Alberto Guerra González

Bots detected · navigation compromised

Bots, Fraud, and the Business of Breaking Games

In the world of online gaming, risk looks very different from banking or e-commerce.

Players expect frictionless fun, not identity verifications. However, behind every login, there is a real-money trading economy, automation, and account theft that feeds a massive underground market.

This talk explores how different online attackers profit from video games—from bot farms and AI-driven automation to resale networks and phishing campaigns—and why the gaming environment represents a high-profit, low-legal-risk target.

We will also analyze how studios respond through risk-based authentication, behavioral defenses, and a constant balance between security and player experience.

Through real-world examples and interactive “think like both sides” exercises, attendees will understand how defenders and attackers adapt in a continuous cat-and-mouse dynamic.

The talk concludes with practical advice:

  • Protecting your account
  • Detecting phishing
  • Monitoring credential leaks
  • Participating in programs like Riot’s Bug Bounty.

Both students and professionals will leave with a clear vision of how business realities shape security decisions.

For students looking to dive deeper into the world of game security, here are some curated resources:

Defense

References (Talks, Blogs & Papers)

Tools

  • UltimateAntiCheat: A usermode anti-cheat system built in C++ designed to detect common attack vectors like debugging, memory editing, and code injection.
  • Open Anti Cheat System (OACS): A machine learning framework in Python for developing server-side anti-cheat systems, focusing on anomaly detection.
  • Little-Anti-Cheat: A popular open-source anti-cheat for Source Engine games (TF2, CS:GO) that runs on SourceMod.
  • javascript-obfuscator (Obfuscator.io): The most widely used open-source tool for JavaScript protection, featuring control flow flattening, string array encoding, and dead code injection.
  • JS-Confuser: A powerful open-source obfuscator known for its aggressive transformations and ability to make code highly resilient to static analysis.
  • Google Closure Compiler: A tool for making JavaScript download and run faster, often used in “Advanced Mode” for obfuscation.
  • FingerprintJS: FingerprintJS is an open-source, client-side, browser fingerprinting library that queries browser attributes and computes a hashed visitor identifier from them.
  • 2FA Directory (Two Factor Auth): A community-driven list of websites and whether or not they support 2FA, essential for protecting accounts.

Attack

References (Talks & Blogs)

Tools

  • Strix: An open-source AI penetration testing agent (“AI Hacker”) that uses LLMs to autonomously identify, exploit, and validate security vulnerabilities.
  • RecaptchaV2-IA-Solver: An open-source project using the YOLOv8x object detection model to solve Google reCAPTCHA v2 challenges.
  • JS Deobfuscator (UglifyJS): While UglifyJS is for minification, its ast parsing is foundational for building deobfuscators.
  • restringer: A JavaScript deobfuscation tool that reconstructs strings and simplifies complex logic.
  • CyberChef: The “Cyber Swiss Army Knife”—essential for multi-stage deobfuscation, decoding Base64, and reversing hex/char encoding.
  • Synchrony: A deobfuscator for modern, heavily obfuscated JavaScript (like that produced by JScrambler or Obfuscator.io).
  • SeleniumBase: A powerful Python framework for browser automation, end-to-end testing, and web scraping with built-in features to bypass bot detection.
  • Scrapling: An adaptive web scraping framework that uses an intelligent parser to handle website changes and bypass anti-bot systems like Cloudflare Turnstile.
  • Browser Use: An open-source Python library that allows LLM-powered AI agents to autonomously control a web browser using natural language.
  • Crawl4ai: An AI-friendly web crawling framework optimized for LLMs and RAG pipelines, transforming web content into clean Markdown or JSON.
  • Browserless (Open Source): A self-hosted headless browser-as-a-service providing managed Chrome instances for high-scale scraping, automated PDF generation, and E2E testing.
  • httpcloak: A Go-based HTTP client that mimics the TLS and HTTP/2 fingerprints of modern browsers to make automated traffic indistinguishable from real users.
  • Camoufox: A custom, stealthy Firefox-based browser engine designed to achieve high stealth scores against modern bot detectors.