On-Line score - how to prevent cheating ?

All,
I would like to set up an on-line score point. The whole system should work with a PHP script; using a POST or GET method, the program can send to the php script the new score as parameter; something like:
www.examplesite.com/score.php?score=500
(p.s. the above web site is only an example, it does not exist)

Problem is, this way is easy to cheat, because anyone could run the same php file from within a browser (or any other tcp connection) with an arbitrary score point as parameter:
www.examplesite.com/score.php?score=50000000

The question is, is there a way to prevent this ?

Thanks for your attention,

Sergio.

A simple solution is to encode the posted information :

www.mysite.com/score?5ef003f18e588fb24abd00298ae57faf

now the hacker would need to know what encryption methods and keys you used to create that string.

But here lies another problem. Why bother to crack the code when they can snoop the memory and change the score there.

Why not have a two-way system based on encryption and server sessions? Here is a breakdown :-

- Don't ever rely on the score in memory.
- Instead of posting complete scores to the server post score changes.
- Get the server to keep track of the overall score.
- Ask the server for the current score and use that in-game.

The above method is employed in the eXigo API that will be rolled out on pjio shortly - we will run site wide meta games and leaderboards based on such information. Where scores == prizes we can't afford cheats.

In addition to encryption, it might be a good idea to send additional information along, which lets you verify if the score is likely to be valid. This would depend on the game of course, but things such as which level the player has reached or how long they played etc. is an easy way of checking if a score is valid.

And that if people cheat, then at least it's within the limits of what it is possible to score in the game.

If you want a fort knocks like system then:

a) Enocde the score relevant pieces of client code and if you want you can use multiple checks on client side already.
b) Visualize relevant stuff graphical.
c) Depending on the game send additional information which afterwards proof that the progress does make sense. And do this in a way that you can automate the investigation of this data as far as possible.
d) Encode the client server communication.
e) Make sure that the server is secure. Both from an internet connection as well as people who can access the server physically/rights.
f) Do use hard standard encryption instead of doing some self made eors.
g) Be paranoid! ;O)

Hi Semar,
the simplest and fastest solution would be to use ETNA that you can find in my sig. ETNA uses encryption so that it will be very hard to cheat! ETNA is very simple to use and in a few lines you have exactly what you want. It's for any versions of Blitz...

Not meaning to knock ETNA since it works in the same way as iNet but :

Honnestly, with the kind of games this indie communauty is doing and the audience it has, I am not sure it's useful to fight against cheater who will do tricky things!! They simply won't because our audience is so limited!
On the contrary, it's useful to fight against simple cheat like this:

and this is what is doing ETNA and surely iNET...

Don't devalue the community, Indies are making great strides and security must always be a concern.

To right, I've also noticed in PC Format, the majority of indie games reviewed receive higher marks than big budget affairs...

Indie Equalz Originality

And originality always comes out on top!

Dabz

Cool stuff. I'll have to try out that etna when the time comes.

Honestly i think all the security sucks and tears you apart from the game but well it's just needed for certain cases... :O/

Ahh, preventing online cheating with scores is easy. What you do is store the score twice, once calculating the score in memory (to be displayed on screen) using normal scoring techniques and then secondly to be scored in a totally different way using variables and stuff (maybe not even using numbers at all)

That way it doesn't matter what your score is, the password is being made from something totally different and will be very difficult to know how. It also means if someone overwrites the numbers in memory to make a huge highscore (easy peasy) it won't make a difference because when the score is made into a passcode, it makes no difference because the code is being generated elsewhere, the numbers really are just dummy numbers.

You should also make it when a player tries to upload their new score that you make it so you have to check the numbers yourself. This stops someone continually testing and trying to break your code against the server.

I can recommend ETNA.

Couldn't you just use an UpdateScore() function that when called normally (i.e. the score is not being hacked) it creates an encrypted score based on the score.

When called again, it first checks the current score value in memory against the encrypted score and then verifies that those two are the same - then updates the score and then creates a new encrypted score? If they aren't the same you can do whatever you want - force the game to shutdown, whatever.

Then, when uploading the score, the game can encrypt the actual score with a different key used for the encrypted score - and send both the original (now encrypted) score, and the verification score (the always encrypted version.)