Javascript in the address bar

Collapse
This topic is closed.
X
X
Collapse
 
  • Page of 1
  • Time
  • Show
Clear All
new posts
Previous template Next
  • Andy Happ
    #1

    Javascript in the address bar

    I have a website which includes a Flash game. Upon the game ending the
    Flash object fires off the javascript method:

    recordScore(val ue)

    This is then queried against the top score for the day and if it is
    higher than this is stored as the new highest score.

    The problem is, I have discovered it is possible to hack this page by
    writing

    javascript:reco rdScore(12345)

    (for example) in the address bar of the page.

    Can anyone suggest a workaround to prevent this hack?

    The page HTML is similar to that below

    <html>
    <head>
    <script>
    function recordScore(val ue)
    {
    if(value>m_intH ighScore)
    { recordNewHighSc ore(value) }
    }
    </script>
    </head>
    <body>
    <object>
    <!-- This is where the flash movie lives
    This movie spits out the recordScore()
    command when the user finishes. -->
    </object>
    </body>
    </html>
    Tags: None
    • Guido Wesdorp
      #2
      Re: Javascript in the address bar

      Andy Happ wrote:[color=blue]
      > I have a website which includes a Flash game. Upon the game ending the
      > Flash object fires off the javascript method:
      >
      > recordScore(val ue)
      >
      > This is then queried against the top score for the day and if it is
      > higher than this is stored as the new highest score.
      >
      > The problem is, I have discovered it is possible to hack this page by
      > writing
      >
      > javascript:reco rdScore(12345)
      >
      > (for example) in the address bar of the page.
      >
      > Can anyone suggest a workaround to prevent this hack?
      >[/color]
      Dump JavaScript and use either POST (although that's easily hacked as
      well, you probably want to generate some unique code on the server for
      each possible score upload and send that back to the server along with
      the result) or XML sockets (quite a fancy Flash feature, of course you
      will have to write server support for that) to make communication a bit
      'more secure'...

      Cheers,

      Guido

        Comment

        • Lasse Reichstein Nielsen
          #3
          Re: Javascript in the address bar

          handyapps@hotma il.com (Andy Happ) writes:
          [color=blue]
          > I have a website which includes a Flash game. Upon the game ending the
          > Flash object fires off the javascript method:
          >
          > recordScore(val ue)[/color]
          ....[color=blue]
          > The problem is, I have discovered it is possible to hack this page by
          > writing
          >
          > javascript:reco rdScore(12345)[/color]
          [color=blue]
          > Can anyone suggest a workaround to prevent this hack?[/color]

          Not that works, no.

          Anything the game can do, the user can simulate. That is the most
          fundamental rule of client-server games: You can't trust the client.

          /L
          --
          Lasse Reichstein Nielsen - lrn@hotpop.com
          DHTML Death Colors: <URL:http://www.infimum.dk/HTML/rasterTriangleD OM.html>
          'Faith without judgement merely degrades the spirit divine.'

            Comment

            • Andy Happ
              #4
              Re: Javascript in the address bar

              > > Can anyone suggest a workaround to prevent this hack?[color=blue]
              >
              > Not that works, no.
              >
              > Anything the game can do, the user can simulate. That is the most
              > fundamental rule of client-server games: You can't trust the client.
              >
              > /L[/color]

              How about have a javascript call which is simply recordScore() - this
              would not pass an argument.

              Inside the javascript recordScore() method this would could call the
              Flash movie requesting a property LatestScore() which returned an
              integer.

              You'd then POST the data, querying the referrer page at the target
              page?

              Would that work?

                Comment

                • Lasse Reichstein Nielsen
                  #5
                  Re: Javascript in the address bar

                  handyapps@hotma il.com (Andy Happ) writes:
                  [color=blue][color=green]
                  >> Anything the game can do, the user can simulate. That is the most
                  >> fundamental rule of client-server games: You can't trust the client.[/color]
                  >
                  > How about[/color]
                  ....[color=blue]
                  > Would that work?[/color]

                  At some point you send a score to the server. At that point, or some
                  time before, I can change what is being sent. It is harder to cheat if
                  everything is handled inside the flash code, but someone with
                  sufficient knowledge about flash and some good tools would still be
                  able to change the program. After all, it runs on his computer, in
                  his browser, and completely at his mercy.

