I built a tool to hack Letterpress(finite.state.io)
finite.state.io
I built a tool to hack Letterpress
http://finite.state.io/blog/2012/11/09/hacking-letterpress/
13 comments
... I'd love to hear ideas about how this could be possible if you think we're mistaken
(The following probably isn't what you had in mind by "fully validate", but I think it puts it considerably closer to the challenge of defeating binary validation. Assuming everything has to happen in the app, infallible validation is impossible anyway.)
You would get pretty far by introducing internal data validation routines and making them compare the output of these routines based on challenges they issue to one another. That would require any attackers to introduce new code paths to defeat it. I've no idea if this can be negotiated practically over GC, but I can only assume so.
Also, I take issue with this:
There's no leaderboard, nor even a long-term score in Letterpress. This cheat doesn't matter.
I don't really care about leaderboards. I do care about the experience I have when I'm actually playing the game. I know this was probably meant in the sense that the incentive is lacking, but I disagree. Some people enjoy ruining other people's fun. The worst experience I've had was hack-enabled griefers in a cooperative game.
(The following probably isn't what you had in mind by "fully validate", but I think it puts it considerably closer to the challenge of defeating binary validation. Assuming everything has to happen in the app, infallible validation is impossible anyway.)
You would get pretty far by introducing internal data validation routines and making them compare the output of these routines based on challenges they issue to one another. That would require any attackers to introduce new code paths to defeat it. I've no idea if this can be negotiated practically over GC, but I can only assume so.
Also, I take issue with this:
There's no leaderboard, nor even a long-term score in Letterpress. This cheat doesn't matter.
I don't really care about leaderboards. I do care about the experience I have when I'm actually playing the game. I know this was probably meant in the sense that the incentive is lacking, but I disagree. Some people enjoy ruining other people's fun. The worst experience I've had was hack-enabled griefers in a cooperative game.
> The worst experience I've had was hack-enabled griefers in a cooperative game.
If that is the worst experience you have ever had, then you lead quite a charmed life.
If that is the worst experience you have ever had, then you lead quite a charmed life.
Hi scoates,
I look forward to seeing your article.
I haven't tested it too much, but I believe the dictionary is read at each turn not at start.
I think you're right about the constraints for client validation, but it's probably possible to raise the bar for cheating a bit without leaving the GameCenter architecture.
Not that I'm an advocate of security through obscurity, but it is after all just a game.
I look forward to seeing your article.
I haven't tested it too much, but I believe the dictionary is read at each turn not at start.
I think you're right about the constraints for client validation, but it's probably possible to raise the bar for cheating a bit without leaving the GameCenter architecture.
Not that I'm an advocate of security through obscurity, but it is after all just a game.
Neat I guess, but I wish it hadn't been released. There's something to say for security through obscurity when the target is only a video game.
I hope my boss doesn't find this. He's already a prolific words with friends cheater.
I hope my boss doesn't find this. He's already a prolific words with friends cheater.
There's something to say for security through obscurity when the target is only a video game.
There is. In case you were curious, it goes a lot like this: It doesn't work.
It doesn't take a genius to crack a game. The most important quality one needs is curiosity. I've personally lost count of the number of games I've messed with, and that's not a boast. Anyone can do it if they try.
I've never done it to cheat at a competitive game, however I have had a number of competitive and even cooperative games ruined by people cheating in such a manner. If it can happen it probably will, especially if the game is popular. Developers of commercial games should be obligated to take this kind of thing seriously (I am looking at you, Team Meat.)
There is. In case you were curious, it goes a lot like this: It doesn't work.
It doesn't take a genius to crack a game. The most important quality one needs is curiosity. I've personally lost count of the number of games I've messed with, and that's not a boast. Anyone can do it if they try.
I've never done it to cheat at a competitive game, however I have had a number of competitive and even cooperative games ruined by people cheating in such a manner. If it can happen it probably will, especially if the game is popular. Developers of commercial games should be obligated to take this kind of thing seriously (I am looking at you, Team Meat.)
>There is. In case you were curious, it goes a lot like this: It doesn't work.
Sure it does, enough, anyways. I'd be willing to be the majority of players don't cheat and have no interest in cheating.
The remainder that have an interest can be futher subdivided into "no idea how, no idea how to begin", "no idea how, but curious enough to look", and with the addition of the author's post, "no idea how, but a google search away with step by step instructions".
It's a cool hack, don't get me wrong, but now the developer is going to have to rewrite their system to mitigate this, and in the meantime, there are going to be a bit more dicks in the world.
But at least there was a nifty wrapper released- I just wish it wasn't for black hat purposes ;)
Sure it does, enough, anyways. I'd be willing to be the majority of players don't cheat and have no interest in cheating.
The remainder that have an interest can be futher subdivided into "no idea how, no idea how to begin", "no idea how, but curious enough to look", and with the addition of the author's post, "no idea how, but a google search away with step by step instructions".
It's a cool hack, don't get me wrong, but now the developer is going to have to rewrite their system to mitigate this, and in the meantime, there are going to be a bit more dicks in the world.
But at least there was a nifty wrapper released- I just wish it wasn't for black hat purposes ;)
Of those with interest, if any of them are programmers or have the slightest curiosity about what all those files are for, they're abundantly competent to pull off this hack. Not necessarily the automation, but they can make it happen.
but now the developer is going to have to rewrite their system to mitigate this
This hack was literally waiting there for anyone who cared to look. Please don't tell me you've forgotten this: http://img820.imageshack.us/img820/1641/itsfinetrustme.png
but now the developer is going to have to rewrite their system to mitigate this
This hack was literally waiting there for anyone who cared to look. Please don't tell me you've forgotten this: http://img820.imageshack.us/img820/1641/itsfinetrustme.png
For game developers, security against hacks is a matter of ROI. And we know that it's usually much easier for hackers to find a few holes than for us to plug all of them, so we often go for the low hanging fruit, rely on players policing themselves, and especially in the F2P arena, disregard players using a hack as players who weren't going to pay anyway.
Of course different games have different considerations in this regard. Consider Draw Something, where the game itself provides the ultimate built-in cheat: draw the word the other person is supposed to guess!
Of course different games have different considerations in this regard. Consider Draw Something, where the game itself provides the ultimate built-in cheat: draw the word the other person is supposed to guess!
Yes, I can certainly appreciate that, but I think there is a minimum you can aim for without going too far out of your way. I could go into detail, but I think I'd be listing off things you already know.
It seems like the app could do a simple checksum check of the file before using it.
It seems like the next step would be to modify the binary or wherever the checksum is stored.
But if you modify the binary, you'll need a jailbroken phone to decrypt it first. If an unencrypted binary is leaked online, you would still need to jailbreak your phone to run it, or you'd need to pay up for the ios developer program, and re-sign the app with your own certificate and make sure to modify all the app IDs embedded too.
Significantly raises the bar for casual cheating.
Edit: Oh, and if it uses game center, then I think you won't be able to match any opponents since you're no longer running on the official app ID.
Significantly raises the bar for casual cheating.
Edit: Oh, and if it uses game center, then I think you won't be able to match any opponents since you're no longer running on the official app ID.
As a developer it's really easy to do simple client side auth like this. Adding server side auth creates a great deal more work and potential usability issues.
As a business question, is it worth it to think about cheating in advance and try to prevent it?
Just going by the example of Letterpress, it seems the answer is a resounding NO.
As a business question, is it worth it to think about cheating in advance and try to prevent it?
Just going by the example of Letterpress, it seems the answer is a resounding NO.
There doesn't need to be any server-side auth, you could have the opponent's device to check the validity of the word when it's played. If it's not in their dictionary, it rejects the play.
Why not just reject every word your opponent plays?
You and your opponent could verify your dictionaries when you are matched up. Checksum mismatch = cancel match-up. Cheaters would be naturally weeded out.
I'd only need to hack my copy of the client to send a pre-determined checksum value- or recalculate it from a different dictionary than the one that's actually used.
If hacking the client is too much of a bother then I'd just have to put a filtering proxy in front of the app to accomplish the same thing.
