Flash games hack, score is 49700?? How to improve flash games security?

Question

I have 2 flash games (written in as3). Both the highscore value being hacked. The normal range of each game score is not more than 5000 (normal users, will only get 2000 - 3000 points). My current method of anti-hacking is:

After finish the game, flash will use post parameters send: username=mike&score=2000&hash=md5(secret . username . score). In php page, I did the check, if the hash != md5(secret . username . score), it will return error, and WONT insert data into database.

I believe this method is not enough, or my flash games would not be hacked. Is there anything I can do to improve my flash games security/anti-hacking??

How do the hackers hack? Using third-party software like, Cheat Engine, Tamper data(firefox ext), tamperIE etc??

Can you list the all the standard hack methods? (by knowing the hack methods/problems, means has solved 50% of the problems, at least I know where the problems are, and do certain pre-caution to that)

Well, my title has "49700" because both games highscore are 49700 (actually alots of this score value inserted into my database, different users thought), so I believe they are using same methods

Thanks

Answer 1

It's not really possible to make your score validation secure if it runs entirely on the client side. You have to do at least part of it on the server side for it to be even remotely secure. I see 2 ways of doing this:

• you send periodic score updates to the server and on the server side you check that the score didn't jump "too much" (to be defined in the context of your game). If it "jumped" you can safely assume the player is hacking.

• you send the entire game movement sequence (along with any random spawns or whatever ai events) to the server with the score at the end and verify that the score is actually accurate. This will obviously not work for every game, but for some games it can work. You didn't say anything specific about your game so I'll leave this here.

Answer 2

By far the easiest method, and hardest to defeat in Flash is to use CheatEngine to simply search for the memory location that stores the score, then change the value to whatever you want. All the server-submit hashing/salting/verification in the world won't fix that because your game thinks it's valid before it packages it up in a nice valid hash for submission.

You can do 'sanity checks' on the scores if they will always fall within predefined values, but even then a determined hacker could simply suss out what the maximum allowed values is and always submit that value.

You could attempt to obfuscate your score values in memory to make them harder to find with CheatEngine, for example storing them as a multiplied value, then in your getters and setters for the score value, include a multiplication/division of the values to get/set the proper score for your views and score submission widgets. Even this is only a stall tactic though.

Unless bogus scores are costing you money, either don't worry about wasting time on the .01% of people who are cheating, or just moderate your score tables manually.

The key thing to consider in preventing cheating is: 'How much does this really matter?' If you're running some kind of high score based competition with a cash prize, then it's a pretty high priority. If you're just miffed that some random person is messing up your high scores table, it's not worth your time to stop them, just check it once a week and drop the bad scores.

Answer 3

You're ultimately trying to delay the time it takes for people to hack your system, or make it not worth their while. You could try adding a salt to the hash for a bit of extra complexity. This could be sent as a value to the flash game (add it as a parameter to the flash object in the HTML) and include that in the hash verification code. You could send some kind of session id or random number so it's always different. You could even generate two hashes by different methods and check them both.

Of course, don't discount the possibility that people have found a way to hack the actual game functionality. Or that they're just really good players...