The term “Network Ownership” has most likely popped up once or twice but let me give a brief explanation to the people who haven’t encountered it just yet.
Every non-anchored basepart are physically simulated, and there are TONS of different states they can assume. To lessen the strain on the server, the roblox engine will automatically assign parts to either the server or to a client. Unless YOU re-assign the network ownership for a specific part, a physically simulated part will generally be assigned to the client that is the closest to it.
My concern/question:
After reading a few articles on exploits and from my interpretation, it appears that the client has control over everything occurring in the client, so if a part were to have its network ownership set to the client, the client will full control over this. The character which has its components unanchored will now fall into the hands of the player completely.
Would the client have ownership of the whole character model, as well as things that aren’t physically simulated such as values, humanoids and etc? This sounds like an invitation to a lot of different exploits
Jokes aside, they use the old form of physics replication that is more Client Authoritative (client has more control) than more common physics models in modern games.
The only way to prevent this is to use Server Authoritative processes such as Client Prediction, which involves the client sending inputs ONLY to the server, and the server syncing / correcting physics between all clients while each client simulates their own physics locally.
Think of it like driving a car, but instead of you controlling the car, its you telling someone to control the car, and after they hear it, they drive the car and you can see the results after they perform the maneuver.
With Roblox’s model however, you control the car, but if you really wanted to, you could choose to just toss the car into the sky or clip it through objects or just teleport the car literally anywhere you want.
This itself is a very complicated process that is discussed in more academic articles and I briefly mentioned it on this thread.
This still doesn’t prevent exploits though. The closest you can get to an exploit-free game is one where you literally just watch something happen like some sort of livestream. Keep in mind that client is on somebody’s computer. A computer that has memory and storage both in RAM and on some sort of drive. Anything on that computer can be manipulated, whether it be program files, a currently running program, or even something odd like how a program might access or manipulate files. The further trust you give to the client, the more freedom the client has and also the more exploitable.
Obviously the only thing that they can manipulate is physics (which is the whole entire point of NetworkOwnership), so if they change WalkSpeed, they will fling across the map at 999 miles per hour but the server sees that they are still supposed to be going 16 studs per second.
HOWEVER, this does not mean that RemoteEvents and RemoteFunctions are secure. They can be watched and local scripts can be ripped or dissected in order to secretly manage, use, or abuse these Instances. If you don’t properly secure or sanity check your Remotes, it can result in the enabling of a wider variety of exploits, and allow possible entry points into things you never expected it to be able to do or access.
example
-- quantity item
BuyItem:FireServer(-999999999999999999999999, Asset.CoolShirt)
-- NaN
BuyItem:FireServer(0/0, Asset.CoolShirt)
Wow okay, I didn’t know about the second one.
Although I am confused what the first one could possibly do?
If I just do
OnServerEvent(parameter)
if parameter >= amount then
this should be all safe to go, right?
What I am most concerned about is reading this guy’s post
Why the need for Script Obfuscation? How well can an exploiter read the code?
If a module is put in an client’s environment, would this be displayed for the exploiter as well?
Script obfuscation and other “trickery” almost always makes code run slower but 100% makes code less maintainable and harder to read. I honestly think this is all a waste of time because all it does is slow exploiters down a bit, but it doesn’t take a rocket scientist to find patterns in code, and if they get ahold of the source code, it becomes really trivial. Worry the most about server side security because that is the only thing that can truly prevent most exploits and the server manages a lot of critical gameplay and data elements.
Remember that nothing on the client is safe and the motto is “never trust the client.” But how far you are willing to trust the client also changes how convoluted and secure your system is.
I really cannot give you a solid answer and also even though it is not stored in plaintext, the code has to be stored somewhere so it can run and the values and variables used within it as well so regardless of what you do the client always has access to everything on itself, but doing other things just makes it harder to find everything.
It’s like making a huge, like gigantic, shelf with books and magazines and games and records and tapes and…, and having an organized shelf vs a disorganized shelf. It’s a lot harder to find things when they’re not organized (and it’s slower to use the shelf overall), but they’re still there. The contents of the shelf don’t just vanish into thin air no matter how you organize it or how much random garbage you toss onto it.
A simple example is i could have an array that stores strings containing item information. Literally any runtime memory watching program can search for that string of text and manipulate it into whatever it pleases as long as it has enough space to do so (or they figure out where the pointer to that data is stored). Here are some examples.
If you want an age old example, this is a video of an old jump hack that was long patched so it is practically now educational content.
This worked by overwriting a script that disabled jumping on the character.
Here’s one hacking money before FilteringEnabled existed!
This worked by overwriting the value of some internal money variable.
advisory: please do not use or trust exploits ever
Hopefully this helps shed some light on what exploits do, where they exist, and how they can be combatted, but do note that again, unless the client has absolutely no control, there will always be a way to use exploits. It is always a good idea to secure your games, but you do not need to go too far because it gets needlessly complicated and at times even unnecessary.
