Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ask Slashdot: How Serious Is Hacking In Mobile Games?

Posted by Soulskill on from the going-for-the-high-score dept.

Origen writes: As a developer contemplating trying out the mobile game scene, a GDC session about hacking/tampering looked interesting — but I wasn't able to attend. The presentation isn't available online, but it was paired with a whitepaper [contact details required], which can be downloaded. I'm surprised by some of the information presented and the potential for damage/mischief. Not so much that these issues are unheard of — they've existed for years on other platforms. What I find surprising is the lack of support at the OS level on mobile devices to defend from many of these types of hacks. Have we learned nothing from the pains of the past? How significant are the points about hacking/piracy in the mobile space that are discussed by this whitepaper?

47 of 86 comments (clear)

  1. If you don't control it it's compromised. by Anonymous Coward · · Score: 2, Informative

    OS level protection wouldn't do much if someone's really dedicated, they'll just remove those protections if needed. Assume everything coming through an internet connection is compromised, don't trust your game client.

    1. Re:If you don't control it it's compromised. by gl4ss · · Score: 1

      besides,

      the key is to not trust the client. for highscores/top-times, run a simulation of the game run on the server from the inputs.

      for ingame bought stuff, there is protections. you can check on your server if the player actually paid for the stuff. or you can skip that check and lose money.

      you cannot trust the client - I mean, what the fuck are the protections on the "os" going to do when the game might not even be running on the target os! I mean, the client might be an entirely different program!

      --
      world was created 5 seconds before this post as it is.
    2. Re:If you don't control it it's compromised. by rioki · · Score: 5, Interesting

      I would simply take the same approach you should take with PC games. If it's single player, don't bother. You are wasting resources, resources you can use to make your game just a little more awesome. (more awesome == more sales) Wit multiplayer games, the key point is the server. The server should not trust clients and use heuristics to detect suspicious behavior. Then give administrators the means to moderate their users. (Or a vote system.) Bad behavior is a real issue with multiplayer games, but that is not limited to cheating.

      But since we are talking about mobile games; are users cheating you on the premium currency? Treat is like any other piracy, ignore it and try to win users by making the cooler more awesome game. Maybe communicate that you are an independent developer and need the money to make games.

    3. Re:If you don't control it it's compromised. by wonkey_monkey · · Score: 4, Interesting

      the key is to not trust the client. for highscores/top-times, run a simulation of the game run on the server from the inputs.

      How do you know you can trust the reported inputs? And you can't run a simulation if your game has (truly) random elements, nor can you allow for all device idiosyncracies.

      Now if you'll excuse me, I need to continue work on my Arduino-controlled Wiimote holder so I can finally get a perfect game on Bit.trip Beat.

      --
      systemd is Roko's Basilisk.
    4. Re:If you don't control it it's compromised. by hairyfeet · · Score: 1

      Seems to be working just fine in the PC market, but of course there you have programs like Punkbuster and Steam that are pretty quick at shutting down the cheaters.

      The problem is that mobile OSes are a good 10-15 years behind desktops which is why iOS had more vulnerabilities than Linux and Windows, the mobile OSes are really still in their infancy and just haven't caught up yet and with so many trying to hack them (for good and ill) its gonna take awhile to catch up. I'm sure eventually you'll have something like Punkbuster or some other anti-gamehack program for phones but until then all you can really do is look at the player as a potential bad guy.

      --
      ACs don't waste your time replying, your posts are never seen by me.
    5. Re:If you don't control it it's compromised. by jandrese · · Score: 1

      Even a simulation of the inputs won't prevent all cheating. What if someone has an x-ray hack in place, and maybe even a bot attached that can play a perfect game? The best solution is to just not give a crap and not have online leaderboards or IAP so the only people affected by the hacking are the hackers themselves.

      PvP is a problem though. There's not a lot you can do to prevent some forms of cheating in PvP, but on the mobile space PvP isn't nearly as important anyway. Usually it boils down to "user A submits an army list to the server, user B submits an army list to the server, the server simulates a battle, and then returns the results to both players". As long as your game isn't structured like a CCG with overpowered "rare" units that are supposed to be balanced by being difficult to get (or requiring real money) then it's not so bad. The cheater can submit an optimal army without having to grind, but otherwise they aren't ruining the game for other people too much.

