1. Append the Facebook ID and score, use a seperation character and append another secret key for added security. For example: 100000229612727_4_paladinrules.
2. Hash the appended data and send it along with the original data. Our sample hash would be 3b707fdc8d8f54c27a543b16a68efcf7.
3. On the server do the same process, append the data we recieve and our secret key. Verify the hashes are the same.

Now if the evil Mark would attempt to change his score the hashes wont match, and we can reject the request completely. Enough talk; lets implement our theory!

Modify insert_highscore.php to add hashing:

[sourcecode language=”php”]
<!–?php <br ?–> mysql_connect(‘localhost’,’root’,”); //Setup database connection
mysql_select_db(‘highscores’);
$score = @$_GET[‘score’];
$fbid = @$_GET[‘fbid’];
$request_hash = @$_GET[‘hash’];

if(!$score || !$fbid || !$request_hash ) //Make sure we get all input
die("No fbid, score or hash");

$data = $fbid . "_" . $score . "_paladinrules"; //Hash it up using our format fbid_score_paladinrules
$hash = md5($data); //Hash it up!
if(strtolower($hash) != strtolower($request_hash)) //The hashes are different, the request is invalid.
{
echo "Invalid request!";
} else { //it seems legit, lets insert it!
mysql_query("INSERT INTO scores (fbid, score) VALUES (‘$fbid’, $score)");
} ?>
[/sourcecode]

As you can see, we now also expect another GET parameter called `Hash` to be passed and compare that to the hash we calculate. When it matches we happily trust the input and insert it, otherwise we show a message to scare off any attackers. Hashes should be case insensitive because some implementations of MD5 capitalize the output and others dont.

Modify DiceGame’s submitHighscore to include the hash:

[sourcecode language=”csharp”]
IEnumerator submitHighscore(int score, string fbid)
{
string hash = md5(fbid + "_" + score + "_paladinrules");
WWW webRequest = new WWW("http://localhost/insert_highscore.php?score=" + score + "&fbid=" + fbid + "&hash="+ hash);
yield return webRequest;

yield return retrieveHighscores(); //After we submit we’d want an update, perhaps someone else played too!
}
private string md5(string input)
{
// step 1, calculate MD5 hash from input
System.Security.Cryptography.MD5 md5 = System.Security.Cryptography.MD5.Create();
byte[] inputBytes = System.Text.Encoding.ASCII.GetBytes(input);
byte[] hash = md5.ComputeHash(inputBytes);

// step 2, convert byte array to hex string
System.Text.StringBuilder sb = new System.Text.StringBuilder();
for (int i = 0; i < hash.Length; i++)
{
sb.Append(hash[i].ToString("X2"));
}
return sb.ToString();
}
[/sourcecode]

It is very similar, albeit MD5 is a bit more tricky but luckily C# is well documented. We hash the parameters using the format we’ve made up, and send it to the server.

Build your game and play it, then try to alter your score as you’ve done before. You’ll see the hashes wont be the same, and your score will be rejected. This approach will keep most script-kiddies out, however its only a matter of time before a malicious user figures your secret format out and would be able to generate the hashes themselves. You could further complicate your security model by for example adding another secret key which is user specific, or using a different hashing algorithm.

Even though we are now secure from some basic forms of attacks, we cant rejoice yet. There are plenty of others ways to hack and cheat in your application, and there are always new ways being explored too. You should be especially scared about SQL Injection, which is the number one most commonly used attack on websites. Although theoretically if you cant alter the values you send to the server, you’d rather be safe then sorry.

This concludes the tutorial about Facebook and Unity. I hope you enjoyed it! Please let us know what you think in the comments or the Unity forum topic.

Tijmen van den Heuvel
Paladin Studios