search

ValveSoftware / Dota2-Gameplay

Public Bug Tracker for Dota2
1.48k stars 81 forks source link

Possible solving the problem of Dedicated Server Key hacking #14885

Open withvoidwithin opened 8 months ago

withvoidwithin commented 8 months ago

Description

The essence of the problem

Custom game developers do not have the option to save player data in Dota 2. Therefore we use http requests and query our own web servers and databases.

The problem with http requests is that any user who decompiles .vpk file of a custom game will be able to find and know in the code where these http requests address, and then emulate that.

To determine the validity of requests from Valve's game servers, there is a function called GetDedicatedServerKey that works only on Valve's dedicated servers and returns a unique custom game key to help determine the validity of the request.

Unfortunately, because this feature is also on the game client, hackers were able to hack into and understand how keys are generated for custom games. As a result, they can easily simulate requests from Valve's dedicated servers and send requests with any data within...

In an attempt to solve this problem, Valve made 3 similar functions of different versions.(GetDedicatedServerKey, GetDedicatedServerKeyV2, GetDedicatedServerKeyV3). All of these functions have been hacked. Each time stepping on the same mistakes.

What I'm suggesting

  1. Remove the GetDedicatedServerKey function, this should not be on the game client!
  2. All http requests from Valve dedicated servers should automatically include the Dedicated Server Key in the request body.

Example Match ID (and possibly Timestamp)

No response

Screenshots

No response

InsaneDoggo commented 6 months ago

I don't know how DOTA2 dedicated server's deploy/initialization process looks like, but there is well known practice (in software dev in general) to store secrets as environment variables. It's not required to use environment variables exactly, similar behavior can be achieved via launch arguments. Main point is to provide way for developers to specify key value pairs bypassing "downloadable addon files" e.g. via WorkshopManager during upload. Then API would looks like: GetSecret("some key") which should return value on server and "empty string/none" on client.

withvoidwithin commented 6 months ago

I don't know how DOTA2 dedicated server's deploy/initialization process looks like, but there is well known practice (in software dev in general) to store secrets as environment variables. It's not required to use environment variables exactly, similar behavior can be achieved via launch arguments. Main point is to provide way for developers to specify key value pairs bypassing "downloadable addon files" e.g. via WorkshopManager during upload. Then API would looks like: GetSecret("some key") which should return value on server and "empty string/none" on client.

This is quite a good solution to the problem, but it is much more difficult to implement. I doubt that our favorite Dota 2 developers, who update the game once every half a year, will implement something like this. It seems impossible for them : ) That's why I suggested the simplest solution, which does not require strong changes to the current functionality.