Hacking Online Games - University Of Arizona

Hacking Online GamesMatt Ward & Paul Jennas IIApril 22, 2012

AgendaImportanceAttack Tree for Cheating On-line PokerBotsDenial of ServiceCollusionSoftware ExploitsConclusion

ImportanceOut-of-band market for virtual equipmentEverQuest exampleIn 2004, ”the Gross National Product of EverQuest, measuredby how much wealth all the players together created in asingle year inside the game . turned out to be 2,266 U.S.per capita.”77th wealthiest country: equivalent to Russia - ahead of India,Bulgaria, and ChinaMost gaming companies frown upon these markets

Importance (cont’d)QuestionIf the markets are outside of the game itself, should they addany more motivation for gaming companies to preventcheating?Real motivation for gaming companies is to keep the customerhappy2005 survey showed ”no game hacking and cheating” as the#2 reason users chose a particular game and the #1 reasonthey stopped playing a game”Any behavior that hurts business is bad behavior.” - RaphKoster, Creative Director for Star Wars GalaxiesFocus on on-line gamblingThe ”market” in on-line gambling is in-bandObvious added motivation to prevent cheating

Attack Tree for Cheating Online PokerCheating Poker VulnerabilityExploitRandom nData

Attack Tree for Cheating Online Poker (cont’d)Cheating Poker nandIntentional SelfDisconnectAttackPoker SiteForce OpponentDisconnectSecretAllianceTake AdvantageOf OpponentandPreventSite rverEncryptDataCombineChipsShare HoleCard InfoBully OpponentsWith Reraises

Poker TutorialCard game where card ranks and forming “hands” are used todetermine winner.High card, Pair, Two Pair, Three of a Kind, Straight, Flush,Full House, Four of a Kind, Straight FlushSkilled players understand game statistics and humanpsychologyMany variations of the game(hand definitions fairly standard)Texas Hold’em, Omaha, Stud, etc.Actions include Bet, Check, Fold, Call, Raise

BotsResource collectionSimple poker bots that win most of the time are sufficient formaking moneycheater can deploy large number of botseach bot may only make a small dollar amount per hour buthaving several that run simultaneously and around the clockcan add up to significant amounts of moneyMore complex bots with advanced AI can improve winpercentagesPolaris Pokerbot won 2008 Man vs. Machine PokerChampionship

MacrosMacrosScripts used to create bots that can play a gameFarming - having a bot perform a repetitive process to gaingame resourcese.g. In WOW find a location where an enemy spawns, havebot locate and kill enemy, then wait for respawn, rinse andrepeatAC Tool is a powerful Macro builder (http://www.actool.net/)Macros have many legitimate purposes, such as GUIautomation testing

AC ToolAC ToolMacro builder - build sequence of commandsPress any number of keys for any amount of timeMove mouse to specific mouse location and click left or rightmouse buttonHold left mouse button down and move mouse to dragwindowsSample pixelsAllows you to locate items on the screen (e.g. enemies)Simple programming logic (if/else, loops, variables, procedures,etc.)Can even ftp

BotsCountermeasuresPlayers can chat to try to discover a botSome players play several games at once and can’t respondIn a game of revolving around misdirection, players may refuseto respond to try to disguise themselves as a botCAPTCHAs - prompt players periodically during long periodsof playScan player’s computers

Bot DetectionWorld of Warcraft (WOW) has client progam called”Warden”Runs every 15 seconds (new versions of Warden come from theserver whenever Blizzard’s wants)Checks every dll injected into WOW.exeReads the titlebar text of every open windowAlso reads memory of every open process

Countermeasures (cont’d)Greg Hoglund wrote program called ”The Governor” tomonitor Warden and see exatly what it looks atGreg noticed email addresses, open URLs, IM contacts andprogram names being sent back to serverConsiders Warden spyware and a major privacy issueDo you agree?

Countermeasures (cont’d)

Denial of ServiceIn on-line poker, users are required to act within a set amountof time

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected player

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected playerOpportunity for a cheater to perform a DDoS attack

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected playerOpportunity for a cheater to perform a DDoS attackAlice and Bob are in a heads-up situation with a large pot atstake

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected playerOpportunity for a cheater to perform a DDoS attackAlice and Bob are in a heads-up situation with a large pot atstakeWhen the action gets to Alice, Bob performs a DDoS attackto prevent her from acting

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected playerOpportunity for a cheater to perform a DDoS attackAlice and Bob are in a heads-up situation with a large pot atstakeWhen the action gets to Alice, Bob performs a DDoS attackto prevent her from actingAlice is auto-folded, Bob wins the pot

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected playerOpportunity for a cheater to perform a DDoS attackAlice and Bob are in a heads-up situation with a large pot atstakeWhen the action gets to Alice, Bob performs a DDoS attackto prevent her from actingAlice is auto-folded, Bob wins the potIf the site policy is to place the player “all-in”

