Defence against the dark arts of mobile game hacking

[Music] [Music] my name is Kristen rivers and I'm with AB sealing let me ask a very quick question here cuz I think oh enough the audience has changed since Josh's earlier question on this how many of you represent developers or publishers within the room okay great how many of you have had your games your own games that you work with hacked or the experience cheating or fraud within your games I guess the vast majority yeah so I'm Kristen rivers I've been in digital entertainment for almost 20 years about the gray hairs to to show for that worked for number companies you guys might have heard of in fact player X who I see 20 pier so I could make Tony Pierce's in here today he's talking

tomorrow about I cos you should definitely go that his talk more recently led Paramount Pictures digital distribution team in Asia and so especially being in that market we've seen a lot of fraud I had in cheating with in with her own videos and games and that's how I came across AB sealing so absolutely have been doing content protection for about 20 years almost 20 years now their first product was actually the first DRM interoperability for for audio files I was brilliant idea allowed you to to have one wrapper one DRM wrapper that would protect music to work both on windows or on on Windows devices and on the iPod and on iTunes or if you had an iTunes song would allow you to transcode it over to a Windows or other DRM without having to buy it again would have been perfect except for about one month after it was launched Apple removed all DRM from both our audio files so absolutely had to kind of go back to the drawing board and figure out what's next and they took their

experience with kind of protection and applied it to movies and that's their primary business today is actually not I said that's how I've come across some is actually doing Dharma interoperability and more inexpensive DRM versus Fairplay Widevine these sorts of solutions they also took more recently that same content protection expertise and applied it to mobile games so they have a wrapper solution Alive's basically take your apk at the very end of your workflow upload it up to ceiling servers we wrap it send it back to you in about 20 minutes and you can upload it to your app store work with Nexen several other games publishers to provide this kind of protection for them so I'll try in 20 minutes or so a little bit less hopefully to to give a little bit of information about how the how the how the ecosystem around games hacking that the black ecosystem works where the money's made in there how it's done a little bit information about some technical guidance too that you can

think about if you haven't already as to how to how to protect yourself from some of this and of course you don't say a little bit about what abseiling does as well I am NOT a developer myself so if we get too deep into the technical questions please bear with me and I will take that question off fly so we look at the black ecosystem there's um there's three primary ways where where other people are making money off of hacking or fraud within your games there's more than 100 cheating apps out there for Android primarily you can download by 80% of them from our from China so these are generally apps that you download and they're paid you download them to your many of them page you download to your phone your phone may or may not need to be jailbroken and then it will unlock or do a different types of cheating and hacking against certain games that are on your phone and they compete with each other for the most number of games or the best games that they can unlock that they can hack there's various

professional hacking services as well we'll dive into that in a moment and then copycat and clone games is probably one of the ones that you guys have experienced the most so when you look at the the the cheating tools and of themselves lucky patch a lucky patcher assuming lucky patcher SB game hacker these are of the top ten that we see try attempting to hack games that we protect these are the top ten of them so lucky patcher and expose framework are generally the most common ones but I so there's about a hundred there that that people can download pay for and I would do want to kind of stress and I'll come back to this in a moment a good percentage of these are actually paid out so they're making money off of being able to go and then hack your game there's modding services and they tend to split into two different areas so the repositories are just places where there is access to 2 hacked games 2 hacked apks they're generally free to download and they monetize their business through ads there's also lots of forums on them

as well and people talk about well you know how do i hack this game as they may found a good hack for this one what's the best way to do this and then on the on-demand services are kind of even more interesting and Android Republic being probably one of the biggest ones where you can actually go in and pay a fee so you get a monthly fee to have access to the best or the newest tax and and if you pay more generally kind of twenty to thirty dollars you can actually request that they hack one of a particular game that you want so you say look and you pay thirty dollars because I really want to hack of whatever latest game is I'm playing and they'll look at it and if they if they think they can do it they'll take your money and week two weeks later they'll give you that hat version you have first access to it and then eventually it goes up into the repository interestingly enough and I don't want to do too much of a sales pitch for a wrap ceiling today on Android we monitor all these forums and we see you know which ones are which games are being attacked Android Republic for their VIP service for the

one where you actually go and pay money to get a game that they they basically banned any requests for app ceiling protected games you know touchwood we haven't had any any half as successful hacking attempts yet so they said look you know we can't get through absolute protection so no requests for that and we won't take money for that another one that's been a little more recent that's kind of really interesting to us is in-game currency hacking services so in these ones are generally a mobile URL that you go to on your phone you type in your user ID maybe your password for whatever game that you're building access to you generally fill out a survey for some more information and then you tell me what game you want and what game you want access to and then two minutes later or immediately depending they actually will increase your gyms your diamonds your in-game currency etc it's generally from what we've seen it seems to be they emulate a client and if there's if there's not good protection within the network

trance within the network traffic between that client and the server they can then put in various kind of requests say okay look this client has already done a an IEP purchase give it give this person X amount or whatever cheat my way ap care there's a bunch of these ones they go they come and go quite often I don't even know if any of these are still up anymore the the copycat clone games is a is a particular challenge that we see and some of you guys have probably experienced this I would guess where you have a game it's in soft launch maybe in the Philippines somewhere and you're doing really well and then all of a sudden you starting to see traffic from Vietnam from China from India you know you haven't launched in these markets what can often happen there's one most common ways this happens is you'll have somebody will take your game they'll decompile it they will maybe change some of the assets change the name within it and then upload it to a store and depending upon if your if again if your servers protected or if it's just a client

