Service Piracy - Doppelganger, Ghost Servers, Emulators, and Private Servers

Sony's Playstation Network is rather different from Microsoft's Xbox Live in that games are tied to an account instead of a console. PSN players can install a game on up to five consoles. Clever users are "timesharing" games using a single purchase to install games on five consoles and share the game... basically buying a game for 1/5th the price.

Capcom has added a layer of "DRM" to its PSN game, Final Fight. This retro game requires players to login with the account of the person who purchased the game originally in order to play and in order to login, the player has to be connected to the PSN.

So, Capcom is requiring the same continuous connection that is getting Ubisoft in trouble, but on a console instead of a PC.

Account sharing may also be a problem for other online services like Steam.

J. Fletcher (2010), "PS3 Final Fight: Double Impact requires PSN connection", http://www.joystiq.com/2010/04/21/ps3-final-fight-double-impact-requires-psn-connection/

via

" Final Fight Brings Restrictive DRM To the PS3", http://games.slashdot.org/story/10/04/23/0536246/Final-Fight-Brings-Restrictive-DRM-To-the-PS3

"Capcom's Response on the Final Fight DRM", http://boards.ign.com/ps3_general_board/b8267/191330467/p1/

Nothing inspires thieves like success... and the sale of a Steam account for $1000 is certainly going to make the online service a more visible target.

There have already been incidents of account theft at Steam.

It will be interesting to see if Steam has to join other online services in moving toward using security tokens or if Valve takes other measures to improve account security.

O. Good (2010), "Steam Account Sells for $1,000 on eBay", http://kotaku.com/5449767/steam-account-sells-for-1000-on-ebay

There hasn't been too much news about Private Servers / Pirate Servers of late. In the US and Europe, the exist, but they are not really viable as businesses as they can be found and shut down quickly. In countries without a major domestic online gaming industry, but substantial Internet access, there is a growing issue with these pirate servers as commercial businesses. China has had a problem with private servers, but the growth of the domestic online game industry is likely to have a huge impact on private servers going further.

The big problem for MMOs in terms of piracy is that most of the value of the game is downloaded to the game client - virtually all of the game assets and much of the game's logic. There are three major ways to pirate MMOs:

1. Reuse art assets and develop your own game logic. The big cost in MMOs are art assets and mission content, most of which is pretty easily extracted from a game client.

2. Use the game client and reverse engineer the game server. Often not hard, again, as most of the game is on the client.

3. Get a copy of the game server as well as the client. This has happened a number of times because of disclosures or theft.

... all brought on by an article at BBC News.

I discuss this issue further in my book Protecting Games.



N. Ryan (2009), "The closed world of private game servers", http://news.bbc.co.uk/2/hi/technology/8393770.stm

Scott Jennings has written a high level overview of gold farming over at MMORPG.com. Nothing really new in the article: Developers REALLY don't like gold farmers, they don't do deals with RMT folks (though individual employees at game companies certainly have), they'd rather monetize players directly (Free to Play, item malls, official player sales, etc.), yes, some gold farmers are paying customers, others use trial accounts, stolen accounts, and stolen credit cards, gold farmers are a net cost to game companies....

I tend to disagree with the fact that MMO designers take these issues very seriously during design. There is just too much evidence to the contrary. Game mechanics in MMOs continue to be virtually optimized to encourage botting and gold farming. Simple mechanisms like restructuring game markets to work like a stock market instead of eBay would radically reduce the ability of gold farmers to covertly transfer assets. Games as click-fests are especially easy to bot.

Gold farmers are a known problem for aspiring MMO / online game / social game developers from Day Zero.

As a further interesting note, Scott has a job again (Congratulations, Scoot), helping NCSoft with its gold farmer and other game abuser problem in its new Game Surveillance Unit...

and, if you are in Austin, you may want to check out the job for a Game Surveillance Agent.

One oddity of the position is that private servers are included in the job... this is a very different problem. Shutting down these sites is a DMCA type task and techniques to stop the creation of private servers is an interesting and challenging engineering problem.

S. Jennings (2009), "Scott Jennings: Real Money, Real Problems", http://www.mmorpg.com/showFeature.cfm/loadFeature/3740/page/1

NCSoft (2009), "Game Surveillance Agent", http://tbe.taleo.net/NA5/ats/careers/requisition.jsp?org=NCSOFT&cws=1&rid=558

Piracy gets an awful lot of press in the games industry. Industry CEOs talk about it at great length.. yet there doesn't appear to be a lot of investment in actually avoiding piracy.

DRM companies have come and gone and come and gone.

Lawyers get the most visibility in the piracy fight... which is ...odd.

Also, in the increasingly online world we live in, there are different kinds of piracy and piracy problems.

The first and most obvious fact that is pretty clear is that there is NOT a one-to-one association between pirated game copies and lost game sales.

