Superstar Session: Protecting Mobile Games Against Hackers, Crackers & Copycatters

coming up right now we've got a superstar session obviously from the superstars of this afternoon protecting mobile games against hackers crackers and copycatters and that's presented today by mikhail greshish jeff from denuvo by odetto please give a warm pocket gamer connects digital 5 welcome hello hi everyone thank you very much for the intro you said it's going to be an easy follow up that was actually an incredible talk so i'm really really happy with that one hi everyone so with that um i think that might be a handoff to get things started is it okay for me to go ahead and share my screen at this point go for it awesome thank you so much

kelly so let's hope things work on the first try share a screen all right we're good to go so as kelly mentioned my name is mikhail grechev and i'm a product manager at the nouveau i hope you guys are all having an amazing start to uh pg connects digital number five and today i'm here to talk to you about an exciting topic about hacking cracking and copycatting in mobile games and i think more importantly how to actually protect your mobile games for these threats and attack factors so we don't have too much time together today it's just a 20 minute session but in that time i'm hoping to help you identify the threats that are relevant to your games or apps based on the features that your games or apps have and i think more importantly how to actually protect those features since at the end of the day it's probably the features that are your generating revenue factors so just things to start things off i just want to list a few threads that might be applicable to your app

and the point of this would be to find at least one or two that resonate with you either the project you're working on now or maybe an app that you shipped in the past or in heights that you look back and you say oh yeah we totally missed the potential for that one and the first one is the potential for your app to be redistributed for the purpose of shipping malware or stealing information so for example if you have a free to play app that relies on an online service maybe somebody has rebundled your app with some malicious code in place that would then steal the credentials required to access those online services or maybe equally as bad repackages a wrap with some malware which will later on show ads on a user's device even after your app has been removed and then unfortunately the users would blame you for putting the app the malware on their machines even though they went and found an app that was not distributed through an official platform i think a more common scenario and one

that a lot of app developers can relate with is when modified apps then replace the original payment processing methods in the app or change the ad settings it shipped along with the app so not only did the app then end up being modified and distributed but even the ad settings within that app are no longer driving revenue towards your platform and instead are redirected to that of hacking and cracking groups and potentially even more dangerously when the payment processors when those apps are replaced with third parties and your potentially legitimate customers and fall prey to providing payment information to processors that they should not be engaging with [Music] another very common example is for cracks and hacks to bypass in-app billing or fast-track in-game progress essentially either gaining them access to premium and premium paid features or bypassing game mechanics that would otherwise encourage users to

provide you with in-game spending if the app is premium there's always the threat of app piracy and probably the number one concern of has been engaged with is yeah i just want to prevent my app from ending up on a cracking site the day it's available on an app store and if the game has a multiplayer feature and which is more and more prevalent today is just ensuring that cheaters and hackers aren't spoiling the experience that legitimate users are intended to have or even worse malicious parties aren't exploiting your multiplayer services for the purpose of manipulating your digital economy like farming currency or the like so there's a lot of threats and one easy way to figure out which ones are relevant to your app is by mapping them to app features so this is an extremely condensed list of a complete map what this would look like but i'm hoping that at least one or

two of these would resonate with you so if you have a paid application or premium application essentially one that somebody has to pay for before they can acquire the obvious threat is piracy somebody takes the app they strip out the drm protection and they make it available for free giving your users little reason to pursue one that is paid and similarly copycatting would take your app and republish it either verbatim or with minor modifications and then resell it either for a reduced price or encourage users some other way to purchase the copycat version instead of yours free apps luckily don't need to worry about piracy since the app is already available for free but the threat of copycatting still remains the same as at the end of the day the free application is really just a vehicle to house the revenue driving services that are housed inside that app which would then also be copycatted and redirected if your app contains online connectivity

so if it's a game maybe it has multiplayer and if it's really a business app maybe it syncs to the cloud or something then you need to worry about credential theft breaches of privacy and in cases of games multiplayer cheating and if the app uses in-app purchases as a revenue model then as we discussed before there's concerns about payment processing methods being replaced or just in-app billing entirely bypassed and no longer being a factor of of the app itself the last one to mention a very common avenue is ad based revenue and the threat this is susceptible to is ad replacement or removal entirely in may 2020 we went on a quest to analyze the top 50 games on the google play store and along with that we took a look at 64 cracking and cheating sites we had some quite interesting findings so out of those top 50 games 86 of them had hacks and

