Security APIs and Massively Multiplayer Games

Transcription

1 Security APIs and Massively Multiplayer Games Mike Bond, Cryptomathic Ltd. ASA 2008, Pittsburgh, 26 th June

2 This Talk Why? why study games? Where? what sort of games need help What? what s a security API got to do with gaming? what goes wrong? Example attacks How? how can the analysis community help?

3 Why? Massively Multipler Online Games (MMOGs) are big money Cheating/Exploiting/Unbalancing damages a game s subscriber base undermines player achivement damages player econonmy can facilitate griefing makes generated content less satisfying

4 Where? World of Warcraft Size (7 million+), demand for items. WoW Interesting tradeability/instancing model keeps economic demand up. Items can be unbound / bind-on-equip / bind-on-pickup, unique/nonunique/quest It s DRM on physical goods. Second Life In-game scripting, not a game, user-generated content. Socially oriented. Lineage series a national pastime in S.Korea, tens of millions of players (need local knowledge to analyse, my recollection sketchy) EVE Online case-study

5 EVE Online The largest, maturest economy of any game 200,000 users in one shard (~5000 per shard in Wow) Conquest oriented Typical group size , alliance 300-5,000 Sink-or-swim game. If you arent skilled, you can t progress. If you can do politics you can get rich. If you can fight well (fighter pilots skills and much research required), you get rich. If you have no skills you ll find a dull job you can handle (hauling goods, mining). In other games, lack of skill can be countered by money. Most virtual economies have realistic faucets human effort to extract natural resources EVE Economy has a natural economic sink warfare Warfare for territorial conquest, to settle long standing disputes Territory held permits (with effort) harvesting of resources. Most wars are won or lost by the economic health of the combatants.

6 Territorial Disputes

7 What? Just to recap what is a security API? An API which enforces a policy on the user.

8 MMOG APIs Mainly public Mainly private GUI Scripting Local State Protocol Packets High-level Tactic Exploit Hack Low-level

9 What s the Policy? You must not be able to GUI gain an unfair advantage cause grief to other players Scripting become turing powerful access forbidden I/O Protocol make money from nowhere duplicate resources travel faster than top speed see through walls become invulnerable

10 Game Server APIs Scripting These APIs of direct concern These APIs indirectly accessible Game Client Engine Connection Handler Node Simulator Node Secure DB (Money etc) 3D Graphics Connection Handler Node Simulator Node Database Cluster Connection Handler Node Specalised Functions

11 Some Example Attacks Dogs Days of Duping The Stochastic Breastplate The Maypole Totem Daley Thompson s Wow Mod

12 Dog Days of Duping Everquest 2: Guy called Methical discovers duping exploit by accident Put a gnomish thinking chair on the market, it is then flagged as in escrow for sale Options remain examine/destroy/place, he decides to place it down on the floor. It remains Third party buys it off market -> gets fresh copy Methical industrialises his exploit, making thousands of dollars from gold sales (actually platinum in EQ2). Upgrades to duping the most valuable item, pet dogs called haulaisian maulers (best sell to NPC price) Soon the size of the industry gives it away

13 Dog Days of Duping (2) How to destroy the evidence?

14 Dog Days Decomposed Why didn t the API preserve non-duplication properties? non-duplication is an obvious policy to implement Clark/Wilson model has explicit invariants which are preserved by all transactions. Why not this too? A hypothetical explanation transact(from,to,amount) Secure DB (Money etc) buy, sell, place, examine, move, eat etc Simulator Node oid=create(object, location) destroy(oid) holds master information about 3D objects id=register(itemname,amount) abort(id) buy(id) Auction/ Market Engine Database Cluster contains only textual representations of objects (for performance)

15 The Stochastic Breastplate Stat Boosting + PvP + Unfair + Rewards/Betting = Economic Risk Magic Breastplates of Cryptography vary in strength, having a intelligence boost of from Cock up in the implementation event BREASTPLATE_equip { intellect += 10 + rand() % 10; } event BREASTPLATE_unequip { intellect -= 10 + rand() % 10; }