The only solution to this is to check words on the server.
If hacking the client is too much of a bother then I'd just have to put a filtering proxy in front of the app to accomplish the same thing.
The only solution to this is to check words on the server.
"The only solution to this is to check words on the server."
What problem are you trying to solve?
My understanding of the problem being discussed: How can you make sure you aren't being cheated when playing Letterpress?
To solve that problem, all I have to do is validate that all your moves are legal. (In the case of Letterpress, that all the words you play are in the dictionary.)
There's no need for a server to solve that problem.
What problem are you trying to solve?
My understanding of the problem being discussed: How can you make sure you aren't being cheated when playing Letterpress?
To solve that problem, all I have to do is validate that all your moves are legal. (In the case of Letterpress, that all the words you play are in the dictionary.)
There's no need for a server to solve that problem.
> To solve that problem, all I have to do is validate that all your moves are legal.
Fair enough, that keeps me from cheating you by playing an illegal word. Now, what prevents you from cheating me by saying all of the words I play are invalid? (And are you really prepared to wait until my phone is in radio range before you learn if your play is accepted or not?)
That this would make for an incredibly boring game isn't relevant.
Fair enough, that keeps me from cheating you by playing an illegal word. Now, what prevents you from cheating me by saying all of the words I play are invalid? (And are you really prepared to wait until my phone is in radio range before you learn if your play is accepted or not?)
That this would make for an incredibly boring game isn't relevant.
You already know whether your play is legal or not. If you're not cheating, then all your plays will be legal. You don't have to wait for anything.
As to your opponent rejecting legal moves, what's the problem? You made a legal move, and then they refused to continue the game. There's no issue here.
As to your opponent rejecting legal moves, what's the problem? You made a legal move, and then they refused to continue the game. There's no issue here.
Well the problem arrises in how such a game with "passive" cheating (your opponent having removed words you might play from their dictionary to thwart you) would be counted. Detecting a mismatch is simple, determining if it was malicious, and thus the next action you take afterward is more complex:
1. You could send back a rejection. This would handle the legitimate mismatch where differing versions of the app could have different dictionaries (there are notable missing words in the 1.0 so I wouldn't be surprised if words are added in newer versions). Receiving something like "could not verify word" is much nicer than the game just ending on you. However, this still allows your opponent to cheat in the manner described above by removing words you want to play from his dictionary. It would thus be frustrating to play against such a person. He knows the word is valid, but cannot play it against you and must play something else. He is forced to decide whether to forfeit or try a different word.
2. The solution you described: simply end the game, no win or loss since you can't know who was at fault. If this game EVER employs a ladder system, then this is the equivalent of pulling the cord in an internet game, you avoid a loss. Not to mention, again, this doesn't deal with the cases of legitimate differing dictionaries.
The problem with both these methods is that cheating still has an affect. Whether it be ending the game or volleying back to you, a cheated action changes the state of the game. It is instead preferable to prevent cheating. Prevention really does thus require words to simply get checked on a server. 1. There is a clear trusted source for the words, 2. You don't need to ship an App Store update to update your dictionary. 3. There is simply no such thing as word cheating anymore, short of hacking the server.
1. You could send back a rejection. This would handle the legitimate mismatch where differing versions of the app could have different dictionaries (there are notable missing words in the 1.0 so I wouldn't be surprised if words are added in newer versions). Receiving something like "could not verify word" is much nicer than the game just ending on you. However, this still allows your opponent to cheat in the manner described above by removing words you want to play from his dictionary. It would thus be frustrating to play against such a person. He knows the word is valid, but cannot play it against you and must play something else. He is forced to decide whether to forfeit or try a different word.
2. The solution you described: simply end the game, no win or loss since you can't know who was at fault. If this game EVER employs a ladder system, then this is the equivalent of pulling the cord in an internet game, you avoid a loss. Not to mention, again, this doesn't deal with the cases of legitimate differing dictionaries.
