5 ms·

I built a tool to hack Letterpress

73 points by ontoillogical 14y ago

Karunamon 14y ago
Neat I guess, but I wish it hadn't been released. There's something to say for security through obscurity when the target is only a video game. I hope my boss doesn't find this. He's already a prolific words with friends cheater.
- smosher 14y ago
  There's something to say for security through obscurity when the target is only a video game. There is. In case you were curious, it goes a lot like this: It doesn't work. It doesn't take a genius to crack a game. The most important quality one needs is curiosity. I've personally lost count of the number of games I've messed with, and that's not a boast. Anyone can do it if they try. I've never done it to cheat at a competitive game, however I have had a number of competitive and even cooperative games ruined by people cheating in such a manner. If it can happen it probably will, especially if the game is popular. Developers of commercial games should be obligated to take this kind of thing seriously (I am looking at you, Team Meat.)
  - Karunamon 14y ago
    >There is. In case you were curious, it goes a lot like this: It doesn't work. Sure it does, enough, anyways. I'd be willing to be the majority of players don't cheat and have no interest in cheating. The remainder that have an interest can be futher subdivided into "no idea how, no idea how to begin", "no idea how, but curious enough to look", and with the addition of the author's post, "no idea how, but a google search away with step by step instructions". It's a cool hack, don't get me wrong, but now the developer is going to have to rewrite their system to mitigate this, and in the meantime, there are going to be a bit more dicks in the world. But at least there was a nifty wrapper released- I just wish it wasn't for black hat purposes ;)
    - smosher 14y ago
      Of those with interest, if any of them are programmers or have the slightest curiosity about what all those files are for, they're abundantly competent to pull off this hack. Not necessarily the automation, but they can make it happen. but now the developer is going to have to rewrite their system to mitigate this This hack was literally waiting there for anyone who cared to look. Please don't tell me you've forgotten this: http://img820.imageshack.us/img820/1641/itsfinetrustme.png http://img820.imageshack.us/img820/1641/itsfinetrustme.png
  - Jare 14y ago
    For game developers, security against hacks is a matter of ROI. And we know that it's usually much easier for hackers to find a few holes than for us to plug all of them, so we often go for the low hanging fruit, rely on players policing themselves, and especially in the F2P arena, disregard players using a hack as players who weren't going to pay anyway. Of course different games have different considerations in this regard. Consider Draw Something, where the game itself provides the ultimate built-in cheat: draw the word the other person is supposed to guess!
    - smosher 14y ago
      Yes, I can certainly appreciate that, but I think there is a minimum you can aim for without going too far out of your way. I could go into detail, but I think I'd be listing off things you already know.
KaoruAoiShiho 14y ago
As a developer it's really easy to do simple client side auth like this. Adding server side auth creates a great deal more work and potential usability issues. As a business question, is it worth it to think about cheating in advance and try to prevent it? Just going by the example of Letterpress, it seems the answer is a resounding NO.
- kylec 14y ago
  There doesn't need to be any server-side auth, you could have the opponent's device to check the validity of the word when it's played. If it's not in their dictionary, it rejects the play.
  - bonzoesc 14y ago
    Why not just reject every word your opponent plays?
    - gojomo 14y ago
      Because that would freeze the game state and defeat the purpose of playing?
    - ghayes 14y ago
      You and your opponent could verify your dictionaries when you are matched up. Checksum mismatch = cancel match-up. Cheaters would be naturally weeded out.
      - evan_ 14y ago
        I'd only need to hack my copy of the client to send a pre-determined checksum value- or recalculate it from a different dictionary than the one that's actually used. If hacking the client is too much of a bother then I'd just have to put a filtering proxy in front of the app to accomplish the same thing. The only solution to this is to check words on the server.
        14y ago
pom 14y ago
Interestingly, this would allow custom localizations. I'd love to play it in French but as far as I can tell the word list is only in English.
- kennywinker 14y ago
  you'd have a bit of trouble with character frequency. As someone who's tried to play (english) scrabble on a french scrabble set, I can attest to this.
  - RandallBrown 14y ago
    the letter frequency in Letterpress is already a little off. I've had games with one or two vowels and like 4 x's. It was tough to finish.
askimto 14y ago
An unfortunate but understandable consequence of going Game Center only is stuff like this.
- ontoillogical 14y ago
  Does Game Center not allow you to do certain kinds of server side validations?
  - askimto 14y ago
    GC is the only server side thing in this case.
    - ontoillogical 14y ago
      I haven't looked into how Game Center "turn based games" work until now. It looks like you can cheat this way at any game with the concept of legal and illegal moves.
jlongster 14y ago
It seems like the app could do a simple checksum check of the file before using it.
- mcpherrinm 14y ago
  It seems like the next step would be to modify the binary or wherever the checksum is stored.
  - 0x0 14y ago