                  /L
                  --
                  Lasse Reichstein Nielsen - lrn@hotpop.com
                  DHTML Death Colors: <URL:http://www.infimum.dk/HTML/rasterTriangleD OM.html>
                  'Faith without judgement merely degrades the spirit divine.'

                    Comment

                    • Andy Happ
                      #6
                      Re: Javascript in the address bar

                      Lasse Reichstein Nielsen <lrn@hotpop.com > wrote in message[color=blue]
                      >[color=green][color=darkred]
                      > >> Anything the game can do, the user can simulate. That is the most
                      > >> fundamental rule of client-server games: You can't trust the client.[/color]
                      > >
                      > > How about[/color]
                      > ...[color=green]
                      > > Would that work?[/color]
                      >
                      > At some point you send a score to the server. At that point, or some
                      > time before, I can change what is being sent...After all, it runs on his computer, in
                      > his browser, and completely at his mercy.
                      >
                      > /L[/color]

                      Well thanks for all of your comments chaps, in the end I *have* solved
                      the original hack. Whether this is rock solid or whether I'll get
                      hacked 2 months down the line time will tell.

                      ////////////////
                      // 1. Old method
                      // Score was passed from the movie into the
                      // Javascript through an FSCommand event
                      function recordScore(sco re)
                      {
                      // we now check score to see if it is the highest
                      // if so, we pass it to the .asp page which deals
                      // recording it.
                      }



                      ////////////////
                      // 2. New method
                      // Flash movie simply calls the recordScore
                      // method - it does NOT pass the score up
                      function recordScore()
                      {
                      // now we query the flash movie to see what the score was
                      var score;
                      score = document.getEle mentById("objFl ashMovie").getV ariable("LastSc ore");
                      // now we have the score and we pass this to the .asp
                      // page. NOTE that we query the referrer page here as a further
                      precaution.
                      }

                        Comment

                        • Lasse Reichstein Nielsen
                          #7
                          Re: Javascript in the address bar

                          handyapps@hotma il.com (Andy Happ) writes:
                          [color=blue]
                          > Well thanks for all of your comments chaps, in the end I *have* solved
                          > the original hack. Whether this is rock solid or whether I'll get
                          > hacked 2 months down the line time will tell.[/color]

                          Try two minutes :)

                          Is this function in the page?

                          Because then I just press Alt-F3 to edit the source directly in the
                          cache, (e.g., "score="1594323 ;") save, and press Alt-V F to refresh
                          the browser window with my changes.

                          It will still be the same page, have the same URL, etc. It's just not
                          the code you expect.
                          [color=blue]
                          > function recordScore()
                          > {
                          > // now we query the flash movie to see what the score was
                          > var score;
                          > score = document.getEle mentById("objFl ashMovie").getV ariable("LastSc ore");[/color]

                          This function is a liability. I can change it to anything I want.

                          You can't trust the client! Any code you send to it can be changed.
                          Any code visible in the HTML file is trivial to change. If you put the
                          connection into the Flash file, then it'll be harder to hack (I
                          wouldn't be able to do it immediately, since I know nothing about
                          Flash).

                          /L
                          --
                          Lasse Reichstein Nielsen - lrn@hotpop.com
                          DHTML Death Colors: <URL:http://www.infimum.dk/HTML/rasterTriangleD OM.html>
                          'Faith without judgement merely degrades the spirit divine.'

                            Comment

                            • Andy Happ
                              #8
                              Re: Javascript in the address bar

                              > > Well thanks for all of your comments chaps, in the end I *have* solved[color=blue][color=green]
                              > > the original hack. Whether this is rock solid or whether I'll get
                              > > hacked 2 months down the line time will tell.[/color]
                              >
                              > Try two minutes :)[/color]

                              After showing Lasse the page in question in an another email to this
                              thread, he very quickly showed me THREE alternative hacks! Quickly
                              clocking up the highest score.

                              I stand corrected. My suggestion in my previous post made it
                              *slightly* more secure - but still badly insecure nevertheless.

                              Ah well, nevermind.

                                Comment

                                Previous template Next
                                Working...