The problem with both these methods is that cheating still has an affect. Whether it be ending the game or volleying back to you, a cheated action changes the state of the game. It is instead preferable to prevent cheating. Prevention really does thus require words to simply get checked on a server. 1. There is a clear trusted source for the words, 2. You don't need to ship an App Store update to update your dictionary. 3. There is simply no such thing as word cheating anymore, short of hacking the server.
You've introduced two new problems, neither of which we were discussing previously:
1. How can you deal with multiple versions of the dictionary?
2. How would a third-party (like a rating system) handle cheaters?
I would say that the simplest solution for #1 is to not allow this. Players shouldn't try to play against each other if they don't agree on the dictionary. Whether you update dictionaries by shipping new versions of the app, by having clients download them from a server, or by keeping them on the server (as an oracle) isn't important.
For the second problem, I think you have a server by definition. You introduced some sort of rankings, which I assume are held on a server somewhere. So this is considerably off-topic.
1. How can you deal with multiple versions of the dictionary?
2. How would a third-party (like a rating system) handle cheaters?
I would say that the simplest solution for #1 is to not allow this. Players shouldn't try to play against each other if they don't agree on the dictionary. Whether you update dictionaries by shipping new versions of the app, by having clients download them from a server, or by keeping them on the server (as an oracle) isn't important.
For the second problem, I think you have a server by definition. You introduced some sort of rankings, which I assume are held on a server somewhere. So this is considerably off-topic.
1. It occurs to me that you may have misunderstood how the server system we are describing would work. Your use of the word "oracle" I believe implies that you think the client is asking the server if the word is fine, then if it is, the client is then sending that word to the other client -- which I agree, is no more secure. However, that is not how it would work. The way it works is you send the word to the server, if the server is happy with it, it sends it to the other player, that way there is a gatekeeper that it is impossible to circumvent.
Without a server, the solution of "ensuring" the same dictionary on both sides is no different than our original issue of checking individual words: how can you reliably check if both sides have the same dictionary? One side can always just lie, because it ultimately is communicating directly to the other party. The client can send fake dictionaries, fake checksums, fake app version numbers, fake anything to the other side. All you've done is move the individual word checks currently being done to one-time some-other-value checks. For this reason it has absolutely everything to do with a server. The server has to be the holder of the "truth" and thus bad words simply will be rejected with no issue. If you are always doing checks on the client, there is simply no way to ever be sure of anything. If you want to argue "OK fine but I don't think many people will cheat", then that is an acceptable but very different argument. But saying "I can thwart cheating just fine solely with client-side operations by doing ____" is really just a waste of your time because it just won't work, you might as well just do nothing.
2. Here I was implying the use of the built in Game Center rankings (which I'm not sure why letterpress doesn't currently use). For example you can go on there and see the top X players of Jetpack Joyride (and this requires no server).
EDIT: I wanted to add that "multiple versions of the dictionary" is not a new problem, it is in fact just a description of the original problem. The author in fact got away with all this by changing his dictionary. I simply pointed out that there existed legitimate cases where this could happen (and probably likely in the future) as well as illegitimate ones, and why this is probably a good thing to consider if you are trying to solve this issue.
Without a server, the solution of "ensuring" the same dictionary on both sides is no different than our original issue of checking individual words: how can you reliably check if both sides have the same dictionary? One side can always just lie, because it ultimately is communicating directly to the other party. The client can send fake dictionaries, fake checksums, fake app version numbers, fake anything to the other side. All you've done is move the individual word checks currently being done to one-time some-other-value checks. For this reason it has absolutely everything to do with a server. The server has to be the holder of the "truth" and thus bad words simply will be rejected with no issue. If you are always doing checks on the client, there is simply no way to ever be sure of anything. If you want to argue "OK fine but I don't think many people will cheat", then that is an acceptable but very different argument. But saying "I can thwart cheating just fine solely with client-side operations by doing ____" is really just a waste of your time because it just won't work, you might as well just do nothing.
2. Here I was implying the use of the built in Game Center rankings (which I'm not sure why letterpress doesn't currently use). For example you can go on there and see the top X players of Jetpack Joyride (and this requires no server).
