Cloud-Based Gaming: A Game Changer For Security?

Published in

Anybrain

8 min readJan 7, 2021

A study of cloud-based gaming security and its risks

Well… more or less! First, let’s understand what cloud gaming is, and then we’re going to take a look at its security and risks.

What is cloud gaming?

A consensual and generic definition of what cloud gaming is —

Cloud gaming, sometimes called gaming on demand or gaming-as-a-service, is a type of online gaming that runs video games on remote servers and streams them directly to a user’s device, or, more colloquially, playing a game remotely from a cloud. It contrasts with traditional means of gaming, wherein a game runs locally on a user’s video game console, personal computer, or mobile device. [source]

Normally, you’d put a CD into your computer or console, or download a game to your drive. The game runs smoothly enough and looks great because you need the necessary computing power to make it happen.

With cloud gaming, you are playing games via a remote server instead of a local machine. You stream games, just like you’d stream a Netflix video, the difference is that cloud gaming relies on the user sending inputs back to the cloud server while receiving video and audio simultaneously. Every time you press a button for your character to do an action, that input gets sent to a remote server, tells the game what you’ve done, and sends you a new video frame that shows you the result.

This project seemed too ambitious a few years ago. Latency, low bandwidth, and a few other things could already make that difficult for someone playing on a local machine, let alone streaming it themselves. But it seems like these companies are all-in on eliminating those issues, so playing games via the cloud can already be a good experience and one as good as playing on a local machine like a console, computer, or smartphone. Cloud gaming requires significant infrastructure for the services to work, including servers for running the games, and high bandwidth internet connections with low latency for delivering the stream to the users.

So what’s the current state of cloud gaming? In this article, I will not focus on this, not even specify each service and their features or pricing, because it is not the point, but I will still give you a quick overview of this already crowded space:

Google Stadia
Nvidia GeForce NOW
xCloud -Xbox Game Pass Ultimate
Amazon Luna
Shadow PC
Maximum Settings
Blacknut Cloud Gaming

These are not all the services that are available today, but these are what I considered the most popular and most relevant cloud gaming platforms at the moment.

Cloud-based gaming is here to stay

Cloud computing provides new opportunities to the gaming industry and can solve some of its issues as well. The level of security when playing through a cloud-based platform prevents external interruptions such as hacking or bypassing the client. On those platforms, the information is stored inside of a virtual space which makes it less exposed and open compared to traditional game client-server architecture.

Here’s a list of some benefits:

security — traditional bypass of the game client, interrupting, or hacking will be harder as the game data is not stored in a local machine.
privacy — your information is protected by industry standards (so little opportunity for hackers).
reduced costs — the cloud-based systems follow a “pay as you go” in which companies pay only for what they use.
game support — if your computer breaks, you won’t lose the game progress. Cloud gaming also eliminates the need to install games and content updates.
devices of any type — allows users to play high-end games on low-end machines, so you can experience excellent quality even with a cheap laptop.
easy access to multiple games — users can play multiple games and switch between them easily.
reduce chances of piracy — without physical gaming software copies, piracy is much harder, so the cloud reduces the chances of unauthorized manipulation.
any game, any device, at any location — cloud gaming supports the use of multiple devices such as smartphones, laptops, desktops, etc. The users can play from anywhere in the world without even carrying a console.

In summary: a lot of benefits, more security, but, of course, there are also a few threats that we need to talk about. The most obvious and the most popular threat to the cloud-based gaming industry is the distributed denial of service (DDoS) attack. The user account and saved games are stored in the cloud. So with the service down, it would be impossible to play any game. These attacks are executed directly to the game servers. However, they can also be the target along with the entire gaming platform and cause serious damage. They could also take the entire system offline, denying access to authentications on cloud-based accounts and saved games, for example. The good news is there are several DDoS mitigation methods available for cloud-based game servers that studios can put in place to prevent these types of attacks.

Traditional online multiplayer games always rely on a balance between a server and a client application. With cloud-based games architectures, it uses a server-side application that takes away control from the user and minimizes exploits options for hackers and cheaters. So regarding the question in this section, the answer is — yes, absolutely yes — cloud-based gaming is a lot more secure against “bad actors” because it is a lot more difficult to exploit and manage game data.

Is a cloud-based game bulletproof against cheaters and hackers?

These “bad actors” are most common on the PC platforms — and are a big issue for game developers and game studios. Cheaters can destroy the success of a multiplayer game in various ways: changing skills, using scripting hacks, wallhack, obtain infinity or unlimited money, health, ammo, achievements, etc.

This leads to a lesser number of active players in a game, a toxic community, and, in the end, an obvious impact on sales. Statistica estimates that, by 2023, there will be 3.07 billion active gamers worldwide. So, with millions of dollars at stake, hackers and cheaters’ exploits can have even more devastating effects and completely prevent the success of a game, while erasing so many years and effort in development. A not-so-new phenomenon that studios shouldn’t take lightly.

Cloud computing has solved many problems experienced by gamers and publishers but…

Are we there yet?

In my opinion, no, and I will explain why. It is still possible to cheat in a cloud-based game, not in the same way as the traditional approach (bypassing the game client, using code injection, memory changes, etc), but it is possible. Here are some examples.

Scripting — is a technique that allows the cheating player to automate certain tasks, or to perform them with unnatural velocity, artificially increasing the player’s performance. These techniques are generally implemented using specific software or by exploiting features of the game (e.g. assigning the fire action to the scroll of the mouse to fire at much faster rates). One such example is the automatic reloading of a gun when certain conditions are met or rapid-fire actions.
Boosting (you can check here the impact in your video game) — or stat-padding is a method through which a player will use multiple accounts and play one against the other, with the main goal to boost (i.e. significantly improve) the player’s standing in tournament rankings and league tables to allow participation in more valuable competitions and get more sponsorship money. This can also be carried out by multiple players, in which one or several players agree to allow the cheating player to win, allowing her/him to artificially improve their personal best number of points.

A few days ago I watched a video explaining how to use TensorFlow (open source machine learning platform) to analyze the video frames inside a game window (the game was CS: GO) to detect objects — the goal was to find the center of rectangles on the enemies, move the mouse to the center and shoot them. For those unfamiliar with it, this is Aimbot cheat, as simple as that! I was very surprised by the final result, an efficient cheat without too many lines of code.

Of course, this video was captured on a normal PC game. But with a similar approach, you could very easily hack a cloud-based title, as you don’t even need to bypass the game. It would work perfectly and be very difficult to catch.

The hackers’ creativity is limitless and they will always find new ways to cheat in a cloud-based game. This was just one example.

How can we fight them?

Anybrain: Security, Privacy and Integrity

Cheating in games goes back for decades, the main difference now is that the online, cloud-based gaming infrastructures have significantly increased the scale and impact. As a result, cloud gaming companies should actively scan for vulnerabilities that could be exploited by cheaters as well as suspicious user activity that could indicate cheating.

Traditional and well-known anti-cheats in the market currently use strategies to prevent mostly a bypass into the game, looking for suspicious malware running in your machine, memory-poking attacks, code injection, network traffic forgery, etc., working very similar to an anti-virus.

Many anti-cheating controls have been put in place, some more effective than others. But that approach makes no sense for cloud-based games because the local machine is receiving only a stream and the game itself is miles and miles away. One efficient way to catch these cheaters is analyzing behavioral biometrics, telemetry, or in-game data statistics and trying to detect anomalies for the user’s behavior and identify that as a type of cheat.