      --

      I read the internet for the articles.
    6. Re:If you don't control it it's compromised. by mlts · · Score: 1

      For real security, the client should just be "eyes/ears" for the server, similar to how MMOs are. This was true back in the UO days, and is true now.

      At least phones and mobile devices are easier to track and ban cheaters because you can ban an account and if any new accounts touch that device's IMEI, they get auto-banned after a random period of time as well. A simple check for a su binary on Android or a check if one can write outside the app's directory in iOS will deal with rooted/jailbroken devices.

      Another trick is to update often, preferably with completely different offsets for code and/or obfuscation algorithms so if a group is making patches for the game, they would have to be constantly after a moving target, even if the update just changes a constant or two.

    7. Re:If you don't control it it's compromised. by Anubis+IV · · Score: 1

      At least the first level of Bit.Trip Beat is pretty easy (I've nearly had perfect scores on multiple occasions, having made it through the toughest parts and then missing easy ones late in the level, all while only playing it casually). But yeah, for those later levels...guh.

    8. Re:If you don't control it it's compromised. by wonkey_monkey · · Score: 1

      I've nearly had perfect scores on multiple occasions

      Exactly. Nearly. Gah!

      --
      systemd is Roko's Basilisk.
  2. Please don't tempt Apple by dottrap · · Score: 1

    People already think Apple's walled garden and sandboxing go overboard. Remember that legit developers have to pay Apple $99/year just to develop+run an app on their own device. Apple also has a long list of requirements about what your app not allowed to do. I'd really hate to see what they do if they got *serious* about locking down the platform.

    1. Re:Please don't tempt Apple by tepples · · Score: 1

      Still not much compared to a developers salary.

      In what country? Different countries have different currencies with different exchange rates to the United States dollar. The cost of a Mac and a certificate are based on exchange rate, not purchasing power parity. And I was under the impression that in order to build demonstrable skills, programmers new to iOS had to each buy a Mac and iPad mini and pay for a certificate out of their own respective pockets before they could get hired for the first time.

  3. That way of thinking is wrong... by Anonymous Coward · · Score: 1

    Blocking any form of "hacking" will also hurt legitimate users. For example, being able to install an APK manually, not every devices come with the Google Play store and quite frankly the Amazon appstore is extremely lacking compared to the Play store. So being able to install apk is a life saver.
    Removing similar features will just hurt the userbase even more.

    1. Re:That way of thinking is wrong... by zopper · · Score: 1

      I totally agree. Making a hack-proof client app is (almost) impossible (don't forget that rooted device gives full control of OS to user), and any attempt costs too much in terms of user experience. But still, all the time we see again and again how developers tries "new" ways of DRM and other stuff, and customers can't use their bought apps, because the verification servers came down...

    2. Re:That way of thinking is wrong... by tepples · · Score: 1

      If you want to run an application that is exclusive to Google Play Store, you have two options. The first is to inform the application's publisher that it is leaving money on the table by not also selling on Amazon. The second is to buy a Nexus device, which comes with Google Play Store access.

  4. Nothing learned? by Dutch+Gun · · Score: 3, Informative

    On the contrary, mobile devices and hardware are awash in security features. Hardware based chain-of-trust, encrypted storage, signed applications, detailed permissions... these are all lessons learned from their big brother operating systems. Modern mobile OSes are actually far more difficult to maliciously subvert than PC systems, but of course, many of those features mean they're also closed systems, and aren't nearly as flexible. It's definitely a trade off. We see that pretty clearly with Android vs iOS, where iOS has a miniscule amount of malware simply by virtue of being a closed system.

    In terms of game development, I think the focus is more on hacking the client than hacking the OS. As a former MMO dev, the rule was that you really can't trust *anything* the client gives you. Simple as that. It makes development a hell of a lot harder, but time and time again we see new MMOs or multiplayer games (presumably created by inexperienced developers) that break this cardinal rule and get hacked all to hell and back.

    --
    Irony: Agile development has too much intertia to be abandoned now.
    1. Re:Nothing learned? by cfalcon · · Score: 1

      ^ Good post, thank you.

    2. Re:Nothing learned? by rodrigoandrade · · Score: 1

      The server basically runs all kinds of calculations in real time to make sure everything the client says it's doing is accurate.

      You buy the Shiny Gold Mace of Obliteration for 20,000 gold, client tells that to server, server runs the numbers to make sure you actually have at least 20,000 gold, said mace is available for purchase, the stats on said mace check with whatever is on the game database, etc.

