C2 Ajax request encrypt values

Discuss game development design and post your game ideas

Post » Fri Dec 30, 2016 9:45 am

@gumshoe2029 exactly.

Just to make it more clear, I'd split it to three simple levels of security here.

1. No SSL, No API KEY
Any kid who fetch the URL, is able to send fake data.

2. No SSL, with API KEY

You need a solid JS knowledge and have a lot of patience to - let's call it - decrypt the minified JS code and understand the API KEY generation algorythm (which by the way might be way more complex than standard sha1(salt+data)) in order to send fake data. So 99.9% of kids are already filtered here.

3. SSL
The right way for securing the data transfer.
ImageImageImage
B
27
S
16
G
82
Posts: 1,029
Reputation: 45,777

Post » Fri Dec 30, 2016 6:59 pm

BackendFreak wrote:@gumshoe2029 exactly.

Just to make it more clear, I'd split it to three simple levels of security here.

1. No SSL, No API KEY
Any kid who fetch the URL, is able to send fake data.

2. No SSL, with API KEY

You need a solid JS knowledge and have a lot of patience to - let's call it - decrypt the minified JS code and understand the API KEY generation algorythm (which by the way might be way more complex than standard sha1(salt+data)) in order to send fake data. So 99.9% of kids are already filtered here.

3. SSL
The right way for securing the data transfer.


Kind of...

You have to think of security from a domain perspective, not an application perspective. In security there are five domains: confidentiality, integrity, availability, accountability and assurance of services.

A. SSL

Protects data from being accessed by anyone except you and your customer. (Except maybe the NSA who has internet trunk access and possibly SSL zero day vulnerabilities in hand). SSL falls under the confidentiality section.

B. API Key (HTTP sessions and cookies fall under this category also)

Ensures that the person who owns the account is actually the one who is talking to your server. (A form of authentication) API keys fall under the accountability section.
---------------------------------------------------------------------------------
So when you start combining things:
1. SSL + No API Key

You have a secure connection between you and each of your players, but you have no way to know which player is asking for which information in any given request.

2. No SSL + API Key

Assuming that your API key is very temporary (like a lifetime of only a minute or less) and regenerated frequently, you are likely to know which of your players is asking for information from your server at any given time, but without using SSL anyone who can get close to either your server or your user's local network can simply scrape the API key from the wire and submit as theirs.

3. SSL and API keys

The data between you and each of your players is secure and cannot be snooped, and you know which player is asking for information.

--------------------------------------------
However, none of this addresses the problem that the OP has, which is legit players who have both SSL and API keys submitting false data. All of the above only prevent OTHER players or hackers from pretending to be that player.

Like @Ashley said, in raw JavaScript there is no way to prevent that, because your registered users have all of the SSL certificates and API keys necessary to submit data to your server, there is nothing stopping them from simply changing the data and submitting it to your server.

I know I probably sound like a broken record constantly saying, "You have to have a server side application," but it is not wrong. That is the ONLY way you can keep players from submitting false data (that I have found thus far).

For example, our API call: https://www.ravenheart.ca/dev0engine?op=moveFleet&fid={fleet_id}&pid={to_planet_id}&oid={to_orbital_id}

Let's say player 2, who is the owner of fleet #3 on planet ID 22 and in orbital 0 wants to move his fleet. All of this information is stored on our databases (which cannot be tampered with by anyone except my developers and the server).

If he submits a call like:
https://www.ravenheart.ca/dev0engine?op ... d=68&oid=2
The call will reply with an error, because I run all of the data through a series of checks on the server to ensure that the player actually owns the fleet, that the fleet exists, that the planet and orbital exist, etc. If any one of these checks fails, the user gets an error message and nothing changes on the server. They get the reply:
{"2041":["Error: This fleet does not exist","You do not have this fleet in this planet's orbitals."]}


JS Minifying helps, but it does not take a lot of skill to see the debugger output all of the variables and simply identify which one is being submitted to your AJAX API and simply changing the value of that variable in the source at execution time.
https://www.ravenheart.ca/home
I don't check the forums much anymore, but I will receive an email for PMs.

