Security issues

[oex]

It's malware related in that if I tell you how to do these things on a public forum malware software will be updated with get arounds not just against your software but against everyone's security protections....

If I email you, someone I dont know from Usama Bin Laden Brad Pitt over the internet, I could get embroyalled in your custody battle with Angelina Jolie over your six children....

Secrecy is #1 security! *oops*

[theunknownguy]

It's malware related in that if I tell you how to do these things on a public forum malware software will be updated with get arounds not just against your software but against everyone's security protections....

If I email you, someone I dont know from Usama Bin Laden Brad Pitt over the internet, I could get embroyalled in your custody battle with Angelina Jolie over your six children....

Secrecy is #1 security! *oops*

If its malware then i dont care, you need to understand then intention behind the thread is to avoid malware behaviour.

Ofc there are pretty much ilegal ways to stop this, its not what i am looking but thanks anyway.  :U

[oex]

Malware is 'malicious software', it is different only from games in intent.... to say you could put a key under the mat or the most common source of entry is an open window is a great common knowledge example of where a burglar will look first before breaking your window for entry, neither of which have any risk of cutting himself and leaving dna :lol....

To talk about serious security issues is to give google keywords and thus to promote malware especially on a dedicated programming forum

The intent of having nuclear weapons is preventing nuclear war :lol

[theunknownguy]

Malware is 'malicious software', it is different only from games in intent.... to say you could put a key under the mat or the most common source of entry is an open window is a great common knowledge example of where a burglar will look first before breaking your window for entry, neither of which have any risk of cutting himself and leaving dna :lol....

To talk about serious security issues is to give google keywords and thus to promote malware especially on a dedicated programming forum

The intent of having nuclear weapons is preventing nuclear war :lol

Again you should limitate to read that the intention is to promote not using any kind of illegal coding.

But since you dont even have an answer and i guess nobody have in a "legal" way, then this reveals somethings must be "illegal" in order to prevent.

Game companys lost 1 million usd at year caused cheats, and do you think companys like INCA (gameguard) give a deal about if they inject a DLL or dont?

What happen with symantec kernel hooks?.

Thats the main difference why you still here and they are on top winning probably 200.000$+.

Also dont look so under your nose what game security is, since loosing 1 million at year, there are some really dedicated people into the game hacking thing.

This is more like fight with bows when the other have guns  :lol

[sinsi]

>Game companys lost 1 million usd
:lol cite please :lol

[oex]

Security is something serious professionals dont discuss with strangers. How many people do you know that work for your nation's secret service <--- Trick question dont answer :wink....

It has nothing to do with legality, simply common sense....

Game companies lost nothing, they made billions of usd.... Money 'lost' through hacking is simply money not made with law enforcement agencies responsible for tracking down criminal activity....

Google cant keep China out and China doesnt know whether Google is reading Chinese citizens emails but the world still goes round 24/7/365

[theunknownguy]

Security is something serious professionals dont discuss with strangers. How many people do you know that work for your nation's secret service <--- Trick question dont answer :wink....

It has nothing to do with legality, simply common sense....

Game companies lost nothing, they made billions of usd.... Money 'lost' through hacking is simply money not made with law enforcement agencies responsible for tracking down criminal activity....

Google cant keep China out and China doesnt know whether Google is reading Chinese citizens emails but the world still goes round 24/7/365

Ye thats why GameGuard cost kind of 40.000 usd (the rumors say)

And i got a contract for 20.000 usd, they just giving money for free ^^ XD

The article about the 1 million lost usd i cant find now, its fully google with things like "how can i cheat please?" lol.

But the article say that company K2 network (wich is the one i am targeting) looses 1 million usd at year on Knight Online game.

It isnt hard to believe, lets see what are the incommings from INCA in the year 2009:

http://global.nprotect.com/aboutus/news_view.php?idx=19&page=2

6 million usd (expected for the first half)

Something releated how much K2 spent in web security:

http://www.cenzic.com/resources/reg-not-required/caseStudies/k2/

PS: If i where you guys for a income from even 1 million usd for detect lammers using aimbots or trying to unpack a protection, then yeah i will switch of job inmediatly ^^ (lucky me this is my job)

[oex]

So do it, dont ask others to do it for you

[theunknownguy]

So do it, dont ask others to do it for you

Nobody is asking to do, you really have a big problem when reading, i was asking for advice, lucky me i get some real opinnion from clive. And probably this opinion will be shared among companys, seems nobody likes "invasive" coding, so trying to switch to a more practical solution.

But again and i repeat i am not asking for you to do my home work, i am asking for an advice (not a ethical debate).


PS: I think some mod should close this, i really can imagine the opinnion from other members of the forum towards "invasive" coding, even if its for security, so ill probably waste my head trying to do some real non invasive solutions, this would make my costumers much more happy.

[oex]

:lol sorry not trying to promote ethics.... my advice is simply that you are creating security holes by discussing your security implementation methods on a public forum.... If you dont know general bases to cover you shouldnt be doing job.... Games are not going towards streaming because of a lack of processing speed or because of console costs.... Even if you own the box someone is going to chip/unlock it.... It's very hard to give direct answers without giving malware tips but you should understand this working in serious security work....

But the article say that company K2 network (wich is the one i am targeting)

Your posts are your biggest security hole, I dont know what else to say :lol

[theunknownguy]

:lol sorry not trying to promote ethics.... my advice is simply that you are creating security holes by discussing your security implementation methods on a public forum.... If you dont know general bases to cover you shouldnt be doing job.... Games are not going towards streaming because of a lack of processing speed or because of console costs.... Even if you own the box someone is going to chip/unlock it.... It's very hard to give direct answers without giving malware tips but you should understand this working in serious security work.... I dont know what else to say :lol

Dont worry i am not saying anything that could put in risk my job, its like talking oreans company (i got license for my products) with themida packer, talk pretty much the same things in open public.
Talking about something it doesnt mean that some one is actually going to figure it out. More when it just an "advice". Also my website is pretty much with alot of info how the anti cheat works and still isnt bypassed. Again there is a big difference between write something and explain it in details.

