0

If I want to store a global scoreboard for a game running locally on the user's computer and I want to make sure that all the requests coming to the server are really generated by the game and not spoofed by the users, is there anything that can be done to prevent cheating? The program is open-source, so no obfuscation can be used.

The problem I have with coming up with a solution is that whatever I choose to implement in code must necessarily include all the components necessary for creating a spoofed program that can send any data user wants, especially any encryption keys and hashing algorithms used.

2 Answers 2

1

In a word, no. The best option is to move all the actual game logic to the server, and have the client be a thin client that just displays state and sends input. That wouldn't prevent various types of cheating (such as game automation tools) but it's the only way to comprehensively avoid the user sending fraudulent game results. It's a popular approach in multi-player, too, as it avoids telling the user anything they don't need to know. However, it's considerably more expensive in server hardware.

The next option is to make it possible to validate high scores. One option would be to record, for every game, the RNG seed value followed by every input that the user provides combined with a timestamp of some sort (for turn-based games this is just an action count; for real-time games it would probably be a game engine frame/tick count). Transmitting all of that back to the server would be a lot, but - combined with the game version and level or whatever - allow the server to effectively replay the player's game, determining whether or not it would achieve the final score. You probably wouldn't do this for every game, but you might do it for notably high scores.

Finally, there is a concept called "attestation", where you depend on hardware in the user's device to cryptographically verify the software (which you'd sign with a private key that is not shared) and to cryptographically sign (with a key that you can verify comes from a hopefully-trustworthy device) messages such as score reports. This is a lot of work to set up, and is mostly only used on devices such as phones and tablets where Google and Apple have systems set up to enable app attestation. It's also not completely foolproof - at the end of the day, you still have to trust the client, which is in the control of the "attacker" (user), and that's never fully secure - but it vastly raises the bar.

2

You cannot prevent it. The server cannot determine if the request was spoofed.

Any encryption keys embedded into the application on the user side can be extracted. The application extracts them, so can do the user.

Depending on the technical expertise of the users you can make spoofing harder. For instance, if users didn't have the source code, obfuscation could make reverse engineering harder. But even in such case you could not prohibit spoofing.

But as you say:

The program is open-source, so no obfuscation can be used.

Thus, it is even easier for the users to spoof the requests.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .