Its me again with my bizarre forum posts. This time I want to discuss a huge security flaw with construct's multiplayer object, and the potential damage that can follow if the security flaw isn't fixed.
We all know that multiplayer can be used to send messages across different devices. That's the entire premise of the feature. However, despite its primary use being to transmit data packages across different devices to synchronize player characters and other game instances, it can also be used with malicious intent.
Take for instance, a fake game sent to a client PC. Multiplayer connects, and the host PC can now send remote code execution to the client PC via "broadcasting multiplayer messages", which when paired up with construct's built-in Javascript feature (that can be used to execute commands on a computer and interact with it in many ways,) creates one hell of a malware program.
Multiplayer can then be paired with other features of construct, such as geolocation and camera, making for an even more dangerous tool. With the recent addition of file transfers to the Multiplayer instance, construct can, and most likely will if placed in the wrong hands, be used for malicious intent as a remote access trojan.
And the cherry on top is that construct programs are trusted software. Essentially, this means that no antivirus will flag or even suspect a construct-exported application to be malware.
I dont know how this was overlooked, but it is a big, BIG security flaw that can cause severe damage to not only individual client PC's, but to the trust and reputation of Scirra. Please, take this message from a game developer and penetration tester and fix the multiplayer security flaws.
Thank you.