PlayNoEvil - Game Security, IT Security, and Secure Game Design Services - Service Piracy - Doppelganger, Ghost Servers, Emulators, and Private Servers

Steam Account sold for $1000 - Account Theft to Follow

ceo@secureplay.com (SecurePlay) — Tue, 19 Jan 2010 05:00:00 -0800

Nothing inspires thieves like success... and the sale of a Steam account for $1000 is certainly going to make the online service a more visible target.

There have already been incidents of account theft at Steam.

It will be interesting to see if Steam has to join other online services in moving toward using security tokens or if Valve takes other measures to improve account security.

O. Good (2010), "Steam Account Sells for $1,000 on eBay", http://kotaku.com/5449767/steam-account-sells-for-1000-on-ebay

Private Game Servers - Piracy for MMOs

ceo@secureplay.com (SecurePlay) — Fri, 11 Dec 2009 05:03:00 -0800

There hasn't been too much news about Private Servers / Pirate Servers of late. In the US and Europe, the exist, but they are not really viable as businesses as they can be found and shut down quickly. In countries without a major domestic online gaming industry, but substantial Internet access, there is a growing issue with these pirate servers as commercial businesses. China has had a problem with private servers, but the growth of the domestic online game industry is likely to have a huge impact on private servers going further.

The big problem for MMOs in terms of piracy is that most of the value of the game is downloaded to the game client - virtually all of the game assets and much of the game's logic. There are three major ways to pirate MMOs:

1. Reuse art assets and develop your own game logic. The big cost in MMOs are art assets and mission content, most of which is pretty easily extracted from a game client.

2. Use the game client and reverse engineer the game server. Often not hard, again, as most of the game is on the client.

3. Get a copy of the game server as well as the client. This has happened a number of times because of disclosures or theft.

... all brought on by an article at BBC News.

I discuss this issue further in my book Protecting Games.

N. Ryan (2009), "The closed world of private game servers", http://news.bbc.co.uk/2/hi/technology/8393770.stm

Shh, Be Very Quiet, We're Hunting Gold Farmers (and we need more hunters)

ceo@secureplay.com (SecurePlay) — Wed, 18 Nov 2009 09:08:00 -0800

Scott Jennings has written a high level overview of gold farming over at MMORPG.com. Nothing really new in the article: Developers REALLY don't like gold farmers, they don't do deals with RMT folks (though individual employees at game companies certainly have), they'd rather monetize players directly (Free to Play, item malls, official player sales, etc.), yes, some gold farmers are paying customers, others use trial accounts, stolen accounts, and stolen credit cards, gold farmers are a net cost to game companies....

I tend to disagree with the fact that MMO designers take these issues very seriously during design. There is just too much evidence to the contrary. Game mechanics in MMOs continue to be virtually optimized to encourage botting and gold farming. Simple mechanisms like restructuring game markets to work like a stock market instead of eBay would radically reduce the ability of gold farmers to covertly transfer assets. Games as click-fests are especially easy to bot.

Gold farmers are a known problem for aspiring MMO / online game / social game developers from Day Zero.

As a further interesting note, Scott has a job again (Congratulations, Scoot), helping NCSoft with its gold farmer and other game abuser problem in its new Game Surveillance Unit...

and, if you are in Austin, you may want to check out the job for a Game Surveillance Agent.

One oddity of the position is that private servers are included in the job... this is a very different problem. Shutting down these sites is a DMCA type task and techniques to stop the creation of private servers is an interesting and challenging engineering problem.

S. Jennings (2009), "Scott Jennings: Real Money, Real Problems", http://www.mmorpg.com/showFeature.cfm/loadFeature/3740/page/1

NCSoft (2009), "Game Surveillance Agent", http://tbe.taleo.net/NA5/ats/careers/requisition.jsp?org=NCSOFT&cws=1&rid=558

Does Game Piracy Matter?

ceo@secureplay.com (SecurePlay) — Mon, 28 Sep 2009 07:55:06 -0700

Piracy gets an awful lot of press in the games industry. Industry CEOs talk about it at great length.. yet there doesn't appear to be a lot of investment in actually avoiding piracy.

DRM companies have come and gone and come and gone.

Lawyers get the most visibility in the piracy fight... which is ...odd.

Also, in the increasingly online world we live in, there are different kinds of piracy and piracy problems.

The first and most obvious fact that is pretty clear is that there is NOT a one-to-one association between pirated game copies and lost game sales.

This is seen by game company investments in anti-piracy technology, if nothing else.

Even the most jaded individuals would accept that it looks like there are around 10 pirate copies of a game for each one sold.

If anti-piracy tech was even SLIGHTLY effective in converting these pirate miscreants to paying customers, everyone would be using DRM, no matter the public outcry.

