5 ms·
Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators. I
by beeker87 12y ago
Saw this posted over on PH and checked it out, extremely impressive game and I'm sure there's a ton of dev time on this. Good job and props to the creators.
I wanted to notify you guys though of some security flaws within the game.
Probably the biggest issue I see is the lack of server side checks against changes coming from the client. I only tested this out on the player object as a PoC, but it only takes changing a variable within the player object to modify things like player speed, mountable craft speed, etc.
For instance, while you obfuscated the name of the player object within the ig.game object, it was easily found by checking for modifications to the health variable, where another function listed it as ig.game.O1376. This name for this player object is also static for every game instance, so it's easily referred to every time.
Once the player object was found, it's easy to modify the variables and the world (server side) accepts it. It was also easy, for the most part, to identify what certain variables did as they were in plain text. To change player jump height for example, all it would take is this piece of JavaScript:
window.ig.game.O1376.altJumpReducedGravityFactor = 0.1;
Now the player can super jump and the server is fine with it (verified by numerous 'holy sh!' and 'wtf!?' comments from other players).
The second thing I see is just obfuscating the code more.
I would suggest first and foremost to do the server side checks. Even if you left all your code in plain text, any modification someone tried to make from the client would be seen, verified, and handled accordingly by the server. Second I would try obfuscating all variable names that you can, especially the class definitions like EntityPlayer. To go further on it, I would have it produce the obfuscated names randomly on each load of the game script so they're not easily referred to.
Just wanted to bring the issue up to you guys after finding it.
- judk 12y agoMaybe send a private message instead of posting publicly before notifying the owners?
- judk 12y agoWhat's PH?
- slaven 12y agoProduct Hunt
- j_philipp 12y agoThanks for these details! We added a client-side scripting option to specifically increase your jumps, so if you want you can create an Interacting for that. We also added flying mountables, triple jump wearables, parachutes, insta-teleporting, a 100% invincibility armor, and everything one might want to do. When you have a need, we try if possible to make it a feature, by integrating it in the Interacting language. At rank 2, try creating an Interacting block to see some of the things you can do. (If people find someone doing something which somehow ruins things for them, they may flag report a person though.) Now as far as tweaking things which are harmful to others go, we try to base it on friendship -- so e.g. if you pick up a weapon you can only harm people who friended you (if your friends disagree with being killed, they can unfriend, and unfriended people aren't affected by one's bullets) -- but if you find anything that harms others even when not friended, please give us some time to fix it and disclose it privately to: we@manyland.com (we do have server-side checks for such things, so if something is not working there, we'd really appreciate the tip) We aren't perfect and private disclosure is very much appreciated. Thanks again! Please let us know via email please if you find anything!
- beeker87 12y agoNo problem, and yeah I only tested simple player vars like jumping, nothing harm wise that would affect other players. Doing the server side check on that is perfect though, so it's obv you guys are aware of it (thought as much given the level of code). I'll definitely let you know if I find anything else, was just messing with it for an hour or so today :) I apologize too if you don't want this up here and let me know if you want me to delete it.
- andygmb 12y agoLooks like you trust the client on their window.ig.game.O722.rank, which allows people to remove blocks at the center and trap people. Check area 2, I think.
- j_philipp 12y agoYou are right, sorry for that and thanks for the reminder. We just recently changed that conceptually and haven't fully synced it -- for the first year, everyone at any rank was able to edit anywhere in area 1 - 4, even in center. We'll look at it soon, was quite a big wave tonight!