Cheaters Gonna Cheat Battling Fake High Scores Nataly Eliyahu CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Intro – About Me Freelance Game Developer (NatalyCreates) Indie Card Game and Video Game Designer Technological Unit Army Service Background in Security and Reverse Engineering CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

What we’ll talk about Back and forth between developer and hacker Approaches and considerations for the developer Think like a hacker CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Step 1 – Naive Score Saving Developer POV Save the score locally Use Player Preferences Hacker POV Rooted phone Use tool – Player Preferences Editor CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Edit Preferences CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Step 2 – Manipulate the Score Developer POV Encode the score (base64 / hex / custom encoding) Math manipulations Hacker POV Blackboxing Guessing Find the Pattern CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Step 3 – Encrypt the Score Developer POV Encode the score (base64) Encrypt the score with a secret key (a string) Also: use an obfuscator on the compiled apk Hacker POV Decompile the apk, rename functions and organize code Find the encryption code to see which algorithms is used Find the string for the encryption key Decrypt and encrypt your own scores CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Decompile APK CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Decompile APK CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Decompile APK CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Step 4 – Non-standard encryption Developer POV Encode the score (base64) Encrypt the score with a secret key (a string) Change the code of the encryption function to non standard implementation Hacker POV Previous method fails! Score isn’t saved correctly with your script Read the encryption code Look for the differences from the standard implementation Alternative – use dynamic debugging CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Step 5 – Server side Developer POV Encode the score (base64) Call a function on the server to encrypt and decrypt the score Secret key is no longer in the apk Always Online issue! Hacker POV Attack the server, look for loopholes Alternative - Use dynamic debugging, change the score in memory before it’s sent to the server CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

The Heuristics Approach Recognize suspicious scores Is the score possible in the amount of time the player played? Patterns in the score (apple = 5 points, banana = 3 points) Send constant updates on player status in the game CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

To Sum Up With enough determination, the hacker will always win But - if cheating at your game is really hard, most people won’t bother Going always online helps make it much harder to cheat, but at a cost for the majority of players Choose the most cost-effective solution depending on your game CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015

Questions? Contact me: Facebook: Nataly Eliyahu CASUAL CONNECT TEL AVIV 19 – 21 OCTOBER 2015