unforum
a.r.g.b.b
Calendar
FAQ
Search
Memberlist
Usergroups
Register
Log in
Welcome!
New users, PLEASE read
these forum guidelines
. New posters,
SEARCH
before posting and read
these rules
before posting your killer new campaign. New players may also wish to peruse the
ARG Player Tutorial
.
All users must abide by the
Terms of Service
.
This week sponsored by:
You
?
Why
do we need
your help
?
Announcements
Got a jones for some uF swag?
Visit Ye Olde Tradin' Post!
Our Esteemed Contributors
The time now is Wed Jun 19, 2013 10:31 pm
All times are UTC - 6
View posts in this forum since last visit
View unanswered posts in this forum
Calendar
Calendar
Tue 18 Jun 2013
Wed 19 Jun 2013
Thu 20 Jun 2013
Fri 21 Jun 2013
Sat 22 Jun 2013
Sun 23 Jun 2013
Mon 24 Jun 2013
Forum index
»
Meta
»
Puppetmaster Help
Use of "hacking" within a ARG
Post a reply
Username
Confirmation code
Subject
Subject description
Message icons
No icon
Message body
Emoticons
View more Emoticons
Font colour:
Default
Dark Red
Red
Orange
Brown
Yellow
Green
Olive
Cyan
Blue
Dark Blue
Indigo
Violet
White
Black
Font size:
Font size
Tiny
Small
Normal
Large
Huge
Close Tags
[quote="EmmanuelGoldstein"]It's entirely possible, given enough time, it would be trivially easy to write a program that sits on some port that emulates any kind of service you want, you could make it as real as you wanted, or as fake as you wanted.[/quote]
Options
HTML is
ON
BBCode
is
ON
Smilies are
ON
Disable HTML in this post
Disable BBCode in this post
Disable Smilies in this post
Forum index
»
Meta
»
Puppetmaster Help
Topic review
Page 1 of 2
[19 Posts]
Goto page:
1,
2
Next
Author
Message
Fliko
If you are wanting to use hacking with an ARG, and effective way to start is to create a
honeypot
on the webserver.
Of course you'd have to speak with the web host and get them to set up some of the stuff for you, or you could run the server yourself.
Then from there start to create the website inside of the honeypot, and make sure that there are security exploits in the website, but it would be
extremely
important to make sure the honeypot secure.
The only problem I see with this is attracting some group of elite hackers, or some script kiddies with some powerful tools.
Posted: Thu Aug 03, 2006 11:19 am
edge0fmadness
one of the things I've done with the game I'm running was to set up protected folders on my server - through 1and1.com they allow you to set up the user name/password through an .htaccess file (can be done on any server, but 1and1.com makes the file for you). Then the players were led to the folder, later they were fed tidbits here and there about the password and login. This allowed them "access" to a secure area without putting them in a position where they would be port scanning, etc.
Posted: Wed Jul 12, 2006 5:55 am
MageSteff
Wandering Scribble wrote:
Hm. You're right. That, I suppose, should be a main concern if someone should try this. But I think it'd be interesting to at least see an attempt, no?
It might. I'm sorry, but I am having trouble getting past a couple of issues.
In addition to the player issues I have stated I have issues from the PM side of things as well.
While I would like to see a PM (or group of PMs) who have the experience and the technical skills try this, I am really afraid that a less experienced PM may take this up without understanding all the possible problems that could arrise from it if it is not implemented with a great deal of care - simply because I know the skills of some members of this community are far far better than my own.
Yes, I know that means "Well then Steff, you don't run a game like that."
But I am afraid that a less experienced PM will use the "hack the character computer" as an easy out and not cover the security issues involved, nor support that aspect of the game as much as it should be (OK my personal fear again I know).
Would it be interesting? For me, only if there is supported story line based reason and not just "because the PM thought it would be neat." Just as I don't think you should put a puzzle in an ARG without the puzzle fitting the storyline in some way for some reason.
Posted: Sun May 07, 2006 4:47 pm
Wandering Scribble
Interesting points, MageSteff. I'll try to reply to each of them in turn.
MageSteff wrote:
1. How to place the players in the "white hat" group?
Well, I suppose this would vary from game to game, but here's one hypothetical situation (apologies if this seems a bit cliched, I'm not in the speculative mindset at the moment): A character has been running a website on a remote server, one that the character and players regularly access. However, an artificial intelligence program has hacked the server and gained control, changing passwords, removing scripts, etc. Now, since the character can't physically reboot the server or anything since he happens to be in hiding (this also being the reason why he can't contact the authorities or his sysadmin), he needs the players to help him regain access to the server, kick out the AI, and possibly do some clue-hunting in the server logs, etc. after they have regained access.
MageSteff wrote:
2. I think we need a definition for Brute force. To me it has meant "not solving the puzzle in the manner intended" running dictionary scripts and not doing the work directly.
