How to hack an MMO Kako piskaralo jedne MMO April 17th, 2008 (Visited 7815 times) Tags: cheating , everquest , hacking , laws of online world design , vw design , vw tech , WoW 17. Travanj 2008 (Posjećeno 7815 puta) Tags: varanje, everquest, suhi kašalj, zakoni online svijet dizajn, dizajn VW, VW tehnologije, WOW

Given the recent hack to the blog , and also given the recent news of the decompiled Eve Online client, it seemed like a good time to go over some of the ways in which a virtual world gets hacked. S obzirom na nedavne posjekotina na blogu, a također s obzirom na nedavne vijesti o decompiled Eve Online klijent, to činilo kao dobro vrijeme za ići preko neke od načina u kojima se hacked virtualnom svijetu.

The interesting thing, of course, is that all the hacks I am going to talk about are actually not hacking the virtual world at all; they instead attack the client , which is your window into the world, and also your waldo , your means of exercising control over what happens in that world. Zanimljive stvari, naravno, da je sve hacks ja odlazim za razgovor o zapravo nije suhi kašalj u virtualnom svijetu uopće, oni umjesto napada klijenta, koji je vaš prozor u svijet, a ujedno i Waldo, vaša sredstva vršenje nadzora nad što se događa u tom svijetu. And that’s because… A to je zato što ...

The client is in the hands of the enemy. Korisnik je u rukama neprijatelja.

– The Laws of Online World Design - Zakonima online svijeta dizajna

You’ve probably heard that before — I wasn’t the first one to say it, but it constantly gets misattributed to me. Vi ste vjerojatno čuli da je prije - bio sam ne prvi reći, ali ona stalno dobiva misattributed za mene. That particular phrasing may have originated with Kelton Flinn , but I am sure many of us came up with it independently. To posebno phrasing svibanj imati nastao s Kelton Flinn, ali siguran sam mnogi od nas došli s njim samostalno.

The first thing to realize is that encryption of the data stream isn’t going to stop anyone serious . Prva stvar je da shvate da je šifriranje podataka na potok se ne događa da se bilo tko zaustavite ozbiljne.

Here’s the diagrammatic way to look at it. Evo u obliku dijagrama način gledati na to.

• You generate data. Vi generirati podatke.
• You put it in a packet. Vi stavite je u paketu.
• You encrypt the packet. Vi šifriranje paketu.
• You send it over the wire. Vi poslati ga preko žice.
• It gets to a user’s computer. Ona se na korisnikovom računalu.
• The client reads the encrypted packet. Korisnik navodi se u kriptirani paket.
• The client decrypts the packet. U klijent dekriptira paketu.
• The client does something. Korisnik nema nešto.

Really, anything after “it gets to a user’s computer” is in the hands of the enemy. Zaista, ništa nakon "to se na korisnikovo računalo" je u rukama neprijatelja. So that means that you are encrypting the packets, handing the user a decrypter called a client , and thinking that encryption helps. Tako da znači da se šifriranje u pakete, predaje korisniku decrypter pozvao klijenta, i koji misle da šifriranje pomaže.

The hackers can choose to do is read the incoming packets out of client memory after decryption, instead of sniffing the stream directly. U hackeri mogu odabrati da je pročitati dolazne pakete od klijenta memoriju nakon dešifriranja, umjesto njuškanje potoka direktno. But really, all this does is raise the bar a bit on the hacking skills required. Ali, zaista, sve to čini se povećati bar malo na isjeckan vještine potrebne.

To top it off, encryption can be slow, if you’re talking a real-time sort of situation. Za početak se, šifriranje može biti spor, ako si ti govoriš u stvarnom vremenu kakve situacije. You may not want to spend the time in encrypting if you need a fast response. Svibanj Vi ne želite provesti vrijeme u kriptiranje ako trebate brz odgovor.

Packet stream sniffing: getting more info than you should Paketni stream njuškanje: dobivanje više informacija nego što bi trebao

This one was a problem early on in EverQuest and is still an issue in many FPSes. To je jedan od problema početkom u EverQuest i još uvijek je problem u mnogim FPSes. In short, you should not rely on the client to filter information. Ukratko, da ne bi trebali oslanjati na klijentu informacije filtriranja. Assume that anything that comes down the wire is visible to them. Pretpostavljaju da ništa što dolazi niz žica je vidljiv na njih. We speak of “culling” the data that is sent down, basically reducing the set. Mi govorimo o "culling" podataka koje je poslao dolje, u osnovi smanjenja skup. Even on the client, we do culling, so that we don’t draw everything in the dataset the client knows about. Čak i na klijentu, radimo culling, tako da ne privući sve u podataka o klijentu zna. In an FPS, you typically cannot do a lot of server-side culling — everyone on the map is “visible” to the client, because everyone is moving so fast that you can’t really do any line of sight culling on the server. U FPS, vi obično ne može učiniti mnogo na strani poslužitelja culling - sve na karti je "vidljiva" na klijentu, jer svi su pomične tako brzo da ne možete zaista učiniti bilo koju liniju očima culling na poslužitelju.

In EQ, the way this manifested was every mob in the zone was sent to the client. U EQ, na taj način manifestira je svaki mob u tom području bila je poslana klijentu. This meant a hack could make a minimap that showed every mob. To je značilo jedan komercijalan mogao napraviti minimap pokazali da svaki mob. You could see repops at a distance. Možete vidjeti repops na udaljenost. But wait, it gets worse. Ali čekajte, on dobiva gore. You could also see everything they carried . Možete vidjeti sve što im je nosio. So you could cherry-pick the good loot in advance. Tako možete odabrati trešnja-dobar plijen unaprijed.

Packet filtering: dropping stuff you shouldn’t Filtriranje paketa: padaju stvari da ne bi trebali

Sometimes the server tells you things you just don’t want to hear. Ponekad poslužitelju govori stvari koje jednostavno ne želite čuti. One such thing might be “no, you can’t go there.” This is the classic wall hack. Jedna takva stvar može biti "Ne, ne možete otići tamo." To je klasični zid posjekotina. Usually, you move, and do a local client-side collision check. Obično ćete premjestiti, a ne lokalni klijent-strana sudara provjeriti. You also send off a request to the server for your movement, so that the server can verify whether you can go there (after all, you might have — horrors — hacked your client to not do collision checks). Također ispratiti zahtjev za poslužitelj za svoj pokret, tako da poslužitelj može provjeriti da li možete otići tamo (nakon svega, možete imati - strahote - hacked svog klijenta da ne provjerava kolizije). The server will send back a “no, you are still over here” message, resulting in being rubberbanded back to where you were. Poslužitelj će vam poslati nazad je "ne, ti si još uvijek ovdje" poruka, što je rezultiralo se rubberbanded natrag na kojoj ste bili.

Unless you simply ignore that message, and merrily keep going. Osim ako vas jednostavno ignorirati tu poruku, i veselo drže ide. This will allow you to explore all of the static dataset that your client has loaded. To će Vam omogućiti da istražite sve od statičkih podataka da je Vaš klijent je učitan. You won’t see any newly streamed objects in the right place, of course, because as far as the server is concerned, you didn’t move. Nećete vidjeti bilo koje novo streamed objekte u pravo mjesto, naravno, jer što se tiče poslužitelj je u pitanju, niste premjestili.

Simply dropping packets can be pretty powerful if the engineers were sloppy and relied on the client to correct itself after being told it was naughty. Jednostavno padaju paketi mogu biti prilično moćna, ako inženjeri su neuredan i oslonio na klijentu da ispravi sebe nakon što je rekao to je bio neposlušan. A common way you can use this to greater advantage relies on the fact that we often do let the client be semi-autonomous about movement. Zajednički način možete koristiti za ovu veću prednost oslanja na činjenicu da mi se često čini da je klijent se o polu-autonomnog pokreta. You can move around on the client with far more granularity and with much more rapid changes in direction than you can on the server. Možete kretati na klijent s mnogo više zrnatost i sa mnogo promjena u smjeru ubrzan nego možete na poslužitelju. Instead of tracking your every move, we instead subsample it, basically. Umjesto praćenje Vašeg svaki potez, mi umjesto subsample je, u osnovi. We rely on simple metrics like “you can’t move that far that fast” to verify whether or not you are in fact cheating in your movement. Mi jednostavno osloniti na podatke kao što su "ne možete premjestiti dotle da brzo" kako bi provjerili da li ili ne vi ste u stvari, varanje u vaš pokret.

