Game tasks are vulnerable to methods of gaining an advantage based on the results of attacks on game resources. In such conditions, it is critical to identify, monitor, and evaluate the possibility of such attacks. It is also advisable to choose methods of preventing them in advance, designing the game environment accordingly. An example of the use of training technologies that form users' awareness of information security issues for the task of predicting the choice of an attacker's attack vector is given. The algorithm of actions of an attacker in a game environment to gain an advantage or bypass (violate) the logic of the training game is shown. Possible criteria for the selection of game resources as targets of an attack are shown. The scheme of actions for determining the target resource and the features that reduce its protection against various types of attacks are briefly described. The application of the approach is possible for multi-user games built on the simulation of various processes, including for training games of various directions. Educational games, attacks on game resources, cyberattacks, an attacker 1Proceedings of VI International Scientific and Practical Conference Distance Learning Technologies (DLT-2021), September 20-22, 2021, ORCID: 0000-0002-8054-8564 (Vyacheslav Zolotarev); 0000-0001-8117-9142 (Maria Lapina); 0000-0002-3486-0602 (Nikolay Parotkin);
For certain types of gaming tasks used in information security for training, there is a serious problem
of countering various cyberattacks on gaming resources. These tasks include quest game tasks [
Of course, the main problem of the game task, in this case, is the presence of a key, answer or hint, integrated into the task or located on a separate game server. For quest-type games, obtaining a key from a task by attacking game resources will mean violating the logic of the game or gaining an unfair advantage; for other types of games - solving tasks that would otherwise require the development of certain skills, and imbalance in the game.
The attacker's task in attacking the gaming environment can be twofold. On the one hand, he is interested in disrupting the gameplay. Perhaps he is not pursuing personal or team benefits. In this study, the main one is the second situation, when an attacker deliberately tries to gain an advantage or violate the logic of the game. environment.
When solving a problem of the second type, an attacker looks for a non-standard way to bypass game tasks or obtain keys, hints, and answers by unauthorized access to them, bypassing the game
2021 Copyright for this paper by its authors.
Previously considered [
Accounts and communication tools, like web interfaces, can be used to penetrate the game environment, unauthorized access to resources, including through attacks on these components, others can be violated - for example, to influence the game logic through developer accounts or interfaces management of physical components.
In addition, it is possible to take into account the peculiarities of working with gaming technologies
in a virtual environment [
The main target of an attacker can be any type of game resource including those containing game content, rules, and technology that implements it.
To assess game resources as targets of cyberattacks, the following conditions are accepted:
● game resources based on imitation of various technological or other processes are more
interesting as an educational element of the game and, as a result, may be of greater interest to an
attacker. The reason for this focus on imitating resources is the data that is collected for legal access
to them. Such resources will collect and store lists of user accounts, be mentioned and discussed in
communication systems, and serve as a point of attraction for players;
● the attacker will choose those resources to which there is access and which are more valuable
to him subjectively. This behavior of an attacker can help predict his actions, evaluate the optimality
of attack algorithms from his point of view [
Next, consider how you can confirm the existence of these conditions in a training game.
Earlier, in the article [
The criteria for selecting the target resource in the indicated experiment were: ● value of information. Information suitable for sale as a source of profit was assessed; ● the attacker's awareness of the presence or value structure of the resource; ● the attacker's awareness of the infrastructure of the target game resource; ● meaningfulness of the attacker's actions.
In the gaming environment, as a rule, these characteristics are not hidden. It is always open space for the exchange of information between players. The ability to restrict access to certain information about the gaming environment exists, but, as a rule, this concerns the infrastructure - the configuration of the environment, the location of the game resource on physical servers, the logic of assigning points for tasks, archives of digital traces, and so on. In general, collecting information about the gaming environment is not difficult for an attacker.
An attack on a game resource has a certain pattern: - the point of entry into the game space is determined - the player's account or manager account, service interface, resource web interface; - the authentication mechanism is analyzed; - the communication protocol (protocols) is analyzed; - the possibilities of the registration and accounting system are being studied; - the capabilities of the attack response system are being studied.
Having gained a certain understanding of the protection of the gaming environment, the attacker implements one of the types of targeted attacks on the resource, taking advantage of the vulnerabilities of the studied components.
The results of an attack can be tracked both by the player's digital footprint (changing the nature of tasks, gaining an advantage, changing capabilities or information support), and by using the components of the game space - web interfaces, rarely used forms of information presentation, access to files containing certain data ...
Examples of attacking actions may even include the use of analytics of the internal chats of the game by an attacker to analyze the tasks being performed and predict the logic of access to them.
