High Scores - A Dilemma

I've almost got a complete rewrite of UberTube working (http://ubertube.tevlog.com, for those who missed the original), but am facing a dilemma. Using a simple "add_score.php?name=Bob&score=1023", allows anyone with a packet tracer to hack the scoreboard in five minutes. To solve this, I added a simple encryption system, where the compiled client contained an embedded private key, stored as a constant, used to encode scores. This number was removed from the source code when released.

Of course, this means that I need to compile the code (or send it to trusted others) for every platform I want to have high scores, and modify it slightly before releasing the code. So, my question is: Can anyone think of a scheme that would stop most script kiddies from hacking the scoreboard, even while they have full access the full source code? I would like to be able to release ALL of the code this time around, but I still cannot think of a way which does not result in a highly vulnerable score board.

Save the scoreboard on a central server and password it. The client app will send the password or an accepted ID to the server and allow access to it.

It could be a simple binary C file and not PHP-based at all. The server would read the high score file and send the appropriate data to the client needing it.

There is a way to encode passwords into a file without people knowing about it but it is highly dependent on the fact that the file will never change.

Much like early copy protections schemes generated passwords by jumping around in the exe via a set table of offsets, you could do the same with the passwords. But if you provide the source code for the high score module you will never be able to keep someone from hacking it...much less you prob still wont be able to if you don't let them have it.

Give out everything except the high score module/reader and you should be ok.

Thanks for your answer. I already have high score system from the last version in PHP, so I'll stick with it, and a system similar to what you described. Releasing everything except the high score module was my solution last time, and I'll probably just stick with it, because you're right, its pretty much impossible to keep it safe and open in this case.

I don't think you can release any type of key/password without it being crackable. Just encrypt the data string and remove the key before release like you described.

Quote:

---

Originally Posted by CrazyNorman

Using a simple "add_score.php?name=Bob&score=1023", allows anyone with a packet tracer to hack the scoreboard in five minutes.

---

I had actually tried that a few days ago, just to see if I could. You had added two other variables in your query string. I don't remember them exactly, I think they were session and verification. Is that what you meant by encryption system? It seems to me that its protected fairly well, but what do I know.

It still has an exploit available I believe, but thats fixed for the next release I push out, and as is, it deters most people.