This is seen by game company investments in anti-piracy technology, if nothing else.

Even the most jaded individuals would accept that it looks like there are around 10 pirate copies of a game for each one sold.

If anti-piracy tech was even SLIGHTLY effective in converting these pirate miscreants to paying customers, everyone would be using DRM, no matter the public outcry.

Reflexive Software, in their article on the topic at Gamasutra, claimed that with MUCH better DRM, they were only seeing an increase of 1 sale per thousand copies pirated (over multiple versions of a single online game... a pretty good model in an area with a dearth of decent data and research).

Given piracy rates of 80 to 90 percent (which are pretty typical)... the potential additional revenue is modest... to reconcile these models:

Assume a 90 percent piracy rate, then if you sell 1 million copies, you have 9 million pirate copies. If we accept the 1 in 1000 additional sales, we are seeing:

1/1000 * 9 million or 9000 additional sales (with an 80 percent piracy rate, you would see only 4000 additional sales.... please check my math, its Monday).

If we wanted to have a "2 to 1" return on our anti-piracy investment, our anti-piracy budget would be our revenue on between 2000 and 4500 games (assuming our game sold a million copies).

The revenue per game can range between $2 to $50 depending on business model, so our anti-piracy product would be "worth" between $4,000 and $225,000.

Assuming the game sells 1 million copies.

If costs were allocated on a per-unit sold basis (which makes more sense given the nature of games industry sales), the anti-piracy "value" would be between $0.225 ($50 in revenue and 90 percent piracy) down to $0.004 per copy ($2 in revenue and 80 percent piracy).

Not a lot of room for anti-piracy benefits or for anti-piracy firms to be viable.

PLEASE NOTE: This is not the appropriate model for music or movies - for music, the simple fact of breaking albums up into singles has had a huge negative impact on revenues (after all, if you only want 1 to 3 songs per album and you can purchase them for a fraction of the price of the album, you win and the music industry loses a lot of sales).

This is not the only factor affecting game companies.

Beyond Retail

If you are providing an online service or customer support, there is an ongoing cost for each customer. However, the requirements for anti-piracy in this environment are different in that instead of preventing duplicates, you want to ensure that the people who are creating ongoing support costs DID purchase your product... something that can be solved by different techniques. A good example would be the problems that Stardock had with early piracy on Demi-god causing huge amounts of traffic for its online game servers. Thought the company's solution has not been described in detail, a key element was to distinguish between paying customers and pirates and make sure that pirates were not keeping paying customers from the service... the monthly cost of an additional online game server would completely reshape the cost/benefit discussion above.... the more active your online service, the more important it is to be able to detect pirates.

There are also other types of piracy. Private Servers / Pirate Servers can substantially undermine the revenue model of an online game and thus have a very different and negative impact on revenues.

Also, the emerging area of Games-On-Demand and services like Steam and Impulse create the possibility of Account Theft which can similarly have a more substantial impact on sales.

Its the Revenue, Stupid

There is a very human impulse involved when game developers and publishers get angry about piracy. However, it is also critical that they focus on their bottom line rather than their (understandable) anger.



R. Carroll (2008), "Casual Games and Piracy: The Truth", http://www.gamasutra.com/php-bin/news_index.php?story=17350

... and I have an entire Part of my book Protecting Games devoted to discussing piracy and anti-piracy.

Once upon a time, consoles were promised as a solution to piracy.

That is clearly no longer the case with both Nintendo and Sony stepping up their war of words with piracy in Asia and elsewhere and Activision's recent expansion of its anti-piracy legal team.

Tetsuhiko Yasuda, president of Sony Computer Entertainment Asia, recently warned countries in SE Asia to take a firm stand on copyright protection and, implicitly threatened to pull its support from a project to support training students on development for the PS3.

Sony and Nintendo have added direct digital distribution to the latest versions of their handheld consoles (the Sony PSPGo and DSi, respectively) clearly with an eye on piracy. As both products are quite new, it is unclear as to whether these digital distribution schemes will work.

OnLive and other games-on-demand services (by the way, when is someone going to team with TiVo on this) are looking at settop devices or new "mini-consoles" / game terminals in conjuntion with digital distribution to battle pirates.

If a game exists in a non-downloaded/non-protected format somewhere, is digital distribution an anti-piracy technique or just another channel?

Lawyers are going to be less and less effective in this fight as Moore's Law and simple economics puts more and more powerful PCs and network access in the hands of game players in countries without strong copyright protection who are neglected by the major game companies and a passion and desire to PLAY.

Online games are not immune to piracy. There are online pirate servers / private servers as well as an increasing problem with account sharing and account theft.

What should be critical for game developers and third party publishers is that anti-piracy protections and promises are aligned with actual business relationships. Currently, console developers feel the pain of piracy only rhetorically for third party games. The costs are largely born by third party developers and publishers.

