Casual Game Dev

Often in security, the devil is in the details. In a nice bit of security analysis from back in 1999, Reliable Software Technologies assessed PlanetPoker's shuffling algorithm and found a number of problems. Check out their work.

Diablo III is coming out soon (hooray!). To date, Diablo and Diablo II have sold 18.5 Million copies. It would be fascinating to see the long term sales chart for the series (via MCV).

Internet cafes in China account for 40 percent of the country's $2.5 Billion in online gaming revenue (projected for 2008), according to research by Niko Partners as reported by Dean Takahashi at VentureBeat.Some key numbers:

There are an estimated 21.9 million computers installed in 185,000 Internet cafes in the country. Overall, Internet cafes generate $20 billion in revenue a year.

Internet cafes are dominant in smaller cities, but even in Beijing and Shanghai, players go to cafes to socialize and compete with their friends.

This model is very important for game developers looking at other developing economies. Few games really seem to actively court Internet cafes as business partners. A notable success and exception is Giant Interactive who partners heavily with cafes, particularly in smaller markets (see previous articles).

Mathew Kumar has a good interview at Gamasutra with Gene Hoffman, CEO of Vindicia. about payment security issues. The article also includes a reference to a good article by Mr. Hoffman at E-Commerce Times.

Some key facts:

- Acceptable chargebacks for VISA - up to 1 percent
- Acceptable chargebacks for Mastercard - up to 0.5 percent
- Hoffman advocates running at the edge of this limit to maximize market size
- Fighting a chargeback - $10 to $15 (for merchants with intangible - technically free - items)
- Weak current ability to link accounts to in-game activities & fraud
- Highlights the average customer lifetime value (ACLV) as a key factor (and why games may choose to ignore fraud as ACLV could average hundreds of dollars, but the cost of a chargeback is $15).
- Because secondary markets and free-to-play games tend to be lower margin, the analysis works the other way and aggressive fraud protection is the norm.

Payment security issues don't get enough attention and are especially critical for non-tangible goods, like digitally distributed games, online game subscriptions, or virtual goods.

A couple of disagreements:

1. I think debit based payments are going to grow and perhaps overtake credit card based payments for games. This is going to be good from a fraud perspective, but does weaken identity.

2. I distinguish micro-transactions for the price of items from micro-payments. The US infrastructure is a long way from being able to handle micro-payments. Instead, consumers will either purchase payment credits in bulk via pre-paid cards or their electronic equivalent.

3. I suspect that the Free-to-Play model is going to overtake subscriptions. The big problem will not be from payment issues or identity, but rather the cost of online infrastructure in the US. Like Asia, we are probably going to see more peer-to-peer gaming.

An issue that was not addressed at any length is the problem of real criminal gold frauders using fraudulent accounts to launder their fraudulent purchases:

1. Gold Frauder buys a game account with a stolen credit card from game operator.
2. Gold Frauder buys gold, accounts, etc. from other players with stolen credit card.
3. Gold Frauder sells gold, etc. to other players with real credit card. (perhaps after passing gold through a couple of accounts for laundering)
4. Gold Frauder has party.
5. Game has customer service nightmare.
6. If legitimate secondary market is permitted, that provider has a nightmare problem as he lacks an alternate revenue stream.
7. Good luck catching the gold frauder.

I’ve long enjoyed the engineering truism “Good, Fast, or Cheap, choose Two”. So, if you want something Good and Fast, it won’t be Cheap and if you want something Fast and Cheap, it won’t be Good. I think the security field needed something similar, so here’s my stab at it:

“Lazy, Cheap, or Stupid any one will get you”… or some such.

To an outsider, security often looks like a black art. The field is full of magic words: “rootkits”, “worms”, “viruses”, “hackers”, “penetration tests”, amazing sagas, embarrassing failures, and spectacular capers. Scratch the surface, however, and you’ll find that almost all security problems arise from one or more basic human failings: Lazy, Cheap, or Stupid. Security’s Three Deadly Sins.

Lazy

There is depth and even some “rocket science” as you learn the art of security, but the reason many security experts can appear to work miracles and divine problems after taking only a cursory look at an organization or system or project comes from 1) the recognition that security is not a primary concern of most people, 2) that when you don’t care about something, you tend to take shortcuts and cut corners, and 3) people are wonderfully consistent, especially in how they cut corners.

Of course, things aren’t quite that simple. You need to have a good deal of knowledge of development practices, programming, system design, project management, business planning, and human nature to pull these miracles off. Once someone describes a security problem for me, the first thing I think about is “what would be the easiest way to do this?” and, because the easiest way is rarely the right way “what is the easiest way to exploit it?”