Oh, ok. I don't really know the ARG lingo, but I would say that "not solving the puzzle in the manner intended" is not the meaning generally applied to the term outside of the ARG community. In my experience from outside of ARGs (information security, cryptology), brute force means trying every possible solution to a given query in order to determine the single correct solution. This is why the term is applied to dictionary scripts - they run through set lists of character combinations, or "dictionaries", in order to eventually reach the right combination. It's also used in cryptology, because pretty much every encryption system in common use today (with the sole exception of one-time pad encryption, which is the only theoretically uncrackable system) can be broken by brute force, with the only factor being computing power and time. I would timidly suggest that perhaps a new term be applied to the whole "not solving the puzzle the right way" concept; I, for one, suggest the term "cheating".
MageSteff wrote:
We still come back to the fact of teaching the players it is OK to attack a server. Players who have been in the community for a while would know the difference, but I am still afraid of teaching newer players that hacking is an acceptible way to solve puzzles when it isn't.
Hm. You're right. That, I suppose, should be a main concern if someone should try this. But I think it'd be interesting to at least see an attempt, no?
Posted: Sun May 07, 2006 3:25 pm
MageSteff
Wandering Scribble wrote:
Very true. One site of note is
http://www.hackthissite.org/
. This is a site designed to assist developing white-hat hackers' knowledge bases, skills, and moral standards.
....
I notice that as soon as the topic moves to hacking, people start grumbling about dictionary attacks and brute force. Hacking != brute forcing, folks! In fact, one of the no-nos in higher-level hacking is attempting a brute force of a site, because it will give away the hacking attempt and most likely the hacker too.
Since we don't want to encourage the appearance of illegal activity i.e. black hats the questions become:
1. How to place the players in the "white hat" group? Do we have a character "hire" them as security experts to test a site?
2. I think we need a definition for Brute force. To me it has meant "not solving the puzzle in the manner intended" running dictionary scripts and not doing the work directly. Time to start a discussion over in the meta section I guess.
We still come back to the fact of teaching the players it is OK to attack a server. Players who have been in the community for a while would know the difference, but I am still afraid of teaching newer players that hacking is an acceptible way to solve puzzles when it isn't.
Posted: Sun May 07, 2006 2:03 pm
Wandering Scribble
Ciaran_H wrote:
That's what *should* be the case, but it sometimes isn't.
Ok, I wasn't going to mention that, but yes, you're right, it's not always the case. In fact, I could mention some pretty ugly examples of big-time corporations or even government agencies not securing their own websites and/or servers. I suppose what I meant was that generally, one should consider what types of hacking should be allowed and what shouldn't in order to not break suspension of disbelief. I mean, wouldn't people think it's pretty unbelievable that some high-tech, conspiracy-perpetuating, super-secret society would not even take a few basic precautions to ensure their websites and/or servers remain secure? It could happen, I suppose.
I merely wanted to stress that the hacking would be just one more challenge to the players, while the immersion that came as a result would be more important. Whatever the players are willing to accept, that's good enough for me.
Posted: Sun May 07, 2006 12:11 pm
Ciaran_H
Wandering Scribble wrote:
A very basic security mistake, like storing a password in a plaintext file out in the open, would only be made by an amateur coder and not by all-knowing artificial entities or large corporations.
I wouldn't be too sure about that. That's what *should* be the case, but it sometimes isn't.
Posted: Sun May 07, 2006 11:48 am
Wandering Scribble
EmmanuelGoldstein wrote:
It's entirely possible, given enough time, it would be trivially easy to write a program that sits on some port that emulates any kind of service you want, you could make it as real as you wanted, or as fake as you wanted.
Very true. One site of note is
http://www.hackthissite.org/
. This is a site designed to assist developing white-hat hackers' knowledge bases, skills, and moral standards. Every challenge presented on the site is basically an emulation of a real site. Using real attempts to hack the sites will yield the same kind of results that one would normally expect from a real, unprotected site, except that in this case, the results are spit back by scripts that give the responses based on the exact input the hacker gave while attempting a hack.
I notice that as soon as the topic moves to hacking, people start grumbling about dictionary attacks and brute force. Hacking != brute forcing, folks! In fact, one of the no-nos in higher-level hacking is attempting a brute force of a site, because it will give away the hacking attempt and most likely the hacker too. From a practical point of view, most knowledgeable sysadmins will notice a huge deluge of queries or connections to a server and realize that it is an attack on the system. They will then call the authorities and/or track the hacker down on their own. So in the interest of immersive reality, one could say that brute forcing is out of the question simply because it would alert the bad guys to the fact that you are, in fact, trying to hack their site and take whatever action they feel is necessary.
Here's an idea: create a site with a customized PHP login script. Allow attempts to perform sql injections, but code in specific responses to a certain injection type to spit out a mirror of the output one would expect from the attack on a real site. It's simple, it's secure, and it's a neat way of expanding immersiveness.
