标签： 武汉品茶微信

On March 5, 2024, Tropic Haze, the author of NS simulator "Yuzu", announced that it had reached a settlement with Nintendo, paid 2.4 million US dollars in compensation, stopped the subsequent simulator development and operation, and closed related websites.

Although many players complain that they wouldn’t use the simulator if it weren’t for the poor performance of NS machines. However, with the increasing awareness of copyright of players today, almost no one will refute the fact that "cracking games is illegal". "Game safety" is not only related to game manufacturers, but also closely related to players.

In fact, "game security" occupies a very important position in the game industry, and both players and practitioners have to deal with it almost every day. However, people usually don’t discuss it much, because "game security" has certain technical barriers.

In China, game security is almost directly linked to big factories. Because of the high cost of the security team, only big factories have enough financial resources. Large factories can make adequate plans before safety accidents happen, but on the other hand, small and medium-sized factories and independent developers, which also occupy most positions in the industry, often find it difficult to make appropriate responses when faced with various safety problems.

To this end, we found a high-tech security service provider FairGuard, which focuses on game reinforcement and anti-plug-in, and jointly found some game security cases that are close to gamers and practitioners and exposed to the public, and analyzed them from a professional perspective. We hope to let the public fully understand the specific operation, function and significance of game security.

In the field of game security, the worst professional but most common case type is DDoS attack (distributed denial of service attack). Because of its characteristics, small and medium-sized manufacturers and independent developers are more vulnerable to such attacks.

For example, the mobile game "Lesonas" launched on February 29th this year was attacked by DDoS organized by ACCN. The game had to be delayed for 1 hour, and many players reported that the game was stuck on the first day. Every time they read a line, it took more than 10 seconds to get to the next sentence. The main means of ACCN is to ask the project team to pay the "protection fee", otherwise it will keep attacking. Coincidentally, a mobile game with 7 digits for users is also attacked by DDoS at the service node. If it is not solved in time, the losses caused are incalculable.

The basic principle of DDoS attack is that the attacker uses a large number of "broilers" (computers remotely controlled by hackers) to occupy the bandwidth or CPU of the game server. If the game server is compared to a hotel, it is like the hotel just opened, and suddenly a group of people came to the door of the hotel to block the door, so that normal diners could not squeeze in, or this group of people entered the hotel and occupied most of the tables, and kept asking the waiter to order, but the waiter could not drive them away, and other diners were also affected.

In order to improve the efficiency of making money, it is often the studio with clear division of labor (such as ACCN organization) that uses DDoS attacks for extortion. Some people will "find" the games to be launched, and record the volume, type and online time of the games. Others will launch attacks according to these records, and there may be a special group of people who will be responsible for contacting various game project teams to confirm the payment.

Of course, these behaviors are illegal, but it is difficult for the project team to trace the source and pursue the responsibility. First, the members of such organizations may not be in China, and the server IP address has been transferred several times; Second, attackers generally use virtual currency transactions such as Bitcoin.

Every year, there are a large number of announcements about developers being blackmailed by ACCN organizations on game platforms such as TapTap. Although some platforms and publishers will provide protection services, for developers, "I am not afraid of thieves stealing, but I am afraid of thieves remembering". Attacks that come from the dark and I don’t know when will always be a hidden danger.

From the perspective of technical protection, DDoS attacks are only a matter of money. The volume of the game is different, and the traffic of the attack will be different. After all, the attack also needs to cost. If this degree is not balanced, it is likely to be a loss-making business.

The cost of "broiler" is low, but the cost of preventing "broiler" is high. For example, if an attacker uses "broilers" to attack the game server with 200G of traffic, then the game project team may have to buy 200G of public cloud (such as Tencent Cloud and Alibaba Cloud) resources for protection. The former may cost only a few hundred yuan, while the latter needs tens of thousands of yuan.

Attackers often take the lower value of the two as the "protection fee", but the project team can’t guarantee that the other party is honest. If the attacker "steals well" and only collects the protection fee once, the project team can barely accept it; But if the other party thinks you are a "fat sheep", they will blackmail you again and again. Many times, the project team dare not gamble, but they have no money to buy special protection services, so they can only pay the money.

