4. Gambling sites are not the only target of denial of service attacks. In 2005, Square Enix’s Final Fantasy XI MMO was also the victim of a distributed denial of service attack5. Although some folks in the game industry may have been pleased, most of Korea’s major RMT sites suffered simultaneous denial of service attacks in early October 2007. The sites took themselves offline for several days to tighten up their security6.

Chapter 32 Denial of Service, Disasters, Reliability, Availability, and Architecture

337

It is possible to attempt to blackmail an MMO with a DoS attack, but as the services do have outages periodically, it is not clear if this would be as financially serious as it is for a sports wagering site. Any site that needs to be operational to earn revenue is a potential target—any business from ad-driven sites to online casinos. However, it is much more effective to target sites that have traffic that is highly concentrated at specific times, because the attack does not have to be sustained nearly as long to have serious impact on the victim. Sites that support rich, user-created content can be targeted by in-game denial of service attacks. Linden Lab’s Second Life has suffered a number of such attacks over the years7. However, user-created content could be used to cause denial of service and other attacks on client computers, not just at the central service, which could be potentially more damaging to the company (and its relationship with its customers). There are four types of denial of service attacks: Hardware—Attacks that result in changes to the target servers’ or associated network devices’ firmware so that they no longer operate. Network—Attacks that overwhelm the network connection to the victim’s site so that legitimate data can no longer reach the target system. Platform—Attacks that target the standard operating system and shared applications, such as the network stack, on the victim system’s computers. Application—Attacks that target the victim system’s specific application. There are an increasing number of strategies that are available to help fight denial of service attacks. Some of the simplest strategies are architecture changes. By hosting an online service at one or more major data centers, it is much more difficult for hackers to simply overwhelm the bandwidth of the site or servers. If the target system is located at a small data center, the company should work with its upstream network providers to ensure that traffic rate filtering is done to ensure that the data that comes over a smaller connection has been purged of standard DoS attack traffic (unusual concentrations of traffic from sites is often an indicator that the computer is a “zombie” and member of a botnet used to attack networks and distribute spam). It is unfortunate that there is no accountability today for ISPs to guarantee that the data they provide or pass through to their clients is clean. (Hackers will also modify the source address of data from compromised computers to hide the source of an attack. Although this is hard to detect by the victim computer, it is easy for the host ISP to detect: Any data generated from a client computer should have an ISP issued or authorized IP address.)

338

Protecting Games: A Security Handbook for Game Developers and Publishers

Defeating hardware and platform attacks is usually the responsibility of the equipment provider. Basically, the providers need to deliver systems that only allow authorized updates to the firmware to be installed and these updates can be installed only by authorized individuals. Firewalls, intrusion protection systems, and other security hardware and software tools can be used to attempt to keep denial of service attacks at bay. These products are designed to protect “generic” online services. Online games can also take advantage of their custom communications protocols to improve their security. First, because most online game services include general website and other nongame related applications, these sets of servers and services should be separated from game servers or shards (groups of game servers that work together). This will allow commercial security tools to work more effectively and have to process less data. Using a content-distribution system or web-caching service like Akamai can also reduce the risk of DoS attacks on websites. Because online game services often process very large amounts of network traffic, typical denial of service security solutions can be quite expensive (the cost for these solutions is mainly driven by the need to process volumes of network packets in real time). However, most game services have very structured network data and this can be used to their advantage. Game services can use proxy servers to ensure that only data that is formatted in the structure required by the game’s protocols gets passed on to internal servers for further processing. Because these proxies only have one purpose—to parse game messages—they can be simple, fast, and replicated easily. They may even translate a public game message format into an internal format to support logging and other security functions. Commercial “deep packet filtering” solutions can implement similar features to a game protocol proxy, but they are burdened with their need to handle a wide range of protocols. Another advantage of a good proxy server system is that it can help prevent buffer-overflow and other malformed data attacks such as that suffered by World of Warcraft in August of 20078. A simple extension to a game protocol proxy is support for a “white-list” authorization service. Because virtually all games establish a session using some sort of login service, the same login service can create a registry of IP addresses and random authentication token pairs that it provides to both the client and the game’s proxy servers: // client creates a secure session with license or login server ClientAuthorizationMessage = (SecureSessionID,AuthorizationToken); // message sent to client ClientRegistrationMessage = (IPAddress,SecureSessionID, AuthorizationToken); // message sent to the game proxies to add to their white lists

Chapter 32 Denial of Service, Disasters, Reliability, Availability, and Architecture

339

When a proxy server receives a message from an alleged client, it can rapidly validate the IP address with SecureSessionID and AuthorizationToken to determine whether it should even begin to parse the remainder of the message. This can be used to speed the rejection of data from botnets or other malicious users. A complete white-list proxy service will include the ability for the login service to de-register a session and IP address. The proxy service should also be able to do this itself if it suspects that a game client or game session has been compromised (even core game servers should be able to “black-list” a game client based on anomalous data or activities).

S CALABILITY

AND

A VAILABILITY

It is always surprising how routinely online games underestimate traffic at start up. The term “overwhelmed servers” is a routine part of the first hours, days, or weeks of far too many game services. There are ways to plan for huge surges or spikes in systems and bandwidth, but none of them is free and they take some serious effort and planning. The game industry isn’t the only one that faces this challenge: Sporting events such as the Olympics can create huge, short-term demands for hardware and bandwidth. Large traffic spikes can also be addressed through the game’s core architecture. EVE Online’s architecture allows multiple solar systems to be housed on a single server so that sparsely populated systems can share resources9. Although game servers may be costly to bring online, it is easier to support surges of license registrations for new games. License registration does not require massive amounts of data to be sent or complicated server support like an MMO. I am not privy to inside data on these cases, but I suspect many games use the same system architecture for license registration as they do for regular online game play: direct socket connections to the license servers, and so on. This is really not necessary. Game registration systems could easily use a standard HTTP POST code with a polite retry system to help handle new game traffic spikes. As a default, the server would respond with the registration key for the application, but it could also send a cached “wait 60 seconds” message to spread out requests. There are many tools to support scaling up websites, ranging from application acceleration tools to virtual servers (which provide the ability to add new servers on the fly) and cloud services (pure “cloud” applications that are not tied to individual hardware platforms), as mentioned previously. Of course, the actual license processing would be carried out on a backend database and application server behind a web server in a typical threetier architecture allowing both front end and backend servers to be added easily.

340

Protecting Games: A Security Handbook for Game Developers and Publishers

Another option for handling high-volume license registrations is to take advantage of email. After all, if a player is online, she almost certainly has an email account. The game could build a structured registration message for the game server that a player could easily paste into an email, and then cut and paste the response to the message when it is received from the game site. Just like web servers, standard email systems are built to scale well; there is no need for game developers to create new solutions when off-the-shelf answers are available.

S AMPLE G AME O PERATIONS A RCHITECTURE Any online game service is going to have a number of fairly standard major systems: The Game(s)—The actual game servers, their supporting proxy servers, databases, and other application servers. The Website—The basic website and community services. The website may also include the front-end support for ecommerce and payments. Game Operations Center—The server, network, and application management functions for the game service. The administration of the website may be included within the operations center or handled separately. Corporate IT—The back office where the game company staff do their work. Conceptually and practically, it is important to separate the day-to-day work of the staff from the actual operations of the game service. There may also be a separate duplicate or small version of the game service itself for testing and back-up purposes. Content Delivery—Many games use a mix of internal and outsourced contentdelivery systems to deliver game software and updates to players. Figure 32.1 shows one such sample game operations architecture. There are several components of an online game service that are particularly important from a security perspective: User Financial Database and Payment Processing Services—Controlling access to any resource that can be monetized is critical. The most valuable target in a game service is any database that contains user credit card or other financial information. These financial and payment systems should be physically separated, if at all possible, and their electronic interfaces closely controlled. If a game has valuable virtual assets, especially with a potential for gold farming, the database that contains those assets should be handled with a level of care similar to that used for a financial system. In addition, financial and payment systems should be carefully controlled and all actions logged.

Chapter 32 Denial of Service, Disasters, Reliability, Availability, and Architecture

341

FIGURE 32.1 Sample game operations architecture

User Account System—Any information about players should be carefully protected. Even though the US does not have strong privacy laws, other countries do and protections like the previously discussed California Data Disclosure law can make any error costly (see Chapter 29). If these systems do not need to be easily available in real time online, restrict access to them as much as possible. If there is data that does not need to be retained or collected, don’t collect it. Data that doesn’t exist can’t be compromised. Logging Systems—Although not shown in Figure 32.1, it is critically important to make logging and analysis systems for all part of the online game service as independent, thorough, and reliable as possible. There is no accountability without history. Logging is not sufficient; it is crucial to build tools to facilitate the analysis of all logs as well as include alerts, metrics, and statistical information for critical logged events. Player Systems—It is actually possible to use the player’s systems as part of the overall reliability, availability, and security of the overall game service. Although player computers may be in “untrusted” and “untrustworthy” hands, they are also very independent of the core game servers. Traditional IT infrastructure and management systems are not often considered part of a game service. However, it is important to think of the whole company as an integrated system—including external entities and interfaces like payment

342

Protecting Games: A Security Handbook for Game Developers and Publishers

processors and outsourced services. All of these components must work together to provide a reliable service. Unplanned interactions between these components can be the source of problems: In late 2007, CCP Games took EVE Online offline due to a suspected security breach10. There was some discussion that the attack originated via a key-logger on a regular office IT computer that had been hacked. True or not, understanding the actual interaction between system components and the activities of individual employees, partners, and players is critical for security success.

D ISASTERS

AND

D ISASTER R ECOVERY

There are many, many circumstances that can knock a system offline. Fires, rain, floods, earthquakes, hardware failures, power outages, vendor problems… the list goes on and on. As I noted at the beginning of this chapter, it is impossible to plan for everything. In December of 2006, Valve Software’s Steam online service was knocked offline by a major storm in the Pacific Northwest11. Sony Online Entertainment, having experienced a number of wildfires in San Diego, was able to keep the game running during a major fire in October 2007, but with minimal technical and customer support12. Perhaps the easiest way to avoid catastrophic failures is to build a truly distributed system. Multiple sites with independent service providers can handle disasters more easily simply because all of the locations in a well-designed distributed system are unlikely to be vulnerable to a single disaster. Because of their experience with hurricanes, many organizations with headquarters in the Southeastern part of the US have moved aggressively to be able to deal with a disaster that can knock out a large region13. More modest failures can still cause serious problems. Outages at individual servers or databases can lose valuable data. A Singapore MapleStory server failed and lost hours of play for several thousand players14. Many games include a substantial game client. This system could conceivably be used as part of a backup and recovery strategy by storing critical game data on player computers. Note that it is not necessary to store a specific player’s data on her own computer and the data obviously needs to be stored in a manner that the player cannot modify (or even read) the encrypted, signed player data.

C ONTINGENCY P LANNING Online games are first and foremost services: Their value and revenue comes from being available to customers. Outages can lead to customer dissatisfaction and abandonment. Design choices can make a game more or less vulnerable to disasters

Chapter 32 Denial of Service, Disasters, Reliability, Availability, and Architecture

343

and substantially affect the cost of ensuring service availability. Often online services will provide “free” time to compensate for outages to protect their relationship with their customers. This “free” time is far from free for the game provider. Employee salaries were still paid while the service was down and other expenses were incurred. The “free” time itself costs additional potential revenue. This is not to say that companies should not offer customers compensation, but avoiding the need to incur such expenses should be part of the game service’s business plan. Planning for contingencies must not be a paper exercise. It should not result in PowerPoint presentations and unread binders sitting on shelves. Actively working to avoid costly outages is usually a better business strategy than just recovering from failures when they occur.

R EFERENCES 1. Xen (2008), “Xen,” http://www.xen.org/ 2. VMware (2008),”VMware,” http://www.vmware.com/ 3. Amazon (2008), “Amazon Elastic Compute Cloud (Amazon EC2),” http://aws.amazon.com/ec2/ 4. Evening Times (2004), “Blackmail Threat to Net Bookies,” http://playnoevil.com/serendipity/index.php?/archives/7-Blackmailers-Threaten-Denial-of-ServiceAttack-Against-Net-Bookmakers-February-2004.html (article no longer available from the Evening Times) 5. W. Knight (2005), “Attack on Game Raises Prospect of Online Extortion,” http://www.newscientist.com/article.ns?id=dn7293 6. Chosun Ilbo (2007), “Hackers Threaten Cyber Money Sites,” http://english.chosun.com/w21data/html/news/200710/200710100013.html 7. T. Walsh (2006), “Rogue Lily Disrupts ‘Second Life’ Service,” http://www.secretlair.com/index.php?/clickableculture/entry/rogue_lily_disrupts_second_life_service/ 8. A. Modine (2007), “World of Warcraft Exploit PKs Servers,” http://www.theregister.co.uk/2007/08/27/wow_exploit_crashes_servers/ 9. B. Drain (2008), “EVE Evolved: EVE Online’s Server Model,” http://www.massively.com/2008/09/28/eve-evolved-eve-onlines-server-model/ 10. N. Breckon (2007), “EVE Online Database Security Breach Leads to Downtime of Game, Website,” http://www.shacknews.com/onearticle.x/49539 11. McWhertor (2006), “God Hates Steam, Too,” http://kotaku.com/gaming/god/god-hates-steam-too-222329.php 12. Sony (2007), “SOE Support Services Suspended During Emergency,” http://forums.station.sony.com/vg/posts/list.m?topic_id=21161 13. FDIC (2008), “Lessons Learned from Hurricane Katrina: Preparing Your Institution for a Catastrophic Event,” http://www.fdic.gov/regulations/resources/lessons/index.html 14. A. Siew (2007), “Server Glitch Loses Gamers Points, Virtual Cash,” http://www.sgforums.com/forums/1720/topics/294434

33

Scams and Law Enforcement

“You can’t cheat an honest man; never give a sucker an even break, or smarten up a chump.” —W.C. Fields1 veryone is looking for an edge, some sort of advantage to get ahead of everyone else. One of the things that breeds cynicism in security professionals is the constant reminders of how reliably corruptible virtually everybody is. Another group of avid students of human frailty are con artists.

E

In general, there are two types of scams that target online games. The most common scams offer players an advantage in a game: some sort of cheat or aid that makes the game easier for them than it is for everyone else. Sometimes the scammers offer a cheat tool that works but also has some “extra features,” such as a keylogger or some malicious software. Other cheat-aid scams are more brazen. They offer a fake cheat; something that the scammers can show on YouTube or offer for sale (or even for free) on a website. The second type of scam is pretty new for online games. It is a Ponzi scheme or pyramid scam that uses a game as the “front business” to conceal the fraud. In some sense, this is flattering to the game industry: Games are widely seen as a “hot new business” and con artists are using them to pull in unsuspecting individuals looking to cash in on the industry’s popularity. Games and other online services are facing a range of criminal activities, including scams and fraud. It is important to understand how your game company should work with law enforcement. Game companies may seek out the help of law enforcement for recourse after a crime, but game companies can also be contacted by law enforcement to support an existing criminal investigation. Companies need to be cautious because sometimes law enforcement officials make inappropriate requests that may put a business in legal jeopardy as well as endangering the company itself.

