MMOs have been around along time. As a result, there are lots of past attacks on MMOs that we can learn from and apply to a modern MMO.

As a security novice, I was wondering if in today's climate you were to create a MMO, would it be possible to create one that is secure for all except the most sophisticated of attacks? In this hypothetical, I only consider the server and client, not any related websites or apps. Furthermore, I assume that time and cost of development are not an issue.

Put simply, what attack vectors are there for an MMO, how likely are they to happen and how would you deal with them if at all possible?

What I Have So Far:

  • Bots (memory/screen scraping) | VERY LIKELY | send client "are you there message?", e.g. "what is 5 + 5", "what color is a banana?"
  • Logic bugs | LIKELY | use source analyzers and fuzzing
  • Memory Editing | VERY LIKELY | memory checksum, debugger detection, own rootkit to look for known programs open
  • Packet Injection | VERY LIKELY | not sure here; if encrypt packets, can't client decode with client?; perhaps have packet structure to only send data that the client has access to and server validates everything?


  • This is impossibly broad. It depends on the technology you use, your infrastructure, etc. And it seems to be asking for a list. You've basically asked "how do I secure an undefined, unspecified, generic server/client system?" We could point you to OWASP, and your complete list will be in there somewhere.
    – schroeder
    May 9 '20 at 13:54