Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/12/2010
10:44 AM
50%
50%

Hackers Not Playing Games With Gaming Sites

Internet gaming companies can be damaged by cyber attacks in a broader variety of ways than other companies

Cybersecurity is a serious issue for any online business, but for online gaming companies it's doubly so.

Beyond issues of data protection, which are similar for any company that handles customer data, Internet gaming companies can be damaged by cyber attacks in a broader variety of ways than other companies.

Online retailers for example may suffer financially when they get hacked or hit with a denial of service attack, but damage to physical assets is likely to be insulated from online threats.

For operators of online games, however, hackers threaten not only revenue and user trust, but user experience and the intellectual property -- game source code -- upon which the business is built.

The ongoing exploitation of game bugs for fraud and cheating can be compared to altering Amazon.com so that links don't work, pages don't load, and recommendations don't fit users -- the result is a poor user experience that can drive customers away and limit both immediate and future revenue.

It can also raise support costs as frustrated players call to recover stolen game items or to deal with in-game problems.

At the Game Developers Conference on Wednesday afternoon, Patrick Wyatt, COO of En Masse Entertainment, recounted his extensive experience with hackers, cheaters, griefers, and cybercriminals in an effort to help game developers understand that game security can't be an afterthought. Having worked on Warcraft, Diablo, Starcraft, Guild Wars, and Aion, he has seen his share of hacking.

"Hacking games is as easy to do now as it was 20 years ago," Wyatt lamented, pointing to the recently released blockbuster Modern Warfare 2, which is vulnerable to a character speed hack.

And the incentive to hack games has risen as virtual goods have been embraced by the masses: Online games are like banks, but without regulations and expensive security measures. Gold farming and gold frauding -- undesirable and illegal methods respectively of amassing huge amounts of in-game currency for black market resale -- cause losses to the gaming industry of somewhere between $1 billion and $15 billion, Wyatt estimated, though he conceded that no one really has accurate figures.

The potential ramifications for gaming companies are significant: degradation of the play environment, fraud prevention technology integration costs, customer support costs, billing transaction costs, billing charge-back fees (from stolen credit cards used to open accounts), fines from credit card brands, enforcement false positives (turning away legitimate customers), and problems selling digital goods.

Among the possible defenses, Wyatt suggests device fingerprinting, proxy detection, phishing site detection and takedown, transaction reviews, telephone verification, shipping address verification, two-channel authentication, and use of game analytics to watch for unusual behavior.

He stressed using two-channel authentication -- using a PC and mobile phone for example -- rather than two-factor authentication -- a hardware device for a code entered through a PC -- because gaming trojans on PCs can intercept two-factor authentication codes. Using two channels means that even if the PC is compromised, a hacker would still have to have malware on the user's phone to intercept the mobile communication.

Wyatt also advised having source code on a separate network, having strong authentication for developers and operations personnel, and investing in physical site security.

Wyatt is not a big fan of DRM solutions, like nProtect GameGuard and Blizzard's Warden, which he said are essentially rootkits. "Nobody likes being spied on," he said.

In addition to considering security measures, game companies should also think about ways to improve business operations that may affect security, Wyatt suggested. Legalizing and overseeing in-game currency trading to reduce fraud, as Eve has done with its PLEX system, was one example he cited.

Another example is being nice to employees and paying them fairly. "I've heard a number of horror stories about working in the game indstry...when people figure out they're not being treated well, they may take it out on you...give them profit sharing," he said.

Companies should expect to be hacked, he said, and security through obscurity is not security. The only answer, he stressed, is defense in depth, giving the security team insight into all areas of the business, and striving to continually watch for problems.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Florida Town Pays $600K to Ransomware Operators
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-12346
PUBLISHED: 2019-06-24
In the miniOrange SAML SP Single Sign On plugin before 4.8.73 for WordPress, the SAML Login Endpoint is vulnerable to XSS via a specially crafted SAMLResponse XML post.
CVE-2014-9699
PUBLISHED: 2019-06-24
The MakerBot Replicator 5G printer runs an Apache HTTP Server with directory indexing enabled. Apache logs, system logs, design files (i.e., a history of print files), and more are exposed to unauthenticated attackers through this HTTP server.
CVE-2019-7231
PUBLISHED: 2019-06-24
The ABB IDAL FTP server is vulnerable to a buffer overflow when a long string is sent by an authenticated attacker. This overflow is handled, but terminates the process. An authenticated attacker can send a FTP command string of 472 bytes or more to overflow a buffer, causing an exception that termi...
CVE-2017-17945
PUBLISHED: 2019-06-24
The ASUS HiVivo aspplication before 5.6.27 for ASUS Watch has Missing SSL Certificate Validation.
CVE-2019-10271
PUBLISHED: 2019-06-24
An issue was discovered in the Ultimate Member plugin 2.39 for WordPress. It allows unauthorized profile and cover picture modification. It is possible to modify the profile and cover picture of any user once one is connected. One can also modify the profiles and cover pictures of privileged users. ...