I installed it in my remote server, installed the advanced chat example for flash in my PC and run it. Anyway, for my new project I decided I dind't want to spend time writing a server and checking every security problem, so decided to give SFS a try. I resolved this checking for application authenticy, that is, checking that every packet coming from the client was from the game and no other application. For my unexperince and lack of knowledge I really didn't know you could inject data to an already connected socket (i was aware about sniffing but not injecting data!) , this resulted in huge problems in the game when some malicious users attacked with WPE Pro (which by the way is really easy to use and they could do almost anything in the game). I have already developed a multiplayer game, at that time I ignored the existance of SmartFoxServer so I wrote my own Java server that is running on a VPS, obviously much more limited than your product.
What is more, i took a message for instance saying "HELLO", modified it with "BYE", resent it and everything was working again as if I had sent that message from the chat (and was from WPE Pro). I took one package and re-sent to the server with wpe pro, hoping nothing will happen (in best case even disconnect me beacuse i was doing something ilegal), but to my surprise EVERYTHING WORKED AS THE REAL APPLICATION WAS SENDING THE DATA. I opened the chat example, the WPE Pro and started sniffing on that example.
...
Maybe it could be solve with server-side extensions, so please tell me a way to solve this problem as I am not going to start programming for this server as that is a huge vulnerability. 2) Click I am not really familiar with SFS, but as I could test, It doens't check for application authenticity, at least not how i tried it (almost bare as i install it), maybe there is some configuration i don't know about, but this is really trouble making (I know for personal experience as mentioned before).
0 kommentar(er)
