Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've got a class exercise that involves a virtual game of Werewolves/Mafia. We're not really taught how to do anything in this class, which makes it hard for everyone to do the labs.

The idea is that for certain rounds of the game, the bad guys vote for people to kill, then in the next round everyone starts guessing about who the bad guys are and tries to kill them instead.

This is set up as:

  • a python server used by a moderator
  • a python client launched by everyone to send/receive server messages (we can modify this)
  • everyone uses ssh to connect to one machine (so server & clients run on one machine)
  • they communicate through named pipes (tucked away in protected directories)

We need to either:

  • as the good guys: find out when the werewolves are communicating with the server so we can vote to kill that user
  • or as the bad guys: not get caught communicating with the server

Some ideas that I'm trying to work with but am too much of a network/linux noob to use:

  • /proc/pid#/sched There should be useful stuff in here. I think I can check for voluntary context switches to see when a user is typing. Unfortunately I'm no good with scripting. Also, I'm not sure how to get the pid#. Maybe pipe top into grep "python"?

  • check the ssh connections to the machine, and somehow listen to the socket for communications?

I'm thoroughly stumped, so any advice would be awesome.

share|improve this question
    
Can you clarify a little? You get to logon to the server, and observe communications? Or you only get to connect to the server with a version of the client? If you have access to the server, you have a regular user account that can't capture traffic or open privileged files? –  Eric G Apr 18 '13 at 22:14
    
Sorry about not being too clear, I've updated it: server.py and instances of client.py run on the same machine, everyone connects to it with ssh. –  Robert Apr 19 '13 at 2:31
    
everything is on the same host, e.g., no network only writing to named pipes? –  Eric G Apr 19 '13 at 3:35
    
P.S. If it might help you to actually play this game, you can go to the IRC network irc.freenode.net and join #wolfgame - it's the same thing –  ekaj Apr 19 '13 at 4:24

1 Answer 1

Just some random musings here: this is quite an interesting problem, and I assume that both good guys and bad guys use the same client, and that bad guys are secretly chosen by the moderator and unknown to each other.

In this scenario, simply detecting communications with the server isn't going to be enough, because a good guy must do so in order to acquire information. Also, any protocol to elect a supervisor good guy might choose a bad guy instead.

It is also unclear whether the guys, good or bad, have a private or public channel to communicate among them.

One approach could be to periodically broadcast on the public channel one's network status parameters. This means that the client is inherently "good" or "neutral" (it has no support for werewolf activity), so that any werewolf has to instantiate and deploy a workaround and trick his own client not to report "bad guy" activity. All the other clients would listen for anomalous reports (e.g. extra connections to the server); submitting an anomalous report, failure to submit anything, or submitting a corrupted report could be taken as evidence of werewolfishness.

For example each user could be requested to send publicly the results of a "good guy" utility that queries and timestamps the output of netstat -snap tcp and netstat -na to detect communications with the server in a non-deniable way. This could be boiled down to a simple utility that outputs a timestamp, a username, a random seed and a secret hash:

12345678:lserni:56789:SHA1("secret:12345678:lserni:56789:WEREWOLF!")

(Each user, even werewolves, would be expected to install the utility on the grounds of him being a good guy).

If the inter-guy channel is private, we can just let every client check the others at intervals. The werewolf will be immediately spotted as soon as he issues a death warrant, and all the good guys will shoot him down. This leaves all the other werewolves free to use their bullet at that turn to shoot down some good guy, but if they're under the same limitations the good guys are - they don't know themselves - then their action will be uncoordinated and ineffectual, and every turn will see a werewolf go down.

The scheme above still holds, if the werewolves are given a client of their own that allows them to coordinate, as long as it does not enable them to fake network status.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.