344

Chapter 33 Scams and Law Enforcement

S CAMS

IN

345

G AMES

The competition between players that underlies most games makes finding “suckers” for scams pretty easy. The same passion about a game that leads some people to play 20 hours or more per week also brings out some people’s desperate need to get ahead. The scammers are there to fulfill that need to win at any cost. Sometimes, the tools are pretty innocuous. In 2006, a crooked inside developer turned a legitimate poker tool that tracked the “rake” (the commission on each hand) collected by online poker sites into a piece of malware that also installed four tools that collected username and password information from the poker players and sent it over the Internet to the criminals2. In 2008, a company released a tool for EVE Online that was supposed to automatically queue up skills for players so that they would not have to log in at odd hours, which also happened to include a Trojan program that stole passwords3. What is interesting about both of these tools is that the game developers themselves could easily have provided these features in the basic game application: It would be a simple courtesy for a poker site to provide tracking information about its own fees. In fact, the reason players want tools like this is that they suspect that the game site is cheating them on the rake. For EVE Online, there is no real reason that the game itself should not allow players to queue up skills to be trained. (EVE Online is unique in the MMO genre in that players earn skills based on elapsed, calendar time, not based on game play activities.) Today, players have to be online to change from one skill to another—an inconvenience that doesn’t help game play and that opened the door for this malicious tool. Many games ban most or all third-party tools, but in some sense this is futile. Because players control their own computers, they will always find a way to run independent tools (see the discussion of bots in Chapter 15). As noted in the earlier discussion, it probably makes more sense to design the game so that such tools are either unnecessary or can be used legally. If there are tools, it would be better for the game and for players if they could buy the tools from the game company who can certify their features, not to mention capture some revenue by running a tool store. Fake hacks are particularly troubling for games. Scammers who create fake hacks don’t need to create a real hack or tool for a game; they offer a way to get more of whatever the game values (additional money, experience, items, and so on) by providing some instructions that include giving the scammers the player’s username and password (and sometimes even credit card). Someone, scammer or not, it doesn’t matter, submitted an alleged “hack” against Sulake’s Habbo Hotel virtual world to my blog4. The hack demonstrated in a YouTube video how to give a player tons of furniture and items. Actually, the

346

Protecting Games: A Security Handbook for Game Developers and Publishers

hacker used a memory editor to add items to the inventory in the player’s game client application. This worked because the art assets for all of the items are included in the game client on the player’s computer. Virtually all online games work in a similar manner and are vulnerable to the same “attack.” To most players, the attack looks valid since it is using the actual game client and art assets. However, these changes are purely local to the player’s PC and do not actually alter the information in the game’s database. The videos have since been removed, apparently at the request of the game’s publisher. YouTube poses a particular risk for game companies. Whenever a game company contacts me to consult on a game, the first place I look for attacks is on YouTube. Often, I find some pretty entertaining exploits. However, there are fake hacks mixed in with the real ones. The key clue to identifying the fake hacks is the request to go visit the scammer’s website and enter your username and password, install some software, or buy a tool. Game companies need to constantly keep up with these videos and contact YouTube to take them down. Third-party sites can also house scams. These sites are run by fans, and occasionally scammers, for games. In general, third-party sites are great for a game. Player-run forums, blogs, social networks, and other communities are evidence of a game’s popularity and are mostly beneficial. However, the low level of technical skill of many of these fan sites makes them good places to launch an attack against a game—either direct malicious code attacks or as a means to advertise “fake hacks” and other malicious tools. Both of the malicious tools mentioned previously were downloadable through otherwise legitimate game community sites or found on YouTube. Simply setting up a fraudulent fan or community site for a game is not usually sufficient to cause real problems for the game company. Game community sites take a lot of effort and are really a labor of love by the players who create them. IGE, known for its involvement in the gold-farming and gold-selling businesses for World of Warcraft, notoriously bought two very popular WOW community sites: Allakhazam5 and WowHead.com6. Gold frauders and power-leveling firms (see Chapter 22) can take their business a step further by using their interactions with game players to scam them as well. The players who use gold farming and powerleveling services have little recourse, as they are already cheating at the game. Game companies can do little to directly protect themselves from scammers who use third-party sites to target their games. Even though the game company and game are blameless, these scams can be costly from a customer service perspective when players complain about looted accounts, viruses, and other security problems.

Chapter 33 Scams and Law Enforcement

347

One tactic that may make life difficult for scammers is to sponsor “official affiliate” community sites that have access to game art assets, animations, and affiliate revenues in return for following a code of conduct. The sites could perhaps even allow the game company to scan the fan site for malicious code and downloads. Another tactic that was mentioned previously is the notion of bundling a good security tool suite with the game client.

G AME S CAMS There are two main categories of game scams: (1) scam business models that target affiliates and partners and (2) crooked game operations. Game business models that are scams are a relatively new problem and I have yet to see a case go to trial, although I have seen several suspicious games. The closest example was an FTC move to shut down the online music service BurnLounge7. Most of the scam business models are variations on pyramid schemes or Ponzi schemes. These business models basically “rob Peter to pay Paul.” Later entrants’ fees fund the earlier participants, who are continually encouraged to recruit others. The typical clue that a game business model is not legitimate is that it has a very complicated payment structure8. However, it could be quite interesting to see a game company legitimately use a multi-level marketing business model; even affiliate revenue-sharing services are not supported all that widely in the game industry. If used more widely, affiliates, channels, and MLM programs could deter game scams by giving fan sites a legitimate revenue stream to reward their efforts. Crooked game operations have mainly been a problem for online gambling, although the problem could also affect skill games, online lotteries, bingo, and contests with an entrance fee. These crooked games either rig the game so that no legitimate player wins or they simply refuse to pay out and take the players’ money and disappear. One of the consequences of attempts at prohibiting online gambling is that even game companies that desire legitimacy have been unable to be licensed in major jurisdictions. (This may be changing in many countries in Europe as of 2008.) Lacking strong government licensing regimes, industry groups will need to self-regulate and self-certify. Skill games could be a prime target for scams, as there is a general weakness and lack of uniformity of regulation for the industry (this is also true for other “not gambling, but games for money” businesses).

348

Protecting Games: A Security Handbook for Game Developers and Publishers

L AW E NFORCEMENT

with J. Price Game companies may need to contact law enforcement to handle a security breach or in case of fraud; or they may be contacted by law enforcement in support of an investigation. The topics of how to collect, retain, and preserve data that may be needed for evidence are far beyond the scope of this book, but an online service’s leadership, IT staff, engineering team, and legal counsel should consider these issues carefully throughout their design and development process. Most operators of online games and other online services will eventually receive a request from law enforcement asking for information about an end user. When a state or federal law enforcement officer presents a subpoena, court order, or some other “authorization,” the game operator should not panic. These are typically routine events, and should be processed professionally and efficiently. First, have a plan in advance. Designate someone in the company to receive and interact with law enforcement. When the request comes in, be sure it is immediately forwarded to the designated person. That person must decide whether the request is valid and is what it purports to be or escalate matters further to management or legal counsel. Ideally, legal counsel can assist to make the determination whether the request is valid and provide guidelines that game company staff can use for most situations. After the game company has seen a number of requests, counsel should only be necessary for the “odd-looking” ones because company personnel will develop a feel for what are legitimate and illegitimate requests. It is important to note that if the request is obviously illegitimate, the company may be held liable for turning over the requested information. Generally speaking, however, there is immunity for a good faith reliance on law enforcement. But the immunity does not extend to all situations, and caution is warranted as seen by the recent lawsuits against U.S. telecommunications firms for their involvement in the government’s “warrantless wiretapping” program9. The designated person may delegate tasks where appropriate. However, law enforcement might require tight secrecy in some instances, which will limit who in the company can know about or assist with supporting the activity. If there is any doubt about who can know about the request, ask the law enforcement agent. In most instances the request will include explicit instruction and leave little confusion, but do not hesitate to clarify any concerns with the agent. After accepting the request and establishing that it is valid, the person designated to assist law enforcement should consult the relevant staff to determine whether the information being requested (1) is available and (2) can be provided to

Chapter 33 Scams and Law Enforcement

349

law enforcement within the period of time allotted in the request. If the request is legitimate and the information is available, you should fulfill law enforcement’s expectation. If the request appears legitimate and the information is available, but the company simply cannot meet the deadline, the company has recourse to protect itself. You may consider making the law enforcement agent who served the request aware of any difficulties that you have, as the agents are in a position to alter the request and avoid a confrontation in court. Courts can receive challenges to law enforcement requests and alter the request to make it more manageable or provide other relief. It is important to ask the law enforcement agent about reimbursement procedures for their agency. You may be able to have costs you incur when responding to a law enforcement request reimbursed. The federal government and most states permit a responding person or entity to be reimbursed for their time and associated expenses such as overnight mailings. The reimbursement might not cover all costs, but it can help, especially if you receive numerous requests. Another good practice is to keep the law enforcement request and any related material in a safe, secure location (unless law enforcement forbids the record retention for security reasons). Keep these records after you have complied with the request. If any issue arises later, you will be able to refer back to the records.

F ACILITIES R EQUIREMENTS : P OTENTIAL U NEXPECTED L AWS

AND

R EGULATIONS

with J. Price Game services are not just providing games. They provide a range of network and communications services that may impose requirements to support law enforcement. Depending upon the game’s infrastructure, game designers may need to comply with various laws. For example, if a game operator provides voice service, it may have legal and regulatory obligations under the Federal Communications Commission’s (FCC) Communications Act. But its obligations will depend upon how the service is provided and whether a different service provider is responsible for legal and regulatory compliance. If the operator provides its own network facilities or provides broadband Internet access, the Communications Assistance for Law Enforcement Act (CALEA) should be reviewed. CALEA requires that the operator include specific security features within the network. It also requires the service provider to file “System Security and Integrity Plans” with the FCC and adhere to those plans within the company.

350

Protecting Games: A Security Handbook for Game Developers and Publishers

A number of other regulations might also apply, including taxes and tariffs and “Universal Service” obligations, just to name a few. It is recommended that you take a careful look at the legal obligations that might come with any expansion of services, or before you implement a unique business strategy that may impose regulatory requirements. Also, be very aware of the obligations that come along with services being provided by third parties. A contract with another company can leave you with unexpected legal obligations. You might assume that the third-party service provider is responsible for compliance with the assorted regulatory obligations that are associated with the service and, therefore, you do not have related legal exposure. Most service providers, however, go to great lengths to avoid regulatory obligations, and the details of the service agreement contract might shift the burden to you. You do not have to accept the “standard” contract that another party offers. Negotiate. One place in the contract to study carefully is the “indemnification” section, which explains how and when you must protect someone other than yourself. Some third-party contractors try to avoid any responsibility and, when an issue arises, leave the obligation to you. It is usually reasonable to indemnify against issues you may cause the service provider, but they should stand by their product and handle expected as well as unexpected issues and expenses related to providing the service. Also, as always, be careful who is responsible for costs and taxes related to the service. Be sure these terms are defined broadly and do not come back to haunt you.

R EFERENCES 1. W.C. Fields (1939), “You Can’t Cheat an Honest Man,” http://www.imdb.com/title/tt0032152/quotes 2. F-Secure (2006), “How’s Your Poker Face?,” http://www.f-secure.com/weblog/archives/archive-052006.html#00000878 3. J. Egan (2008), “EVE Online Trojan Warning,” http://www.massively.com/2008/09/27/eve-online-trojan-warning/ 4. S. Davis (2007), “Demonstrating Real Game Hacks vs. Fake Game Hacks: Fake Cheats Attack Sulake’s Habbo Hotel,” http://playnoevil.com/serendipity/index.php?/archives/1243-Demonstrating-Real-GameHacks-vs.-Fake-Game-Hacks-Fake-Cheats-Attack-Sulakes-Habbo-Hotel.html 5. L. Smith (2006), “Gold Farmers Buy Allakhazam,” http://www.1up.com/do/newsStory?cId=3150282 6. Emma_UK (2007), “WOW Fansite Sells for Reported $1 Million,” http://www.gamespot.com/news/show_blog_entry.php?topic_id=25727087 7. G. Gross (2007), “FTC Asks Court to Shut Down Digital Music ‘Scheme’,” http://www.pcworld.com/article/132857/ftc_asks_court_to_shut_down_digital_music_scheme.html 8. S. Davis (2007), “Multilevel Marketing for Games? And a Bit of Info on Pyramid Schemes,” http://playnoevil.com/serendipity/index.php?/archives/1310-Multilevel-Marketing-for-Games-And-aBit-of-Info-on-Pyramid-Schemes.html 9. J. Leydon (2007), “AT&T Sued Over NSA Warrantless Wiretapping,” http://www.theregister.co.uk/2006/02/01/atandt_wiretap_assistance_suit/

34

Operations, Incidents, and Incident Response

perations is where “the rubber hits the road.” It is also where security pays off or fails. Security becomes real when technology is combined with business operations to actually do something. If users and operators circumvent security because it is too complicated or too expensive or too time consuming, it is a failure of the security team, not the users. It is appalling to read professionals in the security industry talking about PEBKAC— the problem exists between keyboard and chair—the user, in other words1. Security is, at its core, as much about human behavior as it is about technology.

O

There are some in the security industry who’ve taken the adage “the best defense is a good offense” to heart. Instead of being content with protecting their games or other online services from the “bad guys,” they’ve decided to turn around and wage war on their foes. Some of these techniques are very self-contained, but others are more aggressive and expose their users to legal and business risks. It is almost inevitable that security systems will fail. Good security systems are designed to fail gracefully and recover quickly. Unfortunately, many developers neglect to plan for failure. Some of the worst security incidents are the result of failure to consider the possibility of the system’s failure. Such systems tend to collapse catastrophically and sometimes can never recover. One of the worst characteristics of many public key cryptography systems is that their compromise recovery systems (compromised key lists and certificate revocation lists) are terribly awkward and inefficient. Games are a particularly public business. When things go wrong, they are highly visible and widely commented on. Part of protecting the integrity of the game and game company is planning for public relations problems, especially when responding to security incidents. Although almost everyone would prefer that security incidents don’t happen, effective preparation and a well-handled response can sometimes turn a security incident into a marketing and branding benefit.

