动作脚本 3.0 -> PHP->游戏应用程序的 MySQL 安全问题
我计划用 Actionscript 3.0 (flash) 制作一个游戏。但是，我在保存用户积分方面遇到了一些安全问题。
更具体地说，请阅读下文，您将了解确切的问题是什么。
- 您正在启动我的 Flash 应用程序。 PHP 为您的用户名创建一个会话。玩了几分钟就达到了750分。
- 您点击“保存我的积分”按钮。
- 它将“game.php?points=[]”与您的积分金额连接起来，因此，game.php?points=750。
- PHP 连接到 MySQL 并使用您在打开应用程序时输入的用户名执行更新/插入查询，并使用 $_GET['points'] 获取积分，如您在 3 中看到的那样。
问题是， 任何可以直接浏览“game.php?points=999999999999”的人都会将他的积分保存在数据库中。
我考虑过加密点，但是，Flash 是客户端应用程序，任何人都可以使用“Cheat Engine”等应用程序更改“点”值。一旦他们改变了点，Flash就会自动生成加密点。
我还考虑过为每个玩家在注册时创建一个私钥并进行相应的加密，但这也行不通，因为一旦用户使用 Cheat Engine 更改了他的积分，flash 将自动使用给定的私钥对积分进行加密，因此，另一个无用的理论...
有些人建议我使用 SSL，只是因为像 Zynga 这样的流行公司使用它，但我在这里寻找其他理论。
除了使用 SSL 之外，对这种情况还有什么想法吗？
诗。该游戏将是一款MMO，因此确保数据交易的安全至关重要。
I am planning on making a game with actionscript 3.0 (flash). However, I am having some security issues on saving user points.
To be more specific, read below and you'll understand what's the exact problem.
- You are starting my flash application. PHP creates a session for your username. Playing for few minutes and reaching 750 points.
- You click on "Save my points" button.
- It connects "game.php?points=[]" with your point amount, hence, game.php?points=750.
- PHP connects to MySQL and does an update/insert query with the username you entered when opening application, and gets the points with $_GET['points'] as you can see on 3.
The issue is,
Anyone who could directly browse "game.php?points=999999999999" would have his points saved in the database.
I thought about encrypting the points, however, Flash is a client-side application and anyone could change the "points" value with an application like "Cheat Engine". Once they change the points, encrypted points will automatically be generated by Flash.
I also thought about creating a private key for each player on their signup and encrypt accordingly, but it also won't work because once an user change his points with Cheat Engine, flash will automatically encrypt the points with given private key, hence, another useless theory...
Some people suggested me to use SSL, just because popular companies like Zynga uses it, but I am looking for other theories here.
Any ideas on this case, except using SSL?
Ps. The game will be a MMO, so securing data transaction is an essential.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
为了真正安全的方法，您需要将游戏的逻辑尽可能地移至服务器，并且理想情况下使 Flash 影片只是一个向用户显示游戏当前状态的界面。
查看此线程中 Yeldarb 的帖子，以获得很好的解释。
For a real secure approach you need to move your game's logic to the server as much as possible and ideally make the flash movie just an interface to show the game's current state to the user.
Check out Yeldarb's post in this thread for a good explanation.
首先，SSL 根本没有帮助你。听起来您好像从未听说过Tamperdata。
这是典型的 CWE-602 违规行为。密码学不能解决这些问题，因为攻击者对应用程序的控制比您更多。没有地方可以隐藏秘密。
First of all SSL doesn't help you at all. It sounds like you have never heard of Tamperdata.
This is a classic CWE-602 violation. Cryptography does not address these problems because the attacker has more control over the application than you do. There is no place to hide a secret.