Hello everyone,
so I have been reading up on getting UE4 to service some database implementations. The main thing I found interesting was that there are many posts about using SQL code in binaries as a security risk.
So I have a few questions I have not found specific answers to but first let me provide some context and environment information. I am working on a project where player stats are to be saved to an Amazon RDS server running MySQL. This data will be used for tracking purposes in addition to other stuff such as trend analytics and the like. For the moment we would not have many players as we are still in the testing but we expect to eventually have many players playing at once.
This will be a sort of strange project setup. There will be a connection from the game, which will be played locally, to our database which will update after set periods of time. We don’t anticipate moving this to an mmo-like structure with certain aspects being hosted on a server somewhere; all local to the player’s computer except for this MySQL piece.
So, now the questions.
I had read that if you write local connection code that it can be pulled from the binaries? Is this true or would there be certain other programs involved? Is there a way this could be mitigated, say having a login screen within the game that uses a POST or REST call to “log in” to the game this way only those with actual accounts with us would be able to access the parts where it may be possible to sniff the connections to the database? We will have tight control over who is playing the game and we don’t expect our players to have the technological sophistication or ability to do something like that.
If somehow Unreal writes this information to a plain file somewhere, where the user can see it we would need to know that. We plan to do everything within some custom C++ classes with no connection information stored outside of the game or in any blueprints.
What are the potential secondary impacts to putting SQL command calls into code? For example, does UE4 expose the calls to injection even when using parameterized queries? What about if the statements were scrubbed before hand in addition to being parameterized?
Is it possible to modify variables from the console in-game?
Are there any other things we should be aware of? We don’t really care if it is not “standard practice” if there are ways we can mitigate some of the potential risk both through various in-code techniques and the way in which users will be able to access the game.
We want to avoid using php intermediary files at all costs for as much of our game as possible, we tried this approach in a much earlier version of our game using a different platform and found not only is it too slow but also would be too costly in time and money to implement for our game given the scale of what we are doing.
Given some of what I have read, we may need to consider separating the sensitive information that our database will hold and the rest which will normally be interacted with from the game; this would make more sense if we had a REST/POST call for logging in to that section of the database so if there was an intrusion all they would find is data that would be relatively worthless to them and modification of the data would not result in much of an impact. The two databases would not interact with each other within the game and we won’t have any kind of real-money purchases so the data in the non-sensitive database is not too important generally.
I have searched for a while for some specific on the questions above but I was not able to find enough information to answer these questions to my liking.
Thanks.
