I had the opportunity to sit down (virtually) with Steve Davis, CEO of IT GlobalSecure, a software publisher and consultant for security issues specific to the gaming industry. His company develops “SecurePlay“, a security middleware toolkit for online games. IT GlobalSecure is currently working to elevate awareness by unveiling a course covering the whole range of business and technical issues related to game security.
Your blog tracks the proliferation of exploits and vulnerabilities in the gaming world. Have you quantified any loose trends in your survey that you could share?
I have been tracking game security incidents since the late 1990’s. At that time there were usually a half dozen incidents per year. By 2004, the pace was up to about one per month. In 2005, there as about one incident every two weeks. This year (2006), I have said the pace was about one per week. This is actually very conservative. The pace is closer to an average 2-3/week. Part of this apparent increase is attributable to my closer monitoring since I started my blog, so one per week is a good/bad-enough number.
Methodology - My threshold for an “incident” is something that is announced via a press release, a regular news article, or a major online site. Occasionally, I’ll pick up something smaller if I find it particularly interesting or informative. I do not go hunting into warez or hacking sites to find attacks though I will use borderline hacker sites if they provide useful details on the nature of the attacks (usually, I find these sites via major online sites as their reference for the story).
Seeing as how there are more online services available, this increase isn’t particularly surprising. Can you draw any conclusions about the most prominent type of attack, or perhaps characterize the most typical of targets?
Actually, the growth of the problem is pretty impressive, at least to me. Publicly disclosed incidents have been doubling every year for the past several years. The problems have been spreading across the board. The most surprising, and disappointing, is the number of code compromise incidents. This is one of the most damaging problems and probably the easiest to fix. I am most interested in the areas where we haven’t been hearing much: casual games, tournament games, and, of course, online gambling. Serious cheaters are going to “follow the money” as they do everywhere else.
By code compromise, you mean hacking of the game client, right? How can this be easily prevented?
No, by code compromise I mean the disclosure of the game’s source code base. Typically, these losses have been by the game developer, though publishers have been guilty as well. It is a failure of basic IT security. Game code and raw art assets can be worth hundreds of millions of dollars or more (or less). They should be protected appropriately during the development and publication process.
What are your thoughts on the emphasis on security in the game industry, today?
“Generally speaking, game publishers own the security problem in this industry. This has serious implications. Developers are compensated for delivering a product on-time and typically get the bulk of their compensation for completing the game on-time. Therefore, they do not have real incentives for good security design or practices unless such incentives are written into their contracts Also, because game publishers still see themselves in the “publishing” business where most revenues are earned in the first 30 days after a product release as opposed to a longer sales and services cycle, they have allocated security into the QA or distribution side of the business where there is little power or incentive to address security strategically.
“This leaves out some great revenue “tails” – tournaments and other “secondary” markets for games could extend their shelf-life by adding more traditional sales and open up additional revenues from licensing and royalties.
“There are a lot of ways that good security can grow revenues, not just try to protect against loses.
Are middleware vendors indifferent to security? How many breaches, how much downtime, how many lost users and revenue will it take?
“The middleware guys haven’t focused on security because the developers and publishers are still struggling with the decision to use middleware at all. As the middleware market matures and game publishers really come to terms with the opportunities and implications of online play, security should become more clearly important.
“People have been telling me for years that the game industry needs a “Pearl Harbor” incident. Part of my motivation for writing my blog is to show that, while Pearl Harbor hasn’t happened, the industry has experienced a number of Dunkirks, Polands, and North Africas.
Based on your observations, what is your general appraisal of security amongst the MMORPG developers, themselves?
“Security is being taken more and more seriously by MMOs once they are in operation. After all, this is where security failures cost real money. I am not so sure about MMOs in development. It is much easier to change PowerPoint slides and specifications than a running game service. However, the development team is not typically rewarded for good security. They are paid to get a game out the door as quickly as possible. Even worse, they are often not the guys who are stuck with the security problems once the game is in the field. This is the same problem faced by other types of games as well as other software services with a security component. It is hard to make developers accountable for security.
What are the “wins” that we’ve seen towards security with respect to online gaming? What are the success stories that you feel should be told here?
“Even Balance has been doing a great job in the US with PunkBuster. It may not be what you or I would consider the “right” solution from a security purist perspective, but they have raised awareness of the issue. In some sense, their model is perfectly suited to the way the industry thinks about security. Hopefully, publishers will start looking at their PunkBuster budget and consider if there is a better way. There are similar stories in Asia with nProtect’s GameGuard and AhnLab’s HackShield.
“There has also been some interesting data out of Korea from NCSoft. According to some public articles, they spend 10 billion Won (out of 350 Billion Won in revenues) on security. This doesn’t include the marketing costs associated with lost customers (I don’t know if it includes customer service costs for security related incidents either).
Finally, what is the most important thing that MMORPG developers and middleware developers can do to increase the security of their offerings?
“The biggest thing developers can do is to begin to consider security in their designs from day one. There aren’t any magic bullets, just good engineering and business strategy.
Thanks very much for your time!
“My pleasure.”
For interested readers, a related discussion took place in early October over at covertcreations. The article is titled, ‘MMORPGs, Security and the Grand Promise of Middleware’.
Technorati tags : games security, steve davis, secureplay, it globalsecure, game middleware
![[Valid Atom 1.0]](/valid-atom.png "Validate my Atom 1.0 feed"){kind=small}
