7 ms·

In Team Fortress 2, there is a group of people who host multiple cheat-controlled aimbotting bots, which run around on servers, destroying everyone playing in t

• ajross 9y ago
  So in one sentence, a user name containing "catbot" is a legitimate signature of an actual work of malware Valve is trying to mitigate. HN, you got trolled. There's nothing wrong here at all.
  • rnhmjoj 9y ago
    A legitimate signature would be a sequence of actions the client sends the server that are clearly not possible to have been performed by an actual user playing the game. Like an incredibly improbable statistic or too fast actions or something else. This is a poor solution: it's the equivalent of blocking spammers by IP address. It works but will also lock out legitimate users.
    • ajross 9y ago
      That's not the way this kind of thing works, not even in commercial AV. What you are asking for is for Valve to solve the halting problem before addressing ongoing actual cheating in it's games. That's ridiculous. You take what clues you can get and you push the fix. This is what all their users not named catbot want.
      • revelation 9y ago
        Which is why commercial AV routinely throws up entirely bogus reports. Not a good example. Comparing statistics (accuracy, reaction time, chat messages, what have you) server-side to a not cheating player population seems like a very promising solution, given it doesn't involve the game client (which is assumed compromised). I don't see how that has anything to do with the halting problem.
    • aceofspad3s 9y ago
      Maybe legitimate users shouldn't use the name of a hack as their account name.
      • FRex 9y ago
        People names in TF2 and CSGO are all over the place in many languages and get crazy, weird or stupid. Fucking excuse me for not looking up aimbots to know what names I shouldn't use to not lose access to games I paid money for. Why the fuck would a normal user know stuff like that and why is that even remotely reasonable? What crazy planet were you born on?
        • Moter8 9y ago
          You can express most of what you said in normal, clear words, without having to insult the other person.
          • FRex 9y ago
            I can express all I said in timid words (and my insults, if you consider asking "WTF" an insult, are also very clear) but to insults I reply with profanity. To tell me that this is a reasonable protection mechanism on Valve's part and that if I happen to have these two very common English words as part of my Linux login I can get banned out of the games I purchased and it'd be my fault for not knowing these are the words that cheaters use in their scripts is an insult.
      • anonymousab 9y ago
        'catbot' is a name I can certainly see being used by for a PC username on a gamer's system. It's certainly not unique if you google around. I don't have steam locally so I can't use their username search to check for similar ones.
        • Moter8 9y ago
          A search gives me 739 results, some appear to be just "duplicate" though. There are 8+ accounts which seem real on the first two pages, so there must be false positives as you implied. http://steamcommunity.com/search/users/?text=catbot&x=0&y=0 http://steamcommunity.com/search/users/?text=catbot&x=0&y=0
    • jimrandomh 9y ago
      This particular detection seems very unlikely to ever have a false positive. The noise about false positives appears to be coming from the authors of the cheat software themselves.
      • lakechfoma 9y ago
        It's not about false positives, it's about the half ass solution. The name is just gonna change and it'll be an impossible cat and mouse game
        • rnhmjoj 9y ago
          They have already implemented randomly generated names: https://github.com/nullifiedcat/catbot-setup/pull/11/files https://github.com/nullifiedcat/catbot-setup/pull/11/files
        • throwaway2048 9y ago
          all anti-cheat is fundamentally cat an mouse, when you can control the kernel (applies to both linux and windows) you can lie about anything anticheat tries to detect. There is no bulletproof solutions.
          • lakechfoma 9y ago
            You're right but some statistics analysis on the gameplay by players would do a lot more to reveal bots than analyzing usernames, especially once the bots start using random diceware names
            • paulmd 9y ago
              They do that too, but this was an easy 'tell' for a while.
            • throwaway2048 9y ago
              I'm guessing this is how they determined this was a valid metric, everybody with a catbot user statistically looked like a hacker, and nobody didn't look like a hacker.
  • subway 9y ago
    By that same token, use of sudo is a legitimate signature of the malware. That said, its a really shitty signature with lots of false positives -- catbot is exactly the sort of strange names I assign to hosts or projects.
    • userbinator 9y ago
      catbot is exactly the sort of strange names I assign to hosts or projects. ...and also doesn't look too out-of-place as a gamer handle --- in other games I've seen players with variants of 'cat' and 'bot' in their names (catman, botman, catfish, fishbottom, etc.), which didn't seem to be cheating either. If it was a name with more "entropy", like jH3bzKflAC5, then the case for it being a signature might be far clearer.
      • FRex 9y ago
        It's about the local Linux account name (which frankly Steam has no business touching or inspecting the contents of past pasting it into a path IMO), not the in chosen steam name (which can be anything) nor the unique steam name in profile link (which I think comes from the login, I'm not sure now). In any case - both are all over the place and in online games there are often crazy names that look like the came from /dev/random. It'll also be easily circumvented now that it has been discovered and it was dumb in the first place. Valve really dropped a ball, it's not like they don't know how crazy, meme fulled or troll-y usernames get on their platform. Outright VAC ban (that's a big deal) for something like that is absolutely idiotic (extra inspection that doesn't affect anything for legitimate users - sure).