351

352

Protecting Games: A Security Handbook for Game Developers and Publishers

S ECURE O PERATIONS There is a lot more to security than just good technology. One common delusion is that security systems need to be invisible to users. In fact, the most familiar security system of all, standard keys for cars and homes, are highly visible and somewhat inconvenient. From an operational perspective, they work pretty well. People lock doors (most of the time) and crooks need to find another way in. It is also fairly obvious that people don’t lose keys too often, but they can “recover” from the loss or compromise of a door or car key pretty quickly. Games and other online services are defined by their interfaces and procedures. It is unfortunate, but good human-machine interface (HMI) design does not seem to be part of the security discipline. This is regrettable, as psychology and ergonomics probably have a huge impact on the actual secure operation of systems. There are two equally important interfaces that need to be considered to operate a game securely: that of the game company’s operational staff (live team, system administrators, customer support staff, security staff, and so on) and, of course, the players. One of the benefits of using a physical security token is that people are used to protecting hardware keys. Blizzard’s authentication token will provide most of its security benefits just because it is a physical key—the details of its cryptography and any anti-tamper or other design features probably hardly matter. Similarly, because people protect their cell phones as valued items, the Asian games that use a cell phone challenge-response system are likely to be quite effective and secure (see Chapter 29). Successful, secure operations are usually invisible. Often, so are unsuccessful ones. One of the rare instances of a game having problems with its internal security operations has been a series of account thefts at Xbox Live. Hackers have been able to use “social engineering” to access other player accounts. First, there is a basic weakness in the Xbox Live system—player’s publicly known Gamertags are also their account names. This aids attacks by making it easier to hack accounts directly (by guessing passwords and so on) and makes it much easier to convince customer support to disclose or reset a player’s password. …(W)hen I first heard about the “Xbox Live network hacked” story, I checked with the people on our end, and then posted about it. As originally posted, Xbox Live has not been hacked. That is still true. A security researcher, Kevin Finisterre, discovered not a hack, but the fact that some accounts may have been compromised as a result of “social engineering,” also known as pre-texting, through our support center. Kevin gave me a call directly and once I realized what he was talking about (he sent me some painful-to-listen-to audio files), I confirmed that the team is fully aware of this issue. They are examining the

Chapter 34 Operations, Incidents, and Incident Response

353

policies, and have already begun re-training the support staff and partners to help make sure we reduce this type of social engineering attack. —Major Nelson (Larry Hryb, Xbox Live Director of Programming)2 From an operational security perspective, the statement “Xbox Live has not been hacked. That is still true.” may be true, but it is also is fairly meaningless. It is clear that the security of the system was compromised whether through technical measures or procedural gaffes. Even worse, it appears that the problem was not resolved. Although the first incident was made public in March 2007, in September 2008 these incidents seem to be continuing—in the latest case, a senior employee of Bungie from the Halo 3 team’s Xbox Live account was among those compromised3. What is frustrating is that the system’s security could probably be improved fairly easily (although there certainly may be internal constraints on the system that I am unaware of): Xbox Live accounts are, at least partially, tied to a specific console. Microsoft could use that console’s ID number to authenticate the user by having the user tell the customer service rep the number. Microsoft could also use any credit card information associated with the account owner to authenticate users. This could be done through the console so that the customer service rep is not told the card number. Depending on the account details, authenticating another credit card to confirm the player’s address could work as well. Microsoft could send an email to another email account owned by the user that had been established previously as the “emergency notification account” (or a phone number or an SMS message or even regular mail). Microsoft could use the official Xbox console to send a challenge message to a user (similar to the phone systems used by Korean game companies discussed previously). Of course, the best solution would be to break the link between the Gamertag and the user ID. The fact that everyone knows your user ID on Xbox Live makes the attack much easier. As to the customer service system, it really shouldn’t “unlock” the account, even for the customer service rep, until the user has passed an official, authenticating challenge. The Xbox Live scenario is only an example. The essential key is to design operational procedures and user interfaces, not just technology and systems, to help players and company staff operate in a secure manner. There is no security without people.

354

Protecting Games: A Security Handbook for Game Developers and Publishers

A CTIVE M EASURES Some companies have gone beyond simply defending themselves; they are attacking their foes. Although “information warfare” may sound exciting and tempting, anyone who is not in government is likely putting themselves and their business in legal peril. Any time a game or other application has an effect beyond the application itself, there are opportunities for trouble. The Starforce DRM tool was controversial because it affected the use of DVD drives for other applications than just the game it was intended to protect (see Chapter 5). The Sony BMG Rootkit could be used for other purposes besides defending a specific song from copying and had the potential to open the computer up to external attack. Online applications are even more risky. Customers have legitimate concerns about their personal privacy and integrity of their computers. Blizzard’s Warden anti-cheating tool, and some other similar products, captures information about the player’s computer’s processes and even some screen data from the player’s computer. From a user perspective, there is little difference between a key-logger installed by a hacker and one provided as part of the latest game. The potential for serious abuse by these applications is a real concern from a public relations and marketing perspective, if nothing else. The Motion Picture Association of America (MPAA) and Recording Industry Association of America (RIAA) have adopted active measures against media piracy (see Chapter 9). It is unclear whether these activities have been effective in fighting piracy. What is clear is that some of these techniques have backfired. MediaDefender launched a denial of service attack against a legitimate firm that uses peer-to-peer distribution services. This action resulted in an FBI investigation as a potential violation of computer security laws4. More broadly, the RIAA and MPAA have been getting less sympathy in court and no sympathy from the general public for their strong-arm tactics. The potential for civil and criminal actions (not to mention terrible public relations) from active security measures should make them a tactic of last resort, if active measures are even to be considered at all. If you would ever be concerned that there was a newspaper story describing your active measures, you probably should choose an alternative strategy.

I NCIDENTS

AND

I NCIDENT R ESPONSE

Earthquakes, fires, theft, data loss, hackers, or other disasters or security incidents happen regularly to companies everywhere. It is impossible to plan for every variation, but it is more than prudent to have an overall plan for the major types

Chapter 34 Operations, Incidents, and Incident Response

355

of incidents that you may face. Level Up, an MMO operator in the Philippines, uncovered currency duplication cheating in the game RF Online that caused massive, 500 percent inflation in the game’s economy5. The company had hoped to identify the cheaters and remove them and their ill-gotten gains from the game. However, they found that the entire game economy had been corrupted because of the massive influx of illegally created game currency. Instead, the Level Up team rolled back the server and gave bonuses to all players to compensate for their losses (and worked with the game’s developer to fix the game’s software). The key is to have well-established procedures. After running EVE Online for several years, CCP Games had a mature process for dealing with potential security incidents. In October 2007, employees identified an anomaly in the game’s database that indicated a potential exploit6. Standard procedures were followed and an assessment was made by an internal team. They decided to take the game offline within two hours of initially identifying the exploit because of the potential risk. CCP had expected to be offline for two hours, but it took ten hours to fully reconstitute the game’s security and safely restore service. Because CCP Games had an orderly process for handling general security incidents, they were able to rapidly contain the problem, repair the service, and keep their customers informed. The following activities should be included in an incident response and recovery process: Alert—Online services need to include sufficient internal telemetry and monitoring systems so that it is possible to know if something is going awry. In addition to technical systems, skilled operators are essential. A good operator should be able to “sense” an anomaly and be able to clearly communicate the problem to management. Escalate and Act—Once a human or technical system has identified that an incident has occurred or is in process, management needs to be notified so that they can bring together the resources necessary to respond. This should include appropriate technical staff, but also business, public relations, customer support, marketing, legal, operations, and any other group that may be necessary to actually handle the incident, work with customers, and address impacts to the business. Identify and Assess—The designated team needs to determine the actual nature of the underlying problem that triggered the incident as well as assess the severity and scope of the problem. The team needs to develop strategies to address the problem itself as well as limit the impact of the incident on the company’s operations. In addition, the team will form a communications strategy to protect the company’s relationship with its customers and handle any media inquiries.

356

Protecting Games: A Security Handbook for Game Developers and Publishers

Contain—Once the underlying problem has been identified, the team will implement a containment strategy. This can include doing nothing and accepting the (limited) impact of the compromise; disabling certain functions, features, or servers; restricting access by certain users; or shutting down all or a portion of a service. Communicate—Some level of customer communications is critical to managing an incident. There needs to be a solid communication strategy operating in parallel with all of the other incident response activities. This may extend beyond the actual problem to deal with rumors and speculation by customers and the media. The goal is to keep customers and the public informed and confident in the company. One important communications element is not to lie. Most likely, any lie will be found out and it will undermine all future communications by the company during this incident or any that occur in the future. Repair and Recover—Once the problem has been contained, the incident response team should fully analyze the situation and develop an actual repair or work-around. There is a balance between rapidly reestablishing service and repairing the problem. This may not be a single-step process. It is also possible that service may not be fully restored to the state prior to the incident if the problem is severe enough. Review and Revise—After the system has been fully restored, the company should review its incident response procedures as well as its overall operations to determine whether there are related weaknesses that could lead to additional incidents. Operations, technical systems, and the incident response process should be updated based on this close-out review. The company may also issue compensation, incentives, or freebies to players in accordance with the impact of the incident. There is something to the notion that one’s true character is revealed through adversity. How we respond to security incidents and other crises can have an important effect on how we are perceived by our customers, partners, and employees. Although it is best to be able to avoid such incidents, a modest level of planning can be the difference between humiliation and increased respect.

P UBLIC R ELATIONS

AND THE

P ERCEPTION

OF

S ECURITY

Perfect security is not possible. One of the keys to effective security is trust. It is important that customers, partners, and employees believe that your system is secure, that you care about hackers, that there is no cheating or abuse, or, if there is, you are actively doing something about it. Because of this, good public relations is important to your security.

Chapter 34 Operations, Incidents, and Incident Response

357

Balancing public relations and security is not necessarily easy or obvious. For a long time, Blizzard provided regular reports on the number of players that had been banned for cheating or gold farming. This was done to give players confidence that the company cared about the problem and was doing something about it. Square Enix provides regular, monthly reports on the state of security in the game7 and other companies make periodic announcements about exploiters caught, gold seized, and other security news8. Interestingly, however, Blizzard has stopped providing nearly as many announcements about gold farming due, in part I believe, to a concern that the announcements were acting as an advertisement for the potential lucrative opportunity from gold farming instead of working as a deterrent9. The worst thing for a game company, or any other business for that matter, is for security to overshadow the business. Electronic Arts launched the game Spore to much fanfare. However, the game’s digital rights management system became almost more of a story in the media than the game itself10. Although the game appears to be a substantial hit, the large number of negative stories about its security system probably cost the game many sales. One has to wonder if there were more sales lost due to bad public relations from the security tool than sales added by the anti-piracy product. A good PR campaign can actually solve some security problems. CCP Games faced a huge trust issue in the wake of a scandal where company employees were cheating in the game for their teammates’ benefit11. The company’s initial response created a serious perception problem in the player community. When CCP realized that players’ trust in the game was being undermined, they took action. They created a Director of Internal Affairs12, but, more significantly, began a move towards creating a process for incorporating players into the process of running the game13. The Council of Stellar Management has become a story in and of itself, including getting positive coverage for EVE Online in The New York Times14 and elsewhere. Completely false stories can also be damaging. ArenaNet was falsely charged, by a disgruntled former employee, with aiding gold farmers and other abuses15. It took a year for the miscreant to confess, but ArenaNet still had to deal with the incident. The challenge for any consumer business is to avoid even the appearance of impropriety and be as transparent as possible to protect your players’ trust and your company’s reputation. From a security perspective, public relations is important for maintaining the trust and reputation of the game or online service. It is the very last part of the mesh of technical measures, operational procedures, and good customer care. Security and public communications is a balancing act. It is important to instill trust in current and potential customers, but it is foolish to unnecessarily provoke hackers and criminals.

358

Protecting Games: A Security Handbook for Game Developers and Publishers

R EFERENCES 1. E. Bangeman (2007), “Study: PEBKAC Still a Serious Problem When it Comes to PC Security,” http://arstechnica.com/news.ars/post/20071001-study-pebkac-still-a-serious-problem-when-it-comes-topc-security.html 2. M. Nelson (2007), “Xbox Live Security Update,” http://majornelson.com/archive/2007/03/23/xbox-live-security-update.aspx 3. P. Klepek (2008), “Reports of Hacked Xbox Live Accounts Stir Concerns Over Gamers’ Security,” http://www.mtv.com/news/articles/1593637/20080827/id_0.jhtml 4. D. Kravetz (2008), “MediaDefender Defends Revision3 SYN Attack,” http://blog.wired.com/27bstroke6/2008/05/mediadefender-d.html?cid=117123750 5. GM T (2008), “RF Online Philippines Rollback,” http://gmtristan.com/rf-online-philippines-rollback/ 6. CCP Games (2007), “EVE Online Service Restored after Unexpected Downtime,” http://www.eve-online.com/news/newsOfEve.asp?newsID=464 7. Square Enix (2008), “Accounts Banned (Mar. 25),” http://www.playonline.com/ff11us/polnews/news12898.shtml 8. J. Wood (2006), “Cheaters Never Prosper!,” http://www.mmorpg.com/gamelist.cfm?loadnews=4798&fp=1280%2C800%2C2041228203%2C2006031 4180812&bhcp=1 9. S. Davis (2007), “World of Warcraft Bans 100,000 Accounts in March, And Doesn’t Tell Me!,” http://www.playnoevil.com/serendipity/index.php?/archives/1237-World-of-Warcraft-bans-100,000accounts-in-March-And-doesnt-tell-me!.html 10. A. Greenberg, M. Irwin (2008), “Spore’s Piracy Problem,” http://www.forbes.com/2008/09/12/spore-drm-piracy-tech-security-cx_ag_mji_0912spore.html 11. J. Blancato (2007), “Jumpgate: EVE’s Devs and the Friends They Keep,” http://www.escapistmagazine.com/articles/view/editorials/op-ed/847-Jumpgate-EVE-s-Devs-and-theFriends-They-Keep 12. CCP Games (2007), “CCP’s Director of Internal Affairs: An Introduction,” http://myeve.eve-online.com/devblog.asp?a=blog&bid=429 13. S. Schiesel (2008), “In a Virtual Universe, the Politics Turn Real,” http://www.nytimes.com/2007/06/07/arts/07eve.html?_r=2&adxnnl=1&oref=slogin&adxnnlx=11812321 01-fdpr4iZw9pveXa3MfyOw5A&oref=slogin 14. S. Schiesel (2008), “Face to Face: A Council of Online Gamers,” http://www.nytimes.com/2008/06/28/arts/television/28eve.html 15. S. Schuster (2008) “Disgruntled ArenaNet Employee Blogger Finally Admits it Was a Hoax,” http://www.massively.com/2008/09/12/disgruntled-arenanet-employee-blogger-finally-admits-it-was-a/

35

Terrorists

t was inevitable. Take terrorism, the bête noire of early 21st century Western society, and virtual worlds, where science fiction and reality are allegedly colliding, and put them together for a buzzword or a headline. When I first saw stories about “virtual worlds” and “terrorists,” I laughed1. The idea has somehow gained traction, however, most recently with a Pentagon analyst proposing that terrorists could use World of Warcraft to plot attacks on the US2. I realized we have entered the Theater of the Absurd.

I

V IRTUAL T ERRORISM Could terrorists use virtual worlds to hatch their nefarious plots? Of course. They could also meet in Starbucks, talk on the phone, use Skype or other VoIP technologies, or any one of the vast number of communications services that help and bedevil us all today. Would they? Who knows. Comparatively speaking, there doesn’t seem to be much advantage in doing so. Because most virtual worlds require some sort of payment and registration, they seem less appealing than the many social networks, blogs, IRC channels, or simple web forums that are available for free with the only registration being some sort of email address, if that. There have been four main “attack vectors” associated with terrorists and virtual worlds: Propaganda—Using virtual worlds to disseminate propaganda. It certainly would be possible for a terrorist to do something in many virtual worlds to press their agenda. However, the audience for virtual worlds is quite small. It would seem much easier to create a YouTube video or story that would be more likely to catch the public’s attention. One of the arguments within the online game development community is about the use of downloadable clients versus “no-download” tools like Flash. In general, the easier it is for an audience to see your story, the better, and requiring downloads definitely reduces your potential audience. 359

360

Protecting Games: A Security Handbook for Game Developers and Publishers

Training—3D environments are used by many organizations for training purposes, including the military. Some have argued that open virtual worlds could be used by terrorists to prepare an attack. The low fidelity of most commercial, for-fun, virtual worlds tends to make them not very suitable for this purpose. Also, because most of these environments are public, terrorist plotters could face their plans being uncovered by wandering players or a nosy system administrator. Standalone first person shooters could potentially be more useful. They support private servers, are optimized for combat simulation, and have a wide range of map editors and tools available for free or low cost that can accurately duplicate most potential “targets.” Ironically, the Chinese Military is apparently using one such game, Counter Strike, for training3. If one worries about such matters, the simulation tools are not really the problem. Detailed maps, floor plans, and other such information are much more dangerous and widely available online. Attacking a Virtual World—Why? It is unclear why anyone would consider a virtual world a particularly interesting target. Today’s largest online game, World of Warcraft, does have more than 10 million subscribers; however, these people are spread over many servers in many countries. Any “attack” would have limited impact, probably even to Blizzard. By comparison, the NASDAQ stock exchange handles 2 billion messages per day4 and average daily dollar volume traded was $85 billion5… a much more significant target. Attacking the Real World via a Virtual World—The wildest proposed scenario is that cyberterrorists could use an attack on a virtual world to somehow attack the real world. At this point in time, there is nothing to attack. Perhaps a hacker could take down the server that the game is operating on, but that is the end of it. Increasingly, utilities, banks, and other institutions are linking their actual business operations with online services. If you can order phone service online, there is then some sort of actual connection between the frontend website and the actual control system for the telecommunications network. This connection is a real target. Whether it is accessed through a simple web page, or an immersive, 3D environment, live business applications are the real objective for any attacker.