On a side note, one should be aware of the fact that hacking, like everything else in an ARG, should make sense given the situation. A very basic security mistake, like storing a password in a plaintext file out in the open, would only be made by an amateur coder and not by all-knowing artificial entities or large corporations.
Posted: Sun May 07, 2006 11:03 am
EmmanuelGoldstein
It's entirely possible, given enough time, it would be trivially easy to write a program that sits on some port that emulates any kind of service you want, you could make it as real as you wanted, or as fake as you wanted.
Posted: Thu Apr 13, 2006 10:05 am
MageSteff
tjray wrote:
I am just starting to think about becoming a PM and I have thought about this too.
If a hacking angle were introduced into a game, would it be too "cheesy" to provide (via hints) access to a hacking "tool" (i.e.:.exe file, Flash, or ActiveX, local security aside) that I developed for the game? The "tool" could give the illusion of hacking without actually having the player perform any real hacking. It could be created in such a way that less techno-saavy people could perform the "hack" and participate in the game as well.
Just chewing on ideas and looking for feedback.
Thanks
-TJ
It's a question of feel and realism. For the tech savvy, it wouldn't be real, which they would tell other players. It would be a nice visual, but would it break the suspension of disbelief in the "realism" of your game? And is that something you are willing to sacrifice?
Call me gun-shy, but I would hate to encourage players of any game to basically use brute force as a storytelling tool. You can never be sure which ones are the new players who don't understand the "usual" conventions about not using brute force (port scans, dictionary attacts) - they might take them to the next game without checking that it is part of that games play style.
Re: Nik_Doof's original question:
My personal opinion (worth whatever you are willing to donate for it) the community in general has been about finding ways other than "brute force" to solve a problem. That resorting to Brute Force is a "coward's way" to get a solution.
Now if you were putting in play information that tells the players that there is an open port - that they should be LOOKING for an open port in a specific place - that isn't really brutung, that is players making use of in game information. The difference being - the players now have a reason to be looking there and not just randomly attacking your servers. I think the community will make sure that in those situations the newer players know that they can only ping that port because the Characters said it would be open and not because they can just go hit a server because they feel like it. If you decide to have an open port... I sure hope you make the players bend over backwards first to get that info...
Now if you go and tell them they will need to launch a dictionary attact against you... I'll give you a wet noodle for stupid PM tricks and have your photo plastered over the beer bottles at the Chat room bar as an example of what not to do....
Posted: Tue Apr 11, 2006 12:09 pm
Nova Loop
I am just starting to think about becoming a PM and I have thought about this too.
If a hacking angle were introduced into a game, would it be too "cheesy" to provide (via hints) access to a hacking "tool" (i.e.:.exe file, Flash, or ActiveX, local security aside) that I developed for the game? The "tool" could give the illusion of hacking without actually having the player perform any real hacking. It could be created in such a way that less techno-saavy people could perform the "hack" and participate in the game as well.
Just chewing on ideas and looking for feedback.
Thanks
-TJ
Posted: Tue Apr 11, 2006 9:51 am
Alex Smith
Re: Use of "hacking" within a ARG
Nik_Doof wrote:
I've come across an interesting idea...
I was sat trying to devise better ways of interaction, more things players can do than the normal search a site for URLs, checking emails, IMs etc... and i thought: wouldnt it be good for players to actually "hack" a server. Obviously it wouldnt be securied up to the teeth, and possibly a handy hint would point them to where they have to go.
I know already we've got alot of eager beavers who telnet and ftp to every site in-game in the chance its actually in-game....so would you think this concept would drop quite easily into existing gameplay or would you have to point it out in broad daylight.
It'd work extremely well, if it was mocked up accurately, and could be executed effectively. Unfortunately, it's another one of those brilliant ideas that is nigh-on impossible.
Posted: Mon Apr 10, 2006 6:14 pm
GuyP
A site that might interest you is:
http://try2hack.nl/
[/url]
Posted: Thu Oct 06, 2005 11:16 pm
Nik_Doof
Now that is what i suspected....
I dont like the idea that players will adopt the "hack" angle against other ARGs, i'd be responsible for making brute-forcing the server acceptable
As for the port scanning, i guess boundries will be enforced in that, maybe a little script that gives the play a slap in the term of a firewall rule to drop traffic from there ip if they step out of line
(of course mapped into the plot)
Also with regards of security, it would of been setup more as a server just for the purpose of that. Having a hacking angle and having your websites hosted on the same box would be silly, unless you want them to find and enable the website
I'm going to be playing more with this idea, as it might be a nice little nugget of gameplay to throw into the mix.
Thanks for the input guys!
Posted: Thu Oct 06, 2005 3:43 am
jefftheworld
The problem is people will start using that to solve everything...you would have to use multiple sites/servers so that they wouldn't get everything at once.
Posted: Wed Oct 05, 2005 9:15 pm
Page 1 of 2
[19 Posts]
Goto page:
1,
2
Next
Back to top
Like this site and want to support it?
Powered by
phpBB
© 2001, 2005 phpBB Group