In this regard, the relatively professional advice is to enhance safety awareness. Some developers don’t have the concept of prevention, and they often make up for it after the incident. However, the profit lost after the first DDoS attack is more than the money spent on early protection, which is not worth the candle.

According to the experience summarized by professional security service providers, the low-cost method is that as long as the project team buys public cloud resources or corresponding protection services in the first month of online, there will be basically no more studios to launch DDoS attacks. Small games can directly solve the problems that may cause great losses by spending less money.

Compared with DDoS, most people may know more about plug-ins and pay more attention to the impact of plug-ins on their own game experience.

Some plug-ins can monitor or directly modify game files, which will cause serious damage to the game ecology. FPS games have always been the hardest hit area for black-and-gray attacks because of their high category popularity, high cheating income and data storage in the client.

For example, in the "fake match" incident of the professional team "Crossing the Firewire" last year, the team invited the anchor team to play against the professional players in an open environment, and speculated through subsequent offline battles and whitewashing. Players find that the plug-in used by the anchor team is extremely concealed. If it is not because of the complete victory over the professional players, it is difficult for people to think of using the plug-in. In related reports, this kind of hanging is also called "anchor customized hanging".

There are two characteristics of "anchor custom hanging", one is just the right function castration, and the other is the anti-detection means with external intervention. The former is to make the anchor "icing on the cake" in technology and provide good enough "effect" in the game. For example, the "lock" function can only be triggered when the enemy appears and the sight is close to the enemy’s body. It is difficult for the naked eye to tell whether this tiny moving trace is from the plug-in. As for the latter-teams that do "anchor customization" services often sell special equipment together with plug-ins and put them in the equipment, which makes the official detection methods fail to some extent.

From the point of view of protection, game manufacturers often get plug-in samples first, and use the similar identification code in the plug-in samples to carry out preventive testing in the player’s game. If an official identification code appears in the background data of a player, then the official has the right to take measures, and generally it will not be blocked by mistake. However, the identification code of the anchor custom hanging is separate, and this process naturally doesn’t work.

However, even if the player’s behavior is not detected by the conventional process, the official can make manual judgment, which is based on the background environment and some behavior data of the player-reporting is meaningful at this moment.

If a player receives a large number of reports from other players, the official will check his background environment and behavior data, and give him a risk rating according to the results of the inspection. There are many dimensions of rating, generally to see whether the memory has been modified or whether it is in an unconventional environment (such as a virtual machine).

The security team will send the high-risk player ID to the project team, and the project team will decide the specific measures to be taken later. Some players may be "big R", charging a lot of money, and the direct title may cause legal disputes. If the manufacturer fails to produce enough "objective evidence", there will be a greater probability of losing the lawsuit. Therefore, some manufacturers will turn a blind eye to "big R", and for players below "small R", they would rather kill by mistake than let go.

Compared with anchor customization, "script" is less harmful, but it also has a direct impact on the balance and life cycle of the game. Scripts often appear in role-playing, card and strategy games. From the perspective of protection, scripts are directly linked to the studio, and MMORPG with economic system is the hardest hit area of the studio.

The role of scripts is to efficiently collect in-game resources and realize the obtained resources. In the long run, when the resources in the game are collected too much, the resources will become cheap, and players will tend to find a studio to buy resources instead of "earning" resources through their own game labor. In order to reduce costs, scripts often run on virtual machines or in the cloud. A studio with more than a dozen people may open thousands of scripts at the same time. In other words, in fact, the script is "endless".

Another phenomenon derived from scripts and studios is the "initial number". Chen Shiliu, the technical director of FairGuard, talked to me about this: nowadays, the second tour often requires players to exchange growth resources or roles through repeated work in the game. However, after the game has been in operation for one or two years, it is difficult for newcomers with self-built numbers to catch up with the progress of the game, and it is a common choice to buy "initial numbers" from the studio.

For example, on August 30, 2022, Nexon, the international service operator of Blue Archives, permanently banned 280,000 initial numbers, including not only those in the studio, but also many that have already flowed into the hands of players. This has caused "inflammation" among the players-players have taken lessons in the game and continued to play for a while, but after the manufacturer banned it, they did not provide compensation measures. Players will naturally question: Why didn’t the manufacturer deal with this violation immediately, but it took some time to deal with it?

