[BUG REPORT] - uasset files not secured when packaged
So I just had a friend try out my game that released on Steam back in June 2017 and he's discovered that he can access any of the files in the game and extract them which then gave him the ability to add any info he wanted to the online score board. I've already reached out to Epic Leaderboards about this security issue, but it's also a risk on your end because if he wasn't able to access the files to begin with then he wouldn't have been able to do anything.
I was under the impression that once the files were packaged they were encrypted and inaccessible but this is obviously not the case. It's rather disconcerting really.
asked Feb 10 '18 at 09:37 AM in Using UE4
you need to encrypt them i think, go to ur project settings and search encrypt and create a encryption key and then just check the stuff u want to encrypt [ there are checkboxes ]
answered Apr 22 '18 at 09:08 AM
As Jurrasic Studios said above, you need to encrypt your files via in the Engine. 4.19 added pak file signing and encryption. See https://www.unrealengine.com/en-US/blog/unreal-engine-4-19-released for more information. (search for encryption)
These features can now be controlled in Project Settings, under the Project section, in the Crypto panel.
Follow this question
Once you sign in you will be able to subscribe for any updates here