O NLINE T OOLS

FOR THE

M ODERN T ERRORIST

The other proposed opportunities for terrorists come from using virtual worlds or online games as means to support their operations. Like the rest of us, terrorists need to plan and fund their activities:

Chapter 35 Terrorists

361

Communication—It is certainly possible to use online games as a communications service. All support text and some are now supporting voice communications. There are a multitude of other communications services available, however. The larger concern is that government may require monitoring (or at least the capabilities for monitoring) of all online communication services in an attempt to be able to find terrorists. Voice services would probably be a bit more effective for terrorists, because they are more difficult to monitor and it’s harder to extract useful information from them. Of course wise terrorists, just like the military, know that the best way to avoid interception is to avoid communicating. Money Laundering—Moving money around and turning illicit funds into real dollars are difficult challenges. The fact that some online games and virtual worlds have convertible currencies makes them candidates for money laundering, as discussed in Chapter 28. The significance of online games is a bit overstated in this area, and I am afraid I am a bit at fault, as I was quoted on the subject in one of the early articles on terrorism and virtual worlds. The most likely candidates for online money laundering are peer-to-peer financial services, such as micro-loans, peer-to-peer gambling, skill games, online sports wagering, and gift cards. Prohibition in the US in the 1920s helped give rise to organized crime; it appears that one of the unintended side effects of the UIGEA law that restricts online gambling is the rise of anonymous covert payment systems, which may be used for terrorism as well as other forms of cybercrime. Game Crime (Funding)—Gold farming is estimated to be a $1 billion per year industry. It doesn’t take a huge amount of effort to do profitably and the risks of any sort of meaningful investigation or prosecution are virtually nil. The work is naturally fairly anonymous and its practitioners sometimes need links to ID thieves for stolen credit cards and identities. Fake hacks and other gamerelated scams could also be lucrative and have low legal risk. As such, game crime makes for a natural funding source for terrorists (and other criminals, of course). Criminal Game—There is no reason that a criminal or terrorist group could not set up and operate its own online game. The costs are modest and the project could generate reasonable potential revenues. In addition, a criminal game operation would be very useful for collecting identity information and installing malware that could be used for other types of criminal activities. Terrorists are no longer the bomb-throwing anarchists of the late 19th century. However, they are not really any more advanced technologically than the rest of us.

362

Protecting Games: A Security Handbook for Game Developers and Publishers

It is somewhat remarkable that we consider the ability of terrorists to set off bombs at the same time in multiple locations a sign of an amazing malevolent intelligence when many of us routinely set up teleconferences and meetings with our cell phones and PDAs with people from all over the world. We are terrified that terrorists use websites, social networks, online chat, and VoIP, yet tens of millions of us do the same every day. There is nothing amazing about the technologies that terrorists have used or notable about how they have used technology. If anything, the more serious potential problem will come from actions by countries or organized criminals. Terrorism is essentially theater. Its goal is to provoke a dramatic overreaction leading to political or economic chaos. A criminal or state actor is more willing to invest in a financial or strategic payoff. In early 2008, hackers allegedly caused a number of serious power outages in order to extort money from utilities6. This rather alarming story went almost unnoticed while wild speculation that terrorists might use World of Warcraft for planning purposes received wide publicity. We do believe what we see and read. I’ve included hundreds of footnotes in this book to lend credence to my argument that game security is an important issue (how many have you checked, by the way?). Virtual worlds and online games are fantasies. They are one of the few places where we know that what we are seeing is not real. As such, we do not take them seriously. This would seem to make them particularly uninteresting for terrorists, but quite interesting for criminals. Attacks on Wikipedia7 and propagating a story through numerous online sources can build a powerful, virtual truth for lies. A six-year old story about the 2002 United Airlines bankruptcy filing was accidentally republished in 2008 and the company’s stock plummeted 75 percent in less than a day8. The hoary story of the tribesmen who refused to be photographed because they are afraid that the image will steal their soul has a grain of truth. If we are shown enough images and told enough stories about someone, that becomes the truth; real-world reality does not matter. The biggest danger for online games and virtual worlds and terrorists does not come from the terrorists, but from governments’ fear of terrorists. The collapse of a virtual world will anger its customers and annoy its investors. It is not a national security threat. The democratization of information is a huge benefit for society as a whole, but terrorists and criminals will have access to this data as well. The risks for online games come from regulation and law enforcement requirements including extensive monitoring of individual communications. It behooves game companies to preempt and avoid these threats.

Chapter 35 Terrorists

363

R EFERENCES 1. The Economist (2007), “Jihad on the Internet,” http://www.economist.com/world/displaystory.cfm?story_id=9472498 2. N. Shachtman (2008), “Pentagon Researcher Conjures Warcraft Terror Plot,” http://blog.wired.com/defense/2008/09/world-of-warcra.html 3. B. Crecente (2005), “China Trains Army with Counter Strike,” http://kotaku.com/gaming/oddities/china-trains-army-with-counter-strike-30782.php 4. NASDAQ (2008), “NASDAQ Performance Statistics,” http://www.nasdaqtrader.com/Trader.aspx?id=MarketShare 5. NASDAQ OMX Group, Inc. (2008), “NASDAQ OMX Announces August 2008 Market Performance Statistics for U.S. and Nordic Exchanges,” http://ir.nasdaq.com/releasedetail.cfm?ReleaseID=333405 6. N. Shachtman (2008), “CIA: Hackers Shook Up Power Grids (Updated),” http://blog.wired.com/defense/2008/01/hackers-take-do.html 7. P. Boutin (2008), “Sarah Palin’s Wikipedia Page Scrubbed,” http://valleywag.com/5043886/sarah-palins-wikipedia-page-scrubbed 8. K. Zetter (2008), “Six-Year-Old News Story Causes United Airlines Stock to Plummet: UPDATE Google Placed Wrong Date on Story,” http://blog.wired.com/27bstroke6/2008/09/six-year-old-st.html

36

Practical Protection

y goal has been to show that protecting games is possible and that there are many paths to solving game security problems. That security does not require cryptography or iris scans; it just requires a bit of thought and consideration. That security is, first and foremost, a business issue, not solely a technical one. That games and the business of games are deeply entwined with security. Arguably some of the oldest “security problems” were people cheating at ancient dice games. Fortunately, or unfortunately, it is no longer practical to stick a spear in the back of cheaters or make pirates walk the plank.

M

How much is security worth? I read a press release recently about an antipiracy product. They cited the oft-repeated statistic that for every legitimate game sale, there were 10 to 15 pirated downloads and that if just one of those pirates converted, sales would double. If anyone really believed that there were 100 percent or more sales to be earned from better anti-piracy and that there was any anti-piracy solution that could give those sales to you, there would be hardly any negotiation or concern about purchasing anti-piracy products.

“W E H AVE M ET

THE

E NEMY

AND

HE IS US”

This quote by the comic book character Pogo (copyright of the Walt Kelly Estate) pretty much sums it up. Games are a major hacker target. Some of the most common forms of malware—Trojans and account phishing scams—target online games. On one hand, this is a tribute to the huge growth in the game industry. One the other hand, it is an indicator that both the game industry and law enforcement do not take these attacks very seriously: Real Money + Low Risk = Juicy Target

364

Chapter 36 Practical Protection

365

This is likely to get worse. In 2007, the rate of attacks targeted against specific businesses was almost 20 percent1. These attacks are much less likely to be detected by standard, commercial security products, so companies need to harden themselves against all attacks. Denial of service attacks can be launched for as little as $100 per day from an outsourced botnet. The cost of cyberattacks on businesses grew from $168,000 per incident in 2006 to $350,424 in 2007. As game companies move their business online, they are increasingly vulnerable to these hackers. Today, the game industry seems wracked with security fatalism: PC gaming is doomed because of piracy. Gold farmers are ruining MMOs. Cheaters and bots are destroying online poker. The sky is not falling. Security problems are big enough to be taken seriously, but, as has been shown throughout this book, there are ways to bring these challenges under control. The first step is for both security personnel and their colleagues to consider security as an important and integral part of game development and game operations. There seem to be six kinds of security insanity that afflict both security professionals and their coworkers: Zealots—The radical “true believers” of security. They believe in security at the expense of everything else. If something is not perfectly secure, there is no reason to do it. This is most often found in very young (or inexperienced) and very old security professionals. Product Pushers—These individuals have been totally seduced by one brand or type of security product and believe it is the magic bullet for whatever security problem you face. This may occur in the wake of an article, a security course, an industry conference, or an encounter with a particularly charming and/or attractive sales person from the offending company. This is a moderately annoying problem in security staff. It is utterly depressing and frustrating when an executive has caught the bug. Guards and Fences—These individuals view security solely through the lens of physical security: guards, fences, security clearances, and such. Very often, these people have no appreciation for intellectual property as a valuable commodity. This is not found too often in the game industry, but there are definitely folks in the security industry who continue to have this view. Blissfully Ignorant—There is no security problem, there is nothing to worry about, time to move on. “These problems would never affect my product or our business.” In severe cases, they are the willfully ignorant who refuse to consider anything that differs from their world view.

366

Protecting Games: A Security Handbook for Game Developers and Publishers

Pearl Harbors—“I’ll worry about security when some large enough security event occurs.” “Whatever it is, it’s going to have to be big, a Pearl Harbor.” If nothing else, I hope that this book has provided enough specific incidents to answer this question for both the Pearl Harbors and blissfully ignorant in the game industry. Security Apocalypse Believers—There is nothing that can be done. We’ll just have to abandon this market. Maybe the government can save us. The entertainment industry seems to be veering into this direction. For the games industry, PC gaming is routinely pronounced “doomed” due to piracy. Real protection goes with a real understanding of the business and its environment. My discussions of price, multi-player gaming, and rich interaction systems as strategies to fight piracy are based on the recognition that piracy exists, but the goal is to maximize revenues, not become a surrogate for government and mete out “justice.” Second-hand game sales may, in fact, be a more costly problem than piracy (in terms of lost sales). Real customers willing to spend real money on real games are increasingly choosing to buy used rather than new games. Hoping for some sort of revenue share from retailers or individuals is naïve, at best. Cheating and social subversion are direct threats to any game service. Any breach of trust or confidence will cost you customers. In the largest available survey, cheating was the number one reason for leaving online games2. There is nothing that ruins fun like perceived injustice. Although piracy may be the largest threat to games as products, cheating and social subversion are the leading threats to game services. Games may be an escape from the real world but game businesses are real businesses. They face numerous challenges, some of which stem from the explosive growth and changes in the industry. Although it may suit the game industry’s purposes to consider virtual items as worthless and owned by the company, it is dangerous to ignore the fact that your players place great value on these mere entries in a database. This view devalues your customers and facilitates problems like gold farming. Games are a major industry and can earn many millions of dollars from their players. In return, developers and game operators should value their customers and their customers’ trust seriously. Protecting identity, providing a safe environment, and securing payments should not be afterthoughts; they are central to the success of a game service.

Chapter 36 Practical Protection

T HE B USINESS

OF

367

G AME P ROTECTION

When games can earn more than $300 million in a week3 and there are lawsuits for millions of dollars over security breaches4, it is time to realize that the game industry has grown up and that protecting these games is serious business. There are a lot of multi-million dollar security incidents mentioned in this book: Sony Online Entertainment faced millions of dollars in chargeback fees due to gold frauders; K2 Networks lost a million dollars in one year due to phishing, identity theft, and credit card fraud; and Shanda offered $1 million in rewards to find private servers, malicious code, and cheats. One has to wonder if the potential costs of a security breach were even considered when these games were developed. How carefully do game publishers review the security procedures of their developers or production contractors, given the number of times games have been compromised before they were released? How much thought was put into various online games’ economic systems to consider the operational and fraud related costs from gold farming? How early in the development process was the threat of piracy considered during a game’s design and business strategy? Yet, it seems security investments are very lean. The game industry is not alone in this. The game industry has an advantage over many other industries in that it can clearly measure return on security investment. Piracy can be tracked; customer complaints and security incidents can be counted. Security investments can be tied straight to the bottom line. It is certainly the responsibility of security staff to propose security solutions as well as identify security vulnerabilities and fairly cost them over the lifecycle of the game, but it is also the responsibility of management and designers to take heed. Security is truly an engineering discipline and an art. It is all about leverage. The goal is to make an investment in security tools, implement appropriate changes to the game design or business model, or even alter operational procedures that, taken together, will produce substantially larger revenues or avoid large costs. It is reasonable for management to expect these margins to be fairly large because so are the unknowns. If game protection is started early, the cost may consist of altering a PowerPoint design presentation or a Word requirements document. GLOBAL INDUSTRY CHALLENGES The game industry is in the midst of a fundamental change. It is moving from a shrink-wrapped software business dominated by a few major publishers serving a few large developed countries, to a much more diverse online industry with a wide range of business models and a huge number of players spread all over the world.

368

Protecting Games: A Security Handbook for Game Developers and Publishers

Industry leaders need to think globally instead of focusing on individual markets or regions. The debate in the United Kingdom between industry-sponsored Pan-European Game Information (PEGI) age-rating system and the British Board of Film Classification (BBFC) over game-rating authority is not really about which approach is better, but whether companies will need to get their games approved in each national market or be able to use a standard, global certification. The challenges extend far beyond game ratings. The game industry has a strong interest in standardizing and strengthening online identity, developing standards for parental controls and usage limitations to address game addiction concerns, improving online payments and fighting fraud (including pushing liability back onto payment processors and credit card firms), fighting online crime, and clarifying jurisdictional issues for online services. Many of these issues are not unique to the game industry, but their resolution, or lack thereof, will have a notable impact on the shape and growth of the industry in the future. At the same time, the very way the game industry operates is in flux. Game developers increasingly outsource portions of their projects and operate as virtual teams spread around the globe. Licensing games has changed from simple localization for each country and local marketing to supporting extensive online services. These partnerships reduce the costs of development and can help expand business opportunities, but at the same time they expose companies to threats that they hadn’t previously considered. Maintaining management control, much less effective security, is a serious challenge. SECURITY BEYOND TECHNOLOGY One of the most important themes throughout this book is that security is not solely a technology problem nor does it always have a technological solution. The role of the security team is to look at everything about the game—its business model, design, distribution, payments, implementation, tools, and so on—and help navigate a path to success in the face of adversity. Although security is not paramount, its impact needs to be considered seriously along with business and art to achieve success. The joke among my NSA friends when we were adding a piece of security gear to a project was that we were expected to be a heat sink, add power, and add lift. The development team as a whole often did not see any reason to value security. Why should they?