      That's part of the reason some MMOs have chronical lag issues, no matter how low your ping is. If all that overhead is poorly coded, players will experience lag, no way around it.

    3. Re:Nothing learned? by Dutch+Gun · · Score: 2

      I should clarify that statement a bit: nothing related to actual game state from the client can be trusted. In other words, for instance, you wouldn't rely on the client performing hit-detection and telling the server "I just attacked and hit this creature for x damage". Instead, you would only relay the raw input commands (e.g. "I just pressed the command to cast a fireball") from the client to the server, and it's the server that processes all the game logic, then sends the result back to the client as to whether it hit or not, what the effect was, and so on. The client is really just a dumb terminal with fancy graphics and sound fx.

      Of course, the client also has a full set of local collision data and local agent positions, so it can more or less predict what will happen on the server in advance, especially regarding your character, since it obviously knows how you're planning to control before the server does. This is important to reduce the apparent effect of network latency. Otherwise, the game would feel horribly laggy, especially when moving your character around and firing off spells or skills. Client-side prediction is a pretty old technique for networked videogames, but generally has to be uniquely tailored and tuned for each game you make.

      --
      Irony: Agile development has too much intertia to be abandoned now.
    4. Re:Nothing learned? by TranquilVoid · · Score: 1

      Yes, all the fighting calculations are done on the server. The client doesn't get to do the dice roll for how much damage a swing of their golden mace did. However the client will do their own temporary calculations as to whether the mace can swing (target is in range, last swing is complete etc.) and update the graphics to start showing the swing. Generally the server will return with the damage, or whether it was a miss/block, before the graphical swing is complete, and the client can therefore show the result in real time.

      If the server comes back and says, no, your opponent had just moved out of range then the client has to stop it and it looks a bit jerky. A similar thing happens for movement. The client will move your character instantly, but ultimately the server will sync and tell the client the real position. I believe in some games you can take advantage of the server erring on the side of client smoothness (by tolerating lag and therefore giving a little trust to the client) and get your client to cheat by running a few percent faster.

  5. Probably not by Anonymous Coward · · Score: 1

    Complex topic, I would "no" at least in the scope "should you as a developer take significant steps to prevent hacking"

    Consider following:
    1) The whitepaper is from a company selling services for this, they want to paint a grim picture
    2) Like PC with piracy, Android/jailbroken iOS piracy is likely something you can't solve, but it will take a lot of time & money to fight
    3) People downloading pirated games are pretty much lost audience, they were not planning to buy upfront anyhow
    4) Anti-piracy measures can piss off your real customers. This is much bigger risk in mobile where it's really easy to just move along
    5) If you can detect pirated users, feel free to "up the ante" in ads to full page interstitials, etc. ;)

    So, worry about making a good game, follow best practices about validating IAP results, but let Apple & Google worry about securing APIs

  6. OS Level protections = DRM by cfalcon · · Score: 4, Insightful

    We don't need "OS level protections". It's your phone, you control all the code on it. Same as on your PC. Are you really fucking bitching that phones don't have enough fucking DRM? I'm sure glad to give up all my freedoms so some teenager can't cheat in clash of fucking clans.

    1. Re:OS Level protections = DRM by cfalcon · · Score: 3, Interesting

      As a note: a lot of games already try to detect jailbroken iphones and refuse to play. Because OBVIOUSLY, if you are jailbroken, it must be to cheat at their stupid games. That's like refusing to run if your machine has a local admin account, or the root user has a fucking shell attached. Ludicrous.

      Anyone who wants more of this shit hasn't had the first thought on the topic yet.

    2. Re:OS Level protections = DRM by renderhead · · Score: 3, Informative

      I know this is a troll, but in case anyone is mislead I want to clear up a factual error:
      Jailbroken iPhones absolutely can make purchases from the App Store. I have a history of jailbreaking my phones when they get old to enable certain mods and extensions that are not supported by Apple (for example, I had a notification center on my iPhone before Apple released theirs in iOS 7). It didn't change anything about the way I ran or installed my official App Store apps, and I never downloaded a pirated app.

      --
      I wish that my inferiority complex were as good as yours.

      -RenderHead

    3. Re:OS Level protections = DRM by Lumpy · · Score: 1

      And right there is the ONLY real answer we have had on this subject.

      Thank you for being one of the only sane voices on this.

