Vulnerabilities / Threats
3/11/2010
07:02 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

GDC: Developers Vs. Cybercriminals

At the Game Developers Conference, accounts of run ins with hackers show many gaming firms haven't grasped how cybercrime can ruin everything.

Among the possible defenses, Wyatt suggests device fingerprinting, proxy detection, phishing site detection and takedown, transaction reviews, telephone verification, shipping address verification, two-channel authentication, and use of game analytics to watch for unusual behavior.

He stressed using two-channel authentication -- using a PC and mobile phone for example -- rather than two-factor authentication -- a hardware device for a code entered through a PC -- because gaming trojans on PCs can intercept two-factor authentication codes. Using two channels means that even if the PC is compromised, a hacker would still have to have malware on the user's phone to intercept the mobile communication.

Wyatt also advised having source code on a separate network, having strong authentication for developers and operations personnel, and investing in physical site security.

Wyatt is not a big fan of DRM solutions, like nProtect GameGuard and Blizzard's Warden, which he said are essentially rootkits. "Nobody likes being spied on," he said.

In addition to considering security measures, game companies should also think about ways to improve business operations that may affect security, Wyatt suggested. Legalizing and overseeing in-game currency trading to reduce fraud, as Eve has done with its PLEX system, was one example he cited.

Another example is being nice to employees and paying them fairly. "I've heard a number of horror stories about working in the game industry...when people figure out they're not being treated well, they may take it out on you...give them profit sharing," he said.

Companies should expect to be hacked, he said, and security through obscurity is not security. The only answer, he stressed, is defense in depth, giving the security team insight into all areas of the business, and striving to continually watch for problems.

InformationWeek's GDC Coverage:

GDC: OnLive Takes Gaming To The Cloud

GDC: Sony Unveils PS3 Motion Controller

GDC: Microsoft Surface Plays Dungeons & Dragons

GDC: iPhone Developers Face Hidden Risks

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

CVE-2015-0915
Published: 2015-05-21
Cross-site scripting (XSS) vulnerability in RAKUS MailDealer 11.2.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted attachment filename.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.