Skip to main content
Share Your Experience: Take the 2024 Developer Survey
116 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

We can analyze your setup by comparing it against a system known to be not tamper proof, the Sony PlayStation 3. OS control You have no control over the OS. Sony did write the OS themselves. Size ...
MSalters's user avatar
  • 2,689
89 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

There are too many things that can be done at the OS level. That's the actual problem. There are numerous ways to launch processes and/or explore the system. One important aspect is that it looks like ...
Overmind's user avatar
  • 8,899
51 votes
Accepted

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Create a session, and use the session identifier as identifier, not the user ...
vidarlo's user avatar
  • 16.6k
45 votes
Accepted

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

This "Data Tamper Vulnerability" is not a vulnerability. It's like "Door without lock vulnerability." Client-side validation is not validation. Is a convenience tool: better let ...
ThoriumBR's user avatar
  • 54.5k
39 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

It sounds like you're creating an arcade machine. In that case, learn from the companies who actually make and sell arcade machines, and Use Windows Embedded instead of the desktop version. Using TPM ...
twisteroid ambassador's user avatar
30 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

This is not secure. The hardware is under the control of the user, so they can always find a way. I'm assuming that TPM is meant to prevent the user from starting another OS (like Ubuntu) from CD, ...
S.L. Barth is on codidact.com's user avatar
27 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

Some ideas of attack against that: Windows normally comes with a Repair mode. It may be more or less easy to activate it (ref., but if it is possible the user can make the computer start in command ...
Serge Ballesta's user avatar
19 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

Only one attack is enough to prove that it's insecure, right? Press the Shift key 5 times. A dialog will pop up, asking if you want to activate some feature for disabled persons. On that dialog, ...
Thomas Weller's user avatar
18 votes

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

Proper web site/app security MUST assume that the client may sometimes actually be a custom made malicious tool, designed and built from the ground up by an attacker for the express purpose of ...
Douglas's user avatar
  • 281
13 votes

Protect API from being tampered?

Basically, you have to treat every input from the user as potentially malicious. Vidarlo has already mentioned two security issues and how they can be prevented in his answer. I'd also add that the ...
Lukas's user avatar
  • 3,178
12 votes

Protect API from being tampered?

What if the attacker decides to tamper the "from:id" such that it could send arbitrary messages to anyone from any user? Do not use from:id in your API. You already know it from user authenticated ...
Oleg V. Volkov's user avatar
9 votes
Accepted

How should I verify a backup has not been tampered with?

Cryptographic hash lists From a theoretical standpoint, verifying the integrity of data that will be put on an untrusted medium (such as a remote backup server or an unattended storage device) ...
forest's user avatar
  • 66.8k
9 votes
Accepted

Sessions implemented through cookies over HTTPS

TL;DR: HTTPS prevents both cookie tampering and also cookie stealing and replaying by a man in the middle. First, HTTPS not only encrypts the cookie but the whole traffic. And, due to the way the ...
Steffen Ullrich's user avatar
7 votes

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

I understand that this will allow an attacker to evade Client-side validations. You're thinking of the roles backwards. If you're trying to make software running on an end user's computer enforce ...
R.. GitHub STOP HELPING ICE's user avatar
6 votes

Can we tamper-proof a game that's sold along with the Windows machine it runs on?

As others have said, this cannot be considered secure. You can however remove the 'low hanging fruit', both to reduce the chances of your software being stolen and to ensure your users experience is ...
Spaig87's user avatar
  • 161
6 votes

Does client-side data tampering allow more than just evading validation? Dictionary attacks? Brute-force login attempts?

Other answers correct you on client side vulnerabilities. I want to add this rather direct answer to be very clear. Every attack is indeed possible, unless your own server deliberately prevents it. ...
Stilez's user avatar
  • 1,694
5 votes
Accepted

Does TLS (Transport Layer Security) protect against deliberate tampering or accidental corruption?

It depends on where the data was changed and all you mentioned outcomes are possible. TLS messages has some public scructure. For example, TLS record: and if its structure is broken, then entire ...
Crypt32's user avatar
  • 6,391
5 votes

What's the point of providing file checksums for verifying downloads?

It allows distribution of the bulk data through untrusted channels. For example, you could give me an USB stick and ask me to download it for you over night using my cheap DSL connection, while you ...
Simon Richter's user avatar
4 votes
Accepted

How can I check whether Notepad++ is using a version of the SciLexer.dll library that was modified by the CIA?

From the website of the editor, you can download an archive (zip or 7z) of the version installed on your computer. Check the signature of your archive. Then unpack the archive and compute the checksum ...
A. Hersean's user avatar
  • 10.5k
4 votes
Accepted

Runtime checksum of Mach-O differs from executable checksum

This is because of the dynamic linker, dyld. Certain sections of the __TEXT segment, such as __stubs get modified in memory by dyld so as to be able to call out to the linked symbols. Basically it is ...
Alexander O'Mara's user avatar
4 votes

How to protect against request intercepting and parameter-tampering?

You can not stop user from intercepting the traffic that your application generates. There're following alternatives that you can do for making your application works correctly :- 1) User Secured ...
Mangu Singh Rajpurohit's user avatar
4 votes
Accepted

How to know whether a textfile has been edited or tampered with on the local system?

I fear that the answer is "it's not possible" You are right. The user have the save file, and the executable. He can change the save file as much as he wants, and he have an infinite number of ...
ThoriumBR's user avatar
  • 54.5k
4 votes

What's the point of providing file checksums for verifying downloads?

If the organization hosting the downloadable file simply posts the checksum of the file along with the file, then you are right. If an attacker manages to breach the server, and replace the ...
mti2935's user avatar
  • 23.6k
3 votes
Accepted

Prove log files weren't tampered with?

Disclaimer: I Am Not A Lawyer. Despite of this, I know a general rule: nobody can be a proof for themselves. That means that if the log was generated in your system you cannot use it a definitive ...
Serge Ballesta's user avatar
3 votes

Question about HTTPS & Client side tampering

Sounds like you have configured BurpSuite to allow monitoring of HTTPS traffic. According to the documentation: By default, when you browse an HTTPS website via Burp, the Proxy generates an SSL ...
John Wu's user avatar
  • 9,321
3 votes

Android tamper resistance: BuildConfig.DEBUG spoofing?

As your sample code shows if the attacker uses a debug version he can easily bypass the security checks. Actually you need compiler directives to do that. Using compiler directives the portion of ...
Xaqron's user avatar
  • 306
3 votes

Verifying android application integrity from server side

I am arriving a little late to the party, but I think I can add some useful insights. Is there a way I can validate the integrity of the application (using a checksum or a signature) on the server ...
Exadra37's user avatar
  • 176
3 votes

What's the point of providing file checksums for verifying downloads?

You seem to be assuming that all security measures inherently prevent some type of attack. This is a rather common misconception. All security measures increase the difficulty of some type of attack, ...
Austin Hemmelgarn's user avatar
2 votes
Accepted

Post Data tamper detection

One way to ensure security is to have the client create a Message Authentication Code for the request and then send the MAC along with the data. The server will recreate the MAC and then validate it ...
Qwerky's user avatar
  • 751
2 votes

Sqlmap: bypass website security filtering SQL reserved words

I had a similar situation with a test, the applicationn used SQL server, there was a WAF filtering the data input, then I couldn't use reserved words, because the WAF was blocking the reserved words. ...
hmrojas.p's user avatar
  • 1,059

Only top scored, non community-wiki answers of a minimum length are eligible