2004 Web and Downloadable Games White Paper 

IGDA Online Games SIG 

Similarly, it doesn't matter if a developer uses Secure Sockets Layer (SSL) to encrypt credit card numbers 

if they leave them in the open and unencrypted on public servers. Good development and operational 

practices will go a long way towards addressing security problems.  

a) 

Hacking 

Hacker attacks are classic attacks on operating systems, networks, and standard applications, such 

as databases. These methods of attack may be used to affect the behavior of a game (such as 

editing the game code binary on a server), but at their core, they are traditional vulnerabilities that can 

be countered by traditional security tools and disciplines. This does not mean they are any less 

important, but the game security community has its own unique problems to deal with.  

Anti piracy and digital rights management tools are not unique to the online game business, but the 

issue is sufficiently relevant that the game security community does need to develop its own expertise 

and solutions. Fortunately, digital rights management and anti piracy measures for games are 

sometimes simpler than for video and music in that interaction and community are a part of the 

experience, a situation that game rights tools can use to their benefit. 

b) 

Cheating 

Cheating attacks the game itself. Examples include: alterations of software and data to reward the 

cheater and penalize others; tools to extract or discover unauthorized information; timing attacks to 

favorably manipulate online game play; and any thing or method that breaks the rules of the game. 

The category of  aim bots , or software that automatically aims for a player, is particularly interesting. 

Just as card counting is strongly discouraged in Blackjack, tools that help optimize players' actions 

are considered cheating, even if they don't otherwise break the rules. Also, as with card counting, 

some form of observation and modeling is required to attempt to separate highly skillful play from 

augmented performance. The suspicion of cheating by players can cause a serious problem for an 

online game. Even worse is the possibility of cheating by the game site operator. 

c) 

Griefing 

Beating the system can, unfortunately, be done legally. Games are inherently social activities and the 

systems that implement them assume norms of behavior. Abusive language, improper conduct, and 

other nastiness in online games get a disproportionate amount of publicity and have a dampening 

effect on the entire industry. Griefers are individuals who, using the relative anonymity of online play, 

are actually not playing a game, but using the game as a mechanism for satisfying other, darker, 

purposes (causing grief to other players). Technical solutions are of limited value. Monitoring and 

other forms of adult supervision are the most effective, and unfortunately, very expensive 

countermeasure. Griefers can even use anti griefing systems to disrupt games by generating 

sufficient complaints against a targeted innocent player to get them identified as a griefer. 

2. 

Common Exploits  

In the following sections, we will review the most common methods used in online cheating, and the 

protections against them.

50

51

52

a) 

Packet & Traffic Tampering 

In online games, three classic ways to cheat are 

reflex augmentation

, 

packet interception

, and 

packet 

replay

. Reflex augmentation consists of replacing or enhancing the player skills and response with an 

automated input. Using proxies or traffic monitoring, the cheater sends additional packets on the 

network with the effect of, for example, increasing their firepower. Reversely, in packet interception, 

the cheater prevents packets containing information that could damage their character from arriving, 

thus becoming invulnerable. In a packet replay attack, the same packet is sent repeatedly, such as to 

increase the cheater's firing rate. 

50

 M. Pritchard. 

Cheating in Multiplayer on line Games. 

The 2001 Game Developer Conference 

Proceedings, San Jose, California, 2001 

51

 J. Smed, T. Kaukoranta, H. Hakonen. 

Aspects of Networking in Multiplayer Computer Games

. In Virtual 

Reality Annual International Symposium, 2001. 

52

 http://dark.swcombine.com/documentation/pdf/SWC SO v1_0.zip 

Page 73 of 93