In gaming security, a “risk environment” is any setup that runs independently of the original device or that compromises the device’s native system. The usual suspects: cloud phones, virtual machines, virtual frameworks, jailbroken iOS devices, and rooted Android devices.
These environments hand cheaters and crackers the elevated device permissions their tools depend on. The moment a game runs inside one, it’s exposed to serious security risks.
This post uses real examples to break down how cloud phones work, why they’re so hard to detect, and what an effective detection strategy looks like.
A cloud phone is, at heart, an Android instance hosted in the cloud — built on public-cloud infrastructure and ARM virtualization. The user controls it remotely and in real time over a video stream, which means native Android apps and mobile games can run entirely server-side.
A few of the cloud phone services on the market
Users upload the apps from their physical handset to the cloud, and the compute, storage, and other work the phone used to handle is offloaded to cloud servers. Freed from physical hardware, a single operator can now simulate, spin up, and control devices in bulk.
Cloud phones simulating devices in bulk
On top of that, advances in ARM server virtualization let cloud phones outperform virtual machines and virtual frameworks — sometimes even real handsets — while cloud technology makes it easy to scale up elastically, upgrade, and migrate on demand.
Bulk multi-instancing, elastic scaling, painless migration, high performance, low cost — these “advantages” let studios mass-produce accounts cheaply and quickly, doing serious damage to a game’s economy in remarkably little time.
Cloud phones are remarkably cheap to run
Cloud phones have become a favorite tool of gaming’s black and grey markets, and they’ve caused real headaches for plenty of titles. Detecting and identifying them accurately has become a genuine industry pain point. From what we’ve seen, a few things make cloud phones especially tough to catch:
The technology is mature and runs on the same ARM platform architecture as a real device, so cloud phones are far more convincing — and far harder to detect — than other risk environments.
Inside a cloud phone, plugins like Magisk can hide a cheat tool’s process from the game to dodge detection. Some cloud phones go further with per-app root, granting root to the cheat tool while leaving it switched off for the game itself — yet another way to slip past checks.
Some cloud phones can enable root for a single app
To tackle the risks posed by cloud phones and similar environments, JikGuard has built a dedicated countermeasure strategy. It’s already integrated into a number of popular titles, where it has proven its protective strength.
Security Risk Environment Detection
Unlike other products on the market, JikGuard’s hardening relies on lower-level detection to tell game environments apart with precision. It reliably identifies cloud phones, virtual machines, virtual frameworks, jailbroken and rooted devices, and other risk environments — and applies a tailored crash strategy for each.