    But if you modify the binary, you'll need a jailbroken phone to decrypt it first. If an unencrypted binary is leaked online, you would still need to jailbreak your phone to run it, or you'd need to pay up for the ios developer program, and re-sign the app with your own certificate and make sure to modify all the app IDs embedded too. Significantly raises the bar for casual cheating. Edit: Oh, and if it uses game center, then I think you won't be able to match any opponents since you're no longer running on the official app ID.
peterhajas 14y ago
Modifying a file isn't really "hacking". I was hoping to see automated playing or maybe some math regarding tiles and words to play.
- Negitivefrags 14y ago
  Actually that is exactly what hacking is. I find it highly ironic that people post stories about hacking this thing or the other all the time, most of which do not even resemble the original definition of the word in any way and yet a story about an actual hack has this comment on it. Hacking is exploiting code in a way that it was not intended to be used.
ujeezy 14y ago
Thanks for releasing the libimobiledevice wrapper! That's probably worth its own blog post. I'm already thinking of ways I can use it for interesting hacks of my own :)
- ontoillogical 14y ago
  I'm glad you found it useful! Libimobiledevice does a lot of things, and as I mentioned in the post I've only implemented a subset so far. I'd like to make it more feature-complete soon. You should come help out in https://github.com/stateio/imobiledevice https://github.com/stateio/imobiledevice.
callmeed 14y ago
I've been wondering how hard it would be build an app that accepts a Letterpress screen shot and gives you the optimal word to play
- brador 14y ago
  There are already online word generators given the letter press letters. All you'd need is to do the OCR on the image.
- smackfu 14y ago
  http://letterpresscheat.com/ http://letterpresscheat.com/ The OCR part on top of this would be easy, it already exists for Soduku solvers.
masklinn 14y ago
A better hack would be to do image recognition on the board and have an arduino or lego play for you. Just loading your OS's dict[0] in a trie and filtering using the characters on the board, you can already pretty easily win games without even using any strategy (just try the longest matching word with a letter or two you don't own), add a very basic AI to get the board painted in the shortest possible number of moves and you should be done (nb: an extension would be deciding on suffix-pruning, as I believe letterpress doesn't allow suffix extensions of already-used words) [0] using letterpress's own dictionary file would be better as it'd avoid words which are in one but not in the other.
bvdbijl 14y ago
I made a Python implementation of the DrawSomething API https://github.com/boukevanderbijl/drawsomething-api https://github.com/boukevanderbijl/drawsomething-api Draw Something uses a key value storage to store all game state including user profiles, drawing and gamelists. You can edit all games and users, and give yourself as many coins as you want
cncool 14y ago
Game Center should allow developers to write server side code, not unlike Cloud Code by Parse.
tehwalrus 14y ago
you see, I wrote a python script which chugs through SCOWL (a dictionary..) with certain constraints to help me win the endgames, and I felt bad. This feels, somehow worse (although at least this hack is obvious to your opponent, mine was more covert.)
scoates 14y ago
At risk of contributing to the comment soup… [Some colleagues and ]I have been doing some research on Letterpress for the past couple weeks (expect a HN story about us later this week… I hope). We independently discovered this hack last weekend. Here's some information: - the client is trusted; the opponent's client does not validate a played word - Game Center is a naïve carrier for turn-based games; no validation is done on the server side - Game Center is naïve by design; this is the beauty (and one of the drawbacks of GC—another major drawback is that your client only works with GC, which means you can't easily port to other platforms, and if you do port, you can't play cross-platform games because non-iOS devices can't use GC). The real beauty here is that Loren/Atebits doesn't need to run any server infrastructure. Apple does it for him. This is a huge benefit to games like this. - We contacted Loren; he was really cool about it, and doesn't seem to care that Letterpress is cheatable in this way. I'm with him on this. It doesn't matter. - There's no leaderboard, nor even a long-term score in Letterpress. This cheat doesn't matter. - As far as we could figure, there's no way to fully validate both clients without 1) adding a server component, or 2) losing the ability to port Letterpress games between devices (from iPhone to iPad, for example); I'd love to hear ideas about how this could be possible if you think we're mistaken - The dictionary files live in the application's `o/` directory, as a series of text files, named by the word's first two letters. e.g. "imbecile" would be in `o/im.txt` - The app will re-read dictionary files on launch (or maybe at word play); either way, the dictionary can be changed during a game; it's even possible to start a game with a person and immediately play the winning 25-letter word, before the opponent even gets a game-state notification from Game Center - There are 271377 words in the Letterpess dictionary. - The longest words in the Letterpress dictionary 21 letters long. There are three of them: `counterdemonstrations`, `hyperaggressivenesses`, and `microminiaturizations` - There are 124 two-letter words We'll try to outline some of the other Game Center research in the article we publish. We welcome future upvotes. (-: S [edit: auto-paragraph fail, tyop]
- ontoillogical 14y ago
  Hi scoates, I look forward to seeing your article. I haven't tested it too much, but I believe the dictionary is read at each turn not at start. I think you're right about the constraints for client validation, but it's probably possible to raise the bar for cheating a bit without leaving the GameCenter architecture. Not that I'm an advocate of security through obscurity, but it is after all just a game.