        • deleted 9y ago
          [deleted]
        • Zpalmtree 9y ago
          Unique steam urls' have to be manually set and don't exist by default.
      • throwaway2048 9y ago
  • janoc 9y ago
    The problem is that everything is wrong here. Username is not a signature of malware by itself. There could be a ton of reasons why someone could have an account like that on the machine - be it someone's name, maybe some AI project, perhaps a robotic feline, who knows. Unfortunately, it seems that Valve's software doesn't bother to actually check whether the machine has any malware installed, it bans anyone who has any account on the machine that matches a regexp. Innocent or not, who cares, right? How "effective" this approach is is very much documented by the fact that as soon as the botters caught wind of this they have changed the username they use and Valve can play a game of cat & mouse with them now. It is not the first time Valve got caught by doing dumb/lazy stuff like this. E.g. Steam was known to erase your entire machine (or at least what your current user had access to - so most likely all you data) because of lazy programming and hardwired assumptions (see here: https://www.theregister.co.uk/2015/01/17/scary_code_of_the_week_steam_cleans_linux_pcs/ https://www.theregister.co.uk/2015/01/17/scary_code_of_the_w... ). Their response has been pretty similar too - "Works as intended, go away, we don't care". Yay ...
    • paulmd 9y ago
      > Username is not a signature of malware by itself Devoid of all context, no it's not. When a malware is known to exclusively use a particular and uncommon pattern, yes it is. If you remove all context then nothing is ever a signature of malware. Maybe there is a legitimate reason for a third-party program to be writing your memory or injecting DLLs, you never know! But in practice those are red-alert triggers for any anti-cheat.
  • gaius 9y ago
    Tell me, have you ever been to Scunthorpe?
    • tzs 9y ago
      That reminds me of Everquest and "cock". Their chat filters did not allow the string "cock" in chat...and then they put a bunch of nasty cockatrices in the Dreadlands and in the Overthere, along with quests that asked you to seek out their eggs, feathers, and beaks, thus giving you a reason to use the string "cock" when talking with others.
  • lakechfoma 9y ago
    The interesting thing is that this "legitimate signature" will just change. Maybe to another basic name, maybe a random string, maybe diceware. No one is trolled.
    • stordoff 9y ago
      I wouldn't be surprised if it starts using real names to avoid this particular detection - gather a few thousand real Steam usernames, and create variants of them at runtime.
      • nitrogen 9y ago
        Aimbots ruined TF2 for me a couple years ago. One of the things they used to do to make them harder to kick/ban was change their name to the name of a different real player on the server every second. The mentality that drives the use of aimbots is a disgusting scourge on humanity.
        • Moter8 9y ago
          But they player/Steam ID stays the same if you look via the console, iirc it was `status`?
      • deleted 9y ago
        [deleted]
      • paulmd 9y ago
        One of the mechanisms to avoid a server ban (different from a VAC ban) is to rapidly switch between names of other players on the server (but with unprintable/non-breaking characters added). You need to use 'status' to tell them apart.
  • vladd 9y ago
    A "legitimate" signature (or, for a better word, a good-performing signature) is one that performs well on both precision and recall ( https://en.wikipedia.org/wiki/Precision_and_recall https://en.wikipedia.org/wiki/Precision_and_recall ). Precision is the ratio between correctly-identified cheaters and the total number of people matched by the signature. Recall is the ratio between correctly-identified cheaters and the total number of cheaters in the system. In this case, the signature had good recall but poor precision, as those threads describe cases that make it plausible to have a "catbot*" username without cheating. (I said "had" because the recall rate is going to drop when the string gets changed by the cheat authors. So long-term, the signature is poor on both recall and precision.) The most problematic issue I see for Valve is not the lack of measurement of precision and recall for their VAC ban signatures, but rather the inability to obsess over their customer experience and react properly when relevant issues in their products are reported.
    • rahimnathwani 9y ago
      "poor precision" How so? Of Steam's users that are running linux and have 'catbot' as part of a username on their system, what proportion do you think are running a cheat bot? 99%? 99.9%? What level of precision would you say it not 'poor precision'? 99.999%?
      • Kr4ken 9y ago
        None anymore, the cheaters have already stopped using catbot as their usernames. https://github.com/nullifiedcat/catbot-setup/commit/c2d22ee92d0af11376243ca20c7522e6e7205506 https://github.com/nullifiedcat/catbot-setup/commit/c2d22ee9.... This is further proof of how poor of a response this was by Valve.
        • rahimnathwani 9y ago
          I was responding to a comment made when "the signature had good recall". So whilst you have a reasonable point, it's not relevant to the point I was making, which is that the precision of the rule (after implementation, and before discovery) probably exceeded 4 nines, which doesn't seem like 'poor precision' to me, without further detail on the requirements. And BTW I have no opinion about whether this was a good or bad move by Valve. I don't have sufficient context for that, and my comment was intentionally focused to try and understand what the person to whom I replied thought would be acceptable precision.