EDIT: I wanted to add that "multiple versions of the dictionary" is not a new problem, it is in fact just a description of the original problem. The author in fact got away with all this by changing his dictionary. I simply pointed out that there existed legitimate cases where this could happen (and probably likely in the future) as well as illegitimate ones, and why this is probably a good thing to consider if you are trying to solve this issue.
1. Both players can just give their version numbers at the beginning of the match (or checksum if that's easier). Don't start a game with someone who doesn't have the same dictionary as you, because that's not fair. Your opponent has no incentive to lie here, but they can if they want. If they try to play a word not in the agreed-upon dictionary, you'll immediately notice and see that they're cheating. (No need for a server!)
2. When you say "This requires no server," you mean "Game Center provides the server." I don't know how this works, but it seems like it would allow cheating. If you want to actually know who beat whom in what game, you'll need them to submit their moves to a trusted third-party (and of course you'll need to validate that their moves were legal). I'm not disagreeing with that; it's just off-topic. (Okay, to be pedantic, I believe asymmetric keys and the right protocol would allow two players to play such that they could later disprove any false claims about the sequence of moves. But now I'm veering way off topic.)
EDIT: Just to sum up the only point I'm trying to make on this thread: Letterpress is currently a game of perfect information with only two interested parties, namely the two players. Ignoring external rules like "You shouldn't let someone else (i.e. a computer) help you," there's no way to cheat undetected in a game of perfect information. E.g. When two people sit down to play chess on a physical board, there's no need for a referee. Either player can tell if the other player "cheats."
2. When you say "This requires no server," you mean "Game Center provides the server." I don't know how this works, but it seems like it would allow cheating. If you want to actually know who beat whom in what game, you'll need them to submit their moves to a trusted third-party (and of course you'll need to validate that their moves were legal). I'm not disagreeing with that; it's just off-topic. (Okay, to be pedantic, I believe asymmetric keys and the right protocol would allow two players to play such that they could later disprove any false claims about the sequence of moves. But now I'm veering way off topic.)
EDIT: Just to sum up the only point I'm trying to make on this thread: Letterpress is currently a game of perfect information with only two interested parties, namely the two players. Ignoring external rules like "You shouldn't let someone else (i.e. a computer) help you," there's no way to cheat undetected in a game of perfect information. E.g. When two people sit down to play chess on a physical board, there's no need for a referee. Either player can tell if the other player "cheats."
can you check the md5sum on the dictionary files ? approved values per version are included in the binary, if the check fails it prompts for an update?
what happens when a letterpress update updates the dictionary but you are playing against someone with an older version ?
what happens when a letterpress update updates the dictionary but you are playing against someone with an older version ?
Because that would freeze the game state and defeat the purpose of playing?
What if you have two different versions of the app with different dictionaries?
I'm curious whether there even is a server-side component to this, or whether it just passes the moves in the next turn notification in GameCenter. Not sure if the latter is possible but it certainly seems doable.
I made a Python implementation of the DrawSomething API https://github.com/boukevanderbijl/drawsomething-api
Draw Something uses a key value storage to store all game state including user profiles, drawing and gamelists. You can edit all games and users, and give yourself as many coins as you want
Draw Something uses a key value storage to store all game state including user profiles, drawing and gamelists. You can edit all games and users, and give yourself as many coins as you want
A better hack would be to do image recognition on the board and have an arduino or lego play for you. Just loading your OS's dict[0] in a trie and filtering using the characters on the board, you can already pretty easily win games without even using any strategy (just try the longest matching word with a letter or two you don't own), add a very basic AI to get the board painted in the shortest possible number of moves and you should be done (nb: an extension would be deciding on suffix-pruning, as I believe letterpress doesn't allow suffix extensions of already-used words)
[0] using letterpress's own dictionary file would be better as it'd avoid words which are in one but not in the other.
[0] using letterpress's own dictionary file would be better as it'd avoid words which are in one but not in the other.
Thanks for releasing the libimobiledevice wrapper! That's probably worth its own blog post. I'm already thinking of ways I can use it for interesting hacks of my own :)
I'm glad you found it useful!
Libimobiledevice does a lot of things, and as I mentioned in the post I've only implemented a subset so far. I'd like to make it more feature-complete soon.
