Hackers demand $10M from Riot Games to stop leak of ‘League of Legends’ code

You don’t know who is going to try to hack the system, and the security strategy should handle the fact that the system is going to be compromised at some point. Otherwise you don’t have a security policy, but simply a more or less efficient palliative to fear that risks generates.

Yes, if you know who is going to have a will to attack, in which timeframe and with which resources at hand, security by obscurity surely can help a lot. Otherwise this is just buying the comfort of delusion, in my humble opinion.

Obscurity *by itself* is a poor security measure, but it can decrease the surface area for automated attacks substantially. A determined human can figure them out eventually, but if their bot never sees you in the first place, the human might never even attempt the attack.

Obscurity is not a bulletproof shield, it's another layer of Swiss cheese.

Then what is it? Script kiddies? I doubt that they are going to benefit from gaining access to a complex code base.

I don't think anyone in this comment thread has the data to truly argue one way or the other. The open source world is obviously the easiest example here - there have certainly been plenty of exploits that people started using in the wild before any of the "Good Guys" caught it. But there's also been huge numbers of security bugs quietly fixed because some random person saw it and contributed a fix. And plenty of the highest visibility exploits over the past decade have been found by security researchers unrelated to the projects utilizing the open source code was part of their toolkit in finding issues. If it was closed source, would the "Good Guys" have found it before the "Bad Guys"? Who knows!

You'd need to actually compile and analyze all this data to have a strong argument that isn't just people going off of what sounds the most logical to them, and there's also all sorts of confounding factors that would need to be accounted for, like value of the potential target, overall popularity of the codebase, etc.

Here's how to build a simple "bot" for any game in about 30 seconds.

Step 1, Scan memory for Hp using a tool like cheat engine. Step 2. Since you know simple C programming, you know HP is kept in a structure, most likely the player structure. Look at surrounding memory and you'll have something like this.

struct LocalPlayer { INT32 CurHP; INT32 MaxHp; INT32 CurMana; INT32 MaxMana; Position Pos; }

Step 3. Now you have a basic structure, how do you find what uses it? Well, you know what a getter setter is from your CS 101 class. So you set a HW breakpoint on Read for the hp, and a HW Breakpoint on Write for the hp. Now you have GetHp(); And SetHp();

Step 4. You also remember how linkers work from your Compilers class, so knowing this, just like the structure has similar variables in memory, the binary will also have similar functions next to eachother(Or you can use class/variable passing from your struct.). So Right below GetHp, is 99 % of the time going to be GetMana.

Step 5. Now you have your structures, and know what functions use it, so find the global variable or scrape how these functions get the address to update.

Step 6. Repeat for other players using exact same steps, congrats, you now have all you need for a wallhack, bot, or whatever you want.

So as we can see, no code is needed, no big brain hacks are needed. A cs 101 student can do this(And alot do, this is why cheats are filled with skids). And it's all done through super simple dynamic analysis. Games are different, since in a regular application, you won't be able to memory scan as easily.

No, they made a big deal about rewriting the code a few years back to help make things more stable, easier to maintain, and easier to expand.

All Wikipedia says is: “A demonstration of League of Legends built in the Warcraft III game engine was completed in four months and then shown at the 2007 Game Developers Conference.”

Sure, I wouldn't want any cheaters on my games, but these systems are not fool-proof and cannot circumvent every single cheater out there.

Dedicated enough cheaters are getting what they want anyway, while the unknowing user is left with a backdoor on their systems (in the event of a compromise)

That's about as feasible as making a perpetual motion machine.

Mate you are chastising him for not reading the article and you are contradicted by the first paragraph.