Cheaters’ Secrets Unveiled – How Cheaters Operate in Mobile Games & How to Counteract Them

next up we've got the cal from danube who you can see yay look at that right there one of our wonderful sponsors who's going to be talking about uh cheetahs secrets and build um how cheaters operate in mobile games and how you counteract them hi how are you michael hey sophie i'm doing great how are you yeah i'm not bad thanks where are you coming at us from where are you based at the moment jeff spain he had a really great talk and i'm actually calling from ottawa canada which is a little bit early on our side it's 4am here but i've been watching the uh i've been watching the pocket gamer connect recording so i'm actually really excited to do a live session oh well fantastic well thank you so much for being here and again for being with us in the middle of the night um yeah i can't explain how grateful we are so thank you so much um yeah i i won't keep you too long i will let you get on and so what i will do is while you're sharing your screen getting everything

sorted i'm going to remind everyone to uh throw your questions into the q a for macau because i'll be back at the end and we'll go through all of your questions um but once again i would just like to say a huge massive thank you to mikhail as well for being up so early so um yes that is uh that deserves applause and i hope you've got your copy charged i'm looking forward to the question so thank you for doing that oh no worries at all yeah so um and do you have any slides or anything like that i do i'll start sharing in just a second i just wanted to give a super quick intro and then i'll head right into it perfect well in that case what i will do is it sounds like you're all sorted so i will drift off into the background but i'll be here if you need me and i'll be back at the end for the q a thanks so much sophia hi everyone my name is michaela grishichev i'm a product manager at stevo and their anti-cheat solution so today i have an exciting topic for you and that's cheater secrets in video games and

advice on how to counteract them we have a massive amount of content to cover in just 20 minutes but before i hop into it and go on my verbal diarrhea parade just a few words about the fine folks that brought me here before you the organization on the right the nouveau barredetto is the organization for which i'm a product manager at they're the world's number one games protection platform and you might know them for their anti-tamper solution on pc where their objective is to secure the launch window of games and today we have an unprecedented 160-day crack free window which i'm really proud of the team for delivering we protected over a thousand games which equates just over two billion unique game installs um and yeah we feel like we're really the experts in the industry on this side our parent organization is ardetto they've protected more than six billion devices and applications today this is everything from the operating system that's running in your car to the uefa match that went on just a

few days ago so there are many many security threats that mobile games will face but today i'd like to focus on just four of them um for the sake of fitting into 20 minutes uh the first one being cracked premium games that have all their content unlocked so essentially piracy or free games that have hijacked monetization um with the ability to create tampered versions of applications you then enable malicious redistribution so this is when games are used as vehicles to distribute malware or steal credentials and in this case it doesn't have to be just games it could be applications maybe somebody doesn't want to pay for the premium cost of photoshop so they try to find a free version and then when they sign in to creative cloud from there little do they know that the app has accurately hijacked their credentials service infrastructure attacks so this is a class of attacks like denial of service data theft due to poor security or vulnerabilities and headless farming which is

essentially when an online service believes it's talking to a mobile client but in reality it's just talking to one of a thousand threads on some machine pretending to be a real life client and finally i think the key focus of this talk the client-side cheating portion so this is software like bots scripts and trainers um either to remove the need for a player to spend money on in-game offline monetization or in the worst case through in the experience of players playing in competitive multiplayer games in uh may 2020 we analyzed the top 50 games on the google play store with the objective to discover what is the cheating landscape look like and we did this by scanning 64 cracking and cheating sites for cheats and hacks and what we discovered was that 86 of the games in the top 50 had a cheat available and if those that were available were actually up to date to the latest version so this means you can download an app

from the google play store and then most of the time find a cheat that is already updated to work with the latest app these cheats were delivered in two forms uh the first form was a version that is uh in which the app is already tampered with the cheat or hack already pre-installed so you would be downloading a tampered application that already has a cheat software built in and the other one we delivered as a client-side hack most of the times in memory editor which work on a pristine version of the game so this means you can go to the app store download the pristine version of the app and then use a third-party tool to then cheat or otherwise hack the app so let's take a look at how these tampered apps are created and how these memory editors are created i apologize for the grain not sure why i did that so the tampering process for android and ios is actually the same and the process is you analyze the