Chen Shiliu told me that this is because the script does not modify the game memory data, but is just a fixed "simulated click", brushing the trumpet and licking the wool. Therefore, the security team needs to proceed from the risk situation of the equipment and combine the behavior judgment of the player after boarding the number. For example, players need to touch several fixed positions on the screen when doing daily work in a mobile game, but the time and operation logic of manual operation and script opening are different. In the case of background protection, the background will immediately detect the abnormal behavior of players and prompt that there is script risk. However, unlike FPS’s "anchor customization", the connection of the second tour is often "weak connection", and this behavior of hanging scripts and brushing resources cannot be reported. Game manufacturers can only observe it for a long time and regularly "one pot".

"One pot" means lag, so it is difficult to consider whether there are players in the account playing normally and whether there is recharge behavior. It is worth noting that while the players are "on fire", there are also many examples of the game rising due to the reduction of studios.

In Japan, the origin of the "initial number", many manufacturers have acquiesced in the existence of the initial number and formed a "symbiotic" relationship with the studio during their long "Yan Shang" career. Some games may be small in size and lack of newcomers, and the initial number even plays a role in saving some channels and announcing costs for developers. As long as it doesn’t directly affect the experience of other players, some developers will tolerate some behaviors that slightly modify the game memory, such as "variable speed hanging".

Other manufacturers adopt the attitude of "people don’t lift, officials don’t investigate". For example, the "ACT" plug-in of MMORPG Final Fantasy 14, if the player only uses its "damage monitoring" and "mechanism broadcasting" functions, the official will not take the initiative to intervene. After all, this plug-in has really improved the player’s game experience. But in principle, the game is not allowed to use plug-ins. If you take the corresponding test data to "police" other players, it will be officially banned.

Generally speaking, whether it is a plug-in or not, it is necessary to analyze the specific situation. For players, as long as the game is played according to the normal process, it will definitely not be banned. In this process, manufacturers need to reflect on whether their game design and version planning are unreasonable, and whether players must rely on some kind of soft plug-in (script) to get a good experience? If this is the case, it is not surprising that after the manufacturers take measures to crack down, they are "burned".

Strictly speaking, modifying the plug-in of game memory is also a part of cracking, but there are many more serious cases of cracking, and in the field of game security, anti-cracking is also the most important part.

In cracking, the most typical case is Legend. In the early years, "Legend" was cracked, and the source code was leaked. Some people deleted the source code with ulterior motives and added their own servers, which became a private server. In the field of black ash production, when a game is cracked, the cracked results will inevitably spread like a virus. When private servers can generate huge benefits, many people will ignore the law and start taking risks.

Under normal circumstances, game developers need to find the copyright party to request authorization to make genuine products. Private servers are like "tax evasion", which saves the step of paying money to the copyright party. There are many benefits in private servers, so there are fewer players playing genuine ones and the losses caused are incalculable.

Li Lei, marketing director of FairGuard, said that there are at least 20 billion industrial chains in the "Legend" mobile games, which are being attacked every year, but they just can’t be beaten.

Of course, "Legend" is because the code leaked and cracked too early, and there will be a situation of private servers. A more common "crack" is to make paid games available for free. This has also brought a series of chain problems: after some small games with in-house purchases are cracked, they will be sold online at low prices, causing losses to developers and operators; Embedding some programs in the installation package, collecting personal information of players during installation, and then selling the information for profit; Implanting illegal advertisements in the original internal purchase part to achieve the effect of imitating genuine products and making money; What’s more, it will adopt a "subscription system" to make profits systematically, far exceeding the bottom line that game security can tolerate.

However, there are fewer cases of cracking the whole game, while there are more cases of cracking encrypted resources. For example, the pictures, audio, text and other contents in the game are all "game resources". Before the game goes online, these resources need to be packaged and encrypted. Generally, the encryption methods of game manufacturers are relatively low, so they have to entrust a third party to further encrypt.

