Skip to content

Hacking Problem & Solution

roundpitt roundpitt
in Feedback and Suggestions

THE PROBLEM

Hacking is becoming more prevalent, I’m seeing it every other game. Either subtle hacking where the survivor is outrunning bloodlust 3 just barely. Then there’s obvious hacking, where they are doing things like running at 800%, instantly healing, completing all gens instantly, etc.

These vulnerabilities stem from an underlying problem in DBD. The game is Client Authoritative. This means a few things.

  1. The client has access to and the ability to change values of Actor objects in the game. (Actors are any object in UE4; Survivors, Killers, Gens etc.)
  2. When the client makes changes to an Actor the server replicates this to other clients automatically. This is what UE4 does by default when you enable replication for an actor blueprint.

SOLUTION

Behaviour needs to implement a Server Authoritative architecture for it’s game.

Actors must not be accessible to the client. They must exist only on the server. The only commands that the client should be able to send to the server are those that a player would normally be able to provide. Button presses, analog stick movements or mouse clicks. That’s it.

Any attempt to change actor values from the client, would only effect the client and not the server.

Please read and understand the information provided here to get you started.

https://docs.unrealengine.com/4.27/en-US/InteractiveExperiences/Networking/Actors/

Comments

  • roundpitt roundpitt

    One form of hacking I’ve seen used in gaming and enterprise level applications is packet sniffing. Here’s an example to help understand.

    1. The hacker listens to http requests. They see a particular packet and record it. Let’s assume this is the packet that usually tells the game that a survivor should be healed.
    2. The hacker replays this packet over the network. The server recognized this command, and heals the player.

    This vulnerability would be resolved by following the directions in my opening post. This is because the only packets sent to the server would contain information about which buttons the player is pressing.

    This particular hack is extremely easy for anyone to do and can be setup/exploited within seconds on client authoritative applications.

Categories