Way back in 2006, I reverse engineered the protocol used between isc.ro and its desktop client so that I could write my own GUI. It was just a fun side project.
In the process I discovered all sorts of vulnerabilities (potential cheating vectors). Nothing prevented a malicious client from:
- picking your own tiles (even if they no longer exist in the bag)
- seeing your opponent's tiles
- setting your clock to any value after making a move
- aborting a game at any time without opponent approval
If you exchanged tiles, the number of tiles you exchanged was sent through the # of seconds on your clock. So if you exchanged 3 tiles at a point where you had 1m40s on your clock, it would change to 1m43s or 1m33s or something like that! There was no other way to communicate to the server how many tiles you exchanged.
I never took advantage of any of this. Like I said, I just wanted a nicer GUI to play Scrabble on. But I was pretty shocked at what I discovered in the process.
https://www.michaelfogleman.com/projects/word-warrior/
In the process I discovered all sorts of vulnerabilities (potential cheating vectors). Nothing prevented a malicious client from:
- picking your own tiles (even if they no longer exist in the bag)
- seeing your opponent's tiles
- setting your clock to any value after making a move
- aborting a game at any time without opponent approval
If you exchanged tiles, the number of tiles you exchanged was sent through the # of seconds on your clock. So if you exchanged 3 tiles at a point where you had 1m40s on your clock, it would change to 1m43s or 1m33s or something like that! There was no other way to communicate to the server how many tiles you exchanged.
I never took advantage of any of this. Like I said, I just wanted a nicer GUI to play Scrabble on. But I was pretty shocked at what I discovered in the process.
Not sure if anything has changed since then!