But if you collided with something, were told to bounce back, but then moved to a position on the other side of the wall, the next movement might fall within acceptable parameters, and then you may have moved through the wall. Ali ako collided sa nešto, rekli su da odskočiti, a zatim premještena na radno mjesto na drugoj strani zida, sljedeći pokret može pasti unutar prihvatljivih parametara, a onda su se preselili svibanj kroz zid.

Packet altering: changing what you hear Paketni mijenjanjem: mijenja ono što čujete

Alternatively, you could actually alter the packet before it gets interpreted. Alternativno vam moze promijeniti paket prije nego što se tumačiti. This basically lets you get the client to dance to your tune. To u osnovi omogućava da dobijete klijenta plesati na svoj podešavanje. Maybe you want a nice big waypoint on top of your quest target. Možda želite lijep veliki orijentir na vrhu svoje traganje cilj. Maybe you want to change what zone the client thinks it is loading you into in order to let you tour somewhere you normally cannot get to. Možda želite promijeniti ono što zona klijenta smatra se učitava u kako bi Vas turneju negdje ti inače ne mogu doći do.

Representation altering: changing what you see Zastupanje mijenjanjem: mijenja ono što vidimo

Messing with the data stream isn’t the only thing within your power. Messing uz tok podataka nije samo stvar u Vašoj moći. Lots of folks in FPSes did things to change the visibility level of what was around them. Mnogo ljudi u FPSes učini stvari za promjenu vidljivost na razini onoga što je oko njih. Replace all the walls with transparent textures, and you will have a much better idea of where everyone is. Zamijeni sve zidove s transparentnim textures, i imat ćete puno bolju ideju gdje je sve. Replace small meshes with big ones, or camo-colored textures with bright pink ones, and everything gets easier to spot. Zamijenite malih mreža s velikim one, camo ili boje svijetle ružičastim textures s djecom, i sve se lakše na licu mjesta.

Triggering Aktiviranje

Of course, why give yourself the work? Naravno, zašto ti dati posao? Just have the client automatically send back responses instantly when it gets a particular packet or message. Dovoljno je imati klijent automatski poslati nazad odgovore odmah kad ga dobije određenu paketa ili poruka. This form of automated triggers is, of course, a key element in building bots. Ovaj oblik automatska aktivira se, naravno, ključni element u izgradnji botova. In an FPS, autoaim is an example. U FPS, autoaim je primjer. The accuracy of something happening with a trigger is far far higher than what it is when a mere human is at the wheel. Točnost nešto događa s okidač je daleko daleko veći nego što ga je kad je samo ljudskih kotaèiæa na.

Spamming Spam

A lot of times, the servers aren’t hardened properly against receiving more commands in a given span of time than they expect. A mnogo puta, na serverima se ne otvrdne ispravno protiv primanja više naredbi u određenom span vremena nego što očekujete. Letting the client handle cooldown timers would be an example of a mistake like this; if you can control the upstream, you can bypass the cooldowns. Najam klijenta obraditi cooldown vremena bi biti primjer grešku kao što je ovaj, ako mogu kontrolirati uzvodno, možete zaobići cooldowns.

The Warden and other tricks U nadzornik i drugih trikovi

Of course, there’s countermeasures. Naravno, tu je protumjere. The countermeasure used by Blizzard (and by Steam, for that matter) is to run a separate process that monitors whether the main app is being messed with. U protumejra koristi Mećava (i parni, za taj tvar) je pokrenuti zasebni proces koji prati da li je glavni app se messed s. This is a common practice in Korea as well, and there’s FPS servers that require you to run Punkbuster , etc. From the WoW TOS: To je uobičajena praksa u Koreji te, i tu je FPS poslužiteljima koji zahtijevaju od vas da pokrenete Punkbuster, itd. Od WOW TOS:

# WHEN RUNNING, THE PROGRAM MAY MONITOR YOUR COMPUTER’S RANDOM ACCESS MEMORY (RAM) AND/OR CPU PROCESSES FOR UNAUTHORIZED THIRD PARTY PROGRAMS RUNNING CONCURRENTLY WITH WORLD OF WARCRAFT. # Kada je pokrenut, program svibanj monitor računala memorija s izravnim pristupom (RAM) i / ili CPU procesa za neovlaštene treće strane programe izvode istovremeno s World of Warcraft. AN “UNAUTHORIZED THIRD PARTY PROGRAM” AS USED HEREIN SHALL BE DEFINED AS ANY THIRD PARTY SOFTWARE, INCLUDING WITHOUT LIMITATION ANY “ADDON” OR “MOD,” THAT IN BLIZZARD’S SOLE DETERMINATION: (i) ENABLES OR FACILITATES CHEATING OF ANY TYPE; (ii) ALLOWS USERS TO MODIFY OR HACK THE WORLD OF WARCRAFT INTERFACE, ENVIRONMENT, AND/OR EXPERIENCE IN ANY WAY NOT EXPRESSLY AUTHORIZED BY BLIZZARD; OR (iii) INTERCEPTS, “MINES,” OR OTHERWISE COLLECTS INFORMATION FROM OR THROUGH THE PROGRAM. Kao "treće strane neovlaštenih programa" kako se koristi može se definirati kao bilo koji software treće strane, uključujući bez ograničenja bilo koju "ADDON" ili "mod", koji u svojoj vlastitoj odlučnosti mećava: (i) omogućava ili olakšava varanje bilo kojeg tipa; (ii) omogućuje korisnicima da mijenjaju ili Hack the World of Warcraft sučelje, okoliš i / ili iskustvo na bilo koji način nije izričito ovlaštena od mećava, ili (iii) INTERCEPTS, "mina", ili na drugi način prikuplja podatke od ili kroz program. IN THE EVENT THAT THE PROGRAM DETECTS AN UNAUTHORIZED THIRD PARTY PROGRAM, BLIZZARD MAY (a) COMMUNICATE INFORMATION BACK TO BLIZZARD, INCLUDING WITHOUT LIMITATION YOUR ACCOUNT NAME, DETAILS ABOUT THE UNAUTHORIZED THIRD PARTY PROGRAM DETECTED, AND THE TIME AND DATE THE UNAUTHORIZED THIRD PARTY PROGRAM WAS DETECTED; AND/OR (b) EXERCISE ANY OR ALL OF ITS RIGHTS UNDER SECTION 6 OF THIS AGREEMENT, WITH OR WITHOUT PRIOR NOTICE TO THE USER. U slučaju da program otkrije neovlaštenim treća strana program, mećava svibanj (a) slati informacije natrag na mećava, UKLJUČUJUĆI BEZ OGRANIČENJA VAŠE IME račun, detalje o neovlaštenih trećih osoba program otkrivena je i vrijeme i datum neovlašteno treća strana program Bila otkrivena, i / ili (b) vježbe bilo koje ili sve od njegovih prava prema Odjeljku 6. ovog sporazuma, sa ili bez prethodne obavijesti korisniku.

How does it do this? Kako to učiniti? Well, actually, by using many of the same techniques as described above . Pa, zapravo, uz pomoć mnogih iste tehnike kao što je gore opisano. Basically, it kind of hacks you . U osnovi, ona vrsta hacks vas. It checks to see if stuff is running in WoW’s memory space. Ona provjerava da li je pokrenut u stvari WOW memoriju prostora. It checks the title bars of any window you have open and compares the text of that window title (hashed) against a blacklist of cheating programs titlebars (also hashed). Ona provjerava naslovne trake bilo kojeg ste otvorili prozor i uspoređuje tekst koji prozor naslov (hashed) na crnu listu za varanje programi titlebars (također hashed). And it actually checks some of the code of every program you have running and checks to see if that code is on its blacklist too. A to zapravo provjerava neke kod svakog programa imate pokrenut i provjerava da li da je kod svojih na crnu listu previše.