73 points by ontoillogical 14y ago

Neat I guess, but I wish it hadn't been released. There's something to say for security through obscurity when the target is only a video game. I hope my boss doesn't find this. He's already a prolific words with friends cheater.

smosher 14y ago
There's something to say for security through obscurity when the target is only a video game. There is. In case you were curious, it goes a lot like this: It doesn't work. It doesn't take a genius to crack a game. The most important quality one needs is curiosity. I've personally lost count of the number of games I've messed with, and that's not a boast. Anyone can do it if they try. I've never done it to cheat at a competitive game, however I have had a number of competitive and even cooperative games ruined by people cheating in such a manner. If it can happen it probably will, especially if the game is popular. Developers of commercial games should be obligated to take this kind of thing seriously (I am looking at you, Team Meat.)
- Karunamon 14y ago
  >There is. In case you were curious, it goes a lot like this: It doesn't work. Sure it does, enough, anyways. I'd be willing to be the majority of players don't cheat and have no interest in cheating. The remainder that have an interest can be futher subdivided into "no idea how, no idea how to begin", "no idea how, but curious enough to look", and with the addition of the author's post, "no idea how, but a google search away with step by step instructions". It's a cool hack, don't get me wrong, but now the developer is going to have to rewrite their system to mitigate this, and in the meantime, there are going to be a bit more dicks in the world. But at least there was a nifty wrapper released- I just wish it wasn't for black hat purposes ;)
  - smosher 14y ago
    Of those with interest, if any of them are programmers or have the slightest curiosity about what all those files are for, they're abundantly competent to pull off this hack. Not necessarily the automation, but they can make it happen. but now the developer is going to have to rewrite their system to mitigate this This hack was literally waiting there for anyone who cared to look. Please don't tell me you've forgotten this: http://img820.imageshack.us/img820/1641/itsfinetrustme.png http://img820.imageshack.us/img820/1641/itsfinetrustme.png
- Jare 14y ago
  For game developers, security against hacks is a matter of ROI. And we know that it's usually much easier for hackers to find a few holes than for us to plug all of them, so we often go for the low hanging fruit, rely on players policing themselves, and especially in the F2P arena, disregard players using a hack as players who weren't going to pay anyway. Of course different games have different considerations in this regard. Consider Draw Something, where the game itself provides the ultimate built-in cheat: draw the word the other person is supposed to guess!
  - smosher 14y ago
    Yes, I can certainly appreciate that, but I think there is a minimum you can aim for without going too far out of your way. I could go into detail, but I think I'd be listing off things you already know.