      --
      Do not look at laser with remaining good eye.
    4. Re:OS Level protections = DRM by Bing+Tsher+E · · Score: 1

      But.. but.. but... the leaderboard. Gotta get toprank. gotta gotta.

    5. Re:OS Level protections = DRM by cfalcon · · Score: 1

      Man, I think the last anything I pirated was X-Wing in the 90s. Then I asked for it for Christmas. But fuck you too.

      I've got a jailbroken iphone, and I've pirated not one goddamned thing. There's a lot of reasons to jailbreak- "the default UI fucks up your background with a goddamned gradient .png file" was my breaking point, but there's others. None of them are piracy. You think things are piracy because you have a filter on, and you think people should be shackled to the whims of developers on the hardware they bought and paid for. Not your hardware. Not your CPU. Theirs.

      So YOU fuck right off, you generalizing goddamned idiot. I say something "high and mighty" because I'm goddamned CORRECT. You don't own my phone, I don't break any laws, and your digital vigilanteeism, inability to handle your own failures at developing (the whole industry blames piracy as if a bunch of broke-ass teens trying to impress their friends were all gonna turn into megasales if only you wrote shittier and more fucked up DRM bullshit), instant ability to generalize me totally incorrectly,combined with a 100% selfcertainty are just going to end up with even more shitty content and more fed up users.

    6. Re:OS Level protections = DRM by phorm · · Score: 1

      Because OBVIOUSLY, if you are jail-broken, it must be to cheat at their stupid games

      No, it's more that if you have a jail-broken device, you may be using an illegitimate/copied version of the software (or movie, or whatever). Getting paid apps for "free" was actually one of the big reasons for the popularity of jailbreaks on early iPhones.

    7. Re:OS Level protections = DRM by cfalcon · · Score: 1

      Irrelevant though. Whether a developer wants to point at the bogeyman of piracy or the bogeyman of cheaters, it's still my phone. The fact that I *could* be a pirate because I have root doesn't mean shit, and anyone who thinks that needs technical discouragement (mostly present), but possibly even legal discouragement as well. Ideally, we'd lose the idea of rootless phones entirely, but the model has been really helpful for its actual only good purpose- noob level users not getting ownfaced like they do in Windoze.

    8. Re:OS Level protections = DRM by phorm · · Score: 1

      I didn't say I agree with it, I was just stating the mentality behind it. Personally, I find it retarded that various ports of SINGLE-PLAYER, previously DRM-FREE games - e.g. Final Fantasy series etc - have to do a phone-home check before you can run them on an Android/iDevice.

      The dumbest part is that one of the first thing that happens when a pirate version of the game comes out is that all the stupid DRM shit is stripped off anyways, giving the pirates a better copy than those that legitimately purchased it.

      In the cases of some PC games, the DRM has been known to make the game crash, or even break systems. I seem to recall that there were various cases of Starforce/SecuROM breaking optical drives, for example.

  7. The paper is marketing bull by nomaddamon · · Score: 3, Interesting

    Most of the advises given (if not all) are ineffective and in some cases make things worse.

    Code and data obfuscation only provides false sense of security (and a large paycheck for your "security" vendor) - If i have access to binaries, have root OS access and skills to de-compile the app, obfuscation/encryption (with local key) is only a small nuisance (compared to skill required for decompilation/repackaging/on-the-fly modification)

    Moving data to server-side provides a simpler attack-vector - i can MTM the (hopefully) secure connection and alter data sent to app - i don't even have to decompile the app to hack it

    On-the-fly binary validation does not work (again, if i have OS level access) - i can disable/fake it.

    The numbers in the paper are classic marketing bull - when are you more likely to buy an 99$ in-app purchase?
    - if you can do it for free (Apple MTM bug)
    - if you actually have to pay for it

    TLDR:
    You can't protect against hacking/repackaging if the hacker has access to binaries and root.
    You can't protect against data modification if the hacker can install hes own CA on the device.

  8. Re: Take a page from the China mobile game scene by MenThal · · Score: 3, Insightful

    You can't pirate free apps. The question for these become; how rampant is piracy or hacking for getting the in-game stuff for free.

  9. Candy Crush Saga by Anonymous Coward · · Score: 1

    Ever hear of Candy Crush Saga?

    Ever hear of CandySwipe? That's the game that came out 2 years BEFORE Candy Crush Saga (http://www.snopes.com/politics/business/candycrush.asp).

    Of course, it continues to boil down to being clones / copies of earlier games (Bejewelled for example).