Needless to say, the Warden is also in the hands of the enemy ; although I wouldn’t have the slightest clue on how to do it, you could theoretically either hack the Warden itself, or hack the apps that the Warden is checking, so that they display false or different information. Nepotrebno reći, i stražar je također u ruke neprijatelja, iako ne bih imati slightest trag o tome kako to učiniti, možete ili posjekotina teoretski nadzornik u sebi, ili Hack the Apps da je upravnik zatvora provjere, tako da da su lažne ili prikazati različite podatke. At that point, it’s an arms race. U tom trenutku, to je utrku naoružanja.

There’s already programs to watch the Warden watching you , for example. Tu je već programe gledati na nadzornik gledajući vas, na primjer. And Blizzard’s response was to make a bunch of different versions of Warden , so it’s harder to find and watch; and also to — surprise, encrypt the stuff sent back. I Mećava je odgovor bio da gomila različitih verzija čuvar, pa ga je teže pronaći i gledati, i da - iznenađenje, šifriranje u stvari je poslao natrag. Of course, you could go back to square one, packet sniff, and filter out the Warden reports… la di da. Naravno, možete se vratiti na trgu jedan paket zadah, i filtrirati izvještaje je čuvar ... la di da. Or make the cheat app polymorphic itself. Ili napraviti varalica app polymorphic sama. Or… Ili ...

It’s all very Orwellian — but players seem to value a game environment with less cheats more than they value their privacy, though admittedly, freaking out over an app reading window titlebars and then not actually telling anyone about it unless it finds a match may seem a bit paranoid. To je sve vrlo Orwellian - igrača, ali izgleda da vrijednost igre okoliša s manje vara više nego što je vrijednost njihove privatnosti, iako je priznati, friknuto iz preko cca nepročitanih titlebars prozor i onda zapravo ne govorim nikome o tome, osim ako utvrdi utakmicu svibanj Čini se malo paranoidan. Then again, what if someone hacked a popular WoW fansite or guide site and stuck a banned string in the titlebar? A opet, što ako netko hacked popularno WOW fansite ili vodič stranica i zapinjati jedna zabranjeno niz u naslov ekrana? Could happen… Mogu se dogoditi ...

In the end, you just cannot trust the client . Na kraju, jednostavno ne mogu povjerenje klijenta. Everything Warden protects against fundamentally needs to be guarded against on the server. Sve čuvar štiti protiv temeljno treba biti čuvano protiv na poslužitelju. In the Web world, you just have to assume that the browser could be any damn thing at all — after all, I could write a simple web browser in about five minutes. U Web svijetu, vi samo morate pregledniku pretpostavljamo da je mogao biti bilo briga što na sve - nakon svega, ja mogu pisati jednostavnim web preglednik u oko pet minuta. And in the future, we may well have to design our games with this sort of capability in mind. A u budućnosti, mi svibanj imati dobro za dizajn naše igre s ovom kakve sposobnosti u vidu.

Take the example of the small herb to harvest. Uzmi primjer je mala biljka za žetvu. The hacks described would do things like auto-detect that the herb is around, auto-collect it, pick it out of a crowded area. U hacks opisana će učiniti stvari poput auto-otkriti da je trava oko, auto-ih, preuzmite ga iz jedne gužve području. The “game” lies in it being hard to find or see. U "igru" leži u tome što je teško naći ili vidjeti. In the security world, this is called “security through obscurity,” and it’s generally assumed to be a waste of time. U sigurnosnom svijetu, to se zove "sigurnosti kroz mrak", i to obično pretpostavlja da je gubitak vremena. (This also raises the question of why we are building games out of something like herb-finding.) The secure way is for the client to not even know. (To također potiče pitanje zašto smo izgradnju igara iz biljnih željeli nešto finding.) Na siguran način je za klijenta da ni ne znaju. Have real herbs and fake herbs use the exact same client-side representation in every way. Jesu li pravi bilja i lažni bilje koristiti isti klijent-strana zastupljenost u svakom pogledu. Only the server knows the difference. Samo poslužitelju zna razlika.

We don’t generally do this because, well, we want to have static data and dynamic data we stream. Ne uglavnom to učinili, jer, dobro, mi želimo imati statički podataka i dinamičke podatke koje stream. We want to be able to precache most of the world, and only stream down the stuff that can change, like herbs you can pick up. Želimo biti u mogućnosti precache najviše na svijetu, i samo potok niz stvari koje mogu promijeniti, kao što su bilje možete podići. It’s cheaper in bandwidth, by a lot; it offers better performance; you get much faster load times. To je jeftinije u propusne, tako mnogo, ona nudi bolje performanse, dobivate mnogo puta brže učitavanje.

In other words, we create these vulnerabilities for ourselves because, well, we want to trust the client. Drugim riječima, mi stvaramo ove ranjivosti za sebe, jer, dobro, želimo povjerenje klijenta.

In the end, the most hack-free virtual world is likely to be the one with completely open source clients , completely public and open protocols, and no attempts to cheat by having the client do any heavy lifting. Na kraju, najviše komercijalan bez virtualnom svijetu je vjerojatno da će biti jedno s klijentima u potpunosti open source, potpuno javnim i otvorenim protokolima, a ne pokušaja da se varati od strane klijenta učiniti s bilo kojim teškim utezima. In fact, WoW itself has taken very big strides towards this with their open UI system, which enables officially sanctioned plug-ins which do quite a lot of the things that were formerly done by hacks. U stvari, WOW sama je vrlo velika strides prema ovom sa svojim otvoreni UI sustav, koji omogućuje službeno kažnjeni dodatke koji čini prilično puno stvari koje su nekada radili hacks. The reason this will likely be safer is simply because when the terminal is dumb, you are forced to put the smarts on the server — and the server is a lot easier to make secure. Razlog to će vjerojatno biti sigurniji je jednostavno jer kad je terminal je glupi, vi ste prisiljeni da stavim smarts na server - i poslužitelj je puno lakše učiniti sigurnijim.

The challenges, however, are not small if you want to really go whole hog and make everything driven by the server. Izazovi, međutim, nisu male, ako želite stvarno ići cijeli svinja i učiniti sve što je upravljan od strane poslužitelja. Everything would need to be streamed. Sve bi trebao biti streamed. Everything sent to the server would need to be verified. Sve slati na poslužitelj bi trebao biti potvrđen. And game designers would have to assume they could not rely at all on anything in the visuals as a gameplay mechanic, nor on anything related to speed of cognitive processes (eg, time spent “figuring something out” would not be a good mechanic, since many things could be offloaded to the client, providing instant reaction times). A igra dizajneri bi pretpostaviti da oni nisu mogli osloniti na sve na ništa u vizualan dojam igrivosti kao mehaničar, niti na bilo što se odnose na brzinu kognitivnog procesa (npr., vrijeme provedeno "figuring nešto iz" ne bi bio dobar mehaničar, jer mnoge stvari bi mogle biti offloaded za klijenta, osigurava trenutne reakcije puta). It would all make for a far more asynchronous world. To bi sve napraviti za daleko više asinkroni svijetu.

But that design constraint might also push towards designing cleverer gameplay, rather than gameplay that can be completely undone by knowing where stuff is, picking important stuff out from the crap, and going clicky-clicky on something fast enough. Ali da bi ograničenje dizajn i projektiranje prema Pritisni cleverer igrivost, igrivost, a ne da se može u potpunosti poništiti po stvari znao gdje je, branje važne stvari iz govno, a odlazim clicky-clicky na nešto dovoljno brzo.

A pipe-dream? A pipe-san? Probably. Vjerojatno. We loves us our herb-hunting, our big graphics, our lagless client-side movement, and we seem quite willing to put up with being spied on in exchange for knowing that only bad-ass hackers are cheating, instead of damn near everyone. Mi ljubi nas naš bilja-lov, naš veliki grafika, lagless naš klijent-strana kretanja, a mi izgledaju prilično spremni da se stavi sa spied u zamjenu za znajući da samo loše magarca hackeri su varanje, umjesto prokleti kraj svima.