P. Elliot (2009), "Yasuda-san issues piracy warning", http://www.gamesindustry.biz/articles/yasuda-san-issues-piracy-warning

Pirate servers / private servers are quite common in China (a topic I would love more information on... I suspect this situation is growing worldwide in developing nations as Internet access spreads). These individuals and companies have bought, stolen, or reverse-engineered the game servers for popular online games and operate them for a profit... selling subscriptions and items at a fraction of the cost of the legitimate MMO.

No Honor Among Thieves

A Chinese pirate server operator was having trouble with a competing private server business. So, to retaliate, he leased 81 servers for 280,000 Yuan (around $41,000... apparently, there is good money in pirated game servers!) to run a Denial of Service attack against his competitor.

His first attempt failed (poor hacker hiring... I hate when that happens), so he found a "more skilled" individual who targeted the DNS provider for his foe.

The DNS provider was rapidly overwhelmed by the excessive number of DNS requests and resulted in DNS queries being escalated to China Telecom's DNS servers causing Internet outages in 6 provinces.

The War Continues

The individuals involved were arrested, but the war continues:

Attacks between illegal game operators and other Internet businesses are fairly common in China, both in and outside of major cities, said a local security researcher. Online mercenaries who own servers or control networks of compromised PCs often sell attack services on private forums or chat clients, he said.

By the way, I discuss the Pirate Server problem (and potential solutions) in my book Protecting Games

O. Fletcher (2009), "China Game Boss Sniped Rivals, Took Down Internet", http://www.pcworld.com/businesscenter/article/171018/china_game_boss_sniped_rivals_took_down_internet.html

A very popular view among game developers is that MMOs are somehow immune to piracy. They argue that since the "game is on the server" pirates can't steal it.

... well... in practice, there seem to be 4 forms of MMO piracy:

1. Code theft - stealing the game's code (a problem shared with regular computer games, but aggravated by the need to have live servers with the game code present)
2. Reverse-Engineering - in practice, there is an awful lot of code on the client which makes it pretty easy to reverse engineer a server once you have access to the client software (which also may make it more difficult to prosecute these pirates... particularly for free-to-play games).
3. Game Asset Theft ... to be discussed further below
4. Account Theft - a growing problem for MMOs and, in particular, on-demand game services.

The economics of game development is driving more and more (and more) of the costs into art assets. Developing quality 3D art and animation is hard work and consumes a huge portion of the development costs for most new games. Game logic, AI, and such is a smaller and smaller portion of the game budget.

However, these art assets are downloaded with the game client and so are very vulnerable to duplication, reuse, and theft (depending on your perspective).

In other words, the expensive part of the game is still very vulnerable to piracy ... and the increasing power of game engines and other tools makes it easier for a pirate to capitalize on these assets.

... which leads us to a number of allegations at Massively about Evony and asset theft Civilization 4 and Age of Empires. Whether these allegations are true or not, the prospect of asset theft is a more and more serious problem as the costs of development rise and games spread globally.

I also discuss Server Piracy in Chapter 8 of my book Protecting Games.

C. Brennan (2009), "Comment spam, lewd advertising, and stolen assets abound for Evony", http://www.massively.com/2009/07/13/comment-spam-lewd-advertising-and-stolen-assets-abound-for-evo/

Hong Kong officials shut down and seized a set of servers after being tipped off that an unnamed online game was being operated illegally in the country. The site included 7 servers and 5 additional computers and the 34 year old man was arrested for copyright infringement.

The site attempted to make prosecution more difficult by locating its servers in Hong Kong but have its domain registered in the US.

The site had been operational for 7 months and had 30,000 registered players. It appears that the game used a free-to-play business model with prices much lower than for the legitimate game.

Private servers/pirate servers are an increasingly important problem with the globalization of online gaming. Criminals can locate their computers virtually anywhere and make their pursuit and prosecution much more difficult.

The choice of Hong Kong was probably not wise as China and Hong Kong are growing hubs of the online game industry and, as such, are concerned with protecting the integrity of the industry more than other countries.

Any tips as to which game this is would be welcome. I would guess it is a Korean MMO.

Liu D. (2009), "HK Detects 1st Case of Infringing Online Game Servers", http://english.cri.cn/6909/2009/06/25/1781s496631.htm

Sometimes free isn't good enough, apparently. After a long day at the Game Developers Conference, I returned home to a request here at PlayNoEvil for a source for a "Moshimonsters Private Server"... yep, someone wants a even free-er way to play this free-to-play game.

I did get a full, proper name and email address for this aspiring, courteous criminal.

I've been meaning to write a new article about pirate servers / pirate servers and would love some input. I should probably also write an article about the different security problems that Free-to-Play and Subscription games face...