Chapter 36 Practical Protection

369

Military development projects have many of the same characteristics as game projects. The development team is successful when the project “goes live.” After that, someone else gets to take care of maintenance, operations, and security. Without rewards and accountability, security will fail. Like everything else, people respond to incentives. If security can serve as an impetus to better address operational issues during development, security should certainly be a resounding success. One of the great things about games and security is that there is a lot of freedom to innovate. Games are unique and creative enterprises. Battle.Net started with a free online service and ended up extending the life of its games for years and being pretty effective in battling piracy. Richard Garfield revolutionized the tabletop game industry by combining sports trading cards with a fantasy game to create Magic: The Gathering. The free-to-play business model has shown that you don’t need to charge a subscription to make money from an online game. The Wii showed that game play, not graphics, can be successful on consoles. Puzzle Quest showed that you could make a “hardcore” casual game. Solving business, game design, and security problems can truly be an opportunity to build something wonderful and new. WHO’S THE BOSS? A perpetual problem in the security field is the question of who “owns” security. No matter what we all claim, the adage “where you stand depends on where you sit” has a lot of validity. If security is owned by the Information Technology (IT) department, security is an IT problem. If it is placed within Quality Assurance, quality is security. The bottom line answer is that the “boss” owns security. The owners of a business are the only ones who have enough visibility into development and operations to balance both. Some large companies have created a Chief Information Security Officer (CISO) position, usually underneath the Chief Information Officer (CIO). The main problem with this choice is that it makes security part of IT and often CIOs are a lot less strategic to the business than they should be. My conversations with game developers lead me to a slightly different conclusion for the game industry. The security lead should probably directly report to the Project Manager or an Operations Manager, if one is appointed early. Bringing in an Operations Manager early on is highly valuable. They are the ones who are going to care for, feed, operate, and support the game from the day it is launched until it is shut down, and so are more like a “real” game player than anyone. Operations Managers care about how many customer support staff they are going to need, as well as how many servers, and how many phone lines for complaints. Operations

370

Protecting Games: A Security Handbook for Game Developers and Publishers

Managers also are going to bear the brunt of any security failures and will therefore be strong advocates for security. They will appreciate that good security can affect the variable costs of operations. Best of all, the Operations Manager has a substantial budget—something that security folks almost always lack.

I N C LOSING I almost always open my presentations on game security by stating that “If security doesn’t save you money or make you money, don’t spend a dime on it.” I hope that I have shown that there are real security problems that affect almost everyone in the game industry and that there are practical ways to protect your games. When I started studying game security, the problems were pretty straightforward: piracy for shrink-wrapped games and cheating and griefing for online games. The explosion of games into advergames, social networks, virtual worlds, skill games, and children’s games has been exciting to watch even as the security challenges have multiplied. These are early days for security in the games industry. Companies who take the lead in security will have a competitive edge, while others may lag behind.

R EFERENCES 1. T. Espiner (2007), “Cracking Open the Cybercrime Economy,” http://resources.zdnet.co.uk/articles/features/0,1000002000,39291463-1,00.htm 2. PlayNoEvil (2006), “Game Security Major Issue for Online Gamers in China,” http://playnoevil.com/serendipity/index.php?/archives/719-Game-Security-Major-Issue-for-OnlineGamers-in-China.html 3. P. McDougall (2007), “Halo 3 Sales Top $300 Million in First Week,” http://www.informationweek.com/news/personal_tech/showArticle.jhtml?articleID=202201135 4. B. Sinclair (2008), “Ubisoft Sues Over Assassin’s Creed Leak,” http://www.gamespot.com/news/6195570.html?om_act=convert&om_clk=newstop&tag=newstop;title;2

Appendix

A

Selected Game Security Incidents

began tracking game security incidents fairly seriously after we filed the patents for what became our SecurePlay product back in 1997. Every so often, a news story would break about some problem with a game somewhere and I would file the information away. The pace of these incidents steadily increased and when I started seriously writing my blog, PlayNoEvil, in the later part of 2005, I went back and filled in a number of the earlier cases to build an informal chronology of game security. These cases come from stories in the press or announcements from companies. I have rarely used forums or gamer communities as a reference. When I do use these sources, it is usually because the attack itself is interesting, rather than just noting the disclosure of the incident.

I

T HE G ATHERING S TORM The growth in the number of game security incidents has been impressive. Before 2004, there were several incidents per year. By 2004, the pace had reached one per month. In 2005, there were several each month. In 2006, there was usually at least one incident a week and by 2007 there were more incidents than I could easily keep up with. Part of this is certainly due to the growth of online sites that track the game industry, but the number of incidents seems to have been growing at a remarkable pace. Over this same period, companies have changed how they respond to security incidents. There has been a long-standing habit of simply deleting discussions of cheats or exploits from official game sites. Sometimes game companies will provide information on security incidents only to later remove them from their sites. Blizzard used to provide quarterly updates on bans for Battle.Net and World of Warcraft, but ceased doing so in the fall of 2006. Other companies, like Square Enix, have taken a very different approach and provide regular updates on security for their online game Final Fantasy XI. 371

372

Protecting Games: A Security Handbook for Game Developers and Publishers

On a personal note, when problems have occurred over, and over, and over again, there seems to be less value in writing about them, and less interest in reading the same stories by my readers. The rapid changes in the game industry have given me opportunities to expand my horizons to address issues such as security for kids’ games, problems with contests and advergames, and other topics. This is a long-winded way of saying this list is not complete. It covers many incidents from 2001 to mid-2007 and gives a good sense of the range of the problems. I do refer you to my blog, PlayNoEvil (http://www.playnoevil.com/), which I’ve continued to update. You may also find Luigi Auriemma’s site (http://aluigi. altervista.org/) of interest. There have been a couple of other game security sites launched over the years, but they rarely stay active for long. Incidents in 2007 (though May): In-game griefing turns into real-world violence in World of Warcraft in Mexico Regional licensing issues in Xbox Live and PS3 Nintendo faces media piracy in Korea Lineage III code compromised—$1 billion in potential damage claimed Nintendo Europe fights modchips Sony PSP firmware updated against download security flaw HD DVD and Blu-ray anti-piracy systems hacked after being patched within one week HD DVD and Blu-ray anti-piracy system hacked Xbox 360 privilege escalation exploit Fake cheating scams: Habbo Hotel and elsewhere Cheating in Insomniac’s Fall of Man for PS3 3,900 Final Fantasy XI accounts banned or suspended Teleport hacking in World of Warcraft Xbox 360 exploit found and patched Griefing article in PCGamer Malicious shills in online casinos 100,000 World of Warcraft accounts banned Swedish lottery game shut down for cheating Entropia Universe performance enhancement exploit MMORPG editorial on cheating Blood donations to get “unbanned” in Cabel Online

Appendix A Selected Game Security Incidents

373

Casual game attacks article Hacking kids games—Club Penguin and Whyville Final Fantasy XI bans 5,000 accounts Pirate server earned $200,000 in China shut down UK invests 5 million pounds to fight piracy Lineage 2 pirate server shut down by FBI Hacking games with Cheat Engine article Nintendo DS strengthens media security Game industry article on evolution of game piracy Real robot used for Xbox 360 achievement exploit Epic Software’s Gears of War for Xbox 360 attacked Employee game abuse issue in CCP Games’ EVE Online Nintendo Wii hardware hack Knight Online institutes “double damages” instead of banning Flash high-score system hack demonstrated Sony PSP firmware hacked again Controller hack against Rainbow 6 on Xbox Live Indian gold farming and botting allowed and supported by publisher Chess tournament cheating via Bluetooth Legend of Mir 3 piracy operation in China cost nearly $1.3 million per month in revenues Incidents in 2006: Penis griefing in Second Life Square Enix bans 7,450 from Final Fantasy XI Another pirate server in China shut down—over 260,000 accounts Cheating described in online Backgammon Gold duplication exploit in World of Warcraft (non-US) Sony PSP firmware hacked Electronic Arts’ Battlefield 2142 faces numerous security issues Bungie institutes anti-leader board abuse system for Halo 2 (1,106)

374

Protecting Games: A Security Handbook for Game Developers and Publishers

Square Enix bans 11,500 in Final Fantasy XI FBI shuts down Lineage 2 pirate server Blizzard sues World of Warcraft Glider tool developer Hackers commercialize game save cheats for Xbox 360 Denial of service attack against Second Life Saint’s Row for Xbox 360 gets security patch against exploits Australia challenges piracy damage report Square Enix creates Final Fantasy security task force Yendang Entertainment cracks down on cheaters and hackers iTunes DRM allegedly broken World of Warcraft movement cheat hits YouTube Guild banned in World of Warcraft for using exploit Final Fantasy XII English language code compromised Student essay on Metroid Prime Hunters cheating Game Licensor K2 uses policy instead of patching for Webzen’s Legend of MU exploit Pine tar hack in baseball Gamerscore cheating on Xbox Live Electronic Arts’ Battlefield 2142 ships with spyware Lobby attacks in Gears of War for Xbox 360 Four to five denial of service attacks in less than one month against Second Life Cheating in chess—Kasparov editorial Microsoft sues to fight DRM circumvention tool Microsoft adds security to DVD drive Gears of War code compromised Ubisoft compromised 2GB of art assets Personal data compromised in Second Life K2 Networks loses $1 million in a single year due to account compromises, phishing, and identity theft Baidu sued for publicizing alleged cheater’s name Roulette cheating legalized in UK Gold farming business article in China

Appendix A Selected Game Security Incidents

375

Final Fantasy XI bans 3,000 for third-party software Video and audio griefing on Xbox Live in Uno Payment card spoofing and identity spoofing on Xbox Live Sony PSP patched again Korean organized crime group hacked arcade chips to cheat Apple and Microsoft DRM defeated again Shanda offers $1 million reward to fight cheats and private servers Casino Times covers cheating in Online Poker Executive at Shanda duplicates items in Legend of Mir 2—arrested Three Guild Wars guilds banned for ladder abuse Both Microsoft DRM and Apple FairPlay systems broken (again) EA’s Battlefield 2142 hacked in beta Sony PSP hacked, all versions, via memory stick Xbox 360 piracy reported in Philippines Introversion claims successful use of spoofing against P2P network piracy Final Fantasy XI bans over 1,400 for cheating and third-party software Bank scam revealed in EVE Online VP of Chinese anti-virus firm arrested for selling game hack plug-in for Legend of Mir 3 (earned over US $350,000) “Stat baby” griefing in Netamin’s Ultimate Online Baseball Xbox 360 piracy problems reported in Korea Sony PSP introduces anti-piracy and homebrew features in latest firmware Datal releases trainer for DS World of Warcraft bans nearly 60,000 accounts SiN Episode 1 piracy reported, distributed via Valve’s Steam Xbox 360 piracy problems reported in China Final Fantasy XI bans over 2,000 for third-party software Conquer Online increases penalties for cheating and botting Guild Wars bans over 4,000 for botting $21 million in U.S. dollars seized from botters and gold farmers in Ultima Online New PSP downgrader released Hellgate: London source code potentially compromised

376

Protecting Games: A Security Handbook for Game Developers and Publishers

Cheat tools for Metroid Prime Hunters—WiFi 300,000 players data-compromised in Japanese MMO Xenepic Online Korean gold farming ring earns U.S. $15 million, NCsoft under investigation for inaction Nintendo DS piracy problems Star Wars MMO doppelganger server enters alpha testing PSP dual boot hardware hack released Korea moves to stop wagering in online games Shadowbane MMO announces fix for exploits Final Fantasy XI MMO bans 250 accounts for gold farming with U.S. $4 million in game currency RF Online bans over 2,000 for cheating with bots in May Bethesda Oblivion RPG patch fails to stop duping Blizzard bans 30,000 accounts for gold farming and cheating, with U.S. $3 million in game currency In-game denial of service attack against Second Life Bethesda Oblivion RPG patch to stop duping; because of the Xbox Live service and incentive system this problem has real impact ArenaNet’s Guild Wars bans 1,000 accounts for bots NCsoft to spend U.S. $10 million on anti-cheating and farming, including hiring 150 analysts for Lineage Korean bot makers busted for U.S. $10,000 and two years in prison Xbox 360 DVD drive hack weaponized cheat and piracy product for Nintendo DS Trojan used to loot World of Warcraft accounts Second Life denial of service attack—third in one month NCsoft bans 500,000 accounts in 18 months for Lineage Second Life denial of service attack 5,400 banned from World of Warcraft for cheating Virtual crucifixion to punish griefing in Roma Victor Xbox 360 DVD drive hack disclosed Mythic bans cheaters from Dark Age of Camelot MMO Massive identity theft ring targeted NCsoft’s Lineage—200,000+ compromised accounts

Appendix A Selected Game Security Incidents

Online “lynching” of suspected Chinese gold farmers Mythic bans 450+ cheaters for use of “radar” exploit PSP hacked via GTA game Shadowbane institutes “zero tolerance policy” for cheating Second Life adds virtual prison for griefing or annoying behavior Incidents in 2005: Blizzard closes 18,000+ accounts for cheating in past three months Linden Lab turns to FBI in Second Life denial of service case City of Heroes/City of Villains servers hacked, code compromised Age of Empires III patched to address multi-player exploit Call of Duty 2 fans lobby for better anti-cheating, threaten strike Denial of service attack against Second Life Xbox 360 Live tracking security concerns AhnLabs brings anti-cheating service to US, starting at $30K/year Two denial of service attacks in November against Second Life World of Warcraft hackers using Sony BMG rootkit to hide from Warden Halo 2 ends leader board due to cheating and hacking problems Japan Lineage II fraud/virtual mugging results in arrest Duplicate server problem for Lineage II Major duping incident for EverQuest II Privacy concerns due to security monitoring by Blizzard Far Cry patched for cheating World of Warcraft bans over 1,500 for cheating Bungie (Halo 2) bans thousands for cheating Bungie fights mod cheats Battlefield 2 security flaws allow cheating Major duping problems in World of Warcraft China imposes content and time limits on gaming Battlefield 2 servers delisted for cheating 50,000+ accounts banned from Battle.Net

377

378

Protecting Games: A Security Handbook for Game Developers and Publishers

Shanghai player stabbed over virtual sword theft Spurned woman charged over deleting game data Tecmo settles nude “skinning” lawsuit Gold farming and duping problems in World of Warcraft—thousands banned (several articles) Rise of pokerbots in various online poker games (several articles) Final Fantasy XI bans over 800 players America’s Army hacked Halo 2 service boots several thousand users for cheating at $50/subscriber/year Sims 2 hacked (malicious data attack) Fujistu-Siemens told to pay $16/PC as tax for piracy in Germany Earlier incidents (2001 to 2004): World of Warcraft has major game hack within three weeks of release (timing attack) Blizzard knocks over 500,000 accounts from Starcraft and tens of thousands of accounts from Warcraft III at Battle.Net Valve boots 50,000+ players within three months of releasing Half-Life 2 Blizzard wins suit against BnetD (competitive open source game server) Code theft for Grand Theft Auto – San Andreas Code theft for Halo 2 ASF Texas Hold’em hacked SOCOM online virtually shut down due to cheating EverQuest removes hundreds for cheating Battle.Net boots over 500,000 accounts (out of 10 million) Half-Life 2 code theft China’s online gaming market admits $12,000 lost each day to cheating and piracy McDonald’s Monopoly sweepstakes scandal Cryptologic’s software was hacked and lost $1.9 million in a day

Appendix

B

Glossary

Action Overrun—This type of attack on a game works when games do not explicitly validate the intervals between allowable game actions. The game’s state does not retain information about when previous actions have occurred. Common examples are players who can move far too fast or fire extraordinarily quickly compared to other players. Advergame—A game that promotes a product, service, or brand that is typically provided for free. Asymmetric Cryptography—See Public Key Cryptography. Blind Authentication—A cryptographic authentication process whereby one entity queries another to determine whether the second entity possesses certain information without disclosing the information directly. Blind authentication can be used to verify software or other data. Blu-Ray—A successor to the DVD that can store 50GB of data and includes several digital rights management systems. Bot/Botting—The use of automated programs to play on a player’s behalf. Bridging—The insertion of a hardware or software proxy between two networked game applications in order to facilitate cheating by manipulating the data exchanged between the game players. CAPTCHA—Stands for a “completely automated public turing test to tell computers and humans apart.” A program that tries to distinguish between people and computers quickly and reasonably easily. Chargeback—When a consumer reverses an existing credit card purchase and the vendor is responsible for returning the funds to the credit card company and, ultimately, to the consumer, unless the vendor can successfully dispute the chargeback. Cheating—Active measures that abuse game play or game systems. Checksum—A fixed sized block of data that’s derived from a larger data stream or block. A checksum can be as simple as a parity bit (a count of the number of 1s in the data stream) or as complicated as a cryptographic checksum (where the checksum is built using a secret key and a cryptographic function).