You should come help out in https://github.com/stateio/imobiledevice.
Libimobiledevice does a lot of things, and as I mentioned in the post I've only implemented a subset so far. I'd like to make it more feature-complete soon.
You should come help out in https://github.com/stateio/imobiledevice.
Interestingly, this would allow custom localizations. I'd love to play it in French but as far as I can tell the word list is only in English.
you'd have a bit of trouble with character frequency. As someone who's tried to play (english) scrabble on a french scrabble set, I can attest to this.
the letter frequency in Letterpress is already a little off. I've had games with one or two vowels and like 4 x's. It was tough to finish.
Modifying a file isn't really "hacking". I was hoping to see automated playing or maybe some math regarding tiles and words to play.
Actually that is exactly what hacking is.
I find it highly ironic that people post stories about hacking this thing or the other all the time, most of which do not even resemble the original definition of the word in any way and yet a story about an actual hack has this comment on it.
Hacking is exploiting code in a way that it was not intended to be used.
I find it highly ironic that people post stories about hacking this thing or the other all the time, most of which do not even resemble the original definition of the word in any way and yet a story about an actual hack has this comment on it.
Hacking is exploiting code in a way that it was not intended to be used.
An unfortunate but understandable consequence of going Game Center only is stuff like this.
Does Game Center not allow you to do certain kinds of server side validations?
GC is the only server side thing in this case.
I haven't looked into how Game Center "turn based games" work until now. It looks like you can cheat this way at any game with the concept of legal and illegal moves.
I've been wondering how hard it would be build an app that accepts a Letterpress screen shot and gives you the optimal word to play
http://letterpresscheat.com/
The OCR part on top of this would be easy, it already exists for Soduku solvers.
The OCR part on top of this would be easy, it already exists for Soduku solvers.
There are already online word generators given the letter press letters. All you'd need is to do the OCR on the image.
Game Center should allow developers to write server side code, not unlike Cloud Code by Parse.
you see, I wrote a python script which chugs through SCOWL (a dictionary..) with certain constraints to help me win the endgames, and I felt bad. This feels, somehow worse (although at least this hack is obvious to your opponent, mine was more covert.)
[Some colleagues and ]I have been doing some research on Letterpress for the past couple weeks (expect a HN story about us later this week… I hope). We independently discovered this hack last weekend. Here's some information:
- the client is trusted; the opponent's client does not validate a played word
- Game Center is a naïve carrier for turn-based games; no validation is done on the server side
- Game Center is naïve by design; this is the beauty (and one of the drawbacks of GC—another major drawback is that your client only works with GC, which means you can't easily port to other platforms, and if you do port, you can't play cross-platform games because non-iOS devices can't use GC). The real beauty here is that Loren/Atebits doesn't need to run any server infrastructure. Apple does it for him. This is a huge benefit to games like this.
- We contacted Loren; he was really cool about it, and doesn't seem to care that Letterpress is cheatable in this way. I'm with him on this. It doesn't matter.
- There's no leaderboard, nor even a long-term score in Letterpress. This cheat doesn't matter.
- As far as we could figure, there's no way to fully validate both clients without 1) adding a server component, or 2) losing the ability to port Letterpress games between devices (from iPhone to iPad, for example); I'd love to hear ideas about how this could be possible if you think we're mistaken
- The dictionary files live in the application's `o/` directory, as a series of text files, named by the word's first two letters. e.g. "imbecile" would be in `o/im.txt`
- The app will re-read dictionary files on launch (or maybe at word play); either way, the dictionary can be changed during a game; it's even possible to start a game with a person and immediately play the winning 25-letter word, before the opponent even gets a game-state notification from Game Center
- There are 271377 words in the Letterpess dictionary.
- The longest words in the Letterpress dictionary 21 letters long. There are three of them: `counterdemonstrations`, `hyperaggressivenesses`, and `microminiaturizations`
- There are 124 two-letter words
We'll try to outline some of the other Game Center research in the article we publish. We welcome future upvotes. (-:
S
[edit: auto-paragraph fail, tyop]