Li Lei mentioned that in recent years, the demand for content-based secondary games has suddenly increased. On the one hand, because the art cost of Second Tour is getting higher and higher, art resources have become one of the most important project assets, accounting for the bulk of the project cost. Once the art resources are cracked, it is very likely that there will be competing products with simpler playing framework but similar art content in the market soon-in the legal sense, the criteria for judging plagiarism and skinning of games are still strict, and developers may realize that competing products have cracked their own art resources, but it is difficult to find tangible evidence.

On the other hand, the cracking of resources means "spoiler", which will affect the ecology of the game community to a certain extent and may indirectly interfere with the version planning of the operators. For example, a second tour puts the character resources to be sold into the game in advance, which is cracked in advance and spread in relevant communities. This character will gradually lose its appeal to players in the information flow, resulting in a decrease in profit.

Li Lei highlighted the resource leakage incident of "Girl Frontline 2: Chasing and Releasing" last year, that is, the "Mrs. Raymond" incident. This resource leakage directly led to the subsequent public opinion outbreak, so that the developer scattered the network and lost the trust of the players. From the point of view of protection, it is inconceivable that with the size of "less than the top 2", there are security problems in game resources.

Li Lei said: "Generally, medium and large-scale games will contact professional companies to do encryption work six months before the start of testing. PvE or relatively’ stand-alone’ mobile games need to prevent situations like’ less top 2′, and PvP games should consider whether the cracked resources will be used to make plug-ins."

In fact, once the popular game resources are leaked, they will be spread quickly and widely. Although this behavior is illegal, it is difficult for game companies to hold the disseminators accountable. At this stage, what developers should do is to keep an eye on whether their project resources are used for sale or further malicious use to prevent the loss from expanding.

In the process of communication, we always mention a problem: some small manufacturers or independent developers easily ignore security issues, or have relevant knowledge, but lack experience in dealing with them. Although large and medium-sized factories have accumulated more or less relevant experience in the development process, they will sometimes "stumble" when faced with the rapid change and increasingly rampant black ash production.

In fact, whether it is reality or games, security has always been a big problem. As a developer, what you should do is to make a good plan in advance as far as possible to avoid problems and then find ways to solve them.

The so-called plan, buying "outsourcing services" from professional teams is an option, but not all. Developers should consider some design logic when making games: will it be used by criminals? Can you do some verification work from the server to improve the intrusion threshold of cracking and plug-in? In fact, these jobs don’t cost too much, but are more about ideas and "intentions". On this basis, if something goes wrong, we can avoid more losses to some extent by looking for a security team to deal with it.

For developers, such concepts and "intentions" are particularly important. If there is an excellent game, because the developer lacks security awareness, he doesn’t even know how to deal with the most basic DDoS attack problem when he goes online, which makes a team’s efforts for several years go up in smoke. This is not only the personal loss of the developer, but also the loss of the game industry.

　　As the domestic epidemic prevention and control situation continues to improve, the tourism industry has gradually resumed production. Recently, the 19 peaks scenic spot in Chuanyan, Xinchang County, Shaoxing, Zhejiang Province has attracted many tourists to visit in the spring through the form of "online cloud tour+offline experience". People’s vision

　　Core reading

　　Based on the principle of "orderly opening up" and "paying close attention to online", we will persist in accurately, orderly and solidly promoting the return to work and production of cultural and tourism enterprises. At the same time, accelerate the development of digital tourism industry.

　　Online and offline concerted efforts

　　A number of scenic spots held live online activities, attracting many tourists to participate.

　　"Canceled the travel itinerary, and it is also very informative to visit online at home." These days, Lin Ying, a college teacher in Yangpu District, Shanghai, took her daughter to watch the live broadcast of Xi ‘an Beilin Museum online. Together with more than 300,000 "online tourists", she followed the commentator to the museum to learn about history. "The commentator’s explanation is humorous and vivid, and my daughter is very interested."

　　Since February, some scenic spots have held live broadcast activities such as "Cloud Tour" on Internet platforms such as Tik Tok, Taobao, Tencent and Aauto Quicker. This new way of traveling has attracted many tourists to participate. At most, the single-day viewing of live events in museums alone has reached 10 million people.