[?] [?]

Type in a relevant tag, and click the button, and help organize this blog's information. Upišite se u relevantne oznake, i kliknite na gumb, i pomoći organizirati ovaj blog je informacija.
[More Help] [Dodatna pomoć]

You can follow any responses to this entry through the RSS 2.0 feed. Responses are currently closed, but you can trackback from your own site. Možete pratiti bilo koji odgovore na ovaj unos kroz RSS 2.0 feed. Odgovori su trenutno zatvorene, ali možete trackback sa svoje vlastite web lokacije.

44 Responses to “How to hack an MMO” 44 Odgovori na "Kako piskaralo jedne MMO"

1. Pinging The Services (How To Guidelines) wrote on April 18th, 2008 at 7:57 am : Pinging usluga (Kako Smjernice) napisao je na 18 Travanj 2008 u 7:57 pm:

   to the library and experienced the Dewey Decimal System. na knjižnica i doživjela Dewey Decimalni sustav. He looked up all of his sources online and did a lot of cut-and-paste for his papers. On pogleda sve njegove izvori na mreži i učinio puno cut-and-paste za svoje radove. For some reason, this was acceptable to his teachers…. Za neki razlog, to je prihvatljivo da se njegovi učitelji .... I think the first thing I’d be doing during graHow to hack an MMOGiven the recent hack to the blog, and also given the recent news of the decompiled Eve Online client, it seemed like a good time to go over some of the ways in which a virtual world gets hacked. Mislim da je prva stvar bih se radi tijekom graHow posjekotina na jednom MMOGiven nedavne posjekotina na blogu, a također s obzirom na nedavne vijesti o decompiled Eve Online klijent, to činilo kao dobro vrijeme za ići preko neke od načina u kojima je virtualni svijet dobiva hacked. The interesting thing, of course, is that all the hacks Zanimljive stvari, naravno, da je sve hacks

2. COPE: James Wallis levels with you » Koster-munger wrote on April 18th, 2008 at 8:13 am : Borbu: James Wallis razine s vama »Koster-munger napisao na 18 Travanj 2008 u 8:13 pm:

   [...] Raph Koster gives you a brief tutorial on how to hack MMOs. [...] Raph Koster, daje kratki uvod o tome kako MMOs posjekotina. [...] [...]

3. KVET.CH wrote on April 18th, 2008 at 11:19 pm : KVET.CH napisao na 18 Travanj 2008 u 11:19 sati:

   del.icio.us/emory Apr 18Raph’s Website » How to hack an MMOThere’s already programs to watch the Warden watching you, for example. del.icio.us / emory Travanj 18Raph's Web stranica »Kako piskaralo jedne MMOThere već programe gledati na nadzornik gledajući vas, na primjer. And Blizzard’s response was to make a bunch of different versions of Warden, so it’s harder to find and watch; and also to — surprise, encrypt the stuff sent back. I Mećava je odgovor bio da gomila različitih verzija čuvar, pa ga je teže pronaći i gledati, i da - iznenađenje, šifriranje u stvari je poslao natrag. Of Od

4. Where social software should go next — Habitat’s lessons (Leapfroglog) wrote on April 21st, 2008 at 8:34 am : Gdje društveni softver bi trebao ići sljedeći - Habitat's sati (Leapfroglog) napisao je na 21 Travanj 2008 u 8:34 pm:

   [...] Cheating might be of less concern to social software than to games (although there are exceptions, take Digg for example). [...] Cheating bi moglo biti manje briga za društveni softver nego igara (iako postoje iznimke, Digg uzeti za primjer). For those interested in more about this, Raph Koster recently posted an elaborate examination of hacking and cheating in MMOGs. Za one zainteresirane za više o ovome, Raph Koster nedavno objavljena jedan detaljan pregled isjeckan i varanje u MMOGs. [...] [...]

5. MMO Clerks » Koster writes “how to hack an MMO” wrote on April 30th, 2008 at 4:59 pm : MMO trgovci »Koster piše" kako komercijalan jedan MMO ", napisao je na 30 Travanj 2008 u 4:59 am:

   [...] blog post by game designer Raph Koster (of Ultima Online and now Metaplace fame) will tell you how! [...] Blogu od dizajnera igre Raph Koster (o Ultima Online, a sada Metaplace glas) će vam reći kako! [...] [...]

6. Massively wrote on April 30th, 2008 at 11:30 pm : Masivno napisao na 30 Travanj 2008 u 11:30 sati:

   News items Have you ever wanted to walk through walls in MMO? Novosti predmeta Da li ste ikada poželjeli hodati kroz zidove u MMO? How about telepathically sense the locations of all the good drops in a zone, or make invisible things very, very visible? Kako o telepathically smislu lokacije sve dobre kapljice u zoni, ili nevidljive stvari vrlo, vrlo vidljivi? Ablog postby game designer Raph Koster (of Ultima Online and now Metaplace fame) will tell you how! Ablog postby igra dizajner Raph Koster (o Ultima Online, a sada Metaplace glas) će vam reći kako! Admittedly, Koster doesn’t really go into much detail. Priznati, Koster stvarno ne ide u mnogo detalja. Also, he’s trying to help developers avoid hacking problems, not giving inside secret tips to hackers. Također, on je nastoji da pomogne isjeckanost programere izbjegli probleme, a ne davanje savjeta unutar tajna da hackeri. It’s To je

7. Làm th? Bjekstvo th? nào ?? Não? hack m?t trò ch?i tr?c tuy?n MMORPG? piskaralo m? t trò kanala? sam tr? c tuy? n MMORPG? - Market4Gamer wrote on July 17th, 2008 at 1:56 am : - Market4Gamer pisao na 17. srpnja 2008 u 1:56 pm:

   [...] client does something. [...] Klijent ima nešto. Thú v? Thu v? ?? ?? Các b?n có th? CAC b? N co-og? tham kh?o thông tin chi ti?t : http://www.raphkoster.com/2008/04/17…o-hack-an-mmo/ [...] tham kh? ili bič kositra chi TI? t: http://www.raphkoster.com/2008/04/17 ... O-posjekotina-AN-mmo / [...]

8. Creators of gaming widget app hope to make ALT-TAB obsolete - Big Download Blog wrote on July 17th, 2008 at 6:34 pm : Tvorci igara widget app nada da Alt-TAB zastarjelih - Big Download Blog pisao na 17. srpnja 2008 u 6:34 am:

   [...] framerates, and that it won’t trigger anti-cheating tools like Punkbuster or World of Warcraft’s Warden.The product is currently in its beta test phase. [...] Framerates, i da neće pokrenuti anti-varanje alate poput Punkbuster ili World of Warcraft's Warden.The proizvod je trenutno u beta testnoj fazi. You can sign up for the beta or update [...] Možete se prijaviti za beta ili ažurirati [...]

9. forums.twelvesands.com • View topic - How to hack an MMO wrote on July 17th, 2008 at 10:08 pm : forums.twelvesands.com • Pogledaj temu - Kako piskaralo jedne MMO pisao na 17. srpnja 2008 u 10:08 sati:

   [...] some discussion earlier wondering why on earth I’d put all the user request parameters in the URL.http://www.raphkoster.com/2008/04/17/ho … ck-an-mmo/If you’re logged in to the game, you can basically visit any zone just by manipulating the URL. [...] Nekih ranijih diskusija pitate zašto na zemlji Dajte stavite sve na zahtjev korisnika parametara u URL.http: / / www.raphkoster.com/2008/04/17/ho ... ck-an-mmo/If ste prijavljeni u igru, možete posjetiti bilo koje područje u osnovi samo manipulira URL. If [...] Ako [...]