application to find decoder data to patch you would then change the coder data in the application resign it and re-redeploy it to the device but of course the devil is in the details so let's find out how this is done so the first step to creating a tempered app is to analyze it and to analyze if you first have to unpack it so on android this process is quite trivial you can use command line tools like apk tool or full featured editors like apk editor studio and from the screenshot you can see i loaded up editor studio threw in vlc for android in there and then on my windows operating system i now have a file system the files that were packed in the apk on ios this is significantly more challenging so you can use basic archive tools like 7-zip to unpack the ipas but the binaries would then require decryption and for all intensive purposes it's actually much easier to use tools like clutch and dump ios to dump the decrypted binaries directly

from memory but this then requires a jailbroken device on which to run these tools and this gel broken device requires some communication channel like openssh so assuming you got past the hurdle of dumping the application package you then need to analyze it to find targets of interest so there are many static analysis tools in this case i will use ida pro in a few of our examples but the goal is to explore and find interesting code or data to patch so in the above screenshot is data that is interesting and that's the advertiser id that's used in a free to play game so if i were to patch this advertiser id and then redistribute the stanford application anytime a player plays the game the revenue now be funding me the hacker and the cracker instead of the original game developer this is an example of modifying game data and in the second example i took the dex file converted it to smalli which for all intensive purposes

is java and then we can see that there are code logic responsible for validating if a premium version of the application is unlocked or not and here you can patch the code and essentially pirate the application by gaining access to premium features without paying for it so both of these examples are very cheat related so i have one specific to creating tamper cheats so this is a shark game that you've loaded into ida pro and we have two functions that are interesting right near the bottom called shark stats get currency and get premium currency and if in item pro we navigate to these functions we get the uh arm assembly instructions that are behind it i don't have an arm assembler in my head so here is the uh kind of encode representation of it on the left is the original code and the idea is this get currency function has some original game code that's invoked and eventually returns the

currency but in the patched example we put an instruction right at the beginning that just returns some obscenely large currency value and ignores the rest of the game functionality and if we go back to the assembly code you can kind of see in the patched version it loads into the register an obscenely large value and then immediately jumps out or as in the original version you execute the original code and the way this looks like in game is in the shark game no matter what the game does to increase or decrease the currency value the function will always return the static version that the static value that we now touched in super simple example but i hope that that part made sense so we covered um how to actually tamper and patch the application but how do you repack it for a redistribution well the repacking step actually follows the regular archiving creation and deployment process so for ios there's a provisioning step for uh android is the app apk signing step

and resigning the apps enable resubmission to app stores and this is how you end up with these cloned and copycat apps which are essentially the original version of the application with a few assets either changed or stripped and then republished to steal revenue from the original developer and on android specifically resigning an application reduces the effort to side load the app onto a tampered uh sorry side loaded tampered app onto a device since android is a lot happier loading uh signed applications and unsigned applications and once distributed this is where the damages begin so before that really if somebody wants to go through this process and modify the app for themselves they can knock themselves out but once it's been distributed this is where the danger starts so cheats built into tempered apps um reduce in-app purchases um once you have a tempered app that gives you unlimited coins why would you purchase premium currency

and more importantly the will damage legitimate players multiplayer experience if your game has a competitive multiplayer so tempered apps have their monetization vehicles hijacked so this doesn't just mean you lose your stream of revenue but instead that stream is redirected to fund future hacking efforts and crack premium apps will of course reduce the amount of premium purchases through the app store if i can avoid spending two or three bucks maybe that will be enough to motivate someone to go find the app for free on pirate bay or something like this and finally kind of a hidden danger and a hidden cost is the increased support effort and brand damage as a result to users working with cracking apps oftentimes a user will not be able to tell if an issue with an app is because of a crack or because of the base product and essentially you begin to rack up overhead through the cracked apps that are available out in the wild so we just covered the left side portion which is the 84 percent of apps