　　"Actively introducing new service methods is an effective measure for cultural tourism enterprises to cope with the impact of the epidemic." Jing Linbo, president of China Academy of Social Sciences Evaluation, believes that the epidemic has different impacts on different regions and industries, and the tertiary industry is the most affected as a whole. Tourism is directly related to the flow of people and is directly affected by the epidemic. According to the data of the National Bureau of Statistics, from January to February, the retail sales of travel goods dropped significantly, including the catering income related to tourism dropped by 43.1%, and the room income of the above-designated accommodation industry dropped by nearly 50%.

　　At present, on the one hand, tourism enterprises actively resume work and production, on the other hand, they strive to seek transformation. In order to guide the national tourist attractions to continue to implement epidemic prevention and control, and steadily do a good job in the work related to the resumption of opening up, the Ministry of Culture and Tourism recently issued the "Guide to Prevention and Control Measures for the Resumption of Opening Up of Tourist Attractions", proposing that each scenic spot should gradually resume opening up in different regions and projects according to the actual situation, and clearly control the tourist flow, implement real-name registration and other scenic spot tour management measures.

　　On March 1st, the Potala Palace held its first live webcast, with more than one million viewers in one hour. On March 9th, the Potala Palace once again boarded Taobao’s live broadcast room, which was broadcast live with 5G signal for the first time. The picture was clearer and smoother, and it was well received by viewers. According to incomplete statistics, up to now, more than 30 famous domestic museums, such as China National Museum, Dunhuang Research Institute, Nanjing Museum and Suzhou Museum, have held live webcasts, and some museum curators have gone online to tell the audience the story of national treasures.

　　Scenic tours can be broadcast live, and industry training can also be broadcast live. Since mid-February, Jingyu Mama Group began to organize large-scale public welfare cultural travel live classes. This course, which is introduced once a day and lectured by tourism experts, has become a set of timely and rich training materials for tourism practitioners who are "busy charging" and "practicing internal strength" during the epidemic. As of the beginning of March, the cumulative number of viewers of the live class has exceeded 200,000.

　　As the situation of domestic epidemic prevention and control continues to improve, the situation of offline tourism resuming production is also improving. On March 16th, shenzhen happy valley, windows of the world, splendid china Folk Village and other scenic spots under OCT Group resumed opening in an orderly manner. According to the relevant person in charge of shenzhen happy valley, after re-opening, visitors are required to keep a distance of more than 1.5 meters and wear masks all the way to the park, and the amusement equipment will be taken in separate seats. The staff will fully disinfect the seats immediately after each group of tourists leave.

　　According to the 2020 Destination Recovery Index Report released by Ctrip. com, as of March 11th, the number of scenic spots reopened for booking on Ctrip platform has exceeded 900, and the number of 5A-level scenic spots nationwide has exceeded 100, accounting for nearly 40% of the total number of 5A-level scenic spots.

　　Looking for new growth points

　　The market fundamentals supporting the operation of tourism economy have not changed, and the tourism industry should continue to exert its efforts in improving quality.

　　"During the epidemic, although people’s travel was suspended, the demand did not disappear and the upgrading trend did not disappear." Zhai Xiangkun, an associate professor in the Tourism Department of China Institute of Labor Relations, believes that tourism is directly affected by the epidemic, but it may rebound faster than other industries after the epidemic. After the epidemic, the new growth point of cultural tourism enterprises is still focused on improving quality.

　　The market fundamentals supporting the operation of tourism economy have not changed. Recently, a special survey for urban and rural residents in china tourism academy showed that more than 70% of the respondents expressed their hope to travel after the epidemic.

　　"The epidemic did not make the demand for tourism disappear, but it was delayed." Sun Jie, CEO of Ctrip, said that not long ago, Ctrip and global tourist destinations jointly launched the "Revival V Plan" and launched a 1 billion yuan recovery fund to help the tourism market regain its vitality.

　　Yao Jun, general manager of OCT Group, believes that the current cultural tourism industry is undergoing profound changes, and the problem of "whether it is available or not" has been basically solved, and the problem of "whether it is good or not" is more and more prominent. After experiencing the rapid growth in the early stage, cultural tourism is facing transformation, traditional scenic spots are facing development bottlenecks, and the industrial structure is not suitable for market demand. The high-quality development of cultural tourism is an inevitable requirement.