379

380

Protecting Games: A Security Handbook for Game Developers and Publishers

Children’s Online Privacy Protection Act of 1998—A U.S. law that protects the privacy of children under 13, particularly against marketing. It is sometimes confused with COPA or other laws with very similar acronyms that are related to protecting children from obscenity and have been successfully challenged in court. Ciphertext—An encrypted stream or block of data. CKL—See Compromised Key List. Compromised Key List (CKL)—One of the limitations of public key cryptography is that keys have a long life, sometimes a year or more, and there is no easy way to get rid of keys when they are compromised. The CKL is a digitally signed list of compromised keys periodically distributed by a central authority. These lists are used by participants of the service to ignore messages from holders of the compromised keys. COPPA—See Children’s Online Privacy Protection Act of 1998. Digital Millennium Copyright Act (DMCA)—A U.S. law passed in 1998 that places serious restrictions on attempts to reverse-engineer or circumvent copyright protection technology such as DRM. The European Union passed an analogous act in 2001, called the EU Copyright Directive. Digital Rights Management (DRM)—Software tools that attempt to control the usage and distribution of digital media. Digital Signature—By combining a hash function with public key cryptography, digital signatures are used to ensure the source and integrity of the signed data. The hash function detects data alteration and the public key function ensures that the data came from a source that knows the corresponding private key. DMCA—See Digital Millennium Copyright Act. DRM—See Digital Rights Management. Emulators—Software programs that emulate a different computing platform or microprocessor, and are sometimes used for piracy. Encryption/Decryption Function—A mathematical function that operates on some input data (plaintext) and a key to produce an output. If you have access to the output of the encryption function (ciphertext), it is computationally infeasible to recover the input data without the key. End User License Agreement (EULA)—The contract between a software buyer and a seller. These contracts have come under scrutiny in the US recently because consumers cannot meaningfully negotiate with the licensor. Additionally, software companies have been imposing draconian restrictions in the contracts that may not hold up in court. Escorting—A (paid) service in an online game where the escort plays along with the client. EULA—See End User License Agreement. Exploit—A weakness in the implementation of a game system or flaw in the game’s rules that allows a player to have an inappropriate advantage. F2P—See Free-to-Play.

Appendix B Glossary

381

Feelies—Physical items included with a game. Feelies were an anti-piracy technique pioneered by Infocom. Free-to-Play (F2P)—The name for games whose business model is based on the purchase of virtual goods. It is typically contrasted with subscription games, where players purchase game play based on time (per minute or per month). Gold Farming—The practice of using a game’s economic system to earn real money by selling virtual assets or currency to other players. Most games typically allow, in fact encourage, the accumulation of items and virtual currency and support their trading as a part of the game play experience. The abuse of this legitimate system can cause a number of problems, including spam. Gold Frauding—The use of actual criminal techniques such as phishing, account theft, identity theft, and credit card fraud, to buy and sell virtual currencies and items for games. Griefing—Activities that are not technically cheating, but are disruptive to the game experience of other players. At best, these behaviors can only be documented in a game’s terms of service. Most often, they are enforced by game company staff. Hash Function—A mathematical function that takes an arbitrary amount of data and “hashes” it down to a fixed-size hash word. A good hash function will have the characteristic that small changes to the input data will result in large, unpredictable changes in the resulting hash word. Honeypot—A program or online service that is designed to trap criminals or other targets. Key—A small amount of data (the key) used to protect a large amount of data. Typically used with a cryptographic function. Key-logger—A program that captures the keystrokes from a computer and sends them to a remote location, often for malicious purposes such as capturing user passwords (usually done by a hacker, but sometimes companies monitor their own employees). There are also programs that capture screenshots and mouse inputs. Key Management—The set of operational services are necessary to operate a cryptographic system securely. Typically, a key management system includes key distribution, key exchange, registration or initialization, key update, and recovery. Keygen—An unauthorized program that can generate a game license key that cannot be detected as fraudulent. Macros—Programs that automate sequences of keystrokes as a game aid. See also Bot. Machinima—A video or movie built from a 3D graphics engine (typically a game). Massively Multi-Player Online Game (MMO, MMOG)—A generic name for games that can support large numbers of players, typically in shared, persistent environments. Massively Multi-Player Online Role Playing Game (MMORPG)—A special category of MMO that has a player take on the role of a person or creature, typically represented by a graphical avatar. The role-playing-game aspect of the game is that the characteristics and assets of the avatar can change over time. MMO/MMOG—See Massively Multi-Player Online Game.

382

Protecting Games: A Security Handbook for Game Developers and Publishers

MMORPG—See Massively Multi-Player Online Role Playing Game. Modchips—Additional memory chips, processors, and even circuit boards used to support hardware hacking of game consoles. MUD—See Multi-User Dungeon. Multi-User Dungeon (MUD)—The textual predecessors to the modern graphical MMO games. Players typically use a simple telnet terminal client to access the game (although more elaborate client applications are often available). Interaction is often done with very elaborate textual commands. One advantage that MUDs have is that developing and modifying text is quick and easy. There continue to be several text MUDs that operate commercially. Nintendo DS—Nintendo’s handheld game console that was released in 2004. It is distinguished by the use of a dual screen and is backwards compatible with Nintendo’s previous GameBoy Advance handhelds. It also supports Wi-Fi networking. Nintendo Wii—Nintendo’s game console that was released in 2006. It is distinguished by its use of the Wiimote handheld controller that recognizes gestures and movement in three dimensions. It is also backwards compatible with Nintendo’s previous console, the GameCube, and includes Internet access via Wi-Fi. Unlike its competitors, the Wii does not have a standard hard drive, only Flash memory. Obfuscation—The process of making it difficult to reverse-engineer the design of a program (code obfuscation) or the value of data (data obfuscation), even if the adversary has the obfuscated code or data in her possession. Phishing—The process of attempting to fraudulently convince individuals to disclose credit card numbers, personal data, passwords, or other sensitive data. PlayStation (PS, PS1, PS2, and PS3)—Sony’s video game console series. The latest, the PlayStation 3 (PS3), was launched in 2006 and includes the Blu-ray disk technology and Internet access. PlayStation Portable (PSP)—Sony’s handheld game console first released in Japan in 2004. It is most notable for the use of the UMD miniature disk technology. It also supports Wi-Fi networking. Pokerbot—An automated program that plays poker (see also Bot/Botting). Power-Leveling—A commercial service whereby a third party plays on behalf of a player to accelerate her status in a game. The service may also simply sell pre-built game characters or accounts. Private Key Cryptography (Symmetric Cryptography)—A type of cryptography where all parties to the system use the same (secret) key. The same key is used to encrypt and decrypt data. PS, PS1, PS2, and PS3—See PlayStation. PSP—See PlayStation Portable.

Appendix B Glossary

383

Public Key Cryptography (Asymmetric Cryptography)—A type of cryptography in which it is computationally infeasible to determine the private key if you know the associated public key. This means that if you can decrypt a message with the public key, you cannot encrypt the message because you do not posses the private key. Public key cryptography is mainly used for key management because it is typically much slower than symmetric cryptography. R4 Data Cartridge—An unauthorized product that allows standard SD flash memory storage to be used instead of official Nintendo game cartridges for the Nintendo DS handheld game console. SD cards are routinely used for digital cameras and media players. The R4 product also includes a PC application that allows users to download pirated Nintendo games and use them. The R4 allows multiple games to be stored on a single cartridge and provides its own graphical user interface (GUI) to select games. Race Condition—A situation where multiple systems (often computer programs) that ordinarily work together get into an undefined condition (that often causes strange failures) because of poor handling of temporal updates. Real Money Transactions (RMT)—Inter-player commerce, almost always in online games, where players use the trading system or gift-giving system provided by the game to support real money sales of items. Rich Interaction System (RIS)—An online service that provides a number of types of services designed to be used to enmesh players so that they will be less likely to cheat and pirate games. RMT—See Real Money Transactions. Rootkit—A program that hides itself from the standard utilities provided with an operating system. Many computer hacks try to “escalate privileges” to get root privileges that typically give the hacker total control the computer. Spam—The abusive distribution of marketing information via a legitimate communication service. Standbying—A method of cheating in networked computer games where communications are interrupted to disrupt the synchronization of game state or actions between players. Steganography—A mechanism for hiding important information inside of other data, such as a message concealed inside of a picture or a sound file. For game applications, the most common use of steganography is for concealing digital fingerprints or watermarks. Subletting—Sharing an online game account with another user who is engaged in an activity such as gold farming. In addition to being a violation of the game’s terms of service, subletting is often a fraudulent way to steal a player’s account. Subscription Game—A game that includes periodic payments (typically monthly) for service. Symmetric Cryptography—See Private Key Cryptography. Terms of Service (TOS)—The extension to a game’s contract that defines acceptable and unacceptable behaviors. TOS are not typically enforced by the software.

384

Protecting Games: A Security Handbook for Game Developers and Publishers

Trusted Platform Module (TPM)—A cryptographic coprocessor that stores and generates cryptographic keys and implements cryptographic functions. Each TPM has one or more unique cryptographic keys. TPM is also a specification published by the Trusted Computing Group. Wallhack—The replacement or alteration of game graphic assets to give an advantage to the game hacker. In many games, the graphics engine has sole responsibility for determining whether one player can see another. A simple wallhack will make a wall in a game invisible and, at a minimum, allow a player to see where others are located. Others can be used to allow players to shoot at players that they should not be able to see or fire at. Xbox 360—Microsoft’s game console that was released in 2005 as a successor to the Xbox. It includes Internet access. One notable change from the Xbox is that there is a version that does not include a hard drive (the Xbox 360 Arcade). Xbox Live—Microsoft’s online service for its Xbox and Xbox 360 game consoles.

Index Note: Security principles are abbreviated. See individual entries for complete text.

Numbers 2001 to 2004, game security incidents in, 378 2005, game security incidents in, 377–378 2006, game security incidents in, 373–377 2007, game security incidents in, 372–373

A A1 installation option, explained, 95 abandonment, occurrence of, 199–200 abstraction, using, 172 account compromise, overview of, 306–308 Achaea (Iron Realms), 228 ACID, applying to dupe attacks, 156 action-based networking, 117–120 versus state-based networking, 119 synchronizing between players, 119–120 action hands, explained, 202 Action, role in CAARDS reference model, 110 activation, considering in license policies, 53 activation key, vulnerability to pirates, 39 active measures, adoption of, 354 Adams, Tarn, and Zach (Dwarf Fortress), 175 advergames, tracking, 181 ADV Films, trusted brand security of, 28–29 Age of Conan, 109, 166 age verification overview of, 302–304 problems with, 294 algorithmic games, 170–173 ambushes, turning into mini-games, 174 amusement park economics, 226–227 analysis, availability in cheat detection systems, 153 analytic aids, comparing to cheating, 146–149 anonymity, state of, 296 anonymous systems, using, 301–302

anti-cheating techniques focus of, 120 N-1 Secure, 124 See also cheating anti-fraud, overview of, 282–286. See also fraud anti-piracy approach for PC games, 35 benefits from proprietary media, 32 determining goals of policies for, 97–99 evaluating, 30 innovators, 29 nagware systems used in, 42 price as strategy, 62 public relation problems with, 92 of servers, 70 strategies for used games, 61 techniques, 32–33 worth of, 26–27 See also piracy; RIS (rich interaction systems) anti-piracy Bill of Rights connection options, 95 fair use principles, 93–94 installation options, 95 registration options, 94 anti-tamper software, use of, 135, 139–140 ArenaNet (Guild Wars), 24 Asia, console piracy in, 25 Asian malware, statistic related to, 4 Assassin’s Creed, 257 asymmetric information, significance of, 115 asymmetric warfare, choosing defensive methods for, 16 Atomicity in ACID, explained, 156 attack vectors, association with terrorists, 359–360 Audition dancing MMO, 173–174 Australia, impact of piracy on, 23 authenticating servers, 70–72 authentication, blind, 144 authentication token, use with World of Warcraft, 4 authorization, 37–38 automation, integration for, 286

385

386

Protecting Games: A Security Handbook for Game Developers and Publishers

Avatar’s Bill of Rights, 229 average synchronization model, explained, 113 avoid security strategy, explained, 14 AW (authentication word), creating, 143 Ax installation option, explained, 95

B Bartle, Richard, 224 Battlefield 2, 111, 198 Battle.Net service (Blizzard), advantage of, 24 “Beat the Dealer” (Dr. Edward Thorp), 170 Bethke, Erik, 229 better EULA, proposal of, 229 bias of game operators, explained, 201 billing options, considering for payments, 279–280 Bill of Rights for anti-piracy, 93–94 biometrics, use of, 299 Black, leaking of, 257 blacklist chat services, using for children, 317 blacklists versus whitelists, 151 blind authentication, using, 144 blind security functions, use of, 139 blind service architecture, 123, 125 Blizzard Battle.Net service, 24 free online game play service offered by, 24 World of Warcraft, 4, 69 BMG Rootkit (Sony) use with World of Warcraft, 151 unpopularity of, 25 board games, pattern used in, 176 bootstrapping systems, securing, 58 bots and cheat tools, 148 problems with, 329 sophistication of, 147–148 and syndicates, 197 Brain Age, 169 brand security, Nintendo and ADV Films, 28–29 break-even analysis, performing, 26–27 bridge style rankings, explained, 204 bridging, defined, 161 broker model, explained, 228 BSA (Business Software Alliance), 23 buddy high scores, explained, 185 Burning Crusade, licensing, 270 business models, security problems related to, 129–130 business risk and liability, overview of, 218–221 byte-code, attack on, 137

C CAARDS reference model, 110 CALEA (Communications Assistance for Law Enforcement Act), 349 Call of Duty 2, security failures of, 130 Call of Duty, “kill cam” feature in, 148 CAPTCHAs (Completely Automated Turing Test To Tell Computers and Humans Apart), 149–150 card games, pattern used in, 176 Caribbean, success of online gambling in, 68 casinos, accidental, 326–327 cataloging problem, fighting in trivia games, 168 CCP Games (EVE Online), 137 CD key, problems with, 34–35 CDS (cheat detection systems), 150–154 challenge/response card, 299 login protocol, modifying, 71–72 score posting, 185 Champions, 109 chargeback fees, considering, 276 cheapness, security problems caused by, 10–11 cheat codes, use of, 106–107 cheaters, attacks by, 190 cheating boundaries of, 146–149 costliness of, 105 demonstrating, 148 detecting, 121 versus fair play, 105–106 “for fun,” 120–121 versus hacking and exploits, 108 in high-score games, 181–182 importance of, 104 interpreting, 103 overview of, 102 seduction of, 102–103 by server, 111 in single-player games, 103 threat of, 366 tools used in, 149 using cheat-detection tool with, 16 See also anti-cheating techniques cheating setup, bridger in, 159 checksums benefits of, 73–74 and ID license key system, 35–36 using with game data, 136–137 chess, solvers for, 147