  • deleted 9y ago
    [deleted]
  • Sir_Substance 9y ago
    > So in one sentence, a user name containing "catbot" is a legitimate signature of an actual work of malware Valve is trying to mitigate. I think signature is a strong word. This is kind of like comparing the color of the ink used to sign for something and ignoring the actual signature.
  • FRex 9y ago
    Then perhaps I should make a fork that uses your username to get you banned and then proceed spit in your face when it happens and tell you it's your fault. Or reinstall my TF2 and get banned so then I can tell you to stick it. It's VAC that's doing the trolling here. Person's OS (not even Steam) username is not a cheat (and Steam frankly has 0 reason to examine its name in any way for any purpose, for installing games just pasting will do and for everything else there is a Steam username). This is bullshit, will be defeated now instantly that it came out and on the level of dumb antiviruses that delete exes (i.e. my compiled Pascal and C++ programs) and claim the reason was "unknown low spread program" (yes, that happened, because clearly, unknown program = virus). VAC has sainthood status now, Valve social media staff often tells people it's 100% foolproof and bans are never appealed, people who claim they were unfairly banned are shitted on by the community and it's undisputable (although there were overturns i.e. when CoD players got banned by Steam's mistake[0]) but they do crap like that? It's like Destiny 2 bans last year, they were all "hand made by staff and 100% confirmed cheaters" and then a couple hundred got overturned and claimed to be "software error". What next? Banning everyone who has a GitHub account or knows git because the aimbot code is hosted on GitHub? Banning people from sites for having HN accounts because it's a "hackers" site? What planet do people like you come from? [0] - https://kotaku.com/5597038/valve-bans-modern-warfare-players-by-mistake-apologizes-with-free-left-4-dead-2 https://kotaku.com/5597038/valve-bans-modern-warfare-players...
  • osdedf 9y ago
    You are so thick my head started hurting.
  • shawnz 9y ago
    > a user name containing "catbot" is a legitimate signature of an actual work of malware Valve is trying to mitigate. Who suggested otherwise?
    • paulmd 9y ago
      > Who suggested otherwise? A dozen or so people in this thread?
  • mabbo 9y ago
    Who the heck is valve to say what usernames I can and cannot have on my system? I don't even play TF2. What happens if the cheaters decide the change the 'triggering' username to something far more common? Guest, admin, local, user, etc. Now valve is allowed to ban everyone who has that username on their system?
  • hitekker 9y ago
    More like "HN, you got triggered". Anecdotally, the people who screech about and around VAC bans are the same people who will ruin online games with botting, scripting or just general douchebaggery. Basically, no one notices VAC if they aren't trying to screw over other gamers. Those who do so so repeatedly, often resort to comment threads like this one, venting vitriol on the off-chance the more-gullible will confuse it as signals of a larger problem. Steam has many issues: poor customer service, a wash of bad content, a lack of focus on making games. But being too hard on those poor, upstanding cheaters? Not an issue.
  • dang 9y ago
    > HN, you got trolled. HN is as much your comment as any other.
    • paulmd 9y ago
      No, the hack authors who filed the pull request are actually posting here in this thread. eg this guy: https://github.com/Kr4ken-9/cathook https://github.com/Kr4ken-9/cathook is kr4ken on HN, there's probably others here who are smart enough not to link their black-hat identity with HN. This is literally blackhats bitching that they got VAC-banned, 100% legitimately, and then concern-trolling us about what-if scenarios about some hypothetical innocent user who might have been swept up with their script-kiddie customers. Can't say that such opinions really have any place here, IMO, considering that they are the ones who created the problem in the first place. Maybe it's not worth shutting them down, but they certainly shouldn't be celebrated or legitimized in any fashion. Scorn is an entirely appropriate community reaction here, and a mod tipping the scale in favor of black-hats is not really appropriate IMO.
      • hitekker 9y ago
        I agree. Implying that HN users aren't generally susceptible to blackhat trolling is naive. Our community has its strengths but some subjects like politics provoke a suspension of critical thinking. In this case, small time hackers being punished by a big company in a seemingly overkill way for a seemingly innocuous slight. Ideally, a moderator should be aware of the biases of the community and adjust the discussion accordingly. Or at least when the lies being perpetrated are as obvious as it is in this thread.
      • dang 9y ago
        I wasn't talking about that and am not taking any kind of side. If you think there's abuse going on, emailing hn@ycombinator.com is the thing to do, and then we can take a closer look. My point is the orthogonal one that it's incongruent to snarkily diss HN when you're as much a part of the community as anyone else is. It makes no more sense to say "HN got trolled" than "HN debunked getting trolled". People don't do this to be informative, but rather to superciliously position themselves above others. That degrades the spirit of the community here, which is already so fragile. That's why I reply to such comments the way I did.
• buildbuildbuild 9y ago
  It seems to me that showing these suspicious users a CAPTCHA prior to banning would have been a way less abrasive means to the same end.
  • Moter8 9y ago
    Captchas are easily (or cheaply) solved, there are captcha solver services out there. Captchas alone won't help.
• deleted 9y ago
  [deleted]