8

I've programmed an Android game with Unity Engine. As you know in Unity, scripts compiled into one file named "Assembly-CSharp.dll". I wrote my scripts in C#.

After I compiled whole game into .apk, I renamed it to .zip and dragged the Assembly-CSharp.dll into tools like ILSpy, while the whole program was fully decompiled with all of the details like my RSA public key or AES password, IV, salt ...
The logic of my app is client (Android) and server (Java).

When player finished a level, with this URL: http://www.example.com:8080/MyApp/SaveScores.do?hash=labla....labla, we give him score. The real parameters are username, score, timestamp. Our encryption algorithm is RSA 1024 bit.

When cheater/attacker sniffs HTTP traffic to use replay attack, we check the decrypted hash with RSA and with timestamp parameter we kick him out.

But when he decompiled code beautifully with tools (ILSpy) he simply find my public key and find out that I encrypt user score and timestamp with that publickey. Then, he will write a Unity or C# programm to simply encrypt his manipulated message with a new timestamp and he will be trusted in my server side app because anything is true.

He will increase his score with posting HTTP requests to server without playing the game. He can simply cheat.

What can I do?

  1. I can't use SSL.
  2. With obfuscating, only crack time will increase.
  3. With giving public key at runtime from server to client, memory checkers or traffic sniffers can simply see public key.
  • Can the client send [the time and value of each input] to the server? ​ ​ – user49075 Aug 9 '15 at 17:38
  • yes , it can do that – Jimi Aug 9 '15 at 18:23
  • Well, that would be enough. ​ – user49075 Aug 9 '15 at 18:24
  • 1
    i cant understand that how it can be enough. when cheater now the public key it can do that too. i cant recognize user vs cheater or a cheater user. – Jimi Aug 9 '15 at 18:28
  • 1
    The play-data (what I put in brackets) should be encrypted with a PKE scheme that supports associated data, and the associated data should be the username. ​ – user49075 Aug 9 '15 at 18:36
8

Short answer is: Yes, RSA is useless in this case. If all the game logic happens on client side, you cannot prevent cheating.

If your game is reporting only the final score and nothing else, no encryption can help. The game must know how to submit the score and so the full information will always have to be stored in it. You can only make it harder for the cheater by adding obfuscation and other obstacles.

I would suggest two things:

  • Send more than just the final score. Send some information about how the game progressed. (What was the score at certain time, when the user lost life, what decisions he took...) Then verify on the server if it is plausible to achieve such score with such game progress.
  • Ban any user who submits either results that are not valid, or that were submitted before. Make sure your game always produces valid results and is random enough to not likely produce the same result twice. You don't even have to let the cheater know he is banned, just hide his score from any public lists.
  • Thanks.I've got that encryption in this case is useless. – Jimi Aug 9 '15 at 20:21
  • @Jimi : ​ Public-key encryption with associated data of the play-data would make it infeasible for one to get credit for play-data which one does not independently learn before the server receives its submission. ​ ​ ​ ​ – user49075 Aug 9 '15 at 21:11
  • @Ricky Demer : can u explain more ? but i think each action a client android app can do , a cheater user can do too.because he knows the algorithm and knows input of encryption with RSA he can sniff all messages. I know that he cant decrypt message but he doesn't need that because he knows the whole code. – Jimi Aug 9 '15 at 22:30
  • "he knows the whole code", which would let him submit TASes. ​ Are you trying to prevent that? ​ ​ ​ ​ – user49075 Aug 10 '15 at 4:06
  • @Ricky Demer : I wanted to prevent that with obfuscating , but it harms the file and app on android wont work when i obfuscate the dll file .Is there any way except obfuscating? – Jimi Aug 10 '15 at 5:18
0

If your client can send the time, the server could issue certificates for the public key to the client with an expiration time as opposed to hard coding the public key in your app.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.