based game or a primarily client based game again you'll you'll see traffic and you're not getting any monetization from that a very kind of famous one was and there's a belief still an ongoing lawsuit on this which was Lilith games in China sued you cool in the US for their games soul clash they felt that he was charged was a direct copy of it and they they claim I should say they allege as part of their evidence that on the on the you cool game heroes charge if you get went in and did a couple certain things you would actually see the Lilith games copyright come up so that was their evidence that they presented that and then to make me things even uglier actually Blizzard came in and sued both of them because they argued that that some of the models within the game we're actually straight from Warcraft so more reason just to protect your content in the first place one of our partners in China sent us this fairly recently this just shows on one of the app stores in China within the last two months or so there were three games that they identified

that were just copycat games already uploaded there so a number of things kind of happened that causes problems for this you know for for us a developer as a publisher obviously the the game balance disruption I'm sure anybody that's had that seen hacking on their games the first thing you see is in your support forums people are complaining this person's a hacker that person is a hacker and may very well be maybe they just got beaten legitimately but maybe these people are hacking with developers and publishers I've worked with quite often what we find is all of a sudden we see a bunch of hacking attempts from certain countries that we can identify Vietnam has always been a common one for many of the companies that I've worked with where where the you know hack it tends to come from there obviously lost monetization from IP fraud depending upon how much you are protecting yourself against an IEP fraud another more insidious way this happens coming back to the copycat clone games where if you are if you do have a game that is successful maybe in in certain countries but you haven't launched in other countries and again

places we see is quite often Vietnam India China Brazil people in these countries will see that you've had a successful game they'll download it they'll decompile it they'll strip out your ad server they will put in their own ad server and then upload it to stores and again you're seeing traffic from these countries that you haven't launched in and you're not getting any of the ad traffic from it either and once it's up in a store in certain markets China being the worst one as you guys probably know it's really hard to go and then get it taken down it's hard to prove your ownership of that lourd ratings and downloads obviously your legitimate users both free and paying don't enjoy having to compete against people that are not legitimate so all these kind of reasons are the reasons why you want to think about how you might protect your game there's two main pathways that mobile games tend to get hacked the first one is actually in runtime so running a game maybe on a PC and actually seeing what's happening within the game looking at it putting on

their own hooks they're sending false code into it to see what happens changing variables whatever see what happens analyzing what happens and then going in and make changes to the game at that point the other way is just to unpack the the apk decompile it and analyze the code and then go in and again make the changes to the code in result being altering the code making a mod uploading it to a repository or wherever and again depend upon what type of game you are what platform you're working on there's a number of tools to make this process even easier so there there's tutorials out there on how to do this using these various tools you want to YouTube and you'll find a bunch of tutorials on how to actually how to hack a game using some of these tools so a number of ways to and this where we kind of get into the developer portion of this where I will be outside my depth to some degree number ways to kind of protect yourself from this for anti debug emt tampering

you can look at checking the apk signature you know very obvious things making sure that it hasn't been changed in some way make sure the native libraries that are there haven't been changed obvious ocation ProGuard from google being a very good one that can help with this none of these are 100% by the way each of these are things that that you can do to help protect against it so obviously asian just kind of slows down the the code reversal process so it's not a it's not an end-all be-all hiding the value and the data of your variables is one that does help quite a bit as well because one of the first things that people will do is they'll play a game and they'll look at ok my coin balance is four hundred and fifty nine making this up so you can look through and see all the variables that are set with these raised tools look through see all the various variables are set at 459 and it's a-okay if we change that one does that now increase my coin balance so be going in and maybe miss upsetting the coin balance at 4:59 saying the coin balance

is you know two million divided by three plus the coin balance and another number another hash number that you put in there these are ways you can kind of hide that that variable obviously showing up putting variables up on your server as much as possible putting information up there versus storing locally encrypting data where you can where you don't can't keep it on the on the client sitting at black this is one of things that we do is setting a blacklist of cheating tools if we see these other cheating tools on the device or in runtime actually a runtime in general then we will shut the game down looking for time hacks as well this is one thing especially more running in an emulator one things people do is slow down the time and so if we see that the clock is acting funny we'll just shut the game down several things that you can look at to to to basically protect your game various kind of cheating tools are out there that's what you're looking for so you know what our what our

proposal is you know obviously legitimate players don't like this competition they are not wanting to to compete on an uneven playing field this type of hacking doesn't just impact your immediate revenue your immediate monetization it also impacts your long-term all the money that you're spending on UA is actually diluted because you've got folks who are coming in and not monetizing and the way they have so we actually say you know look at your UA cost and how much is that versus a hacking if your game is getting significant hacking attempts all the kind of basic anti hacking technical guidance that's already out there I've given you some will help you kind of protect as well we would also argue that said consider robust professional app security system like app sealing there are others out there I said are kind of are kinda USP is we're not another SDK and you know most developers do have SDK fatigue we just fit in the workflow right at the very end so so anyway that's it thank you very much I think we have time for a couple questions if

anybody has any questions [Music] [Music]