"Someone once told me I bite off more than I can chew...

I told them I would rather choke on greatness than nibble on mediocrity."
B
23
S
6
G
1
Posts: 1,419
Reputation: 4,857

Post » Fri Dec 30, 2016 9:10 pm

gumshoe2029 wrote:Assuming that your API key is very temporary (like a lifetime of only a minute or less) and regenerated frequently, you are likely to know which of your players is asking for information from your server at any given time, but without using SSL anyone who can get close to either your server or your user's local network can simply scrape the API key from the wire and submit as theirs.

I think you don't fully understand what mechanics is behind the API key trick. There is no such thing as temproary API key that lasts for a minute or even a second. That would not be secure at all. The API key is unique for every call.

gumshoe2029 wrote:JS Minifying helps, but it does not take a lot of skill to see the debugger output all of the variables and simply identify which one is being submitted to your AJAX API and simply changing the value of that variable in the source at execution time.

It's not always a variable, you can make a complex trick to confuse the source. But even if there's a pure variable, it's not just about to change the value. You must know how to generate a proper API key because it is validated on the server side. So you must understand the key generation algorithm first.
ImageImageImage
B
27
S
16
G
82
Posts: 1,029
Reputation: 45,777

Post » Sat Dec 31, 2016 6:16 pm

BackendFreak wrote:I think you don't fully understand what mechanics is behind the API key trick. There is no such thing as temproary API key that lasts for a minute or even a second. That would not be secure at all. The API key is unique for every call.


Even better then! But regardless, you still have to have a library of keys to match it against. And ultimately, these kinds of things are not secure (granted, even servers are not fully secure, even with layers upon layers of proxying/IPS/firewalls), but they are more secure than a permanent API key. The user can still retrieve the key from the source, and use it to submit a false score, prior to your program submitting the score. Breakpoints are a wonderful thing sometimes.

BackendFreak wrote:It's not always a variable, you can make a complex trick to confuse the source. But even if there's a pure variable, it's not just about to change the value. You must know how to generate a proper API key because it is validated on the server side. So you must understand the key generation algorithm first.


Yes, I am aware. But any half-clever user will be able to guess at your algorithm after a few tries, even if they cannot reverse engineer it out of your code. If there is one thing that I have learned, it is never underestimate the cleverness of determined players. Just look at the modding community for Skyrim. That game has not been supported by Bethesda for years, yet determined players are releasing patches and mods for it almost continuously.
https://www.ravenheart.ca/home
I don't check the forums much anymore, but I will receive an email for PMs.

"Someone once told me I bite off more than I can chew...

I told them I would rather choke on greatness than nibble on mediocrity."
B
23
S
6
G
1
Posts: 1,419
Reputation: 4,857

Post » Sat Dec 31, 2016 6:38 pm

gumshoe2029 wrote:But regardless, you still have to have a library of keys to match it against.

No there is no library of keys.

gumshoe2029 wrote:The user can still retrieve the key from the source, and use it to submit a false score, prior to your program submitting the score.

No he can't. The same API key will not work for different score value.

gumshoe2029 wrote:But any half-clever user will be able to guess at your algorithm after a few tries, even if they cannot reverse engineer it out of your code.

Guess the algorithm? That's close to impossible.

We can make a test for fun if you want. I can make a simple service with API secured with API key and you may take your time to "crack it" (send false data). I'll provide you the JS code so you could try to figure out the algorithm. It will be possible (obviously) as the answer will be in the JS code, I'm just curious how long would it takefor a developer to "break it".
ImageImageImage
B
27
S
16
G
82
Posts: 1,029
Reputation: 45,777

Post » Mon Jan 02, 2017 5:34 pm

BackendFreak wrote:No there is no library of keys.

