[BUG REPORT] - uasset files not secured when packaged

So I just had a friend try out my game that released on Steam back in June 2017 and he’s discovered that he can access any of the files in the game and extract them which then gave him the ability to add any info he wanted to the online score board. I’ve already reached out to Epic Leaderboards about this security issue, but it’s also a risk on your end because if he wasn’t able to access the files to begin with then he wouldn’t have been able to do anything.

I was under the impression that once the files were packaged they were encrypted and inaccessible but this is obviously not the case. It’s rather disconcerting really.

you need to encrypt them i think, go to ur project settings and search encrypt and create a encryption key and then just check the stuff u want to encrypt [ there are checkboxes ]

As Jurrasic Studios said above, you need to encrypt your files via in the Engine. 4.19 added pak file signing and encryption. See Unreal Engine 4.19 Released! - Unreal Engine for more information. (search for encryption)

These features can now be controlled in Project Settings, under the Project section, in the Crypto panel.

https://dnnrz1gqa.blob.core.windows.net/portals/Images/Support/Builds/ReleaseNotes/4_19/image_34.png?sr=b&si=DNNFileManagerPolicy&sig=ajg1t85%2FW%2F%2FhSwN%2BtNZQ55szR5vobHgEHHD5omayuq0%3D