Take the 2-minute tour ×

I have 2 flash games (written in as3). Both the highscore value being hacked. The normal range of each game score is not more than 5000 (normal users, will only get 2000 - 3000 points). My current method of anti-hacking is:

After finish the game, flash will use post parameters send: username=mike&score=2000&hash=md5(secret . username . score). In php page, I did the check, if the hash != md5(secret . username . score), it will return error, and WONT insert data into database.

I believe this method is not enough, or my flash games would not be hacked. Is there anything I can do to improve my flash games security/anti-hacking??

How do the hackers hack? Using third-party software like, Cheat Engine, Tamper data(firefox ext), tamperIE etc??

Can you list the all the standard hack methods? (by knowing the hack methods/problems, means has solved 50% of the problems, at least I know where the problems are, and do certain pre-caution to that)

Well, my title has "49700" because both games highscore are 49700 (actually alots of this score value inserted into my database, different users thought), so I believe they are using same methods


share|improve this question
Do you generate the "secret"? How do you do that and how long is it? –  Niels Bom Nov 3 '09 at 9:33
yes.. the secret is some random string, for example: MN!FAH5736ghs^& –  flash_antihacker Nov 3 '09 at 10:12
Remember to search for similar questions before you ask your own. Check this one out: stackoverflow.com/questions/73947/… There are some pretty good answers in there. –  Lillemanden Nov 4 '09 at 10:43
Just for reference, I wrote a program that could play a flash game (Bejewelled Blitz) abiding by all the rules, just much faster than a human player and get scores of ~1M (the best human score I've seen is 380K). There's very little you could do to stop this as all I did was screen capture and mouse automation. –  cjk Jul 27 '10 at 8:31
@cjk: You must be a hacking wiz :D –  codingbiz Jul 2 '12 at 0:51
show 3 more comments

9 Answers

It's not really possible to make your score validation secure if it runs entirely on the client side. You have to do at least part of it on the server side for it to be even remotely secure. I see 2 ways of doing this:

  • you send periodic score updates to the server and on the server side you check that the score didn't jump "too much" (to be defined in the context of your game). If it "jumped" you can safely assume the player is hacking.

  • you send the entire game movement sequence (along with any random spawns or whatever ai events) to the server with the score at the end and verify that the score is actually accurate. This will obviously not work for every game, but for some games it can work. You didn't say anything specific about your game so I'll leave this here.

share|improve this answer
The first bullet doesn't stop a hacker from getting a top score. Your second bullet is a fantastic idea! –  Rook Nov 5 '09 at 1:09
Yea but it's not applicable to many games, especially shooters or those jumpy games where too much happens. It could work for stuff like tetris or logic games in general. –  Blindy Nov 5 '09 at 3:07
Why wouldn't it be applicable to shooters or jumpy games? Is there something I'm not aware of that makes it impractical or impossible to keep a running tally of events which cause a score increase? Keep a list of enemies bounced upon, check that the list does not exceed the actual number present in the game? Depending on the individual game mechanics all sorts of things are possible. The space of possibilities in platformers and shooters is more limited than you might think. –  Breton Nov 24 '09 at 13:19
but there's still a really big number of events that happen in a shooter, especially a key-controlled shooter. you have to not only upload every single event to the server (or you'll lose continuity) but hold it in memory too. –  Blindy Nov 24 '09 at 16:31
I would think you would only keep the events that affect the score, which in the scheme of things, wouldn't be any more than the number of events that affect the score in a turn based game. I mean, unless you're applying a score to every pixel your character moves, or every single key pressed. In fact, I would estimate the maximum number of possible score increasing events to be about 467, but most of the time it'd be between about 30-40. Of course I could be off by a factor of 10 or 100. ~0.47kB of data is not that much, if you've represented each "event" with a byte. –  Breton Nov 25 '09 at 22:32
show 2 more comments

By far the easiest method, and hardest to defeat in Flash is to use CheatEngine to simply search for the memory location that stores the score, then change the value to whatever you want. All the server-submit hashing/salting/verification in the world won't fix that because your game thinks it's valid before it packages it up in a nice valid hash for submission.

You can do 'sanity checks' on the scores if they will always fall within predefined values, but even then a determined hacker could simply suss out what the maximum allowed values is and always submit that value.

You could attempt to obfuscate your score values in memory to make them harder to find with CheatEngine, for example storing them as a multiplied value, then in your getters and setters for the score value, include a multiplication/division of the values to get/set the proper score for your views and score submission widgets. Even this is only a stall tactic though.

Unless bogus scores are costing you money, either don't worry about wasting time on the .01% of people who are cheating, or just moderate your score tables manually.

The key thing to consider in preventing cheating is: 'How much does this really matter?' If you're running some kind of high score based competition with a cash prize, then it's a pretty high priority. If you're just miffed that some random person is messing up your high scores table, it's not worth your time to stop them, just check it once a week and drop the bad scores.

share|improve this answer
add comment

You're ultimately trying to delay the time it takes for people to hack your system, or make it not worth their while. You could try adding a salt to the hash for a bit of extra complexity. This could be sent as a value to the flash game (add it as a parameter to the flash object in the HTML) and include that in the hash verification code. You could send some kind of session id or random number so it's always different. You could even generate two hashes by different methods and check them both.