KaoruAoiShiho 14y ago

As a developer it's really easy to do simple client side auth like this. Adding server side auth creates a great deal more work and potential usability issues. As a business question, is it worth it to think about cheating in advance and try to prevent it? Just going by the example of Letterpress, it seems the answer is a resounding NO.

kylec 14y ago
There doesn't need to be any server-side auth, you could have the opponent's device to check the validity of the word when it's played. If it's not in their dictionary, it rejects the play.
- bonzoesc 14y ago
  Why not just reject every word your opponent plays?
  - gojomo 14y ago
    Because that would freeze the game state and defeat the purpose of playing?
  - ghayes 14y ago
    You and your opponent could verify your dictionaries when you are matched up. Checksum mismatch = cancel match-up. Cheaters would be naturally weeded out.
    - evan_ 14y ago
      I'd only need to hack my copy of the client to send a pre-determined checksum value- or recalculate it from a different dictionary than the one that's actually used. If hacking the client is too much of a bother then I'd just have to put a filtering proxy in front of the app to accomplish the same thing. The only solution to this is to check words on the server.
      - 14y ago

pom 14y ago

Interestingly, this would allow custom localizations. I'd love to play it in French but as far as I can tell the word list is only in English.

kennywinker 14y ago
you'd have a bit of trouble with character frequency. As someone who's tried to play (english) scrabble on a french scrabble set, I can attest to this.
- RandallBrown 14y ago
  the letter frequency in Letterpress is already a little off. I've had games with one or two vowels and like 4 x's. It was tough to finish.

askimto 14y ago

An unfortunate but understandable consequence of going Game Center only is stuff like this.

ontoillogical 14y ago
Does Game Center not allow you to do certain kinds of server side validations?
- askimto 14y ago
  GC is the only server side thing in this case.
  - ontoillogical 14y ago
    I haven't looked into how Game Center "turn based games" work until now. It looks like you can cheat this way at any game with the concept of legal and illegal moves.

jlongster 14y ago

It seems like the app could do a simple checksum check of the file before using it.

mcpherrinm 14y ago
It seems like the next step would be to modify the binary or wherever the checksum is stored.
- 0x0 14y ago
  But if you modify the binary, you'll need a jailbroken phone to decrypt it first. If an unencrypted binary is leaked online, you would still need to jailbreak your phone to run it, or you'd need to pay up for the ios developer program, and re-sign the app with your own certificate and make sure to modify all the app IDs embedded too. Significantly raises the bar for casual cheating. Edit: Oh, and if it uses game center, then I think you won't be able to match any opponents since you're no longer running on the official app ID.

peterhajas 14y ago

Modifying a file isn't really "hacking". I was hoping to see automated playing or maybe some math regarding tiles and words to play.

Negitivefrags 14y ago
Actually that is exactly what hacking is. I find it highly ironic that people post stories about hacking this thing or the other all the time, most of which do not even resemble the original definition of the word in any way and yet a story about an actual hack has this comment on it. Hacking is exploiting code in a way that it was not intended to be used.

ujeezy 14y ago

Thanks for releasing the libimobiledevice wrapper! That's probably worth its own blog post. I'm already thinking of ways I can use it for interesting hacks of my own :)

ontoillogical 14y ago
I'm glad you found it useful! Libimobiledevice does a lot of things, and as I mentioned in the post I've only implemented a subset so far. I'd like to make it more feature-complete soon. You should come help out in https://github.com/stateio/imobiledevice https://github.com/stateio/imobiledevice.

