🔒 Locked

[web] Security Logic

Started by Cygnus_X Aug 22, 2006 at 8:24 AM 5 replies 1.3k views

Original Post

Aug 22, 2006 at 8:24 AM

So, I've had quite a problem with security on a site of mine. The biggest problem is that users obtain multiple accounts and use their second accounts to gain an unfair advantage via funneling cash from one account into the next. I started hashing out some simple logic to help prevent this, and I'd like some feedback before I try incorporating it into my code: Step 1 - Watch all money transactions between accounts and log each transaction. Yes, this will require millions, if not billions of rows in a single table of my database, but I can then go back once every 2-3 days, check the top 10% or top 3000 transactions (whichever is less) and... with a little help from an IP log, see if a suspicious amount of money is going from 1 IP to an identical IP consistantly (note, there may be two transactions between player a and player b, but both transactions would get stored as a running total). I wouldn't check every transaction in the log, as some people may share IPs for one reason or another, but if there is a huge money transfer say... 2 weeks into the game and the accounts have mathching IP's, then I believe there is enough evidence to say something is up. If so, I start banning all accounts associated with the IP in question. Step 2 - When a user registers, check for matching IP's/Passwords. If a match is found with an IP/Password, immediate start banning all accounts associated with the IP. Step 3 - Look through the IP log and find all duplicated IP's. Once found, check how many times this IP has logged into the system under each account name. If, after 2 weeks of up time, an IP associated with one or more accounts pops up that has been logged into more than once a day on under accounts, ban all accounts associated with this IP. Step 4 - Once an IP logs out under one username, set a timer which prevents the user from logging back in under that IP for 5-10 minutes. Thus, if a user sells everything he has in an attempt to log-in under a different name and steal it from himself... this timer should give players enough time to get first grabs. Let me know what you guys think.

markr

Aug 22, 2006 at 9:18 AM

Personally I'd say have all account creations approved by the admin.

Or if that's impractical, have some basic filtering which detects "suspicious" account creations (e.g. from an IP, user agent, location, cookie etc that's been used before recently on another account) and locks the account until the admin has approved it.

In your approval you'd have access to the IP addresses, email addresses used, browser versions, IP location info (if possible) etc, to try to identify if it's a duplicate account.

You can make the system store a persistent cookie in the user's browser which is just a random ID which never changes even on logout. This would stop stupid cheaters who don't know how to clear their cookies.

You could also install logic which attempts to detect these suspicious transactions. Blatant cheaters should get caught very easily.

Logging all transactions sounds simple enough - it's having the ability to actually check them for "suspicious" stuff.

If the players know that all of their accounts will be banned if they do this, that should act as some kind of deterrent.

Mark

Cygnus_X

Aug 22, 2006 at 10:12 AM

I'd like to try to auto-examine accounts for suspicious dealings instead of going through each one manually. My goal is 100k simultaneous users... and going through 100k account registration attempts just isn't pratical. The biggest thing I wish to accomplish with this thread is to formulate a logic as to how I should filter both registration and in-game activity.

Also, I forgot to mention that I do make users provide a unique email address during registration. This of course sends a verification link to that email, etc. Unfortunatly, it isn't a very effective deturent... at all.

Sander

Aug 22, 2006 at 10:42 AM

Quote:
Step 4 - Once an IP logs out under one username, set a timer which prevents the user from logging back in under that IP for 5-10 minutes. Thus, if a user sells everything he has in an attempt to log-in under a different name and steal it from himself... this timer should give players enough time to get first grabs.

Bad idea. What happens if a player looses connection and tries to log in again? What happens if I log out and log in again with that same character (i.e. I forgot something). What happens if I do have two accounts and simply switch, but don't cheat at all (are multiple accounts allowed if you don't cheat?). What happens with AOL users or other people behind proxies and NAT routers?

Cygnus_X

Aug 22, 2006 at 12:16 PM

Quote:
Original post by SanderBad idea. What happens if a player looses connection and tries to log in again? What happens if I log out and log in again with that same character (i.e. I forgot something). What happens if I do have two accounts and simply switch, but don't cheat at all (are multiple accounts allowed if you don't cheat?). What happens with AOL users or other people behind proxies and NAT routers?

You'd be allowed to log back in with the same username/ip, just not with a different username/ip. Basically, I'd have an iplog table which looks like this:

ID | UserName | IP | TimesLoggedIn | LastSeen

Each time the user changes pages, I'd update when they were last seen. I'd also update on a log-out event.

Thus, if I logged in under Cygnus_X, log out, then tried to log back in quickly under a different user name, I'd have to wait 5-10 minutes before the system would let me in (unless I could change IP's quickly... but this is just meant to slow people down, not stop them).

As for multi-accounts... they are highly discouraged. People always start a second account with good intentions, but it ALWAYS becomes too big of temptation for people to deal with. Thus, if a player really wants a second account, they'd have to be willing to put up with the delay AND they'd have to be able to bypass all my other catch 22's or risk getting bannned.

As for AOL users or college students on a central network... I'm not sure how thats going to work. Thats part of why I pose my question here. While I may (or may not) sound like I know something about programming... I really don't. I studied mechanical engineering in college, not computer science. Everything I've leard in CS is self taught. So... just keep helping me hash it out :) Thanks.

Sander

Aug 22, 2006 at 4:57 PM

Quote:
While I may (or may not) sound like I know something about programming... I really don't.

The first thing to remember is that an IP does not uniquely identify a user. It's the best indication we have, but it's far from perfect (let's hope IPv6 will solve this). AOL users are notoriously difficult in this regard. AOL routes all traffic over a limited set of proxies that hide the original IP's. This means that many AOL users share the same IP and also that they jump IP addresses from time to time as the load balancer moves a user from proxy to proxy to distribute the load.

Two things thatflow from this:

1) False positives wil happen and with AOL they'll hapen frequently. Never let a bot do the punishing based on IP data. Instead, let the bot flag an issue for you and review it manually before taking action.

2) Find all blocks of IP addresses used by AOL and flag people as AOL users so that you know you shouldn't rely on their IP info. You can use this flag in your bots as well so they could, for example, treat AOL users differently from regular users with more sensible IP addressing schemes.

Extrarius

Aug 24, 2006 at 3:48 PM

You could try something like diablo etc did, where instead of getting initial money, you get initial equipment that sells for nothing and is basically worthless to anything but a starting character.
Of course, I have no idea what your game is, but you could probably adopt the above idea, such as having a second pool of money that can only be traded with NPCs or can only be spent after some amount of time.

At the very least, make sure you record trades that happen right after logon of an account for the first time - few newbies would start out by giving everything away, but cheaters are likely to since they just want to get the benefit and be done with the other account (unless bonuses occur over time, in which case they might have other obvious patterns such as logging on at regular intervals only to trade then log off). You could try using standard signal analysis techniques such as autocorrelation to find patterns of behavior that probably indicate cheating.

Also, make sure you have some kind of captcha so it's at least non-trivial to automate the process. It's one thing for a person to get double the initial benefits and quite another for a person to get billions of times the initial benefits.

Finally, you could build a rather advanced statistical model using a history of trades (if you log each trade separately and don't combine them) and it wouldn't matter how large it is since you can do it on your home PC instead of on the webserver (download the new trades each day to avoid having to send GB of data constantly, and you might want to write them in a binary format then use gzip or the like on them instead of downloading text database dumps). A bayesian filter might be able to detect probably cheaters rather easily if you train it with information about a few cheaters you catch manually.

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.