Eruadan, a regular columnist on TERAblah.com, posted two interesting threads to our TERA General Discussion forums yesterday while I was out on a day trip. Thanks to him, we're never out of interesting stuff to read! Thanks Eruadan! If I had been near a computer, I would have posted this stuff earlier. It's stickied now! ;)
First, a video of Brian Knox doing a TERA demonstration for ZAM at GDC (Game Developers Conference). Discuss the video in it's Youtube comments or in the thread on our forums!
Brian Knox unveiled Tera to the masses through a live demonstration today at GDC 2010. This video covers Console-Control Gaming, Politics, Castania, Crescent Town (FGT PvP Tournament Area), and the Basic Storyline. Anyone even slightly interested in Tera needs to watch this. Without further ado...
Credits to Zodiac for finding the video. Edited/Uploaded by Eruadan
Second, a presentation done by Patrick Wyatt and reported on by InformationWeek. Discuss this article on our forums too!
Cyber-security is a serious issue for any online business, but for online gaming companies it's doubly so. Beyond issues of data protection, which are similar for any company that handles customer data, Internet gaming companies can be damaged by cyber attacks in a broader variety of ways than other companies.
Online retailers for example may suffer financially when they get hacked or hit with a denial of service attack, but damage to physical assets is likely to be insulated from online threats.
For operators of online games, however, hackers threaten not only revenue and user trust, but user experience and the intellectual property -- game source code -- upon which the business is built.
The ongoing exploitation of game bugs for fraud and cheating can be compared to altering Amazon.com so that links don't work, pages don't load, and recommendations don't fit users -- the result is a poor user experience that can drive customers away and limit both immediate and future revenue.
It can also raise support costs as frustrated players call to recover stolen game items or to deal with in-game problems.
At the Game Developers Conference on Wednesday afternoon, Patrick Wyatt, COO of En Masse Entertainment, recounted his extensive experience with hackers, cheaters, griefers, and cyber-criminals in an effort to help game developers understand that game security can't be an afterthought. Having worked on Warcraft, Diablo, Starcraft, Guild Wars, and Aion, he has seen his share of hacking.
"Hacking games is as easy to do now as it was 20 years ago," Wyatt lamented, pointing to the recently released blockbuster Modern Warfare 2, which is vulnerable to a character speed hack.
And the incentive to hack games has risen as virtual goods have been embraced by the masses: Online games are like banks, but without regulations and expensive security measures. Gold farming and fraudulent gold transactions -- undesirable and illegal methods respectively of amassing huge amounts of in-game currency for black market resale -- cause losses to the gaming industry of somewhere between $1 billion and $15 billion, Wyatt estimated, though he conceded that no one really has accurate figures.
The potential ramifications for gaming companies are significant: degradation of the play environment, fraud prevention technology integration costs, customer support costs, billing transaction costs, billing charge-back fees (from stolen credit cards used to open accounts), fines from credit card brands, enforcement false positives (turning away legitimate customers), and problems selling digital goods.
Among the possible defenses, Wyatt suggests device fingerprinting, proxy detection, phishing site detection and take-down, transaction reviews, telephone verification, shipping address verification, two-channel authentication, and use of game analytics to watch for unusual behavior.
He stressed using two-channel authentication -- using a PC and mobile phone for example -- rather than two-factor authentication -- a hardware device for a code entered through a PC -- because gaming trojans on PCs can intercept two-factor authentication codes. Using two channels means that even if the PC is compromised, a hacker would still have to have malware on the user's phone to intercept the mobile communication.
Wyatt also advised having source code on a separate network, having strong authentication for developers and operations personnel, and investing in physical site security.
Wyatt is not a big fan of DRM solutions, like nProtect GameGuard and Blizzard's Warden, which he said are essentially rootkits. "Nobody likes being spied on," he said.
In addition to considering security measures, game companies should also think about ways to improve business operations that may affect security, Wyatt suggested. Legalizing and overseeing in-game currency trading to reduce fraud, as Eve has done with its PLEX system, was one example he cited.
Another example is being nice to employees and paying them fairly. "I've heard a number of horror stories about working in the game industry...when people figure out they're not being treated well, they may take it out on you...give them profit sharing," he said.
Companies should expect to be hacked, he said, and security through obscurity is not security. The only answer, he stressed, is defense in depth, giving the security team insight into all areas of the business, and striving to continually watch for problems.
Edited by: Eruadan Original Article From: GDC: Developers Vs. Cybercriminals -- InformationWeek