Habits are wonderful. In the game industry, the biggest cheating problems come from the fact that most developers start by programming a single-player game and then add multi-player features. For piracy, even though everyone knows about piracy and complains about piracy, they don’t actually seem to think about piracy until the game is about to launch. Part of this is the legacy of how computer games have typically been developed (where anti-piracy features were added to the CD itself for production), but laziness, cheapness, and stupidity creep in.

The game industry is not alone. I’ve been brought in on classified government projects after years of development and many millions of dollars spent, where security only came up because someone noticed that the system needed to be accredited before it was allowed to operate.

Cheap

Security never has a budget. Or, at least, it never has a decent one. It is a legitimate problem. Security rarely shows up as a positive revenue line item. It is always portrayed as a cost with nebulous benefits at best. Interestingly, one of the things I like best about the game industry is that its security problems are so closely tied to its business. It is very hard to argue whether one firewall is better than another or if we should invest in an intrusion detection system or not from a business perspective. Not so, for the games industry.

Piracy costs sales. As a security analyst, I can make estimates of those costs and the benefits of my anti-piracy strategy and present a reasonable business case to management for a budget. While cheating has not been seen to be a major problem in the traditional, single-player game industry, as games move to multi-player and the industry transforms from a product sales business to a service business, suddenly cheating becomes much more important (and, if you are in the skill games, contests, or gambling side of the industry, cheating and game integrity are already central issues). Similarly, payment processing, identity, protecting children, and the other topics that I will discuss are not theoretical problems. They can cost your business money or, even worse, give you the opportunity to deal with irate customers or governments.

Stupid

The game industry is unique. Just ask them. Of course, every industry is unique. Just ask them. Developers in every industry are rightfully proud of their accomplishments and eager to hurry their products to market. After a long slog of development and hopefully some testing, most developers are rather confident about their product’s ability to work well. In Physics, Work equals Force times Distance. If you don’t go anywhere, you haven’t done any Work. The remorseless Gods of Security don’t care how hard you worked or who you are. Hackers just care about what you have actually done. When I made my first security presentation to the game industry in 2000, developers shared horror stories of players hacking Flash games just to get high scores on their individual sites. Eight years later, players are still hacking Flash games to get high scores to win prizes and lots of cash… and causing some large companies serious grief in the process.

Gold farming isn’t a new problem and people have been creating bots since the early text MUDs, but pretty much every modern MMO has continued to be plagued by these attacks. Only now, instead of a couple of guys running a game on a university server, the gold farmers are earning millions, if not billions of dollars, and chewing up entire customer support teams while major game publishers are spending untold dollars suing small bot builders knowing full well that another will spring up, probably in a jurisdiction beyond the effective reach of their lawyers.

The best way to avoid security problems is to simply acknowledge them at the start of a project and address them early in the process. Or, at the very least, ignore them consciously. It is simply Stupid to do otherwise.

The good news is that solving many of your security problems may be as simple as adding “Remember Security” to your project’s PowerPoint templates.

The hegemony of the US carriers over mobile applications may finally be coming to an end, thanks to Apple. At first, it looked like Apple's App Store for the iPhone was going to be a singular entity. However, T-Mobile has announced that it is moving away from its closed Deck of applications to an App Store model, according to Tricia Duryee at WashingtonPost.com.

This has the potential to unlock real opportunities for all sorts of mobile applications and could fundamentally change the mobile industry (and mobile games, of course).

It will be interesting to see if other carriers follow suit or if the handset manufacturers start opening their own App Stores.

It should be a bit more embarrassing to us all to be living in a third world country from a telecommunications infrastructure perspective. Anyone who has gone to Korea, Japan, or Europe has seen how pathetic US Internet service is.

Investments in this kind of telecommunications infrastructure can be a true engine for economic growth. Korea's huge online game industry is essentially a byproduct of a national strategy to invest in its technology infrastructure.

Who cares in the US about this. Not the telcos, not the high tech industry, certainly not our political candidates.

Nope, its the Communications Workers of America union who put out a report on the topic, according to Mark Hefflinger at Digital Medial Wire.

So, in the US, we average around 2.4 Mbps download speeds.

In France, it is 17 Mbps.

In Korea, it is 49 Mbps.

In Japan, it is 63 Mbps.

Many of the places in the US that have been hit by globalization could use advanced telecommunications and IT to compete. Outsource in the US, not overseas. Create new businesses and services, just as happened in Korea.