    Artwork, design, music, sounds, ideas, most (if not all) are being stolen like crazy in the mobile market. If you don't have a thick skin, don't get into it. Chances are, you spend months, if not years, crafting a beautiful game and release it at $0.99 in the store to only find a cheap copy of it in less than a week on the F2P model from some backwoods out of country developer.

    Are you planning on using a service like FGL.com to find sponsors? They offer help and a better community on how to protect your game.

    1. Re:Candy Crush Saga by Bing+Tsher+E · · Score: 1

      I tried Candy Crush Saga.

      It was so toploaded in derivative bullshit that had nothing to do with the core matching game that I pitched it. It was taking forever to actually get to the gameplay.

      I found a simple clone that just had the actual matching game. It's fun. There isn't bullshit and animated NPC cutscenes (on a matching game. on a phone!) to deal with before you can play.

  10. simple solution by slashmydots · · Score: 1

    This is always been the solution, even after such massive failures as the Valve Anti-Cheat System on PCs. Have the game analyze the size, name, and even hash of all its files when it opens. If they're different than a preapproved list that's loaded into memory for milliseconds after being unencrypted with an enormous hard-wired password, refuse to open the game. That's moderately secure, assuming they can't get to the hard wired password.

    1. Re:simple solution by BradleyUffner · · Score: 1

      This is always been the solution, even after such massive failures as the Valve Anti-Cheat System on PCs. Have the game analyze the size, name, and even hash of all its files when it opens. If they're different than a preapproved list that's loaded into memory for milliseconds after being unencrypted with an enormous hard-wired password, refuse to open the game. That's moderately secure, assuming they can't get to the hard wired password.

      How do you trust that the user hasn't modified "the game" to make it think the hashes always pass?

    2. Re:simple solution by tepples · · Score: 1

      Would "all its files" include third-party video drivers that may be modified for wall hacking, third-party pointing device drivers that may be modified for aim assist, and the like?

    3. Re:simple solution by slashmydots · · Score: 1

      No, that'd be a separate blacklist system. It's not like 1000 people are modding the files in 1000 ways. There's one jackass out there letting people download modified files. In other words, check for the specifically modded file in the specific Nvidia and AMD driver folders and THEN refuse to launch the game.

  11. Submit the replay file by tepples · · Score: 1

    Have the client record input log during gameplay and submit it to the server once the game completes, then replay it on the server when verifying a submitted score. If you really want to block an offline tool-assisted speedrun, require the client to submit a piece of the input log every five seconds or so.

  12. Achievements by tepples · · Score: 1

    If it's single player, don't bother.

    On some popular video game platforms, no major single-player game is truly single-player. For a decade, it has become a race among friends to get the achievements first.

    1. Re:Achievements by rioki · · Score: 1

      +1

      Achievement unlocked: Completed the hamster wheel.

  13. It's good you missed it - it was an advertisement by Vokkyt · · Score: 1

    Reading the whitepaper, the whole thing seems like it's focused on promoting Arxan's services. It's entirely possible that the presentation itself took a different tone/direction, but the whitepaper itself was fairly contentless sprinkled with a few good points about older MITM attacks exploiting the In-App purchases for iOS and the high piracy rates on Android in China and Russia.

    Really that last part is the thrust of the article -- high piracy rates for which they don't really offer any solution except DRM and always-online games. (To their credit, they do make the recommendation of "some sort of protection on the networking layer, in-memory layer, and on disk layer...as well as portions dealing with receiving and unpacking the player's saved game or state.")

    Everything else was either misleading, fairly obvious non-suggestions, or just plain outdated information.

    Examples:

    - Whitepaper dedicates a section to lost revenue from a MITM attack allowing iOS users to get in-app purchases for free. The reference they use is a 2012 article from the Guardian talking about how Apple already fixed it. Specifically, this was relating to iOS 5 and has since been resolved. While Jailbreak options still exist, the whitepaper does not mention these nor does it discuss any other actual leak.Referenced Article

    - Whitepaper has section on Flappybird clones which reads:

    ...However, by March 2014, approximately 60 Flappy Bird clones a day were being added to the iOS App Store...Worst of all -- a reported 79% of these clones contained malware.