only 14 of them were hack free and of those that did have hacks eighty percent of them worked for the latest version of the app and what this means is we are able to successfully take the cheater hack run it against the latest version of the app and if the thing that was run against contained an online component we verified that we didn't get banned or otherwise had some negative action taken against our account so how do hackers actually do this like how do they hack an app how do they modify it or what does it even mean to have a hack tab so in 84 of these cases the hack was in the form of a modified app package what this essentially means is somebody took an original app they unpacked it they've patched or modified the required code of data they repackaged the app and then they republished it either on a cracking site or some other platform and in 22 of these cases the cheater hack was delivered

using memory editors and these are essentially able to work on a completely unmodified version of the app that you would then legitimately acquire through the app store and then you would run a memory editor or a companion application that would then modify the application in a way that was not intended by you the developer so let's go into some details to figure out how are these apps modified and how do these memory editors work and eventually start to understand what can we do to fight against them so on the side of modifying app packages just a reminder that the whole point of modifying the app package in the first place is to execute one of those threat vectors we discussed before so maybe you want to make the app available for piracy for free or maybe you just want to screw with the ad settings to start collecting ad revenue for every pirated app that you convince someone to get off your forum the process for

this is actually quite simple so first you analyze the application and find the relevant coder data to patch so if you want to make the app available for free you'd have to find code related to the drm and if you want to replace the ad settings you need to find the data related to ad settings you would then modify the application code or data to do what you intended to do repackage the application and then redistribute it on a cracking site and many tools exist today to make this process fairly trivial so if your app is using generic adsense framework and he's using generic let's say google play store drm then it's a one or two click process to change these things it's not very sophisticated and it doesn't actually require finding code or data just using a third party tool to do this stuff for you an alternative to modifying the app and then republishing it is using memory editors and memory editors have a little bit of

a higher requirement than just simply repackaging the app and those requirements are first and foremost to require an external tool so not just the app itself but you actually need the memory editor to be running and the memory editor needs to have elevated privileges to the applications it's looking to attack or otherwise tamper with and typically unless a device is jailbroken or rooted these type of permissions can can't be granted but assuming um these requirements are met then the hackers can attach a memory editor to the app they're looking to mess with search for sensitive game code or data they would like to change alter the game code or data that they found and then they would take steps one to three package them into an automated script and publish them online so millions of other users can reproduce what they did in just a few clicks and a short example of what this looks like or how it

manifests in the real world is this game from the i believe is the google sorry the ios store in which a jailbroken device is used to edit the memory of a game to allow a player to instantly win so essentially he just found a match online and then immediately he's granted a victory without clicking anything or doing anything robbing another player of a gameplay experience and the player or the cheater or hacker didn't actually do any cheating or hacking he just ran a script which is more sophistically sophisticatedly a hooking library which performs some basic tasks like editing some data in memory and modifying some function calls so now that we understand what kind of threats apps might be susceptible to based on the features they have i have some recommendations for you on how these mobile threats can start to

be addressed and luckily they fall into three nice buckets there's security by design passive prevention and active detection and security by design i'm hoping everybody is familiar with and this is kind of the best practice and by the book way of shifting as much critical logic to the server as possible going with the mantra of never trusting the client always assuming it's malicious making sure the web server apis or otherwise services are secure and validating all of the input that is received from the client and only once these best practices or fundamentals are met i would recommend moving on to the next steps which would be introducing passive prevention into your app and one of the passive prevention methods is making it harder for an attacker to understand what and how to attack

your application and this is typically done through concepts like obfuscation virtualization code encryption etc and the end goal of these techniques is to hide important game code or data forcing the attacking groups or the cracker to invest significant time into attacking your application so move them away from the one or two click script and force them to really sit down and invest effort into getting through the protection you've put in place another layer or addition that could be added is active detection so in contrast to passively um trying to deter attackers you can actively use the mobile devices resources to perform things like integrity verification that is verifying that code and data hasn't been changed after the application has been loaded you can actively try to block or prevent the application from being hooked and you can do things like detect if you're running on a rooted or jailbroken