10. Raph's Website » How to hack an MMO wrote on July 18th, 2008 at 5:50 pm : Raph's Web stranica »Kako piskaralo jedne MMO pisao na 18. srpnja 2008 u 5:50 am:

    [...] How to hack an MMO April 17th, 2008 (Visited 5387 times) Tags: cheating, everquest, hacking, laws of online world design, vw design, vw tech, WoW [...] [...] Kako piskaralo jedne MMO 17. Travanj 2008 (Posjećeno 5387 puta) Tags: varanje, everquest, suhi kašalj, zakoni online svijet dizajn, dizajn VW, VW tehnologije, WOW [...]

11. Gameguard. Gameguard. - Page 4 - AionSource.com wrote on August 12th, 2008 at 2:32 am : - Stranica 4 - AionSource.com pisao na 12. kolovoz 2008 u 2:32 pm:

    [...] spawn location…) into the client. [...] Razmnožavati lokacija ...) na klijenta. as Raph Koster is fond of reminding ppl, the game client "is in the hands of the enemy": every time a dev offloads an operation onto the client, in order to save CPU cycles for AI [...] kao Raph Koster je sklon podsjećanja PPL, igra client "je u ruke neprijatelju": svaki put kad dev offloads operacija na klijenta, kako bi se spremili stanje procesora za AI [...]

1. Todd said on April 17th, 2008 at 11:31 pm : Todd, rekao je na 17 Travanj 2008 u 11:31 sati:

   In EQ, the way this manifested was every mob in the zone was sent to the client. U EQ, na taj način manifestira je svaki mob u tom području bila je poslana klijentu. This meant a hack could make a minimap that showed every mob. To je značilo jedan komercijalan mogao napraviti minimap pokazali da svaki mob. You could see repops at a distance. Možete vidjeti repops na udaljenost. But wait, it gets worse. Ali čekajte, on dobiva gore. You could also see everything they carried. Možete vidjeti sve što im je nosio. So you could cherry-pick the good loot in advance. Tako možete odabrati trešnja-dobar plijen unaprijed.

   Still is a problem, they still send down tons of data, but you could never see everything they were carrying, only their wielded items (and just the graphic it displayed) and sometimes if they were carrying a light source. Ipak je problem, ipak oboriti tona podataka, ali nikada ne možete vidjeti sve što su nosili, samo wielded stavke (i samo ga grafički prikazati), a ponekad i ako su se nosi izvor svjetla.

2. Kriss said on April 18th, 2008 at 12:44 am : Kriss rekao je na 18 Travanj 2008 u 12:44 pm:

   Yup, all good and so hard to get people to understand these facts. Yup, sve dobro i tako teško dobiti ljude da razumiju ove činjenice. Players are always, “But its on a computer what are you lazy? Igrači su uvijek ", ali na svoje računalo što si ti lijen? just make cheating impossible!” jednostavno napravite varanje nemoguće! "

   Personally I’ve pretty much come down to the idea that an audit type system is the only thing that makes sense. Osobno sam prilično puno spustiti se na ideji da se revizija vrstu sustava je jedina stvar koja smisla.

   Which is more of a social fix. Koji je više društveni popravak. Don’t try and make cheating impossible, just make it detectable. Ne probati i varanje nemoguće, samo je on prepoznatljiv. This is easier and cheaper. Ovo je jednostavniji i jeftiniji.

   Don’t even try and detect it in real time. Nemojte ni pokušati otkriti i to u realnom vremenu. Just take replays and audit them for cheats at a later date should people complain or due to obvious triggers. Dovoljno je uzeti replays i revizije ih vara na kasnije ljudi trebali žaliti ili zbog očitih aktivira. Again easier and cheaper. Opet jednostavniji i jeftiniji.

   Make the response to cheats more of a social slap on the wrist. Neka odgovor na vara više od socijalne pljusnuti na zglob. Don’t take it to seriously, just slap them down take away points, prizes, humiliate them etc. It never makes any sense to even take away their account (unless you plan to sell them a new one). Ne uzme to za ozbiljno, samo šamarati ih odnijeti bodove, nagrade, itd. ponize ih nikad bilo kojem smislu čini se čak i oduzeti njihov račun (osim ako namjeravate prodavati ih novi).

   Apart from anything else trying to build a world where you can’t do anything wrong is a bit dull. Osim svega pokušava izgraditi svijet u kojem ne možete učiniti ništa krivo je malo glup.

   I’ve been toying with the idea of removing the need for much of a central server. Sam toying s idejom uklanjanjem potrebe za mnogo centralni poslužitelj. Turning it more into a central audit system that solidifies when necessary the otherwise shared hallucination. Kad ga više u središnji sustav revizije solidifies kada je potrebno da se na drugi način dijeliti halucinacija. Most people are not cheats after all and as long as you have plans to roll back and undo actions I’m confident you can get away with peer to peer data exchanges. Većina ljudi se ne vara, nakon što su svi i sve dok imate planove za poništavanje vraćanja i akcijama uvjeren sam možeš izvući ravnopravnih članova razmjene podataka. Much of the auditing can even be done client side, with clients flagging other clients as suspicious. Velik dio revizije mogu čak i biti učinjeno klijent strane, klijenti s označavanje druge klijente kao sumnjive.

   The total client side cpu power will always dwarf the server side. Ukupna klijent strani CPU vlast će uvijek patuljak na strani poslužitelja.

   It just takes some clever game design. To traje samo neki pametan dizajn igre.

3. BuschnicK said on April 18th, 2008 at 1:16 am : BuschnicK rekao je na 18 Travanj 2008 u 1:16 pm:

   For me, after playing the game as intended for awhile, the meta-game of hacking and automating it, is far more interesting than the original gameplay. Za mene, nakon igranja igre kao što su namijenjeni za neko vrijeme, META-igra isjeckan i automatizaciju ga je daleko više nego zanimljiva izvorna igrivosti. Programmers, by definition, are keen on automating boring, repetitous and dumb tasks. Programerima, po definiciji, se voljeti automatizaciju dosadno, repetitous i glupe zadatke. This unfortunately describes 75% of most online game gameplay. Ovo nažalost opisuje 75% većine online igre igrivosti. The one who endures the boredom longer and spends the most time in the game gets the biggest rewards. Tko ustraje na dosada više i potroši najviše vremena u igri dobiva najveća nagrada.
   So how do you prevent cheating? Pa kako se to spriječi varanje? Reward actual skill over forbearance, make the core gameplay interesting enough so players will feel they are missing out if they are cheating. Nagradite stvarna vještina više strpljivosti, čine jezgru igrivost dosta zanimljivih igrača, tako će se osjećati oni su nestali iz jesu li varanje. No one sends a bot to see a movie for him… Nitko ne šalje bot pogledati film za njega ...
   Also, make the interface of the game as streamlined as possible. Također, provjerite je sučelje za igru kao efikasnog što je više moguće. Lots of the hacks/cheats are actually workarounds for shortcomings in the interface. Mnogo je hacks / vara zapravo zaobilaznice za nedostatke u sučelje.

   Then again, one of my clients is http://www.zynamics.com so I’m kinda biased A opet, jedan od mojih klijenata je http://www.zynamics.com tako sam kinda polariziran

   Anyways, good post - kind regards, Uglavnom, dobar post - pozdravite,

   Sören Søren

4. Shalkis said on April 18th, 2008 at 3:50 am : Shalkis rekao je na 18 Travanj 2008 u 3:50 pm:

   A small note: FPS games have performed a lot of culling, starting with Quake. Mala napomena: FPS igre su izveli mnogo culling, počevši od Quake. ID used a concept called a vismap, or a visibility map. ID koristi koncept naziva vismap, ili vidljivost sajta. Basically, the map designer calculated in advance which parts of the map are visible from each location. Uglavnom, karte dizajner izračunata unaprijed koji dijelovi na karti su vidljiva iz svake lokacije. However, the main reason for calculating vismaps was not to deter cheaters, but to speed up rendering. Međutim, glavni razlog za izračun vismaps nije odvraćanja cheaters, ali što ubrzava renderiranje. There’s no reason whatsoever to render that wall five corridors and seven rooms away from you, because there’s no way you could see it. Nema razloga što bi da se zid koridora pet i sedam soba udaljena od vas, jer ne postoji način na koji ste mogli vidjeti. All the server needed to do was to put the vismap to a new use and check whether players were in areas that could not be seen by the other players. Sve poslužitelju potrebno učiniti je da stavite vismap na novi koristiti i provjeriti da li su igrači u područjima kojima se uzrok nije mogao vidjeti drugi igrači.