Index

Chief Information Security Officer (CISO), problem with, 369 child pornography, overview of, 318–319, 321–322 children capabilities for online services, 318–319 and identity, 320–321 protecting communications of, 316–317 sexual solicitation of, 313–314 targeting games to, 303 Children’s Online Privacy Protection Act of 1998 (COPPA), 319–320 China anti-piracy innovations of, 29 GDP related to software, 23 server piracy in, 67 chips, attacking information in, 58 CISO (Chief Information Security Officer),problem with, 369 City of Heroes (Cryptic Studios), 269 Clemson University study of cyberbullying, 315–316 client/authoritative server networking, 116–117 client ID, creating with security client, 150–151 client-server option, using, 184 client-side security, end of, 120–121 clocks, considering in license policies, 53 cloning online game services, 68 CO: Connection Optional, explained, 95 code as data, 137 vulnerability of, 137 code losses, occurrence of, 257 code obfuscation, explained, 40–41, 139 code theft, overview of, 255–257 collaborative game security architecture, 124, 126 collection, availability in cheat detection systems, 152 collusion in ladder game play, 197 player, 127–129, 167 in tournaments, 197 in tournaments and ladder games, 197 communications abuse of, 190 griefing and spam, 210–215 Communications Assistance for Law Enforcement Act (CALEA), 349 community sites, overview of, 273 community systems, limitations of, 211 competition, levels of, 204

387

Completely Automated Turing Test To TellComputers and Humans Apart (CAPTCHAs), 149–150 “conduit” model, adopting in lawsuits, 272 configuration data, vulnerability of, 137 connections, options for, 95 Consistency in ACID, explained, 156 console attacks considering emulators in, 56 duplicating game storage media, 55 hardware hacking, 57 manipulating media players, 56 secure bootstrapping, 58 on software, 57 console games anti-piracy strategy for, 25 attacking save game files in, 141 experimenting with pricing of, 62–63 functionality of, 58–59 memory used in, 141 console processors, targeting directly, 56 consumers, concerns about game security, 4 content, considering in license policies, 54 content distribution detecting, 33–34 preventing, 32–33 contingency planning, overview of, 342–343 contracts comparing to software, 266 content of, 266 indemnification section of, 350 security considerations, 266–267 Control, role in CAARDS reference model, 110 coordinated action collusion, explained, 129 COPPA (Children’s Online Privacy Protection Act of 1998), 303–304, 315, 319–320 copyright infringement, occurrence of, 220–221 counters, considering in license policies, 53 covert fingerprinting DRM system, using, 46–47 CR: Connection Required option, explained, 95 credit card fraud, impact of, 287, 289 crimes, punishing, 243–244 Cryptic Studios (City of Heroes), 269 cryptographic checksums, benefits of, 73–74 cryptography effectiveness of, 71 in secure digital distribution, 89 use in DRM, 46 use of, 182

388

Protecting Games: A Security Handbook for Game Developers and Publishers

Cryptologic Inc., attack on online casino, 4–5 The Cuckoo’s Egg (Clifford Stoll), 7 currencies (convertible), risks associated with, 291 CV: Connection Value option, explained, 95 Cx (D or T) connection option, explained, 95 cyberbullies, dealing with, 315–316

D DAC security policy model, explained, 51–52 Dance Dance Revolution, 173 Dark Age of Camelot (EA Mythic), 134 DAS (Digital Affiliate System) DMA player, 86 Media Asset, 86 overview of, 84–86 data obfuscating, 40–41 splitting, 40–41 storing, 41 data disclosures low standard fine for, 306–307 overview of, 255–257 data hash, explained, 136 data integrity, importance in encryption, 72–73 data obfuscation basis of, 139 use of, 134–137 data-protection techniques, 136–137 data storage, cost of, 32 Dead or Alive, 221 defensive proxies, overview of, 157–158 delegate security strategy, explained, 14 Delfino v. Agilent Technologies, Inc., 272 Demaio, Harry (Information Protection and Other Unnatural Acts), 6 denial of service (DoS) attacks, overview of, 336–339 design exploits, overview of, 166 designing for medium, 179 detect security strategy, explained, 15 deterministic games, 186 deter security strategy, explained, 15 development process, including protection in, 18 development, running in parallel to, 17 Diablo (Blizzard) attack on, 120 Cheaters’ Tournament, 102 storage of data for, 135 differential data/data chaining, explained, 137

differential storage, use with obfuscators, 135 Digital Affiliate System (DAS) DMA player, 86 Media Asset, 86 overview of, 84–86 digital distribution, security of, 87–91 Digital Rights Management (DRM) ineffectiveness of, 45 overview of, 44 problems with, 45 problem with, 183 use of cryptography in, 45–46 digital signatures benefits of, 73 problem with, 183–184 using, 45–46, 182–184 using in DRM (Digital Rights Management), 49 disasters and disaster recovery, overview of, 342 Disney, anti-piracy innovations of, 29 Display, role in CAARDS reference model, 110 distribute and update, availability in cheat detection systems, 153 distributed development, risks associated with, 256 distributed state systems, synchronization models used by, 112–114 distribution, security of, 87–91 distribution piracy detecting, 33–34 preventing, 32–33 DLL injection, 138 DMA player in DAS, features of, 86 DMA Registry in DAS, features of, 87 dominant strategies, use of, 175 DoS (denial of service) attacks, overview of, 336–339 downgraders, problems with Sony’s PSP, 58 DRM (Digital Rights Management) ineffectiveness of, 45–46 overview of, 44 problems with, 45 problem with, 183 use of cryptography in, 45–46 DRM systems digital signatures, 49 encryption, 49–50 fingerprinting and covert fingerprinting, 46–48 license policies in, 51–54 obfuscation, 50–51 proprietary encoding, 50 security labels and tags, 49

Index

split delivery, 51 watermarking, 47–48 DS handheld console (Nintendo) piracy problems with, 25 popularity of, 28 dupe attacks occurrence of, 156 solution to, 156 dupe exploit, example of, 109 duplication detecting, 33–34 preventing, 32–33 Durability in ACID, explained, 156 DVD players versus video game consoles, 62 DVDs console attacks related to, 56 regional encoding system used for, 33 Dwarf Fortress (Tarn and Zach Adams), 175

E EA (Electronic Arts), release of Spore, 217 EAM Mythic (Dark Age of Camelot), 134 economic system, fighting server piracy with, 70 emulators, problems with, 56 encryption benefit of, 73 bypassing, 72–74 data integrity of, 72–73 limitations of, 39 popularity of, 17, 41 problems with, 45 problem with, 183 with static key, 136 using, 182–184 using in DRM (Digital Rights Management), 49–50 engines. See game engines; graphics engines entertainment publishers, power of, 98 Entertainment Software Association (ESA), 23, 26 Entropia Universe (MindArk), 130 entry spreading, 196 Epic Software (Unreal), popularity of, 50 episodic gaming considering, 98 pricing of, 63 errors, extending in secure digital distribution, 90 ESA (Entertainment Software Association), 23, 26 escorting, defined, 223

389

escort services, explained, 240 EU, legal requirements for privacy protection, 309–310 EVE Online (CCP Games), 137, 217 EverQuest MMO gold-buying associated with, 225 handling griefing for, 210–211 exception game, Magic: The Gathering, 175 exploits versus cheating and hacking, 108–109 of game design, 166 of shared saves, 141 External Affiliation collusion, explained, 128 External Authoritative synchronization model, explained, 114

F F2P (free-to-play) model challenges of, 129–130 popularity of, 227–228 Fable 2 pub games, problem with, 108 Facebook, targeting for spam, 210 facilities requirements, 349–350 fair play versus cheating, 105–106 Family-Safe Gaming Initiative (Microsoft), 314 fan sites, overview of, 273 faux multi-player gaming, explained, 185 FBI investigation of payment fraud, 290–291 feature versioning, considering in license policies, 53 “feelies” (Infocom), 34 financial database, inclusion in game services, 340 fingerprinting DRM system attacks on, 48 using, 46–47 firmware, updating for duplication, 33–34 Flooz, fraud associated with, 290 fraud, safeguarding against, 288. See also gold frauder; insider fraud friend codes, using for children, 317

G gambling defining, 325–326 versus gaming, 326 Wire Act related to, 331 game accounts, security of, 289–290 game addiction, overview of, 304–306

390

Protecting Games: A Security Handbook for Game Developers and Publishers

game cheating boundaries of, 146–149 costliness of, 105 demonstrating, 148 detecting, 121 versus fair play, 105–106 “for fun,” 120–121 versus hacking and exploits, 108 in high-score games, 181–182 importance of, 104 interpreting, 103 overview of, 102 seduction of, 102–103 by server, 111 in single-player games, 103 threat of, 366 tools used in, 149 using “cheat detection” tool with, 16 See also anti-cheating techniques game clients, vulnerability of, 152 game commerce alternative models for, 227–228 problems associated with, 223, 226 game consoles anti-piracy strategy for, 25 attacking save game files in, 141 experimenting with pricing of, 62–63 functionality of, 58–59 memory used in, 141 game demographics, change in, 24–25 game engines versus graphics engines, 142 keeping data on, 138 game industry alternative models for, 227–228 competition with movies, 62 game injection, explained, 161 game integrity, importance of, 260 game operations architecture, 341 game operators versus gold farmers, 236 problems with, 201–202 sample architecture, 340–342 “Game Over” game, 199 game pirates, values of, 13 game play automating portions of, 147–148 griefing, 215–217 patterns, 176–178

game players, categories of, 224–225 game-play patterns, 176–178 game protection basis of, 366 challenge of, 16 global industry challenges, 367–368 including in development process, 18 security beyond technology, 368–369 Game Save problems, occurrence with Sony’s PSP, 59 game save sharing, explained, 203 game scams, categories of, 347 game security accountability in third-party development, 267–268 accountability in third-party licensing, 268–270 balancing with ease of use, 55–56 being concerned about, 3–5 beyond technology, 368–369 business of, 367–370 challenge of, 5 versus complexity, 19 contract considerations, 266–267 contracting, 266–267 of digital distribution, 87–91 effectiveness of, 7 elements of, 3 fatalistic attitudes toward, 6 importance of, 3 importance to consumers, 4 linguistic trap associated with, 6 as means of managing uncertainty, 15–17 of online games, 43 for online games, 71 of operations, 352–353 ownership of, 369 PCI-DSS, 289 perception of, 356–357 simplicity of, 19–20 subjective definitions of, 9 game security architectures Blind Service model, 123, 125 collaborative model, 124, 126 Trusted Third Party model, 122–123 game security incidents in 2001 to 2004, 378 in 2005, 377–378 in 2006, 373–377 in 2007, 372–373 and incident response, 354–356

Index

game servers putting mathematical models on, 171 using public keys with, 71 game services ensuring integrity of, 185 scams related to, 328–329 security-related components of, 340–341 systems included in, 340 using proxy servers with, 338–339 game state, attacking, 142, 183. See also state-based networking game usage, restricting, 304 gamers, stereotypes of, 24 games attacking via local applications, 132 high price of, 63 operating as services, 26 partial information in, 115 performing break-even analysis of, 26–27 physical security of, 63–64 retrospective verification of, 115 scams in, 345–347 GamesFirst! (Shawn Rider), 159 GameShark and R4 hardware hacks, 108 GameStop 2007 Annual Report, on used games market, 60–61 gaming versus gambling, 326 Gears of War, 143 ghosting in tournaments and ladder games, 198–199 Glider tool, using with World of Warcraft, 147–148 Gödel, Escher, Bach: an Eternal Golden Braid (Hofstadter), 19 Gödel’s Theorem, 19 gold farmers versus game operators, 236 motivations of, 17 gold farming countermeasures for, 232–236 defined, 223 impact on customer service, 231 objectives of, 13 overview of, 230–236 solutions for, 238–239 gold frauders, problem with, 241. See also fraud Grand Theft Auto: Liberty City Stories, 59 graphics engines versus game engines, 142 vulnerability of, 138, 142 graphics, exploit associated with, 109

391

grief, inflicting, 209–210 griefing behaviors associated with, 190 countermeasure for, 211 deterring, 213 game play, 215–217 high-score or player-name, 215 managing, 211 methods of, 209 solutions for, 212–215 Guangzhou Optisp (Legend of Mir 3), 67 Guild Wars (ArenaNet), 24 Guitar Hero, 98, 173–174

H Habbo Hotel, problems with virtual prostitution, 240 hacker proxies, overview of, 158–163 hackers, attacks by, 190 hacking versus exploits and cheating, 108 servers, 122 hacks, fake examples of, 148 Half-Life, 255 Halo 2 French version of, 271 insider fraud related to, 259 proxy problems with, 159 Halo 3, Save Films feature in, 179 harassment, dealing with, 220 hardware hacking difficulty of, 57 R4 and GameShark, 108 hash functions, using, 143, 182–184 Havok, physics engine from, 255 hidden state and partial information, 115 high-score games, cheating in, 181–182 high-score strategies, alternatives for, 185–186 high-speed games, problems with, 174 HMI (human-machine interface) design, importance of, 352 Hofstadter, Douglas (Gödel, Escher, Bach: an Eternal Golden Braid), 19 honeytrap memory, explained, 137

I I1 installation option, explained, 95 ID and checksum license key system, 35–36

392

Protecting Games: A Security Handbook for Game Developers and Publishers

identify theft, overview of, 306–308 identity establishing, 253 importance of, 296 problems with, 202–203, 294–295 state of, 295–296 identity cards, counterfeiting, 290 identity systems components of, 296–297 registration problem with, 296–302 types of, 298–300 Id Software, pricing of Rage, 62–63 ignore security strategy, explained, 14 Illegal Gambling Business Act of 1970, 331 illegal payments, overview of, 290–291 implicit features, including in games, 186 IMVU, 217–218 Incompleteness Theorem, proof of, 19 indemnification defined, 268 section in contracts, 350 independence, achieving goals of, 8 indirect data stores, explained, 136 Infocom (”feelies”), 34 Information Protection and Other Unnatural Acts (Harry Demaio), 6 inside players, problem with, 201 insider fraud countermeasure for, 262–264 occurrence of, 259–260 See also fraud installation considering in license policies, 53 options for, 95 insure security strategy, explained, 14 internal authoritative synchronization model, explained, 113–114 Internet use, security risk associated with, 258 Iron Realms (Achaea), 228 isolation and privileging, overview of, 262–264 Isolation in ACID, explained, 156 Ix installation option, explained, 95

J Jagex (RuneScape), popularity of, 62, 228 judgment proof, defined, 257

K keygens, explained, 36 key-loggers, use of, 4 keys. See license keys; public key kid-friendly services, securing, 316–317 kids communications, overview of, 316–319 Kim, Min, 104, 288 King, Stephen (The Plant), anti-piracy innovation of, 29 Knight Online, punishment related to, 248 Korea commercial game hack tools in, 149 outsourcing security in, 269 Koster, Raph, 229 Kowalski, Robin, 316 Kreb, B. (”Web Fraud 2.0”), 149–150

L ladder games collusion in, 197 game configuration, 198 ghosting, 198–199 ladders, use of, 193–194 law enforcement, overview of, 348–349 Lawrence Berkeley National Lab, investigation at, 7–8 lawsuits, dealing with, 272 layered security, significance of, 7 laziness, security problems caused by, 10 legal considerations federal laws and regulations, 331–332 overview of, 329–333 state laws and regulations, 332–333 Legend of Mir 3 (Guangzhou Optisp) fraud associated with, 259 server piracy of, 67, 122 The Legend of Zelda: Twilight Princess, 59 LGK (license generation key), sharing, 38 liability and business risk, overview of, 218–221 licensees and licensors, 271 replacing, 270 license keys ID and checksum, 35–36 online authorization, 37–38 protecting, 39 public key encryption, 36–37 splitting data for, 40–41 using, 39