that had tampered copies floating around next up i want to talk about the 22 that are hacked using client-side tools like memory editors and just a reminder the difference between the two is on the left you're publishing an application with the hacks already applied and on the right you're working with a pristine application and instead using a third party tool to interact with it so how are apps attacked by memory editors well to begin they have two requirements the first is you need the actual third-party tool like a memory editor to interact with the application and the second one is a big one and memory editor needs to have elevated privileges to actually interact with the application and for all intents and purposes on modern android and ios this is not possible without a rooted device the permission levels cannot be granted to regular sandbox applications while running so assuming these requirements are met then this enables the hacker to attach a memory editor to the application

look for sensitive coder data alter that code or data and then publish a script that essentially automates step one to three so millions of other users can do the same this is what this looks like so on the left i have a game in which a character has 600 hit points uh the character uh the next step would be to open up the memory editor and search for the value 600 and essentially the memory editor will go through the process and returns all the memory regions that have the value 600 in them um hint there's going to be hundreds if not thousands um since there's nothing that unique about this value the next step is to then run around in the game take a little bit of damage and you can see the players health has now been reduced to 480. so we go back to the memory editor and input 480. this is where a little bit of the secret sauce happens um it now takes the values that used to be 600 and checks which ones have reduced to 480.

and this is event that's rare enough that you could figure out that hey there's only one memory region that had this type of behavior and it so happens to be the memory region responsible for representing the characters hit points the memory editor can then freeze this value um there's an option on the left but on the right you can now see a character taking repeating repeated damage and the game engine is struggling to properly decrement the character's hit points and for all intensive intents and purposes to is now uh invulnerable so the the cheater has given himself instability now while these steps are easy to execute for an individual this isn't very easy to distribute to millions so this is kind of where hacking scripts come in and i have an example from battle legion which is a game um that had a hack before tenuro came along um this hack enables a cheater to receive instant wins so as soon as the match is found it accelerates to match countdown timer

for it to start instantly and then without moving any units uh the match is declared a victory for the player so as you can imagine this is probably not incentivizing the player to purchase any in-game purchases and the player they're playing against is probably having a terrible experience so i i think we're all on the same page that yep these are definitely not positive things about mobile app development what can we do with about them so there's three categories of recommendations that i'd have for all app developers regardless if it's games or business applications and that's to follow security by design be diligent and provide passive prevention and then in the most extreme cases consider active detection so what do these mean security by design i'm hoping everybody's aware of at least the basics and that's shift as much of your critical logic as you can to the server so this means don't trust a client with critical decisions or decisions that may be modified by the

client when the server is communicating with the client don't trust it so don't pass it any data that you would have wanted to reveal so for example if you're creating a battleship game and you have a list of units that the player owns in a list of units that the enemy owns don't send the positions of the enemies units because the cheating client will reveal those positions to the cheater and they will not respect any hidden or invisibility properties that you would then try to enforce on the client kind of an obvious one is secure the server apis so make sure your access rules are correct you're validating the client input that's being sent to the server implement throttling and limits have proper access tokens and expiration values rotate your api keys and monitor your api key usage um honestly the security by design is probably a multi-day talk all on its own so i'll leave it at that for now next up is

passive prevention so this is making it hard for an attacker to understand what to attack and this is often done by applying obfuscation the objective is to hide important data and game state and delay the amount of time it takes for an attacker to understand and essentially update or create a cheat for the hack for the app so this will not prevent hacking attempts but it will certainly slow them down and finally for the most extreme of cases you'll want to move into active detection so that's making sure that the code running out in your application is not running from a tampered state so the app executing the code has not been tampered um you want to impede debugging hooking attempts which will prevent those memory editors that work on pristine applications and in some cases you want to perform root detection so making sure your application is running on a trusted environment so doing all three of these from scratch i could imagine would be