callmeed 14y ago

I've been wondering how hard it would be build an app that accepts a Letterpress screen shot and gives you the optimal word to play

brador 14y ago
There are already online word generators given the letter press letters. All you'd need is to do the OCR on the image.
smackfu 14y ago
http://letterpresscheat.com/ http://letterpresscheat.com/ The OCR part on top of this would be easy, it already exists for Soduku solvers.

masklinn 14y ago

A better hack would be to do image recognition on the board and have an arduino or lego play for you. Just loading your OS's dict[0] in a trie and filtering using the characters on the board, you can already pretty easily win games without even using any strategy (just try the longest matching word with a letter or two you don't own), add a very basic AI to get the board painted in the shortest possible number of moves and you should be done (nb: an extension would be deciding on suffix-pruning, as I believe letterpress doesn't allow suffix extensions of already-used words) [0] using letterpress's own dictionary file would be better as it'd avoid words which are in one but not in the other.

bvdbijl 14y ago

I made a Python implementation of the DrawSomething API https://github.com/boukevanderbijl/drawsomething-api https://github.com/boukevanderbijl/drawsomething-api Draw Something uses a key value storage to store all game state including user profiles, drawing and gamelists. You can edit all games and users, and give yourself as many coins as you want

cncool 14y ago

Game Center should allow developers to write server side code, not unlike Cloud Code by Parse.

tehwalrus 14y ago

you see, I wrote a python script which chugs through SCOWL (a dictionary..) with certain constraints to help me win the endgames, and I felt bad. This feels, somehow worse (although at least this hack is obvious to your opponent, mine was more covert.)

scoates 14y ago

At risk of contributing to the comment soup… [Some colleagues and ]I have been doing some research on Letterpress for the past couple weeks (expect a HN story about us later this week… I hope). We independently discovered this hack last weekend. Here's some information: - the client is trusted; the opponent's client does not validate a played word - Game Center is a naïve carrier for turn-based games; no validation is done on the server side - Game Center is naïve by design; this is the beauty (and one of the drawbacks of GC—another major drawback is that your client only works with GC, which means you can't easily port to other platforms, and if you do port, you can't play cross-platform games because non-iOS devices can't use GC). The real beauty here is that Loren/Atebits doesn't need to run any server infrastructure. Apple does it for him. This is a huge benefit to games like this. - We contacted Loren; he was really cool about it, and doesn't seem to care that Letterpress is cheatable in this way. I'm with him on this. It doesn't matter. - There's no leaderboard, nor even a long-term score in Letterpress. This cheat doesn't matter. - As far as we could figure, there's no way to fully validate both clients without 1) adding a server component, or 2) losing the ability to port Letterpress games between devices (from iPhone to iPad, for example); I'd love to hear ideas about how this could be possible if you think we're mistaken - The dictionary files live in the application's `o/` directory, as a series of text files, named by the word's first two letters. e.g. "imbecile" would be in `o/im.txt` - The app will re-read dictionary files on launch (or maybe at word play); either way, the dictionary can be changed during a game; it's even possible to start a game with a person and immediately play the winning 25-letter word, before the opponent even gets a game-state notification from Game Center - There are 271377 words in the Letterpess dictionary. - The longest words in the Letterpress dictionary 21 letters long. There are three of them: `counterdemonstrations`, `hyperaggressivenesses`, and `microminiaturizations` - There are 124 two-letter words We'll try to outline some of the other Game Center research in the article we publish. We welcome future upvotes. (-: S [edit: auto-paragraph fail, tyop]

ontoillogical 14y ago
Hi scoates, I look forward to seeing your article. I haven't tested it too much, but I believe the dictionary is read at each turn not at start. I think you're right about the constraints for client validation, but it's probably possible to raise the bar for cheating a bit without leaving the GameCenter architecture. Not that I'm an advocate of security through obscurity, but it is after all just a game.