Quote from: Lionel on May 17, 2016, 01:03:35 AM

P.S.
If some white-hat hacker is willing to give us hints to improve this situation, we will appreciate and we will give all the info we have gathered about this episode.

This comment attracted my curiosity and I had a quick look at your game (my Game GUID is 1A2C710F-B024-4E07-A98C-75269F3C786D and I'm not interested in your Bitcoins, so feel free to block that user if you want to Cheesy

).

Games like these are hard (or even impossible) to make hacker-proof (if you have solved all levels once, you can probably quickly solve them again; so can a computer), but you can at least make it a lot harder than currently (if you wireshark the traffic of completing 2 levels you basically know how to complete all 40 without requiring any reversing of the game code at all...).

A few hints, sorted by effectiveness (top ones are easy to implement and mildly effective, bottom ones harder to implement but more effective):

Use HTTPS, if your ISP provides it. This one is quite easy to get (certificates are damn cheap or even free in case of LetsEncrypt) and an attacker will at least have to mess with a proxy to be able to still sniff the traffic. I don't know if Unity supports certificate pinning, but if it does, it gets even harder to bypass.
Validate your HTTP headers (like User-Agent). This won't stop any determined skilled attacker, but may provide enough hassles to let a typical script kiddie give up, as request cannot be easily replayed in a browser.
Add some dynamic authentication into your game. For example, take the game GUID together with the game data, add some long constant string (hard coded in the game) and build a SHA hash of them and add to the saveGameData request. Don't forget to verify it on server side. This is not infallible, but it will at least prevent replaying (if you have solved all levels once, you cannot replay the requests from another computer and/or with another game ID to instantly solve all levels too). Note that the effectiveness of this method depends on how easy it is to reverse the code of your program (no experience with Unity here, but I guess there are obfuscators for Unity too that make it harder).
Add some proof of work. Currently the game data just contains 1: true, 2: true, etc. Replace the true by a string depending on gameplay (e. g. a matrix where you code where the player placed an arrow or a bomb or anything) and verify the strings server side (just hard-code the correct solution(s) on the server). That prevents an attacker who has reversed the code (see point above) to instantly solve all levels, but won't help against an attacker who has already solved all levels at least once.
As I did not get to the payout process, I cannot say if you already do it, but consider including a captcha in the payout process (I'd also include one when initially setting up an account, but it depends on acceptance by the users). That way, even if a skilled attacker is able to complete hundreds of games automatically, he will still have to enter many Captchas to be able to pay out (assuming he can get 0.001 BTC per game easily, it would still require 300 Capchas to get 0.3 BTC paid out).
Probably most effective: Add some rate limiting. Each IP will host probably less than 100 unique players on any given day (if your geoip provider provides information whether an IP is shared by multiple parties like on some mobile networks, use that to adjust these measures). Each level takes some time to play through (for watching the intro, watching the animation of the level, and watching the ad), so measure this time, subtract a few seconds for safety and validate the achievements against the elapsed time (i. e. if a user jumps from 2 solved levels to 40 solved levels in less than a minute, he must be cheating and probably should be blocked). Also, limit the number of possible payouts per IP per day (lower than the number of unique players per IP).

Hope this helps and good luck,

mihi

mihi

Posts

Merits