Index

license policies controlling, 52–54 use in DRM systems, 51–54 licensing games, due diligence process of, 269 Limbo (Svenska Spel), 127–129, 197 Lineage II (NCsoft) bots for, 148 server piracy of, 67 Lineage III, 257 live connection, considering in license policies, 53 live play, overview of, 329 lobby attacks, 195–196 logging systems, inclusion in game services, 341 Lumines, 59

M MAC (Message Authentication Code) security policy model, explained, 51–52 using, 143 Magic: The Gathering exception game, 175 malicious code, targeted, 121 malware from Asia, statistic related to, 4 MapleStory (Nexon), popularity of, 62, 129 markets and regions, considering in license policies, 52 mathematical models, putting on game servers, 171 MD5 hash function, using, 143 Media Asset in DAS, features of, 86 MediaDefender service, 18 media piracy, fighting, 29 memory attacking, 132–134 in console games, 141 memory editors, use of, 133–134 merchant accounts, using, 277 Metaplace, 217–218 Metroid Prime Hunter, 141 MGame (Yulgang), 269 Microsoft’s Xbox 360 console, attack on, 33–34 MindArk (Entropia Universe), 130 MMOs movement to P2P (peer-to-peer) architecture, 70 simple game mechanics of, 67 vulnerability to server piracy, 66 moneybookers, using, 279 money, conversion of virtual currency into, 130 money laundering legal issues related to, 291–293 use by terrorists, 361

393

monitoring online services for children, 317 overview of, 316–319 Moore’s Law, relating to emulators, 56 Morris Trap, 300 movies, competition with game industry, 62 multi-player gaming, 79 paper by Matt Pritchard, 111

N N-1 Secure, goal of anti-cheating, 124–125 nagware, activation by anti-piracy systems, 42 NCsoft (Lineage II) bots for, 148 server piracy of, 67 Nelson, Major, 352–353 network games action based, 117–120 implementation of, 111 problems with, 159 state-based, 111–116 synchronization challenges, 115 network time, considering, 163–165 newest wins synchronization model, explained, 112–113 Nexon (MapleStory), popularity of, 62 Nine Inch Nails, anti-piracy innovation of, 29 ninja looting problem, explained, 216 Nintendo DS handheld console, 25, 28 trusted brand security of, 28–29 “NO DISK” hacks, popularity of, 35 “no download” games, 66 non-repudiation, explained, 213 NOOP instructions, replacing verification functions with, 140 number games, 169–170

O obfuscating data, 40–41 obfuscators DRM system, 50–51 use of, 134–137 obscenity, dealing with, 219–220 Office IT, infrastructure of, 258–259 online authorization license key system, 37–38 online gambling, success in Caribbean, 68

394

Protecting Games: A Security Handbook for Game Developers and Publishers

online game services ensuring integrity of, 185 scams related to, 328–329 security-related components of, 340–341 systems included in, 340 using proxy servers with, 338–339 online games alternative models for, 227–228 ease of building, 69 globalization of, 68 movement to P2P (peer-to-peer) architecture, 70–71 original reason for development of, 66 security focus for, 71 storage of, 43 online identity. See identity online payments, growth of, 70 online poker, solvers for, 146 operating systems, targeting directly, 56 operations, security of, 352–353 “The Orange Book,” security grades in, 51 outsourcing explained, 203 risks associated with, 256 OutWar, 197

P P2P (peer-to-peer) architecture movement of MMOs to, 70 movement of online games to, 70–71 packet hacks, types of, 161 parental controls, overview of, 316–319 partner security issues, 270–273 passwords, protecting with Morris Trap, 300 patterns, types of, 176 payment abuse, explained, 201–202 payments fraud, 287, 290–291 illegal, 290–291 processing, 276–280 PayPal, using, 277–282 PC games anti-piracy approach for, 35 pricing of, 62 PCI-DSS standard compliance with, 288 overview of, 289 pedophiles, dealing with, 315–316 penetration testing, weaknesses of, 17

phased distribution explained, 214–215 pacing, 215 physical security tokens, benefits of, 352 piracy cost of, 26 determining scope of, 24–28 estimated annual costs of, 4 insider, 69 international impact of, 23 measuring, 75–76 online game appliances, 69 owning problem of, 38 of PlayStation 2, 60 rate of, 23 reconsidering approach toward, 99 strategies toward, 25 as theft, 22 troubled partnerships, 69 See also anti-piracy; server piracy pirate networks, fighting, 76–78 pirates converting to resellers, 87 handling after catching, 42 pricing out of business, 62–63 Pirates of the Caribbean MMO game, 137 The Plant (Stephen King), anti-piracy innovation of, 29 platforms, considering in license policies, 53 player collusion, 127–129, 167 player handles, inappropriate, 187 players banning, 245 distinguishing from programs, 149–150 player systems, inclusion in game services, 341 PlayStation 2, piracy of, 60 poker, automation of, 147 pornography, child, 321–322 power-leveling defined, 223 overview of, 239–240 pre-paid cards, using, 279 Prince of Persia, replay system in, 179 Pritchard, Matt, 111 privacy, overview of, 306–308 privacy protection, legal requirements for, 308–310 private keys, signing messages with, 213 privileging and isolation, overview of, 262–264 programs, distinguishing from players, 149–150

Index

Project Entropia, 129 proprietary encoding DRM system, using, 50 protect, detect, react, 13 protection basis of, 366 challenge of, 16 global industry challenges, 367–368 including in development process, 18 security beyond technology, 368–369 protect security strategy, explained, 15 proxies defensive, 157–158 hacker, 158–163 proxy design, advantage of, 158 proxy servers, using with game services, 338–339 PR (public relations), perception of security in, 356–357 public key credentials, 299 encryption, 36–37 fighting replacement of, 72 using with game servers, 71 punishments cost of, 244–245 credibility of, 243–244 and credible deterrence, 245–248 goals of, 243–244 possibilities for, 245–248 puzzle games, 169–170, 186 Puzzle Pirates (Three Rings), 129 Python byte-code, attack on, 137

Q QuickTime, vulnerability of, 130

R R4 and GameShark hardware hacks, 108 race conditions and “dupe” exploits, 109 explained, 108 occurrence of, 155–156 in World of Warcraft, 156 Radiohead, anti-piracy innovation of, 29 Rage (Id Software), pricing of, 62–63 Ragnarok Online (Shanda Interactive), 67, 156 rake abuse, explained, 201–202 randomized features, using, 172 randomly seeded client solution, implementing, 184 random number systems, 125–127

395

Random, role in CAARDS reference model, 110 rank boosting and busting, 196 ranking systems countermeasures for, 204 overview of, 192–195 purposes for, 194 types of, 193–194 react security strategy, explained, 15 real world attacking via virtual world, 360 establishing strong identity in, 253 money in, 252 the insider problem in, 252 recover strategy, explained, 13 regions and markets, considering in license policies, 52 registration considering in license policies, 53 options for, 94 problems with, 296–300 Reign of Revolution, 326 the remote data problem action-based networking, 117–120 client/authoritative server networking, 116–117 state-based networking, 111–116 replayable game logs, explained, 186 resync attack, explained, 161 reward security strategy, explained, 14 rewriteable DVDs, manipulating in console attacks, 56 RF Online, cheating in, 355 Rider, Shawn (GamesFirst!), 159 risk, impact on protection, 12–13 RIS (rich interaction systems), 79–84, 102. See also anti-piracy RMT (real-money transactions), fairness of, 105 Rock Band, 98 rock-paper-scissors game, 162–163 Roma Victor, punishment related to, 248 RO: Registration Optional option, explained, 94 round robin method, using with merchant accounts, 277 Royal Canadian Mounted Police, impact of piracy on, 23 RR registration option, explained, 94 rules processing, types of, 119 Rules, role in CAARDS reference model, 110 RuneScape (Jagex), popularity of, 62, 228 RunUO Products Page, 67 Rxx (D or T) registration option, explained, 94

396

Protecting Games: A Security Handbook for Game Developers and Publishers

S save game files, attacking in console games, 141 scalability and availability, overview of, 339–340 scams in games, overview of, 344–347 score table constants, altering, 183 Scrabble Word Finder, 169 Second Life, 129–130, 217–218 secure bootstrapping, 58, 143 secure loading, process for, 143 secure operations, 352–353 security accountability in third-party development, 267–268 accountability in third-party licensing, 268–270 balancing with ease of use, 55–56 being concerned about, 3–5 beyond technology, 368–369 business of, 367–370 challenge of, 5 versus complexity, 19 contract considerations, 266–267 contracting, 266–267 of digital distribution, 87–91 effectiveness of, 7 elements of, 3 fatalistic attitudes toward, 6 importance of, 3 importance to consumers, 4 linguistic trap associated with, 6 as means of managing uncertainty, 15–17 of online games, 43, 71 of operations, 352–353 ownership of, 369 PCI-DSS, 289 perception of, 356–357 simplicity of, 19–20 subjective definitions of, 9 security by obscurity, 19 security client, using in cheat detection systems, 150 security insanities, types of, 365–366 security issues game service scams, 328–329 live play, 329 poker, contest, and skill game bots, 329 security label DRM system, using, 49 security principles Anything easy, 7 Effective security, 7

Make adversary work, 16 Simplicity, 19 security problems causes of, 10–12 impact on business, 129–130 occurrence of, 9 security software, bundling with game security tools, 154 security strategies avoid, 14 delegate, 14 detect, 15 deter, 15 ignore, 14 insure, 14 protect, 15 react, 15 recover, 13 reward, 14 security testing tools, using, 18 security tokens, use of, 299 self-improvement game, Brain Age as, 169 server code reverse engineering of, 68 stealing, 68 server networking, client/authoritative, 116–117 server piracy combating, 70 versus service piracy, 68 trends in, 66–70 See also piracy servers authenticating, 70–72 cheating by, 111 hacking, 122 service providers, partner security issues related to, 270–273 sexual favors (virtual), problems with, 240 Shanda Interactive (Ragnarok Online), pirate server for, 67, 156 shared knowledge collusion, explained, 128 shills, problem with, 201 signatures, attempts at stabilization of, 16 silent filter services, using for children, 317 The Sims Online, problem with virtual sexual favors, 240 SiN Episode 1 (Valve’s Steam service), 24 single-player games cheating in, 103, 106 pattern used in, 176

Index

skill games overview of, 186, 327–328 retrofitting, 206 smart USB tokens, use of, 149 Smedley, John, 236–237 social subversion overview of, 190–191 threat of, 366 Söderström, Hampus (Toribash), 175 soft failures, explained, 137 SoftICE tool, use in Diablo attack, 120–121 software attacks goal of, 57 tracking progress of, 59 Sony’s BMG Rootkit, 18 unpopularity of, 25 use with World of Warcraft, 151 Sony’s PSP Game Save problems associated with, 59 problems with downgraders, 58 problems with image viewer, 59 source authentication, achieving, 73 spam and griefing, 190, 209–215 speed hacks, types of, 160–161 Spel, Svenska (Limbo), 197 split data stores, explained, 137 split delivery DRM system, using, 51 splitting data, 40–41 Spore (Electronic Arts), 217 sporting events, legal wages based on, 331 SQL injection attacks, vulnerability to, 157 SSL, problem with, 183 stalkers, dealing with, 315–316 standbying, explained, 161 Stardock (Brad Wardell), 24–25 StarForce anti-piracy product anti-piracy saga, 18 duplication strategy of, 33 unpopularity of, 25 Star Wars: Galaxies, vulnerability to server piracy, 66 state, attacking, 142, 183 state-based networking versus action based networking, 119 problem with, 116 synchronization models, 112–114 state information, reading, 134 State, role in CAARDS reference model, 110 stat guarding, defined, 199

397

statistical independence, achieving goals of, 8 steganography, using in secure digital distribution, 88–89 Stoll, Clifford (The Cuckoo’s Egg), 7 strategy versus cheating, 146–149 strong play tool, Scrabble Word Finder as, 169 strong strategies, use of, 175 stupidity, security problems caused by, 10–11 subletting, explained, 240 Sudoku, solvers for, 146 surveillance, availability in cheat detection systems, 152 Svenska Spell (Limbo), 127–129 synchronization models, using with distributed state systems, 112–114 syndicates and bots, 197 system memory, attacking, 132–134

T tag DRM system, using, 49 A Tale in the Desert, 194, 204 terrorism (virtual), overview of, 359–360 terrorists, online tools for, 360–362 the insider problem, perception of, 252 Thorp, Edward (”Beat the Dealer”), 170 threats, impact on protection, 12–13 Three Rings (Puzzle Pirates), 129 tiered distribution, considering in license policies, 53 till fraud, explained, 201–202 time policy, creating, 163–165 timers, considering in license policies, 53 time, securing, 165 “time to penis,” 217 Titan Quest, 42 Toontown Online, griefing solution for, 212 Toribash (Hampus Söderström), 175 tournaments collusion in, 197 countermeasures for, 204 game configuration, 198 ghosting, 198–199 growth of, 190 and lobby spiking, 195 overview of, 192–195 retrofitting games for, 206 TPM (Trusted Platform Module), 58, 90 trademark infringement, occurrence of, 220–221 Travel Act, 331

398

Protecting Games: A Security Handbook for Game Developers and Publishers

trivia games, 167–169 trusted brand security, Nintendo and ADV Films, 28–29 trusted client problem, 111 trusted platforms, problems with, 9 trusted third party model, 122–123 Turbo Squid, 220–221 Turing, Alan, 19 turn-based physics games, skill games based on, 171

U Ubisoft lawsuit, 257 Ultima Online, vulnerability to server piracy, 66 UltimateBet.com online poker site, 122, 126 Ultimate Online Baseball MMO, 199 ultra-violence, explained, 202 uncertainty, managing, 15–17 Unreal (Epic Software), popularity of, 50 usage controls, overview of, 304–306 USB tokens, use of, 149 used games market anti-piracy strategies for, 61 revenue generated by, 60 user account system, inclusion in game services, 341 user-created content, overview of, 217–218 user types, categorizing for license policies, 52 U.S., legal requirements for privacy protection, 309

W wallhack, explained, 142 Wardell, Brad (Stardock), 24–25 watermarking DRM system attacks on, 48 using, 47 “Web Fraud 2.0,” (B. Kreb), 149–150 web of trust, problem with, 301 whitelist authorization service, supporting, 338–339 whitelist chat services, using for children, 317 whitelists versus blacklists, 151 Wikipedia, attacks on, 362 Wire Act, 331 word games, 169–170 WOW (World of Warcraft), 217 attack by Sony BMG’s Rootkit, 18 authentication token for, 4 licensing of, 69 player collusion in, 128–129 race condition in, 156 Sony BMG Rootkit used with, 151 using Glider tool with, 147–148

X Xbox 360 console (Microsoft), attack on, 33–34, 56 Xbox Live, internal security problems with, 352–353

V

Y

validation considering in license policies, 53 importance of, 41 Valve’s Steam service (SiN Episode 1), 24 verification functions, replacing with NOOP instructions, 140 video game consoles versus DVD players, 62 virtual currency, conversion into money, 130 virtual items, ownership of, 228–229 virtualization tools, use of, 120–121 virtual prostitution explained, 240 problem with Habbo Hotel, 240 virtual terrorism, 359–360 virtual worlds, attacks on, 359–360 Vote synchronization model, explained, 113 V: Registration Value option, explained, 94 vulnerabilities, impact on protection, 12–13

Yee, Nick, 225 YouTube threat, 148 Yulgang (MGame), 130, 269

Z zero-sum scoring, 200