5. Mox said on April 18th, 2008 at 4:58 am : Mox, rekao je na 18 Travanj 2008 u 4:58 pm:

   As Raph says, people move very fast in FPS games. Kao Raph govori, ljudi vrlo brzo kretati u FPS igrama. What may be invisible in one frame may become visible in the next, and in the high-stakes Quake 3 Arena world, frames matter . Što svibanj biti nevidljiv na jedan okvir svibanj postati vidljivi u sljedećem, te u visoko-udjeli Quake 3 Arena svijetu, okviri stvar. Also, you have to consider the worst-case scenario. Također, morate razmisliti o najgorem slučaju scenarij. Keeping things fast and responsive when you can’t see anyone doesn’t help when all the players in the game are in the same room, blasting away at each other. Imajući to brzo i osjetljiv kad se ne vidi nikoga ne pomoći kad svi igrači u igri su u istoj sobi, miniranje na udaljenosti jedni druge.

   Static items can be filtered properly, however. Statički stavke mogu biti filtrirane ispravno, no. For example, all the weapon and ammo pick-ups. Na primjer, sve oružje i streljivo pokupiti-up prozora. The server doesn’t need to tell you what they are up to until your client is in danger of seeing them. Poslužitelj ne treba vam reći da ono što su do sve do svog klijenta je u opasnosti da ih vidim.

   Interesting thing about the resource-collection example that Raph uses: contrast LotRO and WoW craft collection with SWG craft collection. Zanimljive stvari o resource-zbirka primjera da Raph koristi: kontrast i Wow LotRO obrtničko zbirka sa SWG zanat prikupljanja.

6. Raph said on April 18th, 2008 at 7:47 am : Raph rekao je na 18 Travanj 2008 u 7:47 pm:

   Still is a problem, they still send down tons of data, but you could never see everything they were carrying, only their wielded items (and just the graphic it displayed) and sometimes if they were carrying a light source. Ipak je problem, ipak oboriti tona podataka, ali nikada ne možete vidjeti sve što su nosili, samo wielded stavke (i samo ga grafički prikazati), a ponekad i ako su se nosi izvor svjetla.

   I am almost positive that I once saw a hack client that showed the contents of the mobs’ drops, and that later it switched to not spawning the drops until the mob was killed. Ja sam gotovo pozitivan da sam jednom vidjeh posjekotina klijenta koji su pokazali sadržaj u mobs' kapi, a da se kasnije prebacili na mrijesta ne kapi do mob je ubijen. It may have been during the beta, though. On svibanj imati je tijekom beta, iako. (We were at Origin then, and someone on the UO2 team was analyzing the packet stream? I don’t quite recall). (Mi smo bili na Porijeklo zatim, i netko na UO2 tim je analizom paketa stream? Ne sasvim podsjetiti).

   For me, after playing the game as intended for awhile, the meta-game of hacking and automating it, is far more interesting than the original gameplay. Za mene, nakon igranja igre kao što su namijenjeni za neko vrijeme, META-igra isjeckan i automatizaciju ga je daleko više nego zanimljiva izvorna igrivosti. Programmers, by definition, are keen on automating boring, repetitous and dumb tasks. Programerima, po definiciji, se voljeti automatizaciju dosadno, repetitous i glupe zadatke.

   Designers shouldn’t be. Ne bi trebala biti dizajnera.

   A small note: FPS games have performed a lot of culling, starting with Quake. Mala napomena: FPS igre su izveli mnogo culling, počevši od Quake. ID used a concept called a vismap, or a visibility map. ID koristi koncept naziva vismap, ili vidljivost sajta. Basically, the map designer calculated in advance which parts of the map are visible from each location. Uglavnom, karte dizajner izračunata unaprijed koji dijelovi na karti su vidljiva iz svake lokacije. However, the main reason for calculating vismaps was not to deter cheaters, but to speed up rendering. Međutim, glavni razlog za izračun vismaps nije odvraćanja cheaters, ali što ubrzava renderiranje. There’s no reason whatsoever to render that wall five corridors and seven rooms away from you, because there’s no way you could see it. Nema razloga što bi da se zid koridora pet i sedam soba udaljena od vas, jer ne postoji način na koji ste mogli vidjeti. All the server needed to do was to put the vismap to a new use and check whether players were in areas that could not be seen by the other players. Sve poslužitelju potrebno učiniti je da stavite vismap na novi koristiti i provjeriti da li su igrači u područjima kojima se uzrok nije mogao vidjeti drugi igrači.

   Right, good point. Desno, dobra stvar. I said: Rekao sam:

   Even on the client, we do culling, so that we don’t draw everything in the dataset the client knows about. Čak i na klijentu, radimo culling, tako da ne privući sve u podataka o klijentu zna. In an FPS, you typically cannot do a lot of server-side culling — everyone on the map is “visible” to the client, because everyone is moving so fast that you can’t really do any line of sight culling on the server. U FPS, vi obično ne može učiniti mnogo na strani poslužitelja culling - sve na karti je "vidljiva" na klijentu, jer svi su pomične tako brzo da ne možete zaista učiniti bilo koju liniju očima culling na poslužitelju.

   In the case of what you’re describing — vismaps and other forms of block culling are not all that helpful for deterring cheating, since “all the players that matter” is who you want to operate the hack against anyway. U slučaju ono što opisuje - vismaps i druge oblike blok culling nisu sve to korisno za deterring varanje, jer "sve igrače da se stvar" je koji želite upravljati posjekotina protiv svejedno.

   I know you know this, but for the sake of others reading the thread: Znam da znate ovo, ali zbog drugih čitanje nit:

   The way to think about is this — you have a static dataset (the map) and a dynamic, quickly moving dataset (objects like players, pickups, bullets). Na način da mislite o ovom je - imate statičkih podataka (karte) i dinamično, brzo premještanja podataka (objekata kao igrača, pickups, metaka).

   The map is pre-cached, which means that the client knows ALL of it — it can make automaps if it wants, it can tell you the best paths, it can hack the art. Karta je prethodno spremljenu, što znači da klijent zna sve to - to može učiniti automaps ako to želi, može vam najbolje staze, može Hack the art. But it can also optimize what to render. Ali također može optimizirati ono što bi.

   The dynamic stuff has the potential to move very fast, so the server tells you where all of it is at any time. Dinamičan stvari ima potencijal da se kretati vrlo brzo, tako da se na serveru gdje ti kaže sve što je u svakom trenutku. After all, it might round a corner, or you might round a corner. Uostalom, možda okrugli kutu, ili možda okrugli kutu. This doesn’t mean the client is rendering it, but it does mean it knows about it. To ne znači klijenta je renderiranje, ali to ne znači da zna o tome. That is why I put “visible” in quotes. To je razlog zašto sam stavio "vidljiva" u navodnike.

   The renderer then does render culling, which is decide which items to draw. The renderer onda ne ostaviti culling, koji je odlučiti koje stavke za crtanje. A hacker can change how stuff renders, and given the fact that the client knows where everyone is, it can do things like draw outlines of them on the hud, letting you “see” through walls. A haker može promijeniti kako stvari čini, a obzirom na činjenicu da je klijent zna gdje je sve, to možete učiniti stvari kao što ih obrise privući na hud, što Vam omogućuje "vidi" kroz zid. Or autoaim at them, lining up the shot before they come out from behind the wall. Ili autoaim na njih, obloga se je pucao prije nego što oni dolaze iz iza zida.