Identifying strategies can point to some security issues and recommendations for gaming environments that need to be complemented by requirements for the physical elements that implement the gaming and learning process, namely: ● to prevent attacks on gaming resources in practice, it is necessary to protect management accounts from identity theft attacks (two-factor authentication, control of connection logs, biometrics); ● ensuring the protection of physical communication interfaces of the hardware from unauthorized interception of data or the implementation of control actions, the introduction of mechanisms for monitoring the integrity and/or encryption of transmitted data; ● protection against phishing attacks on manager and game accounts is required. Tracking of keywords and frequency parameters, outgoing IP in in-game and external communications is required.
These requirements are partially offset by the use of organizational measures by the majority of participants, which is possible by increasing their level of awareness of related issues of interaction with the external one when following the instructions for using the platform.
To solve this problem, there are specialized systems for training and knowledge control - they help
to automate such activities, in particular, the Kaspersky Automated Security Awareness Platform
(ASAP) used in the study [
It should be noted that such means of studying user awareness can be part of the gaming environment. For example, by collecting a digital footprint during test tasks, you can analyze the potential exposure of a user (or a group of users) to phishing attacks.
Separately, we can consider conducting a test attack (penetration testing) for a gaming environment. If test attack mechanisms are integrated into the game space, the player will perceive them as an element of such space, and collecting a digital trail will give the best result.
To assess the possibility of choosing an attack vector, it is possible to designate an indicator of an increase in the level of user knowledge based on the test results before and after training. The number of test participants is 70 people. The test results for the above typical attacks for educational gaming environments are shown below (Table 1).
If we consider these vectors of attacks, we can see that the resistance of users to a direct attack on the web interface or through external resources, as well as through personal accounts in the social network, will always be higher, and the most interesting for the attacker remains in this case, as well as and in-game modeling of targeted attacks, an attack vector using email and in-game communications.
Email Websites and internet
Social networks and messengers
It should be noted that when forming an attacking toolkit, an attacker must adhere to the results of a previously obtained study of the system, but only if a targeted attack is being implemented. In the case of a mass attack, for example, phishing or using viruses, the attacker analyzes the initial response of the system and reacts to it.
It is also possible to note situations of using fuzzing as an element of an attack when the studied web interfaces or applications are tested by an attacker using random data sets, but such an attack is more of theoretical interest since it is easily detected and blocked. The only dangerous situation here is when the open web interfaces of the game space (or software services with open access) are not controlled by the security subsystem and their response is not investigated, at least in retrospect, but even a banal selection of authentication data such as logins and passwords for manager accounts.
As a rule, a certain minimum level of implementation of protective measures is assumed, which guarantees the successful existence of the game space in the aggressive virtual environment of the open network by default.
In addition to the attack itself, as indicated in the diagram, the attacker will be interested both in assessing vulnerable resources (including through predicting user awareness) and in eliminating traces of the attack. The work of an attacker with the protective mechanisms of the gaming environment can consist in both destroying and substituting data for registering security events, distorting or destroying a digital footprint, changing or distorting game analytics.
An attacker, evaluating complex attack metrics, can also target user vulnerabilities outside the gaming environment. For example, the theoretical assessment of the resistance of users of the gaming environment to a phishing attack necessarily includes the work of the target user with social networks.
The attacker will aim to identify the focus of users' attention, to select an attack vector using system components for which there is low user awareness of security issues.
Previous studies allow us to focus on developing attack models and assessing how an attacker can influence the gaming environment or its physical components that do not have secure interaction interfaces. Possible attacks on certain information protection mechanisms, such as authentication, may also be of interest for further research. It is planned to study various gaming environments for various areas of study.
The following areas of research are of particular interest: multimodal authentication systems and their vulnerabilities when implemented in educational gaming environments; the possibility of implementing targeted attacks on game resources and statistics of this type of attacks; study of incidents related to game resources in educational games; changing attack vectors taking into account the massive transition to distance learning.
The authors suggest that the study of the vulnerabilities of communication protocols of video conferencing systems that implement communication channels in gaming environments, as well as analysis of the possibilities and methods of preventing phishing attacks, is also of significant interest.
The conclusions made allow us to concisely formulate the order of actions of the attacker, allocate key resources and entry points to the system that need to be protected. It is of interest to evaluate the choice of an attack vector based on the prior knowledge of the attacker about the technologies used. This assessment predicts an attacker's actions and vulnerabilities in existing gaming environments.
The study of user awareness as an element of predicting the targets of an attack has also practical application as a study of the dynamics of changes in the landscape of security threats. Using these approaches, the security service can tune and adjust both the configuration of the environment and the registration and accounting system, including such protective technologies as a honeypot and/or honeynet.
In general, it should be noted that the study of attacks on educational games is necessary since at the moment there is a tendency to increase the danger of their use due to the opening of interfaces, access
This work was supported by the Russian Foundation for Basic Research, project No. 19-013-00711.