16 The Maypole Totem Flaws can be more sophisticated Totem Area of effect

17 The Maypole Totem (2) World of Warcraft zone boundaries are normally small bottlenecks where combat doesn t take place. But in one area, two large plains join. Each plain handled by separate server, with hand-over protocol Path B Simulator A Totem +5 Path A Simulator B +5-5

18 Daley Thompson s Wow Mod In the days of the ZX Spectrum, hammering the keys as fast as possible was a real test of skill! Meanwhile, in World of Warcraft, UI-Mods have gotten so good that all the skill is taken out

19 Daley Thompson s Wow Mod (2) UI actions should be a single click away Left click to heal Right click to dispel etc

20 Daley Thomson s Wow Mod (3) Wow s LUA scripting language allows all sorts of interesting and useful stuff to be displayed show my target s health show my target s target show the health of my target s target etc Loads of functions ActionButtonUp(), GetActionBarPage(), GetMouseButtonClicked(), IsEquippedAction(), PickupAction(), AcceptDuel(), TogglePVP(), LoadAddon(), CalculateAuctionDeposit(), PurchaseSlot(), SetBindingMacro(), GetPlayerBuff(), GetBlockChance(), GetContainerNumFreeSlots(), SplitContainerItem(), GetLootMethod(), GuildPromote(), EquipPendingItem(), etc.. Problem arose: it was easy to customise UI to assist player, but player could be over assisted, for instance automatic selection of target with lowest health, automatic healing using most efficient spell for the level of damage taken and the mana remaining.

21 Daley Thomson s Wow Mod (4) Solution: mark variables and code with metadata Make some variables only displayable to user, but cannot be used as a conditional prevents sophisticated post-processing Make some actions only launchable if triggered by code traceable to a real human action (i.e. keypress or mouse click) prevents bot autotmatically launching actions

22 Daley Thomson s Wow Mod (5) But there are still ways to read variables // draw player health bar int health=protectedgethealth( player ); int max=getmaxhealth( player ); writename(x,y, player ); drawbar(x,y, (health/max)*width, height); // heal player if health goes too low if( ProtectedGetHealth( player ) < 50 ) { nextaction=[ heal, player ]; triggeraction(nextaction); } Exception raised by this conditional, for using protected variable // heal player if health goes too low for(int i=0;i<100;i++) { try { health=protectedgethealth( player ); int foo = 10 / (health-i); } catch( DivideByZeroError ) { break; } } if( i < 50 ) { nextaction=[ heal, player ]; triggeraction(nextaction); }

23 Daley Thomson s Wow Mod (6) And still ways to autonomously launch actions // cast spell when user hits X if( ProtectedGetKeyPress() == X ) { nextaction=[ drinkpotion, player ]; triggeraction(nextaction); } // drink potion every 5 mins if( timesincelastbonus > 5*60 ) { nextaction=[ drinkpotion, player ]; triggeraction(nextaction); } Exception raised by this action, for not being linkable to keypress // drink potion if health goes too low if( ProtectedGetKeyPress() == X ) { if( timesincelastbonus > 5*60 ) { nextaction=[ drinkpotion, player ]; triggeraction(nextaction); } if( condition2 ) { etc... } } and the user hammers away at X all night long (or sets a keyboard macro)

24 Where Next? Second Life UI has gone open source In-game scripting language already integral part of everyday activity in the game (creating stuff) Network API is now there in the code to review Interesting consequences if Second Life server side goes open (community hosted worlds, new physics laws, SL money implementation) EVE-Online s GUI is pretty much entirely stackless python ripe for analysis.

25 Further Reading Dozens of academics researching virtual worlds Terra Nova Blog Castronova, Dibble, Hunter, Lastowka, Bartle, Burke IBM Netgames 2005 CCP, Eve Online Developers, Rekjavik Me