   Something like a vismap doesn’t do complex dynamic culling; instead, it says “this guy is basically in a different building” or “this guy is basically at the other end of a long twisty hallway” — there’s no way for the other guy to come into visibility in any reasonable period of time. Nešto kao vismap ne čini složene dinamičke culling, umjesto toga, ona kaže "ovaj tip je u osnovi u drugoj zgradi" ili "ovaj tip je u osnovi na drugi kraj duge twisty hodnik" - nema načina za drugi momak stupiti na vidljivost u bilo koje razumno vrijeme. So the map gets chopped up into network update areas. Dakle kartu dobiva sjeckani se u mreži ažuriranje područja. “When in room A, tell me about room B dynamic stuff, but not room C stuff.” This is basically the same as EQ not telling you about stuff in the next zone, etc. "Kad u sobu A, recite mi o sobi B dinamički stvari, ali ne soba C stvari." Ovo je u osnovi isti kao i EQ ne govorim o stvari u sljedećem zonu, itd.

   The only total solution is to do line of sight network culling, but that is both CPU-intensive, and also would require a round-trip to the server, which makes it impossibly slow. Jedino rješenje je ukupno učiniti domet optičke mreže culling, ali da je i CPU-intenzivnoj, a također će zahtijevati obilaska na poslužitelju, što ga čini nemoguće sporo. Most MMOs settle for radial network culling. Većina MMOs podmirivanja za radijalna mreža culling.

7. Richard Bartle said on April 18th, 2008 at 8:28 am : Richard Bartle rekao je na 18 Travanj 2008 u 8:28 pm:

   Raph>The dynamic stuff has the potential to move very fast, so the server tells you where all of it is at any time Raph> Dinamičan stvari ima potencijal da se kretati vrlo brzo, tako da se na serveru gdje ti kaže sve što je u svakom trenutku

   It’s possible to send this information in an encrypted form, but only send the decryption key when the client is entitled to see it. To je moguće poslati te informacije u šifriranom obliku, već samo dešifriranje poslati ključ kada klijent ima pravo da ga vidi. It doesn’t have to be heavy duty encryption, just enough to make trying every key in a split second impractical. To ne mora biti teška enkripcije, samo dovoljno da nastoje svaki ključ u djelić sekunde nepraktičan.

   I first saw this proposed on MUD-DEV, but haven’t seen it used in action. Prvi sam to vidio na predložene blato-dev, ali još nisam vidio da se one koriste u akciju. I suspect that even a single UDP exchange with the server may introduce too much lag. Ja sumnja da čak i jedan UDP razmjene s poslužiteljskim uvode svibanj previše zaostajati. Using something similar for precached client-side material ought to be viable, though. Korištenje nešto slično za precached klijent-strana materijal treba biti sposoban za život, iako. The decryption algorithm may be in the hands of the enemy, but that doesn’t mean the decryption key has to be. U dešifriranje algoritam svibanj biti u rukama neprijatelja, ali to ne znači i dešifriranje ključ mora biti.

   Richard

8. Raph said on April 18th, 2008 at 8:37 am : Raph rekao je na 18 Travanj 2008 u 8:37 pm:

   Very true — I had forgotten that came up on MUD-Dev, actually. Vrlo istinito - Imao sam zaboravio da je došao na blato-Dev, zapravo. But yes, a token exchange of hashes or keys in classic key exchange style could be done. Ali da, znak razmjenu hashes ili ključeve u klasičnim ključem razmjene stil bi se moglo činiti.

   I don’t think that for real-time apps an on-the-fly key exchange is practical — the roundtrip time could be too much. Ne mislim da je za real-time aplikacije jedan on-the-letite ključ razmjena je praktična - na roundtrip može biti previše. But it’s worth exploring in the fashion you suggest. Ali to vrijedi istraživati u modi vam predlažemo.

9. Shalkis said on April 18th, 2008 at 9:12 am : Shalkis rekao je na 18 Travanj 2008 u 9:12 pm:

   A vismap can’t prevent you from tracking a player who’s just about to run into the room you’re in, but it can prevent the server from telling you that he picked up an important powerup from the previous room. A vismap ne može spriječiti u praćenje igrača, koji je samo o izvoditi u sobu ste u, ali to može spriječiti poslužitelj od vas govori da je pokupila važnu powerup iz prethodnih soba.

   That decryption-keys-sent-on-demand sounds interesting. To dešifriranje-ključevi-posla-na-zahtjev zvuči zanimljivo. However, the preloaded encrypted packet needs to be padded to a predetermined size and it’s transmission time needs to be randomized. Međutim, preloaded šifrirani paket treba biti postavljen na veličinu predodređen i da je vrijeme prijenosa mora biti slučajno. While you may not be able to decode the contents, the act of transmitting encrypted data can be telling in itself. Dok svibanj neće moći dekodirati sadržaj, čin prenošenja podataka može biti kodirana, govorim u sebi. If you always receive a packet of a certain size 2 seconds before a dragon appears, you’ll soon learn to hide whenever that happens. Ako ste uvijek dobiti paket za određeni broj 2 sekunde prije nego što se pojavi zmaj, uskoro ćete saznati za skrivanje kad god se to dogodi.

10. Spaz said on April 18th, 2008 at 9:40 am : Spaz, rekao je na 18 Travanj 2008 u 9:40 pm:

    These are serious problems now, but will they not eventually go away as bandwidth and server hardware get better? To su ozbiljne probleme za sada, ali će oni na kraju ne odem kao i bandwith na serveru hardver bolje?

    Do you think that the demands of things we want to do are growing faster or slower than the abilities of the physical infrastructure? Mislite li da su zahtjevi stvari koje želite učiniti rastu brže ili sporije od sposobnosti fizičke infrastrukture?

11. Michael Chui said on April 18th, 2008 at 10:20 am : Michael Chui, rekao je na 18 Travanj 2008 u 10:20:

    These are serious problems now, but will they not eventually go away as bandwidth and server hardware get better? To su ozbiljne probleme za sada, ali će oni na kraju ne odem kao i bandwith na serveru hardver bolje?

    They can, but most of these improvements are being put to use in driving bigger and better features, rather than locking down security. Oni mogu, ali većinu tih poboljšanja se staviti na korištenje u vožnji, veći i bolje mogućnosti, nego niz sigurnosnih brava. It’sa resource allocation thing, and security doesn’t make you any money. It'sa alokacija resursa stvar, i sigurnosti ne čini li bilo koji novac. It just keeps you from losing too much. To samo čuva od gubljenja previše.

    Notice how every proposed solution so far has an implied argument of “This doesn’t take much effort.” And every vulnerability comes from, “This makes a better experience.” Obavijest o tome kako svako predloženo rješenje do sada ima podrazumijevana argument za "Ovo ne vodi puno truda." I svaki problem dolazi iz "Ovo čini bolje iskustvo."

12. Steven "PlayNoEvil" Davis said on April 18th, 2008 at 10:50 am : Steven "PlayNoEvil" Davis rekao je u 18. travanj 2008 u 10:50:

    The other option is to pre-load multiple data sets or assets and then simply point to the right one when needed. Druga mogućnost je da se pre-opterećenje više setovi podataka ili imovinu, a zatim jednostavno pokažite na pravo jednom kada je potrebno.

    In many cases you can stop tampering by using a keyed hash function (or MAC) instead of encryption. U mnogim slučajevima možete prestati plesti se u što pomoću hash funkcija s ključem (ili MAC) umjesto enkripcije. This has the benefit that the server can “cheat” and not check the MAC code all of the time (coincidentally, I’m coding one of these right now). To ima prednost da je server može "podvaliti" i ne provjeriti MAC kod svih vremena (coincidentally, ja sam jedan od tih kodiranje odmah).

13. Swift Voyager said on April 18th, 2008 at 11:14 am : Swift Voyager, rekao je na 18 Travanj 2008 u 11:14:

    My personal maxim when writing business software for internal use over a LAN or Intranet: You can try to monkey-proof your software but a monkey is still a monkey. Moj osobni princip prilikom pisanja poslovnog softvera za internu uporabu preko LAN ili Intranet: Možete pokušati oponašati-dokaz vaše oponašati softverskih ali je i dalje čačkati.

