Subject: [Nel] open source MMORPG and hacks/cheats question (probably off topic)

From: "Alexander Denisov" <[email-masked]>
Date: Sun, 16 Dec 2001 02:29:15 -0800

Hi to everybody, I think this is my first time posting on the mailing list.

I was thinking lately about GPL/open source discussion, and one question
still bothers me: hacks and cheats in MMORPG.

I have seen a couple of times when hacks/cheats ruined great games
(and I do believe that Nevrax is doing a very good game), since online
gameplay is very sensitive to such things.

By publishing source code of the game, isn't it like giving a "green light"
to hackers? Are there any ways
somehow to prevent (or at least try to prevent) hacks and cheats, even if
hacker
knows the source code? Can the game company keep the network part of their
game in secret
(though I don't see how, since its clearly using NeL in this case).

I appologise if my question is completely unrelated to NeL and Nevrax game,
since all the details are kept in secret, but I think that this is very
important question.

By the way, thanks for the great engine! (though I'm still trying to compile
it)

Alex

---

From: alfred <[email-masked]>
Date: Sun, 16 Dec 2001 22:20:56 +1100

I have nothing to do with the nevrax team but I know the answer to this. 
To put it simply, there is not security in obscurity. The protection 
isn't in the alogrithm, its in the "secret" that is shared. This axiom 
has been proved time and again, just look at the troubles windows has 
with its codebase... The lack of published source code ain't helping them.

I am not sure what security model nel will adopt but there are many to 
choose from and none suffer from the openness of the protocol. You could 
sign the client binaries with a public/private key pair. This stops 
trivial hacks. You would also run a secure game server which does bounds 
checking on the input, this stops obvious hacking. You can also encrypt 
the client->server data stream. Fundamentally you are in trouble because 
the client is a generalised computing machine which the user has 
complete control over, if they have the machine code they can crack it, 
but you can make it damn hard. You can also make any hack shortlived by 
having dynamic binaries. The open source nature of nel only makes it 
more secure as any flaws or bugs in the implementation will be spotted 
and solved, rather than being exploited (many eyes make bugs shallow).

:)

Alexander Denisov wrote:

> _______________________________________________
> Nel mailing list
> [email-masked]
> /mailman/listinfo.cgi/nel
> 

-- 
Alfred Reynolds
[email-masked]

---

From: Vincent Caron <[email-masked]>
Date: 16 Dec 2001 19:12:38 +0100

There's a bit more than the 'security through obscurity' debate in this
question. It is actually more a question of trust, or if you prefer,
_what_ or _who_ needs to be secured ? The game ? The player moves ? The
server knowledge ?

Eric S. Raymond (with a nice link to Carmack's tought about this) did a
nice essay, back to the time where 'cheating drivers' (making walls
transparent) were about to be unveiled for FPS games :

http://www.tuxedo.org/~esr/writings/quake-cheats.html

---

From: "Daniel Miller" <[email-masked]>
Date: Mon, 17 Dec 2001 12:07:37 +0100

At Nevrax our thoughts run as follows:

Game clients are very easy to reverse engineer or hack on a PC.
Server/ Client data packets are even easier to hack.

We assume that whether the source code for the client is open or closed, it
will inevitably be modified.

The only way to avoid cheating is to take all game sensitive decisions
server-side and to treat client as a kind of dumb terminal. This has
implications throughout the game design.

For instance, to avoid a hack from making invisible players visible, it is
up to the servers not to transmit update information for invisible players
to the clients. This means that invisible players can not make 3d-positional
noises as this would give an exploitable piece of information.

The front end servers clearly have to be robust too which means that all
incoming data from the clients is treated with caution - packets containing
invalid data are simply ignored.

In a nutshell - we assume that servers are trustworthy and that clients are
not.

Daniel.

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
Vincent Caron
Sent: Sunday, December 16, 2001 7:13 PM
To: [email-masked]
Subject: Re: [Nel] open source MMORPG and hacks/cheats question
(probablyoff topic)