Denial of ServiceIn on-line poker, users are required to act within a set amountof timeIf the site policy is to auto-fold a disconnected playerOpportunity for a cheater to perform a DDoS attackAlice and Bob are in a heads-up situation with a large pot atstakeWhen the action gets to Alice, Bob performs a DDoS attackto prevent her from actingAlice is auto-folded, Bob wins the potIf the site policy is to place the player “all-in”Players can intentionally disconnect themselves

DoS (cont’d)DoS attacks for ransomAttack on Grafix SoftechHackers bypassed firewalls and security systems to insert virusthat encrypted data on all five production serversGrafix paid ransom to get the encryption keyLost 75,000 per day for approx 1 week

DoS (cont’d)DoS CountermeasuresDon’t provide IP addresses of other usersUse multiple ISPsDisaster-recovery plan and replicationTrack user disconnect history

CollusionOne of the major issues in on-line pokerRequirement: out-of-band communicationTwo or more players acting together have a significantadvantageWhipsawing - coordinated raises to isolate opponentsCan share information on hole cards – improves oddscalculations

Collusion (cont’d)The BoardJ72 J7 27 6 67Eve’shole cards 5 cards left that could improve Eve’s hand– three 6’s, two 7’s Eve needs at least 4:1 pot odds

Collusion (cont’d)The BoardJ72 2 J7676 6 67 3 cards left that could improve Eve’s hand– one 6, two 7’s Eve now needs over 7:1 pot odds Bob also gains information This information saves both Eve and Bob money Eve’shole cards 6 6Bob’shole cards

Collusion (cont’d)Combining chip stacks in a tournamentIn tournament play, size mattersColluding players can purposefully lose to one member tocreate a large chip stackA single player with multiple accounts can also employ thesecheats

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametable

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametabledoes not prevent communication via phone, text message, IM

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametabledoes not prevent communication via phone, text message, IMeven less effective given wifi and cell phone tethering

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametabledoes not prevent communication via phone, text message, IMeven less effective given wifi and cell phone tetheringCollusion-detection algorithms

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametabledoes not prevent communication via phone, text message, IMeven less effective given wifi and cell phone tetheringCollusion-detection algorithmseffective against whipsawing

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametabledoes not prevent communication via phone, text message, IMeven less effective given wifi and cell phone tetheringCollusion-detection algorithmseffective against whipsawingunlikely to detect players sharing hole card information

Collusion (cont’d)Collusion CountermeasuresIP checking - prevent nearby players from sitting at the sametabledoes not prevent communication via phone, text message, IMeven less effective given wifi and cell phone tetheringCollusion-detection algorithmseffective against whipsawingunlikely to detect players sharing hole card informationTrack player stats, investigate anomalies

Software ExploitsSoftware ExploitsClient codeNetwork PacketsServer CodeExploit VulnerabilityInsider AttackMemory or data modifications

Software ExploitsExploit the game’s card shuffling algorithmASF Software displayed shuffling algorithm online to show howfair it wasCigital Software was able to break it in real timeA seed is used for random number generatorSeed just 32 bits, which allows 4 billion shuffles, much lessthan a real deck’s 52!

Computer Randomness - Shuffling - cont.Seed set with number of miliseconds since midnight, but just86 million milliseconds in a day, so now just 86 millionpossible shufflesGuessing system clock and seed allowed Cigital to reducenumber of shuffles to 200,000 possbilitiesOnce 5 cards were known they were easily able to tell how thedeck was shuffled

Software Exploits (cont’d)Insider attack at AbsolutePokerPlayers noticed a few accounts on AbsolutePoker’s high stakestables with an abnormally high win-percentage

Software Exploits (cont’d)Insider attack at AbsolutePokerPlayers noticed a few accounts on AbsolutePoker’s high stakestables with an abnormally high win-percentageOne player estimated losing as much as 700,000

Software Exploits (cont’d)Insider attack at AbsolutePokerPlayers noticed a few accounts on AbsolutePoker’s high stakestables with an abnormally high win-percentageOne player estimated losing as much as 700,000Group of players obtained hand histories involving the suspectaccounts

Software Exploits (cont’d)Insider attack at AbsolutePokerPlayers noticed a few accounts on AbsolutePoker’s high stakestables with an abnormally high win-percentageOne player estimated losing as much as 700,000Group of players obtained hand histories involving the suspectaccountsWin rate was 15 standard deviations above the mean

Software Exploits (cont’d)Insider attack at AbsolutePokerPlayers noticed a few accounts on AbsolutePoker’s high stakestables with an abnormally high win-percentageOne player estimated losing as much as 700,000Group of players obtained hand histories involving the suspectaccountsWin rate was 15 standard deviations above the meanVideo of reconstructed game: http://www.youtube.com/watch?v FczbS7FiWSM

Software Exploits (cont’d)Win rates of 5,200 online playersX-axis represents the number of blinds won per 100 handsY-axis represents the percent of hands the user entersCheater’s win rate is the equivalent of winning a lottery withone-in-a-million odds 6 times in a row