Of course, don't discount the possibility that people have found a way to hack the actual game functionality. Or that they're just really good players...

share|improve this answer
add comment

If I wanted to hack your game I could decompile your game and find out the md5 "secret". Note that I put secret in quote marks, as the fact that it is provided in your flash game binary means that it is not actually a secret.

Its probably not possible to make your scores unhackable, all you can hope to do is make it harder.

share|improve this answer
Could you please tell me, what are the ways to make it harder to hacks? =) –  flash_antihacker Nov 3 '09 at 10:36
Ultimately, this doesn't help the asker. The question here is how to make it more secure. Secure doesn't mean "perfectly safe". If your house is secured by a dead bolt, a security system and a dog, that doesn't mean I can't break your window, shoot your dog and steal your TV before the cops show up. But I'd just assume rob the neighbors because they leave the door open. ;) –  blesh Nov 5 '09 at 21:50
"How do the hackers hack? Can you list the all the standard hack methods?" I answered some of his questions. Your comment complaining that I don't help the asker doesn't help him or me as you don't answer any of his questions or provide further info about my answer. –  frankster Nov 6 '09 at 9:54
add comment

The cryptographic system you are using is very similar to an HMAC, but yours implementation is less secure. The md5 algorithm is a broken, however your MAC is immune to the prefixing attack to generate hash collisions because the beginning of the your secret. The attacker must be able to control the beggaring of the string in order to create a hash collision.

TamperData is a very useful hacking tool to Modify/Capture/Replay traffic that comes from the browser. So you should prevent against replay attacks by authenticating the current date and time: hmac(secret,date_time.score.username).

The hackers are probably using a SWF Decompiler to find the value of your secret in the SWF file. In order to counter this you should try and bury the secret using a SWF obfuscation such as http://www.amayeta.com/.

None of this is a "silver bullet", this just makes it more difficult for the hacker. A hacker will always be able to modify his or her score because you are trusting the client to tell you the correct score. Even if you made the recommended changes you would still be in violation of CWE-602.

share|improve this answer
+1 Intereesting answer. –  blesh Nov 5 '09 at 21:52
add comment

Would not simply running the game on the server side prevent score hacking? If the game is being run as a random game then you send the random values to the user's browser there wouldn't be much sense in them attempting to cheat,even de-compiling the flash file wouldn't give them an advantage.

share|improve this answer
Flash over a web browser is client side. –  blesh Nov 5 '09 at 21:44
@blesh: The game logic would be on the server side, and the result of that logic would be sent to the client, to be displayed by the Flash application. –  Casey Chu Jul 27 '10 at 8:28
@ Casey : What you are suggesting is used for online poker / roulette games, but it is way harder to write these king of games and therefore doesnt allow for quick development (will also put a considerable strain on the server, which is feeding a few hundred instances to the user)... but it is used already. –  Sigtran Mar 2 '11 at 15:07
add comment

You could to add some sort of RSA (asymmetric) encryption to your Flash apps. You would put the public key in your Flash app, and use the private key on the server side to decrypt the score sent.

This won't necessarily prevent a hacker from hacking your Flash App, but it will make it a bit more of a pain in the butt.

Here is an AS3 library for RSA encryption.

Outside that it'll depend on what server technology you're using (PHP, .Net, or whatever) as to how you implement the RSA on the other side.

It should be noted too that this question has already been answered.

share|improve this answer
add comment

What I was thinking was that since the game appear's to require authentication I would assume that there are calls that require a get user name and other info.

Discussing the matter from another developer thir advice was to use Ajax components. Idk.

Most hackers will find a way to get around most security issues the best way is to prevent them from sending anything back to the server other than what is required for the game to function.

Has anyone used random based on the amount of negative memory available? instead of looking for the specific memory location with those softwares.

Why not send multiple bogus values to mem and derive the outcomes based on open memory locations?

Please don't attack me for this suggestion I am a learner like most others.

share|improve this answer
add comment

As you said depending on what is being done to hack this there are different holes to fix. As you are sending the actual information in your message, and "secret" is contained in the code it becomes a much easier target. Some of the things you could do to improve security

  • Use a different hash function, MD5 has known flaws it is possible to create messages with the same signature without knowing the content, SHA1, SHA2 offer higher security, this will prevent an attack through a weakness of MD5

  • Make the 'secret' unique to each message, ie. send it from the server for each posting, this will prevent people from reusing the same hash over and over again, and make it harder to look at the code and create the hash

  • Hash the result multiple times e.g. value = hash(hash(hash(...,salt),salt),salt) this won't help if people are decompiling your program but it will help if they are just trying to recreate the hash by itself.

  • Look for software to protect your SWF against decompilation, i don't do much flash so I don't have any reliable links for that

share|improve this answer
You have no idea what you are taking about. His implementation of a Message Authentication Code (MAC) is immune from the prefixing hash collision attacks that affect md4,md5,sha0,sha1... Multiple uses of a message digest does not improve the secuirty of a MAC. Read "Practical Cryptography" and stop giving people insecure advice, if you don't know, don't answer. –  Rook Nov 5 '09 at 1:13
add comment

protected by Community Dec 23 '11 at 11:42