device and maybe take counter active actions or maybe notify an online service that hey the integrity of the device you're running on is a little bit lower than expected and therefore maybe not grant us device so many privileges or permissions and doing all three of these is a daunting task when you're trying to create the world's best a gameplay manner the difficult way is doing this in a way that doesn't impact your end users experience by doing things like reducing their mobile device's battery life or otherwise degrading that the experience they would have without passive preventions or active detections being in place

and i think this is where denuvo by our data really brings their expertise so we to date have now had over 2 billion software licenses issued across multiple platforms the primarily one being the windows pc gaming scene on average our security has 120 day crack free window so we don't claim to be undefeated but we do by far have the longest crack free window in the industry and we've protected over a thousand games to date and for those that have used denuvo services before the first thing you'd notice is our very unique approach to integration and that is regardless if you're on the windows operating system or you're on a mobile device we never ask our customers to modify their source code so de nuvo protection is always applied at a binary level and what this means is we actually decompile and disassemble your application we profile the disassembled bits to

identify where relevant protections need to be applied we then insert the protection at a binary level reassemble the application and send that back to you and of course all of this is an automated process it takes 10 minutes or so for a typical app and your ci pipeline then receives the protected version of the app ready for you to review stage and then publish either on the ios and android store and of course the huge advantage here is your developers don't need any sdks apis no one needs to learn how to you know do security from the ground up most importantly you're not littering your source code with security checks we take this burden from you and we take the full responsibility of managing uh the security aspect of your application and the type of protections we apply always remain invisible to the end users because the goal is to preserve the experience you intended them to have the type of protection we apply is obfuscation and virtualization which

protects your sensitive game logic or critical secure security critical operations like um the drm that the ios platform or google platforms might provide um or if you have any aspects of the game responsible for managing credentials or otherwise dealing with secure data if your game has an online components we provide live telemetry so you're equipped with the tools to deal with cheaters so this will tell you things like if a player has debuggers attached or has modified their game code or game data it'll notify you if they're running on a jail broken device or an emulator giving you the option to maybe treat these players differently if you so choose to do so and on top of these two key features the solution really works on protection plugins doing everything from hook detection to anti-debugging to continuously verifying integrity of data structures or code in your game and

just like the threats were different based on the type of features your app would have the protection plugins really just let you customize the type of protection that would be applied to your application to ensure that you're only dealing with threats that are relevant to the type of features your application might have so at the end of the day the goal of the nouveau mobile protection is to take the threats we covered earlier and make sure we're dealing with them in a manner where they no longer need to concern you so if you're ever worried about you know somebody trying to get a malicious version you have your application and instead ending up with malware your brand is protected because with the nuvo mobile protection there's no chance that a user would end up with a private copy of your app that insta installs malware if your sources of revenue are ads or require in-game payment processors or maybe alternatively you heavily rely on in-app purchase or premium features with mobile protection

we secure those revenue streams by making sure they're enforced and not bypassed if you have a boxed product or premium product in which the revenue model is upfront that is users have to pay to use your app we try to strive for 120 day crack free window to ensure your app isn't cracked in that time and i think it's worth mentioning here that every time you submit your application for protection the security on it is renewed everything is reseeded so even if somebody manages to crack one version every application and you manage to release an update since then you would essentially be re restarting the crackers progress forcing them to start from day one so as long as you're updating your app once every 120 or so days you can benefit from a relatively long crack free window and finally if your game is susceptible to multiplayer cheating you can take advantage of our telemetry so you're equipped with

the tools needed to take action against cheaters and these players so with that i really appreciate the time for you guys taking to learn about the nuvo mobile protection and hopefully some of these threats mappings were useful for you going forward in your project and this would be a great time to take your questions now thank you thank you michael that was really interesting again we've just got an afternoon today i think of just really mind-blowingly great stuff the quality is so high i've got some great questions for you though the first one that's coming to us is which counter measures are easiest to implement in terms of avoiding performance issues and increasing server load yeah really great question so on the of course for performance issues the passive preventions are always probably your best bet um even though the passive preventions usually end up in things like code bloat or code duplication like virtualization or obfuscation

