A Taxonomy of Online Game Attacks and Defenses Presentation Computer and Communication Security Laboratory Korea University

Copyright © 2005 CCS lab., All rights reserved ㅊ 2 CONTENTS  INTRODUCTION  RESEARCH TREND  MOTIVATION  A TAXONOMY OF ONLINE GAME ATTACKS  RESPECTIVE ATTACKS AND DEFENSES MECHANISMS  EVALUATION  CONCLUSION

Copyright © 2005 CCS lab., All rights reserved ㅊ 3 The shining star area people are enjoying enthusiastically The emergence of online game cheating INTRODUCTION Sensational game popularity in Korea An example of game cheating

Copyright © 2005 CCS lab., All rights reserved ㅊ 4 J.J. Yan and Ying-Chieh etc. : Classifying some key security issues (International Conference on Information Technology: Coding and Computing, 2005.) Matt Pritchard : Patterning online game hacker’s rules out (Information Security, 2001.) Brian Neil Levine, etc. : Secure online game network architecture (Global Telecommunications Conference Workshops, 2004.) Brenda Harger etc. : Secure online game interface design (International Conference on Entertainment Computing 2004) Christopher Ruggles etc. : The external factor of online game security (International Federation for Information Processing 2005) RESEARCH TREND

Copyright © 2005 CCS lab., All rights reserved ㅊ 5 Classifying online game attacks with respect to vulnerable spots to know what threats exist in online game Analyzing the principles of respective attack Proposing defense mechanisms Evaluating applied defense mechanisms to online games MOTIVATION

Copyright © 2005 CCS lab., All rights reserved ㅊ 6 A definition of game cheating II+1 Game variable set GS = {Memory, File, Time, Event, Packet} J Game cheatingNormal play J ≠ I+1

Copyright © 2005 CCS lab., All rights reserved ㅊ 7 A taxonomy of online game attacks

Copyright © 2005 CCS lab., All rights reserved ㅊ 8 A taxonomy of online game attacks

Copyright © 2005 CCS lab., All rights reserved ㅊ 9 Server attacks Session server Database server Game state computation server Update server FTP server Server directory attack Buffer overflow attack Inadequate parameter attack SQL injection attack Backdoor attack Game server group Top Five Server Attack Techniques

Copyright © 2005 CCS lab., All rights reserved ㅊ 10 Server countermeasure Item ID Item max transfer value Item max transaction number User 1 User 2 ……… … … … …

Copyright © 2005 CCS lab., All rights reserved ㅊ 11 Online game network architecture

Copyright © 2005 CCS lab., All rights reserved ㅊ 12 Network attacks Game client Proxy server Game client (An attacker) Game server group Packet fabrication attack for game packet analysis Packet pace attack for game packet speed or acceptance control Packet flooded attack (DDoS) for game service interruption Controlling packet Client traffic control Appling Random Pseudo Number to game packet for PACKET DISIMMILIARITY

Copyright © 2005 CCS lab., All rights reserved ㅊ 13 Client attacks

Copyright © 2005 CCS lab., All rights reserved ㅊ 14 Memory alteration attack

Copyright © 2005 CCS lab., All rights reserved ㅊ 15 Memory alteration attack

Copyright © 2005 CCS lab., All rights reserved ㅊ 16 Memory alteration countermeasure VirtualAllocMemory OpenProcess ReadMemory WriteMemory Memory access functions Access denied by moving function execution pointers

Copyright © 2005 CCS lab., All rights reserved ㅊ 17 File fabrication attack A file fabrication attack made the target mark more accurate form.

Copyright © 2005 CCS lab., All rights reserved ㅊ 18 File fabrication countermeasure Game client Game server group The latest file checksum inspection when running a game

Copyright © 2005 CCS lab., All rights reserved ㅊ 19 Time frame-up attack

Copyright © 2005 CCS lab., All rights reserved ㅊ 20 Time frame-up attack countermeasure timeGetTime QueryPerformanceCounter Timer functions Access denied by moving function execution pointers Time synchronization check between server and client

Copyright © 2005 CCS lab., All rights reserved ㅊ 21 Time frame-up attack countermeasure algorithm

Copyright © 2005 CCS lab., All rights reserved ㅊ 22 Event faking attack

Copyright © 2005 CCS lab., All rights reserved ㅊ 23 Event faking countermeasure MouseEvent KeyEvent Check repetition actions by using simple data structure Event functions Checking events and access denied to event class

Copyright © 2005 CCS lab., All rights reserved ㅊ 24 Fraud Social engineering Internal absurdity Collusion User attacks

Copyright © 2005 CCS lab., All rights reserved ㅊ 25 Evaluation

Copyright © 2005 CCS lab., All rights reserved ㅊ 26 Evaluation

Copyright © 2005 CCS lab., All rights reserved ㅊ 27 The contribution of an attack classification The importance of identifying attack mechanisms Building up the defense mechanisms focusing the anomaly the attacker provokes Future work : Developing more accurate and reliable anomaly-detection solutions to online games Conclusion