    This section has a reference that points to a McAfee threat report from June 2014 - as the section reads, "these" refers to the clones on the iOS App Store, however, the McAfee report clearly shows that this is Android stores that are plagued, not iOS. http://www.mcafee.com/us/resou... Page 6

    - Whitepaper has a section on how hackers damage communities, which is not incorrect, however, they provide the following "helpful" tips:

    • Learn how to tell when a hacker hacks
    • Include banning as a feature
    • Look for reports of hacking

    While these are not bad suggestions, they're also absolutely common sense for mobile game developers, or just people dealing with problems in general.

    The submitter is absolutely right that this could have been a really keen presentation, but based on what they produced in the whitepaper, it sounds like a business trying to drum up some more business for themselves with misleading and/or useless information.

  14. Have we learned nothing? by DougPaulson · · Score: 1

    "As a developer contemplating trying out the mobile game scene, a GDC session about hacking/tampering looked interesting .. Have we learned nothing from the pains of the past?"

    I would ask anyone in developing connected devices. What happened the last time you tried to hack your own device? And if the answer is you haven't even tried then most definitely you've learned nothing about security. If the underlying OS can't prevent hackers walking all over your memory then it's GAME OVER ...

  15. Re: Take a page from the China mobile game scene by Nyder · · Score: 1

    You can't pirate free apps. The question for these become; how rampant is piracy or hacking for getting the in-game stuff for free.

    If you put out an app, it will get hacked. It has been this way since the 70's. Nothing has fucking changed, 'cept the Twenty somethings that do NOT know computer history at all and thinks everything is new.

    If you are a developer, the app you put out will be hacked. Always has been, always will be, nothing will change that. The question is, as the developer and knowing your app will be hack, how do you respond? Do you then fuck over your paying customers by putting in draconian DRM, or do you make a program that rocks because you know the word of mouth is probably your best review system?

    The choice is up to you, the developer. Do you harvest good will with your customers, or do you be a EA/Ubisoft and shit on your customers?

    --
    Be seeing you...
  16. Re: Take a page from the China mobile game scene by mlts · · Score: 1

    Only problem with that logic is that EA and Ubisoft are quite successful right now, which only sets an example that extreme DRM, DLC, and releasing only a few hours worth of content and calling it a game is the way to earn money in the industry. Especially with consoles where there is a 0% piracy rate and the game developers control everything on that platform.

    Of course, it would be nice to see another ID or Bioware. I'm sure there is money to be made on games with a long tail like Neverwinter Nights and NWN2 [1]. However, there just doesn't seem to be an interest to push in that direction. It seems that almost all newer games either fall into the bottomless pit of F2P-P2W or are part a mediocre sequel in a franchise. Even the SimCity app on the phone was all about IAP in order to make your city not suck.

    [1]: Ignore the NWN OC... IMHO, that was more of a demo of what one can do with the toolkit than something playable.

  17. They handled it well in Simpsons tapped out by GuB-42 · · Score: 2

    In Simpsons tapped out, a typical time-waster of a moblie game, free with premium content, players found an exploitable bug allowing them what is basically infinite money. IIRC they handled it this way :
    - they fixed the bug
    - they referred to the hack an in-game event (the moral being of course : you won't get any fun by hacking)
    - they gave a special item to everyone that didn't use the exploit
    - they didn't penalize those who did (except by not giving them the special item)

    I found it was a wonderful way to handle the situation : they didn't punish the hackers, they simply told that the non-hackers were way cooler.

  18. The real problem by Anonymous Coward · · Score: 1

    For an indie developer, the real problem is that almost nobody can get a significant number of players in such an over-crowded, competitive marketplace unless they have a hugely popular brand (famous movie, famous developer, famous game company, something), or millions of dollars in marketing money.

    Given that your indie title with no marketing "oomph" behind it is 99.999% likely to not get a large number of players or make significant money, fixing any potential security problems in it is almost always going to be a waste of your time. Unless you're just doing this hobby to learn game security programming. If you're doing this hobby to learn fun gameplay programming, physics engines, client server coding, etc. don't worry about the security piece too much. (If you want to learn EVERY detail of game programming from your hobby, sure, learn security too.)

  19. Jackass will do the polymorphic shuffle by tepples · · Score: 1

    It's not like 1000 people are modding the files in 1000 ways.

    Yet.

    Virus authors figured out polymorphic code long ago. Now imagine one jackass making a program that shuffles the order of blocks of code in the hack so that you have 1000 files all different but with identical behavior. Thus blacklisting fails for wallhack and aimbot detection the same way it has been shown to fail for virus detection.