Reflexive Software, in their article on the topic at Gamasutra, claimed that with MUCH better DRM, they were only seeing an increase of 1 sale per thousand copies pirated (over multiple versions of a single online game... a pretty good model in an area with a dearth of decent data and research).

Given piracy rates of 80 to 90 percent (which are pretty typical)... the potential additional revenue is modest... to reconcile these models:

Assume a 90 percent piracy rate, then if you sell 1 million copies, you have 9 million pirate copies. If we accept the 1 in 1000 additional sales, we are seeing:

1/1000 * 9 million or 9000 additional sales (with an 80 percent piracy rate, you would see only 4000 additional sales.... please check my math, its Monday).

If we wanted to have a "2 to 1" return on our anti-piracy investment, our anti-piracy budget would be our revenue on between 2000 and 4500 games (assuming our game sold a million copies).

The revenue per game can range between $2 to $50 depending on business model, so our anti-piracy product would be "worth" between $4,000 and $225,000.

Assuming the game sells 1 million copies.

If costs were allocated on a per-unit sold basis (which makes more sense given the nature of games industry sales), the anti-piracy "value" would be between $0.225 ($50 in revenue and 90 percent piracy) down to $0.004 per copy ($2 in revenue and 80 percent piracy).

Not a lot of room for anti-piracy benefits or for anti-piracy firms to be viable.

PLEASE NOTE: This is not the appropriate model for music or movies - for music, the simple fact of breaking albums up into singles has had a huge negative impact on revenues (after all, if you only want 1 to 3 songs per album and you can purchase them for a fraction of the price of the album, you win and the music industry loses a lot of sales).

This is not the only factor affecting game companies.

Beyond Retail

If you are providing an online service or customer support, there is an ongoing cost for each customer. However, the requirements for anti-piracy in this environment are different in that instead of preventing duplicates, you want to ensure that the people who are creating ongoing support costs DID purchase your product... something that can be solved by different techniques. A good example would be the problems that Stardock had with early piracy on Demi-god causing huge amounts of traffic for its online game servers. Thought the company's solution has not been described in detail, a key element was to distinguish between paying customers and pirates and make sure that pirates were not keeping paying customers from the service... the monthly cost of an additional online game server would completely reshape the cost/benefit discussion above.... the more active your online service, the more important it is to be able to detect pirates.

There are also other types of piracy. Private Servers / Pirate Servers can substantially undermine the revenue model of an online game and thus have a very different and negative impact on revenues.

Also, the emerging area of Games-On-Demand and services like Steam and Impulse create the possibility of Account Theft which can similarly have a more substantial impact on sales.

Its the Revenue, Stupid

There is a very human impulse involved when game developers and publishers get angry about piracy. However, it is also critical that they focus on their bottom line rather than their (understandable) anger.

R. Carroll (2008), "Casual Games and Piracy: The Truth", http://www.gamasutra.com/php-bin/news_index.php?story=17350

... and I have an entire Part of my book Protecting Games devoted to discussing piracy and anti-piracy.

Consoles and Piracy - Sony steps up the war on Console Piracy in Asia

ceo@secureplay.com (SecurePlay) — Fri, 25 Sep 2009 08:35:41 -0700

Once upon a time, consoles were promised as a solution to piracy.

That is clearly no longer the case with both Nintendo and Sony stepping up their war of words with piracy in Asia and elsewhere and Activision's recent expansion of its anti-piracy legal team.

Tetsuhiko Yasuda, president of Sony Computer Entertainment Asia, recently warned countries in SE Asia to take a firm stand on copyright protection and, implicitly threatened to pull its support from a project to support training students on development for the PS3.

Sony and Nintendo have added direct digital distribution to the latest versions of their handheld consoles (the Sony PSPGo and DSi, respectively) clearly with an eye on piracy. As both products are quite new, it is unclear as to whether these digital distribution schemes will work.

OnLive and other games-on-demand services (by the way, when is someone going to team with TiVo on this) are looking at settop devices or new "mini-consoles" / game terminals in conjuntion with digital distribution to battle pirates.

If a game exists in a non-downloaded/non-protected format somewhere, is digital distribution an anti-piracy technique or just another channel?

Lawyers are going to be less and less effective in this fight as Moore's Law and simple economics puts more and more powerful PCs and network access in the hands of game players in countries without strong copyright protection who are neglected by the major game companies and a passion and desire to PLAY.

Online games are not immune to piracy. There are online pirate servers / private servers as well as an increasing problem with account sharing and account theft.

What should be critical for game developers and third party publishers is that anti-piracy protections and promises are aligned with actual business relationships. Currently, console developers feel the pain of piracy only rhetorically for third party games. The costs are largely born by third party developers and publishers.

P. Elliot (2009), "Yasuda-san issues piracy warning", http://www.gamesindustry.biz/articles/yasuda-san-issues-piracy-warning