Fake scores in Google Play Game Services

Question

Some of the scoreboards have been receiving fake score submissions. Here is an example:

The same thing happened to a game I've made. Is there a way to protect one self from fake submissions and is there a way of moderating the scoreboards?

Answer 1

The most simple (and popular?) way users fake high scores is by using root access to edit saved data.

Few simple steps you can take in order to make it harder:

1. Don't hold the score as is in the memory or on saved state. For example multiple/divide by a factor & add a constant. Even better option is to implement an encrypted shared preference.
2. Add a check-sum to the structure holding the score (CRC32, MD5).
3. Validate the score to check no one played with it when loading from saved state or reading/writing in the memory.
4. Use ProGaurd to obfuscate your code. If you're making money use DexGuard which is much stronger and will also make software piracy harder.