extremely daunting i mean uh obfuscation you could probably find off the shelf solution for these but doing things like uh verifying the integrity of your application without killing battery life is challenging to do properly impeding debugging and hooking requires expert level platform knowledge to understand how platforms offer this functionality and doing things like root detection is really an endless game of cat and mouse because as soon as you create a detection method uh the cheaters and hackers will find out how to uh circumvent it or patch it so this is really where duo's expertise comes in as i mentioned on the pc we had incredible success with our 160-day crack-free window and we took this technology took the learnings we had from the platform and we've brought it to the mobile space so we're very excited to offer the new mobile up protection the exciting thing here is our integration process um it essentially requires well not

essentially it does require no game modification no game source code modification so you would take your fully built ios or android application after the apk has been created you submit it to us for encryption using a tool we provide that integrates into your ci pipeline and once the tool returns the encrypted version of your application you would then go through your regular review staging and publishing process and at the end of the day your application will now ship with integrity verification ensuring that there's no tampered version of your application floating around it has the anti-debugging functionality which will prevent memory editors and tools used to analyze or dump game code hook detection so for these frameworks that i showed with battle legion that will enable easy things like patching for an instant win uh optionally you have the ability free application to react to jailbreak or root detection so if it detects this maybe you would like alternative flow in your app and

only certain features be available to users not running on trusted platforms and finally a feature that we're very excited for and that's our emulator detection and the ability to tell you when we're running in a trusted emulated environment versus one in which you should take caution and part of this comes the mobile telemetry so this is an optional portion if your application has an online component and the purpose of the mobile telemetry is to get real-time insights into hacking and cheating attempts which are absolutely critical to securing multiplayer online games so if you notice a player cheating mid-match with mobile telemetry you can then kick a player from the match or take whatever action you would prefer maybe you put them on a cheater island where they only play with other cheaters or maybe you revoke their online access entirely it's really up to you and of course this mobile telemetry is accessible via apis and has an integration with every major game platform

so finally pocket gamer uh is really a conference for indies um and we absolutely love indies and by this we mean one the solution is affordable um it's just easy to implement which is perfect for small teams i mean you already have 12 hour work days this is one less thing to worry about once it's integrated and the revenue model for us implies that we only succeed when you succeed and we have an awesome recommendation from traplight the developers of battle legion we've been on their game for almost a year now and ever since they introduced a new mobile protection uh they have not had any cracks or hacks and the game is protected to date so we're very proud of the work we did for them and we're looking forward to working with more ideas in the future so i really apologize for the pace of that presentation i know it's kind of rushed and there's a lot of content to cover but i wanted to leave plenty of time for questions and this would be a great time to ask your questions now thanks a lot

oh fantastic thank you yes well like you say we've got a couple of questions so uh yeah of course i'd like to say a massive thank you for the talk and um should we dive into the questions please do looking forward to it fab so the first one i've got i'm just gonna pick them out maybe do them in reverse order this time uh does danuvo also take into consideration devices that are older and slower when doing the checks or and will that have any influence over the performance i mean obviously this market's like like you know around the world that utilize you know not the latest hardware for playing games yeah absolutely so on pc testing um for the anti-tamper solution the performance testing was really heavily focused on frame rates frame times and kind of the perceivable performance of the users will see but once we move on to the mobile space the performance requirements escalated significantly so we take a look at things like impact to battery life cpu usage memory consumption

because we found all these variables are so much more significant on a mobile device than a pc platform so yes the majority of our test farm is older devices because these devices are more sensitive to these type of performance impacts and the type of metrics we collect is things like battery life memory usage cpu consumption etc okay fantastic take that one off there we go how often should we perform integrity verifications and root detections oh so maybe i'll start with the latter one so root detection really depends on how how much of a requirement it is for your application to be running on a device that is trusted so oftentimes for things like banking applications that want to take advantage of some of the potential hardware security features oftentimes they'll perform room detection to make sure they're running on a trusted environment just to dot their eyes and cross their t's but after times it is actually acceptable for games to be running on emulated