A cheating ring was busted at Harrah’s Cherokee Casino for stealing $286,000 in 3 weeks. It involved a dealer and 11 players, according to Jon Ostendorff at the Citizen Times in Asheville.

Interestingly, they were playing an electronic version of baccarat or blackjack (the story doesn't specify this).

In the casino, there are dealers who simply "push a button" to deal. The game is played and then payouts are handled with traditional chips.

I guess this allows you to have less skilled dealers.

I also suspect someone thought they could also skimp on security.

Except, these guys are handling the real money.

So, how did they cheat?

Well, basically the dealer paid off for hands that didn't occur.

Now, the logical way for a game like this to work would be for the game to track bets (if you want to keep with the low skill model, use RFID casino chips) as well as game results.

Then, at the end of the shift, the casino player would turn in his chips and winnings and it would be reconciled with the table's report of results.

I used to do this, more or less, when I worked in retail. You balance and close out the register to see that the actual purchases match the logged purchases.

This scam should have only been able to operate one day for one shift of the casino instead of three weeks.

How would I implement this online?

In an Internet Casino, the insider would be a software developer or someone with access to the game software, like a system administrator. I would choose a set of rather odd user names (which isn't hard) and, perhaps, some initial deposit behaviors to trigger the cheat. Then, when these players were playing, they would magically have winning hands appear (at a reasonably modest rate) that would generate suitable game logs. All I need is a reasonably modest positive return for this to be very profitable.

To keep the casino happy, when anyone else played, I could create a slight negative bias on the days of the attacks, spread out among all the players, probably in slots, to keep returns steady.

This would work with any game.

In an MMO, favored players would just be more likely to get better "loot drops" when defeating monsters or better returns on player-vs-player combat to support a gold farming operation or just for fun.

There are countermeasures of course. A topic for another day.

Piracy is certainly a problem. It costs the game industry billions of dollars worldwide each year. While we may all want to wish piracy away, our only real alternative is anti-piracy. So, how much is anti-piracy worth? Should we ignore piracy or fight it?

For simplicity’s sake, let’s say that we are developing a traditional PC game. We choose an anti-piracy software provider who has an upfront licensing fee of $100,000 and a royalty of 4 percent per copy sold (of the game’s retail price). Then our actual upfront costs are:

Total Upfront Anti-Piracy Costs = $100,000 + Integration Costs*
We’ll say these are zero as the vendor promised.

Let’s assume the game sells for the fairly standard price of $50 and our revenue per copy is $20 (after packaging, marketing, revenues for the retailer, etc.). Then, our net revenue is:

Net Revenue = $20 - $50 (.04) = $18, because the anti-piracy service cost us $2 per game sold.

However, we may lose some sales because of the anti-piracy tool we use and also incur some additional customer service costs to handle complaints and such. For simplicity, let’s just say this costs us 2 percent of sales.

With a game that sells a respectable 1 million copies, without anti-piracy we’d see:

No Anti-Piracy Revenues = 1 Million $20 = $20 Million

With Anti-Piracy, our revenues are:

Net Anti-Piracy Revenues = 1 Million (98 percent customer base)*$18 - $100,000 = $17,540,000

It is obvious that I am giving no credit for additional sales for the anti-piracy solution. So, how many more sales do we need to earn to break even?

The money we need to make up, just to break even is: $2,460,000

Increased Anti-Piracy Sales = $2,460,000/$18 = 136,667 additional units

Or, around a 14 percent increase in sales.

Suppose, instead, the anti-piracy product had no up front fee and didn’t cost any sales, incur any customer support issues, or otherwise make life difficult.

Our break even additional revenue number would be: $2 Million and 111,111 additional sales – just to cover those royalties. The upfront licensing cost has negligible impact on the price impact, the key driver is royalties. It is probably wise to include a margin of error for expected additional sales of perhaps 200,000 or 20 percent to rate the anti-piracy tool a success.

It is worth noting that this analysis could probably be done when the game is “green lighted” and an initial estimation of expected sales. The question should perhaps be asked – if this game had an additional $2 Million to spend, how could it best increase sales to compensate for the estimated “anti-piracy” losses? Other security options may make sense and should be considered. After all, the only additional revenues are going to come from additional sales.

A bunch of knitters are having a contest to go along with the Olympics. The Ravelympics (sorry, the official site requires a login) is a challenge to start a knitting project when the Olympic flame is lit, and stop when it is put out to see if you can finish your project.

There are teams, of course.

And cheating, of course.

A number of teams have already finished their projects. As of August 6th, 2 days before the Olympics, and the contest, starts, there are 38 completed projects.

I didn't know knitters could time travel.

(courtesy of Celeste's Blog)