You build it on the fly as you generate keys.

BackendFreak wrote:No he can't. The same API key will not work for different score value.

You are assuming you know the value of the score ahead of time.

BackendFreak wrote:Guess the algorithm? That's close to impossible.

Hardly, there is an entire avenue of science dedicated to exactly this. It is called cryptanalysis. I have dabbled in it, but I am not an expert in this field, sadly. But when your algorithm is as simple as SHA256(score + salt), it is very easy to guess.

BackendFreak wrote:We can make a test for fun if you want. I can make a simple service with API secured with API key and you may take your time to "crack it" (send false data). I'll provide you the JS code so you could try to figure out the algorithm. It will be possible (obviously) as the answer will be in the JS code, I'm just curious how long would it takefor a developer to "break it".

I actually do want to do this. It would be instructive for both of us. Let me know when your API is active. You're not allowed to have any server-side checks though, since that is what the OP was about. This needs to be a pure JS solution. You don't need to provide me with any code, just send me the URLs/API. I want you to minify it too, just for fun. :-p

We can even keep the discussion and results in this thread.
https://www.ravenheart.ca/home
I don't check the forums much anymore, but I will receive an email for PMs.

"Someone once told me I bite off more than I can chew...

I told them I would rather choke on greatness than nibble on mediocrity."
B
23
S
6
G
1
Posts: 1,419
Reputation: 4,857

Post » Mon Jan 02, 2017 6:08 pm

gumshoe2029 wrote:You build it on the fly as you generate keys.

Uhm... no you don't. There is simply an API key generated on the fly for this specific call. How can a one API key with a lifetime of milliseconds be called a library?

gumshoe2029 wrote:You are assuming you know the value of the score ahead of time.

No you don't. I'm not sure what you meant here exactly but there are no assumptions.

gumshoe2029 wrote:And when your algorithm is as simple as SHA256(score + salt), it is very easy to guess.

In such a trivial example it might be, but the point is to make it more complex.

gumshoe2029 wrote:You're not allowed to have any server-side checks though, since that is what the OP was about. This needs to be a pure JS solution.

Uhm.. what? ;) The point with API key is to validate it on the server side. The OP even provided a sample of PHP script. So it is all about to make a server check and authorise the request or not.

gumshoe2029 wrote:You don't need to provide me with any code, just send me the URLs/API. I want you to minify it too, just for fun. :-p

What you want me to minify if you don't want any code? If I'll provide you just a sample URL and and API URL, you will depend purely on luck. The point is to crack it, not to guess it as I am sure you will not guess it.

So the test would be as following:
- I will prepare a minified JS code which will make an AJAX call to my server API. This call will make some action on the server - let's say - create an account. So there will be an email and password send over from JS to the server secured in my way without using SSL.
- Your goal will be to send another request to the server to create new user. So you will have to figure out my security (algorithm) trick and based on it create a request which will cheat my server and allow you to create a new account.

So the overall test would show how much a non SSL request, covered with hashing tricks is secure. I will send you an HTML5 app which sends the request (like if you had my game locally) and the rest you have to deal yourself. Is that ok for you?

BTW: It might be easier to talk on Discord or Skype, so PM me after you read it ;)
ImageImageImage
B
27
S
16
G
82
Posts: 1,029
Reputation: 45,777

Post » Mon Jan 02, 2017 7:03 pm

BackendFreak wrote:BTW: It might be easier to talk on Discord or Skype, so PM me after you read it ;)
Yea, let's discuss on PM, then post a project definition, then we can post results, etc.
https://www.ravenheart.ca/home
I don't check the forums much anymore, but I will receive an email for PMs.

"Someone once told me I bite off more than I can chew...

I told them I would rather choke on greatness than nibble on mediocrity."
B
23
S
6
G
1
Posts: 1,419
Reputation: 4,857

Previous

Return to Game Development, Design & Ideas

Who is online

Users browsing this forum: No registered users and 1 guest