devices because maybe players just prefer playing from their desktop on a full screen using keyboard and mouse and this is perfectly fine um so it really depends on what type of game is being played and for what reason i imagine if you have a competitive game being played for a large amount of esports money and you really want everybody on a fair playing field you probably want to enforce that for this match everybody's playing from the same device just so nobody has an unfair advantage but for your casual gamer maybe ignore the um emulator detection and allow these devices to work as is and then the first part of that question was about how frequently should you perform integrity verification i mean there is no simple like hey do it every five seconds it's really do it frequently enough to ensure the security of your application and the technology that we build in is smart enough to only run the integrity verification when it deems necessary so it's not like it's sitting there just scanning your app over and over and over

that's a really naive approach that's not how it's done under the hood yeah okay and next thing we've got when dealing with uh hacking what is your advice for best protecting the players data as a leak could create a trust issue in the long term um so de nuvo is actually based in salzburg austria in the eu and they're under the gdpr regulations and we found that actually going through the conformance process to make sure we are compliant with gdpr and the california rights privacy act um was a good framework to review our internal policy for how data is being transferred and protected so my recommendation would be actually verify if your organization conforms with those uh price privacy rights and regulations and this will actually also force you to go through the process of making sure that data is secure fantastic we've got two questions left hopefully we can get through them both i think we will um would you advise indie developers working with solutions

like denuvo from the start like would you advise working from the start um to have security already in place set in the design or is this something that's best to be done afterwards so basically it's like would you design the game with that ad in danube in mind or is it something that's equally suitable to add in later on so i the solution is really built in mind where somebody doesn't have any time available and last minute they need to apply a solution okay um but by all means that doesn't mean that's the optimal way to use it so as i mentioned for example with the mobile telemetry where you have the ability to see if somebody's cheating cheating in real time i think if ahead of time a developer knew they had an ability to create an experience from that type of functionality they can really design their multiplayer experience around that and add the necessary ui elements to maybe notify other players that a cheater has been detected and kind of proactively build an experience around that there's value from it but if there is no time to allocate to security and really the focus of the

game developer should be making an awesome game experience and the solution is more than usable last minute and applied as is fantastic yeah next up is when dealing with um well it says here when dealing with for example chinese markets that um are known for you know sometimes controlling how your game is approached can be difficult um is using anti-tamper solutions enough or should we take additional measures so i had an interesting slide in the deck that i removed um because in order to cut time but we did find that more more than 86 percent of tempered applications actually came from china so to us this was we heard the situation was bad but we didn't quite know how bad it was over there so the anti-tamper solution does work in that region and it works by sandboxing that region that means any data from china stays in china and vice versa um and from the experience we had so far predicting applications there is yes it is more than enough so anti-tamper has protected sorry deneuvel mobile

protection has protected mobile apps in china with them remaining on cracked so far for nine months because that's how long the solution has been out on the commercial space um and we're hoping that nine months just extends even further but right now we don't see any uh evidence of increased hacking in china versus other regions once mobile protection is applied fantastic and last question we've got we've got actually got one more in is from brian who is the editor of pocketgamer.biz i said do you find that developers tend to offload all responsibility for data security privacy etc to publishing partners or are they dealing with it themselves um it's a mix oftentimes organizations that have the resources to dedicate to data privacy and just security of their organization in general do want to maintain ownership and control of that data flow and at the end of the day in the regulations they are then the data processor and the data controller but oftentimes we'll deal with organizations that say

listen guys we just really want you to own this problem for us and use you as a white glove service and in this case we have a document that states we become the data controller we become the data processor and from a regulation regulation regulation standpoint uh that onus and responsibility legally falls on us so it's really a mixed bag and i would say in most cases we're handed the bag to deal with the problem and in rare cases the organization has the security effort to maintain the data themselves fantastic well that's we got through all the questions as well and we're bang on time so thank you so much raquel thank you for sharing all of that insight uh with us and uh hopefully a lot of the people in the audience found that vastly interesting if they didn't already know about you amazing thank you so much sophie i had a great time thank you oh thank you so much yeah and like like like i said before um go get some coffee or go to bed or whatever it is you're doing next go relax and enjoy i know have a great time everyone oh no

thank you uh yeah like i say uh another another uh speaker pulling double duty there so thank you so much thank you to mikhail