that is a magnitude of order lower than running active detections like routinely scanning your code and data for changes um but in all cases security always has a cost it's very rare you'd be able to get away with the security feature that doesn't have a cost associated with it but what we can guarantee is will offer the best balance possible of security versus the performance impact thank you another question is does this interfere with ios and ndk crash reporting sdks in any way that's a really good question because actually that's one of the first issues we encountered in the early days of developing this solution so it did not anymore we figured it out that's a very pointed question i'm almost i wonder if somebody knows something what's the most effective way to protect my app from sdk spoofing both install and event spoofing

um unfortunately i cannot provide an answer to that question i would have to defer that to one of the security engineers so i really apologize for that okay this is a great opportunity therefore for people to reach out to you guys directly at danuvo biodetto um is there any indication on the user ends that an app has been hacked or compromised uh it depends on the protection settings selected so if you're talking about online features and things like telemetry it's to the server to decide what kind of action they'd like to take against the user but if you've selected the plugin that prevents the app from running on an emulated device well then the user will see that the app cannot start on an emulated device so it's fairly customizable in that manner and i think i would flip the question back to you and i'd say how would you like your app to behave in that scenario and if we don't do it already i'll make sure they do do it thank you um you know that in this world that that obviously you working michael

it's sort of really important but for people that are developing there's a lot of bottom line forcing issues um what do you think in terms of what it is that you guys do is really the value save for mobile developers moving forwards because i mean i'll be talking about are we saving mobile developers uh millions of dollars worth of profit is it just a small margin that we're saving i think we can definitely suggest that looking at some of the new stories that came out during 2020 particularly of um apps and games being hacked especially in southeast asia directly from app stores it's important for us western developers as well and worldwide developers to know that we're making a good saving on the bottom line by putting our security questions issues and needs into the hands of somebody like danuvo biodetto yeah that's a really great question um

so at the end of the day the goal of this is to protect revenue like the question is which sources of revenue are we capable of protecting so i think the most difficult one to calculate is probably ones related to brand so if a teenager or some young person wants to grab a copy of fortnite that has to be side loaded through epic store they're equally vulnerable to accidentally grabbing a copy of fortnite that might steal their credentials or install some adware and then they would go and blame epic games for doing this to them when in reality it's not their their fault and how to put a monetary figure in that i honestly cannot provide an answer however the ones that are more direct like securing revenue streams so i think it's safe to say any app that ends up on the app store minutes later so not even hours minutes later is available on a cracking site for free unless it used some third-party drm solution and that becomes easy to put a monetary

value on because you see hey which percentage of users are using the cracked app and how much does that app cost you multiply together and it's usually in the millions of dollars and then the second one which is slightly more difficult to calculate is when revenue streams get redirected so you take a free to play game you change the revenue ads that are displayed in game to then show ads for cracking and hacking sites and all of a sudden your free to play app is now funding a russian cracking group or something so that one is a bit more trickier to calculate but is one that is probably doable so at the end of the day if you have a feature that feature is probably a key driver to a revenue source and it's our job to make sure that revenue source stays protected that's brilliant thank you so a final question that we've gotten from our viewers today on the webinar which there's loads and great feedback for you as well so thanks for coming along you mentioned that releasing an update tends to reset the clock on hackers

trying to crack open the game is that in regards to how danuvo handles the code or more to do with the ways that hackers do their thing both actually so many security solutions are capable of renewing other security on an update but it all comes down to how diverse is the security every time it's renewed like if the change is not significant enough then the tools that the hackers and crackers use remain effective and essentially you lose this endless battle of if we invest x minutes how many more minutes will it take for a cracker to attack a game and what the nuvo has gotten extremely good at especially in the pc platform is ensuring that for every minute that the nouveau invests into preventing cracking and hacking it takes months if not years for hackers to figure out how to reverse that technique we've took that exact same mantra we brought it to the mobile platform and the goal is when an app reuses security and the hacker looks at it

they don't have any tools they can use to give them a shortcut they have to from the ground up start reverse engineering the virtual machines and the protection that's in place to figure out how to crack or attack the app thank you very much indeed that was a really interesting part of this afternoon session again you know i don't know how we're going to follow it each one of the sessions that we're having today is like amazing so thank you very much indeed mikhail thank you you