GDC: Developers Vs. Cybercriminals

Cybersecurity is a serious issue for any online business, but for online gaming companies it's doubly so.

Beyond issues of data protection, which are similar for any company that handles customer data, Internet gaming companies can be damaged by cyber attacks in a broader variety of ways than other companies.

Online retailers for example may suffer financially when they get hacked or hit with a denial of service attack, but damage to physical assets is likely to be insulated from online threats.

For operators of online games, however, hackers threaten not only revenue and user trust, but user experience and the intellectual property -- game source code -- upon which the business is built.

The ongoing exploitation of game bugs for fraud and cheating can be compared to altering Amazon.com so that links don't work, pages don't load, and recommendations don't fit users -- the result is a poor user experience that can drive customers away and limit both immediate and future revenue.

It can also raise support costs as frustrated players call to recover stolen game items or to deal with in-game problems.

At the Game Developers Conference on Wednesday afternoon, Patrick Wyatt, COO of En Masse Entertainment, recounted his extensive experience with hackers, cheaters, griefers, and cybercriminals in an effort to help game developers understand that game security can't be an afterthought. Having worked on Warcraft, Diablo, Starcraft, Guild Wars, and Aion, he has seen his share of hacking.

"Hacking games is as easy to do now as it was 20 years ago," Wyatt lamented, pointing to the recently released blockbuster Modern Warfare 2, which is vulnerable to a character speed hack.

And the incentive to hack games has risen as virtual goods have been embraced by the masses: Online games are like banks, but without regulations and expensive security measures. Gold farming and gold frauding -- undesirable and illegal methods respectively of amassing huge amounts of in-game currency for black market resale -- cause losses to the gaming industry of somewhere between $1 billion and $15 billion, Wyatt estimated, though he conceded that no one really has accurate figures.

The potential ramifications for gaming companies are significant: degradation of the play environment, fraud prevention technology integration costs, customer support costs, billing transaction costs, billing charge-back fees (from stolen credit cards used to open accounts), fines from credit card brands, enforcement false positives (turning away legitimate customers), and problems selling digital goods.

Among the possible defenses, Wyatt suggests device fingerprinting, proxy detection, phishing site detection and takedown, transaction reviews, telephone verification, shipping address verification, two-channel authentication, and use of game analytics to watch for unusual behavior.

He stressed using two-channel authentication -- using a PC and mobile phone for example -- rather than two-factor authentication -- a hardware device for a code entered through a PC -- because gaming trojans on PCs can intercept two-factor authentication codes. Using two channels means that even if the PC is compromised, a hacker would still have to have malware on the user's phone to intercept the mobile communication.

Wyatt also advised having source code on a separate network, having strong authentication for developers and operations personnel, and investing in physical site security.

Wyatt is not a big fan of DRM solutions, like nProtect GameGuard and Blizzard's Warden, which he said are essentially rootkits. "Nobody likes being spied on," he said.

In addition to considering security measures, game companies should also think about ways to improve business operations that may affect security, Wyatt suggested. Legalizing and overseeing in-game currency trading to reduce fraud, as Eve has done with its PLEX system, was one example he cited.

Another example is being nice to employees and paying them fairly. "I've heard a number of horror stories about working in the game industry...when people figure out they're not being treated well, they may take it out on you...give them profit sharing," he said.

Companies should expect to be hacked, he said, and security through obscurity is not security. The only answer, he stressed, is defense in depth, giving the security team insight into all areas of the business, and striving to continually watch for problems.

InformationWeek's GDC Coverage:

GDC: OnLive Takes Gaming To The Cloud

GDC: Sony Unveils PS3 Motion Controller

GDC: Microsoft Surface Plays Dungeons & Dragons

GDC: iPhone Developers Face Hidden Risks