In the midst of all this one wonders how it could happen, and not be real obvious. As a Job I had
in the past required me to check our SQL Servers for known flaws such as SQL Injection (depending the SQL Database type) I would drag out my Laptop with my sniffer and plug it into the network.
Then I would open an instance to the SQL Server (such as in this case Plarium). The sniffer
would record all the traffic between the Server and the workstation. It I can clearly see the Code
of the game which is down loaded and the other information in the cookies. It also tells me what
type of Database is being used. Now that I am connected to the SQL server I open another tool and select SQL Queries for known issues... and start running them.
What follows is very simplistic. The hours of work and SQL queries used would be volumes’.
I get a report as each succeeds or fails. The ones that succeed can be used to open a doorway to the
server which unless the Admin is sharp looking logs it might be overlooked.
Next knowing how to get into the server, I look for the target I want.
The Best Fruit is rubies.
with Rubies I can buy anything.
Now we take the same workstation and start recording a session to go get rubies.. All I need is 1 ruby. As that is complete I examine each step of the process, including the number and types of troops I have to complete the process.
Next given there are according to what is displayed a certain number of rubies to be harvested at each ruby mine.
So now to construct the SQL Query to connect to the ruby mine with X amount of troops with Credentials of where to send the rubies.
So a machine is used to log into the game and the SQL engine send the query which fails and then adds the injection that X amount of troops just land on ruby mine xxxxx and this is where to send when full…
This would be very hard to spot other than maybe a small error in the SQL Logs where there are so many transactions happening every second. even though the player only logged in everything would appear normal except he send no troops to the mine... the Server only thinks he did and returns the rubies to the right place in the right Database. So now I only need to know where the ruby mines are.
So a question might be asked what could one do with unlimited rubies. One could go start killing
Prizes gain new ships and buying lost ones back. In a short time you would have a very powerful fleet. It would appear to be legit, but a lot of work.
If I get tired of having to sit there I work on my SQL Queries to connect to the Ruby mines
part of that database saying I have had this many ships there for this many hours and issue a
recall query.. they move to the users database. over time I know the exact regeneration of the
ruby mines and speed things up. Then I can collect even more rubies appearing to be legit.
Now if I have unlimited rubies what can I do to escalate my position. I can try to connect to the
Prize database saying that I sent X amount of troops at the prize. Return what is left and what is
won to this user. This could potentially bypass the transaction where the troops are actually put
in the hold status waiting for the battle. Oh it becomes a troop doubler. I lost nothing of what was in my account but gained all these extras... Now use free rubies to buy back what was sent to be redeemed.
Utube is full of videos with successful exploits for various things. It is known that it can be
done. How would you catch someone doing this... One way would be to look at the top Mission
Holders. and how consistently they stay there.
What this boils down to the SQL Admin needs to know what "holes" there are in his/her database server and how to close them. The Game Code needs to insure there are equal transactions that can be traced if not throw a BIG Flag for the Admin.
Every Legit Security Engineer gets training on how to be as smart as the Black Hat.
OK Q Whats the red button do?
Any chance we can have that in basic layman's language, for us no computer software engineers please.
Regards
(Post)
Wait :) 