    We had a large application designed for internal use and since we controlled all aspects of that use, we could make arbitrary statements like “This site requires MS Internet Explorer version xx or higher” or “Screen resolutions of xxxxx by xxxxx or higher are required to view this page”. Imali smo velik program osmišljen za internu uporabu, a od nas kontrolira sve aspekte koji koriste, mogli bismo napraviti proizvoljne izjave poput "Ovaj site zahtijeva MS Internet Explorer verzije xx ili više" ili "ekran rezolucije od XXXXX XXXXX ili više su potrebni za vidjeti ovu stranicu. It saved a lot of time in testing and customizing. To spremljene puno vremena u testiranju i prilagođavanjem. Later, someone got the bright idea that certain outside clients and vendors should have access. Kasnije, netko je dobio sjajna ideja da određene izvan klijenata i distributera trebalo bi imati pristup. “uh oh” "Uh oh"

    And that doesn’t even begin to get into the area of open public access where people are going to deliberately trying to break your software just for fun. A da ni ne početi da se u području javnog pristupa gdje ljudi idu za namjerno pokušava razbiti svoj softver samo za zabavu. I can’t imagine having to handle that kind of problem without having full time people on staff who are dedicated experts. Ne mogu zamisliti da se obrađuju takve probleme bez puno radno vrijeme na ljude koji su posvetili osoblje stručnjaka. What a nightmare. Koje noćne more.

14. Shalkis said on April 18th, 2008 at 12:41 pm : Shalkis rekao je na 18 Travanj 2008 u 12:41:

    And that doesn’t even begin to get into the area of open public access where people are going to deliberately trying to break your software just for fun. A da ni ne početi da se u području javnog pristupa gdje ljudi idu za namjerno pokušava razbiti svoj softver samo za zabavu. I can’t imagine having to handle that kind of problem without having full time people on staff who are dedicated experts. Ne mogu zamisliti da se obrađuju takve probleme bez puno radno vrijeme na ljude koji su posvetili osoblje stručnjaka. What a nightmare. Koje noćne more.

    Security in general does require a specific mindset . Sigurnost općenito ne zahtijeva određenu načinom razmišljanja. You have to keep asking yourself: “How this can be subverted?” and “What damage could I do with this?” Once you get into that mindset, all else follows. Morat ćete se držati pitate: "Kako to može biti subverted?" I "Što sam mogao učiniti štete s ovim?" Kada bi u to razmišljanje, sve ostalo slijedi.

15. Mox said on April 18th, 2008 at 3:41 pm : Mox, rekao je na 18 Travanj 2008 u 3:41 am:

    With respect to sending encrypted data to the client speculatively, to be decrypted only when it becomes appropriate, it seems to me that it can be useful to cache potentially relevant data on the client. S obzirom da se slanjem podataka u šifriranom klijenta speculatively, da se decrypted samo kad postaje primjereno, čini mi se da to može biti korisno cache potencijalno relevantnih podataka na klijentu. For example, the stealther problem in Dark Age of Camelot. Na primjer, stealther problem u Dark Age of Camelot. There’sa whole pile of data that you need to send to the client to get it to adequately represent a figure in a graphical MMO like DAoC - race, custom appearance options, visible equipment - but you don’t want to “tip off” the client that there’s an invisible assassin nearby until you are sure the client has detected the stealther (Camelot uses a simple binary system for stealther detection, such that if you haven’t detected the sneak it’s supposedly completely undetectable). If you hold off on that bundle until the client has successfully made their “detection test” then it’s possible that there isn’t the bandwidth available to bring the client up to speed fast enough. In Camelot, with enough Stealth skill, you could bring the detection radius down to a very short distance indeed - crucial when trying to stick a knife in someone’s back. Pre-sending unencrypted data could give a compromised client some information you would not like to present to an unmodified client - the appearance, allegiance and perhaps the name and Realm Rank of the would-be assailant. Sending it early but encrypted sounds like an effective compromise technique. You can disguise it by filling otherwise unused bandwidth with nonsense that you never ask the client to decrypt. The missing data, position, speed and animation, should hopefully form a small enough packet it will not introduce any significant latency by itself.

16. Rik said on April 19th, 2008 at 12:07 pm :

    Perhaps we could get an overview of how Metaplace fits into this topic?

17. Raph said on April 19th, 2008 at 12:38 pm :

    In Metaplace, the packet stream is completely open, and the client is completely stupid. So you are forced to verify everything on the server and do everything on the server. In alpha, we have had a couple of hacks related to spamming and to triggers, and both were because of inadequately secured scripts on the worldbuilder’s part.

18. Brent Michael Krupp said on April 19th, 2008 at 3:25 pm :

    Raph was correct about EQ. Early on they *did* spawn loot with the mobs and ShowEQ (the major EQ hacking program back then) showed you that loot. Then Verant got smart and made mobs only spawn loot when killed.

    Another wonderful aspect of the way they used to do it was that rogues could pickpocket loot off of mobs leaving them empty when actually killed!

    The occasional quest mob would drop his head when you killed him — rogues could pickpocket those too. Pretty funny.

    This went away pretty early, possibly even pre-Kunark but I can’t quite remember now.

    And fwiw, I never ran the program but some good friends did.

19. Eolirin said on April 19th, 2008 at 4:13 pm :

    Raph…

    That’s twice now.

20. Ola Fosheim Grøstad said on April 19th, 2008 at 4:28 pm :

    Richard: It doesn’t have to be heavy duty encryption, just enough to make trying every key in a split second impractical.

    There is no reason to not use heavy-duty encryption on the client side, but I suppose it could be heavy for the server for real time data. However, you might get away with just encrypting the most vital information. For instance if you set up compression streams then you might separate IDs into it’s own stream and only encrypt that stream. (Separating information into their own streams tends to give better compression ratios, so it makes sense to do it for two reasons..). If you have say 20 clients subscribing to the same area you get away with spending 5% of the alloted time per client on compression, which might make it an acceptable overhead….
    *shrugs*

21. Raph said on April 19th, 2008 at 4:33 pm :

    Eolirin,

    Fine. I fixed it.

22. Raph said on April 19th, 2008 at 4:35 pm :

    Ola,

    Actually, it’s usually the client load of decryption that has been an issue, in the past anyway.

23. Solok said on April 19th, 2008 at 5:08 pm :

    Cool topic. I’m curious, what are some of the ways the server know’s that my client, and not another, is sending the data? What prevents my neighbor from impersonating my client and telling the server I’m doing something I’m not?

24. Eolirin said on April 19th, 2008 at 8:13 pm :

    Raph, I and the English language thank you.

25. Ola Fosheim Grøstad said on April 20th, 2008 at 2:20 am :

    Raph, you need to push a lot of data for that to be a problem. Here is a random page which suggests that cryptos takes less than 100 cycles per byte. A modern CPU can do billions of cycles per second…

    You might be thinking of public key encryption? Authentication rather than pure symetric encryption? Like SSL? I still think the server is on the loosing end, but I could be wrong.

26. Ola Fosheim Grøstad said on April 20th, 2008 at 2:44 am :

    (Turns out SSL only uses public key for setup and symmetric ciphers for encryption?)

27. Steven "PlayNoEvil" Davis said on April 20th, 2008 at 3:27 pm :

    @Solok - the cryptographic system would have a unique key for each client (SSL does this as a default). Therefore, unless the client willingly shares its key with another, the server can tell them apart and it is cryptographically hard for a client to spoof another.

    @Ola Fosheim Grøstad - people rarely use public key for regular encryption, they use it for establishing a key because it is so computationally intensive.

    @Raph - It would seem surprising to have the computation problem for encryption on the client side. After all, they only have to encrypt one data stream while the server has to encrypt N times the data streams (one for each client with whatever computational overhead is associated with each).

    $Richard - Actually with encryption, the hardest problem is to protect data for a second. Also, it is distressing as to how willing people are to work at attacking these systems.

    #Michael - “Not Losing You Money” may be the difference between success and failure. There have been several online games that have been brought to their knees by security problems.. security (or lack thereof) is part of the game experience.

28. Trend said on April 21st, 2008 a