Also i understand that you cant give malware tips, but there is pretty much tips you can give if knowed them without breaking the forums rules.

Example heuristic scanner (i use one in my system) should not be a theme that goes agaisnt forums rules and at the same time "discussing it" should not reveal any information that could make it insecure.

But about my question and the advice i need, yeah its pretty much nothing you can say or anyone can say without giving "against rules" tips. Thats why i want some mod close this thread ^^.

http://global.ahnlab.com/en/site/product/productSubDetail.do?prod_type=P0&prod_class=P&prod_seq=9003
(I guess youll tell them that give too much info too)  :P :P

PS: This is how buisness work, at least how "i understand it", reveal features and at the same time give no info how remove them, you can see this in all security system for games, they give all features and still people dont get the idea ^^.

[oex]

These are *some of the* security holes:

So first to check for is this:
   "PS: I do already do kernel tricks, CRC, metamorph code, obfuscation, reloc game procedures to virtual space and encript them"

Then anything other than this you probably havent accounted for:
   But this is probably the last "issue" i have about secure system for "games" (the usage of some APIs for malicious usage).

You dont have a clue on this:
   what happen with APIs like GetPixel
   I actually dont see any method, and i dont believe any other anti cheat sees it too, probably you talking about somekind of AI that recognise a specific patron of inputed keys, but it will be quiet hard to detect for a player input


Good advice:

Quit wasting your time on this. Focus on the game. Your adversaries are smarter and better equipped.

-Clive


Forum Rules:

You should accept the forum rules in spirit not just in word.... They are for your own protection and the protection of others as well

"and at the same time "discussing it" should not reveal any information that could make it insecure"
er OK

[theunknownguy]

These are security holes:

So first to check for is this:
   "PS: I do already do kernel tricks, CRC, metamorph code, obfuscation, reloc game procedures to virtual space and encript them"

Then anything other than this you probably havent accounted for:
   But this is probably the last "issue" i have about secure system for "games" (the usage of some APIs for malicious usage).

You dont have a clue on this:
   what happen with APIs like GetPixel
   I actually dont see any method, and i dont believe any other anti cheat sees it too, probably you talking about somekind of AI that recognise a specific patron of inputed keys, but it will be quiet hard to detect for a player input


Good advice:

Quit wasting your time on this. Focus on the game. Your adversaries are smarter and better equipped.

-Clive


Forum Rules:

You should accept the forum rules in spirit not just in word.... They are for your own protection and the protection of others as well

"and at the same time "discussing it" should not reveal any information that could make it insecure"
er OK

- Like i say you dont know how to read, i paste you 2 website of knowed companys that give all the features...
- Yes its the last issue i got, caused i want to do a legal way and not illegal or too invasive (again you read bad)
- There should be no possible way in order to stop graphics API, since i dont have controll over the graphics input and i cant, there is a limitation between what a anti cheat can do interfering with the game itself
- And finally i send you the same website before sleep:

http://global.ahnlab.com/en/site/product/productSubDetail.do?prod_type=P0&prod_class=P&prod_seq=9003

Code Select Expand

Memory Hacking Protection

* Prevents memory access of game hacking

Speed Hack Protection

* Detects and blocks speed hack programs that tempers with system timer

Debugger Protection

* Detetcts and blocks hacker's debugging tools for auditing and analyzing codes

Message Hook Protection

* Makes message hooking function of game hacking tools useless and obsolete

Auto-mouse Protection

* Detetcts and blocks auto mouse operation, making normal ones ineffective

File Change and Forgery Protection

* Detects and blocks changes or forgery of files

Hacking Tools and Blocking Detection

* Detects hacking tools and terminates client game connection from server

Run-time Forgery Protection

* Prevents from forging runtime modules of HackShield

Executable File Packing

* Protects HackShield, hacking protection functions, itself from hacking

Data File/Message Encryption

* Encrypts important data and messages in AES(Rijndael) format

Data File Encryption

* Encrypts data files passed between client and server

Server-side Crack Protection

* Regularly checks for changes or forgeries of executable files at client

Executable File Encryption

* Encrypts game executables in real-time

Consistent and Continuous Update

* Updates with new hacking tool pattern files and protection modules

Other so you can learn read better, oreans company, themida packer information:

http://www.oreans.com/themida_features.php

But again you seems to have no notions about security, making an estatement so foolish has: "dont discuss your features, it could make it insecure".

Since when declaring that you have metamorph code, CRC or something else is going to make an insecure estatement?...

Good night, 6 AM here.

[sinsi]

Since when declaring that you have metamorph code, CRC or something else is going to make an insecure estatement?...

The same way that knowing a password needs to be x characters long does, it gives you a starting point. CRC can be got around, metamorphic code
is just 90% bullshit, easy to get around. Ever come across IdaPro? Or razor1911?

Once your code is in memory and running, you can look at it. Obfuscation can help but only to make it longer to get around.
Things need to be decrypted before they can be executed, that's when you look at them.

[oex]

These companies are publishing the things they are confident about and understand. You are asking for advice and showing all your weaknesses. You are also publishing your expected client list. Further you are trying to get people to post more security info details potentially highlighting flaws in their understanding and judgement and their products linked to from this site.... You are also giving keyword after keyword to wannabe malware writers.... Posts like these loose games companies $millions

"But again you seems to have no notions about security"
Good.... Secrecy is #1 security