　　Innovation is the main source of new growth points. On March 26th, Song Cheng Performing Arts announced that its romance of the song dynasty, Guilin and Zhangjiajie will resume their performances on April 3rd, and hangzhou paradise will resume its opening on the same day. After the reopening of the park, a series of brand-new performances will be presented in Song Cheng, Hangzhou, including a number of new dramas, such as Hua Xiang Rong, Katyusha, Modern Times and Phantom, which were created during the epidemic period, and are expected to become new highlights to attract tourists.

　　Looking forward to a lot of help.

　　Help digital tourism enterprises to reduce the losses caused by the epidemic and expand the supply of high-quality digital tourism products.

　　Zhai Xiangkun believes that the demand for travel will quickly pick up after the epidemic has become the consensus of the industry, and the cultural tourism industry, which is dominated by small and medium-sized enterprises, needs to make efforts in many ways.

　　According to the relevant person in charge of the Ministry of Culture and Tourism, we will adhere to the principle of "orderly opening up" and "paying close attention to online", and promote the resumption of work and production of cultural and tourism enterprises in an accurate, orderly and solid manner, and formulate open guidelines or guidance for tourist attractions, public libraries, cultural centers and cultural and cultural institutions respectively, so as to provide safer consumer products and places for the people on the premise of preventing and controlling the epidemic. At the same time, accelerate the development of digital tourism industry, strengthen the construction of smart tourism in 5A-level scenic spots, guide the scenic spots to change their development concepts, promote the deep integration of industries, constantly expand the connotation and extension of industries, create diversified products and improve the supply structure.

　　In view of some problems faced by the development of digital tourism industry, the Ministry of Culture and Tourism will issue relevant policies, including the implementation of fiscal, taxation and financial policies, to help enterprises reduce the losses caused by the epidemic and enhance the development confidence and stamina of digital tourism enterprises. At the same time, expand the supply of high-quality digital travel products, accelerate the release of emerging consumption potential, develop immersive experience-based travel consumption, and guide and cultivate new hot spots and new modes of consumption such as online consumption, experiential consumption and intelligent consumption. In addition, the Ministry of Culture and Tourism will strengthen the construction of new infrastructure, promote the deep integration of cultural tourism and digital economy, and promote the digital, networked and intelligent development of the cultural tourism industry.

　　In order to help enterprises trapped during the epidemic, the Ministry of Culture and Tourism recently issued a notice to temporarily refund part of the tourism service quality deposit and support travel agencies to cope with operational difficulties. At the same time, the Ministry of Culture and Tourism also set up a column on official website to support the development policies and measures of enterprises in response to the epidemic situation, and set up online courses such as Red Tourism Cloud Classroom, Face-to-Face Live Classroom of Rural Tourism, Cloud Classroom of Tourist Attractions and Cloud Lecture Hall of Cultural Tourism Industry. At present, policies in finance, finance, taxation, social security and other aspects have benefited cultural and tourism enterprises.

　　To tide over the difficulties and fully recover, the tourism industry also needs to work together. In order to alleviate the pressure on partners, the tourism platform Mawei has fully opened up and integrated the platform’s high-quality resources, and provided urgently needed action guides for partners free of charge, which has been welcomed by many partners.

　　Recently, Linyi Blue Ocean International Hotel under Shandong Blue Ocean Hotel Group has found a new revenue growth point. The Blue Ocean Hotel, which joined the "Stay +X" evergreen plan of the US Mission, launched a take-away service during the epidemic, and the daily average take-away order increased rapidly from about 10 to 160, and the transaction volume also increased from 500 to 800 yuan at the beginning to nearly 13,000 yuan.

　　Jing Linbo believes that as long as the cultural tourism enterprises accurately analyze the current trend of tourism consumption upgrading, further update tourism products, change tourism management and operation methods, and improve the risk management mechanism, they will certainly enhance their ability to resist risks and the driving force for sustainable development, thus achieving a comprehensive recovery of the cultural tourism industry.

　　People’s Daily (April 1, 2020, 19th edition)