Piracy & Security

This is a talk I gave as part of the Chartboost University program, on the fundamentals of security and piracy prevention. The audience was mainly game developers.

Transcript

1. piracy security &
2. kenneth ballenegger ARCHITECT at CHARTBOOST
3. A LITTLE HISTORY
5. serial box
8. a few lessons learned the hard way
9. first lesson if your app is at all popular, somebody will try to attack it
10. design a solid foundation second lesson
11. third lesson do not trust the client
12. fourth lesson your app will be pirated anyway
13. fifth lesson a pirate is not a lost sale
14. securing your native app
15. compiled code vs resources
16. obfuscate hide sensitive information in your binary
17. obfuscate #define checkRegistration _cRfn - (void)awakeFromNib { [self checkRegistration]; } - (BOOL)checkRegistration { // important registration code goes here... } // the compiler sees: - (void)awakeFromNib { [self _cRfn]; } - (BOOL)_cRfn { // important registration code goes here... }
18. obfuscate char secret_key_obfuscated[] = “): qyebj byyru”; size_t key_size = sizeof(secret_key_obfuscated) - 1; char secret_key[key_size]; for (size_t i = 0; i < key_size; i++) { char c = secret_key_obfuscated[key_size - 1 - i]; if ((c>=‘a’ && c<=‘m’) || (c>=‘A’ && c<=‘M’)) c += 13; if ((c>=‘a’ && c<=‘m’) || (c>=‘A’ && c<=‘M’)) c -= 13; secret_key[i] = c; } //=> secret_key is now “hello world :)”
19. securing your backend
20. use ssl
21. use crypography
22. hellban bad users
23. seggregate bad data
24. cryptography overview
25. hash functions MD5, SHA-1, SHA-512 PBKDF2, BCRYPT, SCRYPT
26. symmetric ciphers AES, DES, BLOWFISH X-SALSA-20
27. asymmetric ciphers RSA, DSA CURVE-25519
28. diffie-hellman
29. NaCl github.com/jedisct1/libsodium
30. in-app commerce piracy
31. always, always verify StoreKit receipts server-side!
32. verifying receipts apple backend awesome game 1 2 3
33. verifying receipts apple 1 2 3 backend awesome game
34. verifying receipts 1 2 3 apple backend awesome game
35. verifying receipts 1 2 3 apple backend awesome game
36. verifying receipts 1 2 3 apple backend awesome game
37. wrap-up if your app is popular, somebody will attack it, and will succeed 1
38. wrap-up don’t waste too much time trying to prevent it 2
39. wrap-up pirates are not lost sales 3
40. wrap-up but, be aware, and don’t let it skew your analytics 4
41. Q&A
42. thanks kswizz.com kenneth@chartboost.com