20 ms·

Anti-cheat software is an absolute shit show of cat-and-mouse tactics. It’s often difficult to distinguish anti-cheat software from rootkits or spyware. They’re

by jchw 7y ago

Anti-cheat software is an absolute shit show of cat-and-mouse tactics. It’s often difficult to distinguish anti-cheat software from rootkits or spyware. They’re invasive and user hostile, and they frequently cause collateral damage that is swept under the rug and that support tacitly refuses to acknowledge. This has happened on multiple occasions with Blizzard: - https://www.phoronix.com/scan.php?page=news_item&px=Blizzard-Banning-DXVK-Wine https://www.phoronix.com/scan.php?page=news_item&px=Blizzard... - https://m.slashdot.org/story/75350 https://m.slashdot.org/story/75350 Of course, although Blizzards initial response was to claim that the users cheated and were lying, they did eventually fix the problem the first time (although IIRC they never reversed all of the bans for the very first WoW Wine ban wave.) Now they have a bit more experience with the issue so it seems it is getting more attention. However with EA I don’t really have utmost confidence they will pay any attention to this, so I’d guess it’s time to get loud if you want any hope of this being fixed.

coldpie 7y ago
> Anti-cheat software is an absolute shit show of cat-and-mouse tactics. It’s often difficult to distinguish anti-cheat software from rootkits or spyware. They’re invasive and user hostile, and they frequently cause collateral damage that is swept under the rug and that support tacitly refuses to acknowledge. Sure, but I don't see a good alternative. Cheating is a real problem and will quickly destroy your online community (see other comments in this thread). Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me. It's unfortunate that it is necessary, but people are jerks.
- alkonaut 7y ago
  Don’t join a server without an admin. Problem solved. I wouldn’t join some random server hosted by the game publisher where there are no admins and no votebans.
- anonymousab 7y ago
  >Sure, but I don't see a good alternative Allow users to votekick and voteban. Provide the server software for players to host their own servers and provide their own solutions to these problems. These are tools and approaches that we had in past games and while they are not perfect, they are better than these black box invasive anticheat solutions born from a desire to avoid giving community control to users. >Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me Only if you provide a robust and empowered support staff to quickly unban and resolve false positives. That is, actually take responsibility, which is something game developers and major publishers seem allergic to.
  - lossolo 7y ago
    > Allow users to votekick and voteban. Provide the server software for players to host their own servers and provide their own solutions to these problems. How would that work in case of MMORPG with open world ? One clan would votekick competing clan? Any group votekick whoever they want? Or in case of FPS games lets vote to kick player X because he is just too good (killing us all) so he is cheating for sure? > Provide the server software for players to host their own servers and provide their own solutions to these problems. Dosen't apply for most MMO games.
    - anonymousab 7y ago
      The false positive of someone getting kicked for being too good is a better negative outcome than the false positive of a ban, especially in an opaque system with poor support staffing and resolution processes. When users can trivially provide and administrate and experiment with their own servers, then the effect of not being able to return to the same server is lessened. >MMO games They're a different beast entirely. But in the case of battlefield, you have a capped playercount that is orders of magnitude smaller than an MMO, and much more manageable.
      - deleted 7y ago
        [deleted]
- jiofih 7y ago
  AI will save us. If a human can detect cheating by looking at the screen, it’s doable.
  - saagarjha 7y ago
    Humans are notoriously bad at this. See countless examples of people claiming “hax” when they’re against a player that’s much better than them.
    - magicalhippo 7y ago
      Back when I played a lot more, I would usually call it a bad day if I didn't get accused of cheating a few times. I guess it's the Dunning-Kruger effect, where players think they're a lot better than they really are, so they can't imagine how someone can be _that_ much better than them.
      - lozaning 7y ago
        This brings me back. When I used to play competitive BF2 in one of the tops clans in TWL, we'd start our thrice weekly practises by squading up in a pub server and play until we got votekicked and then switch to our private server. IDK if it's still the same these days, but in BF2, 8 people in a squad all working together and doing their role within the squad could easily roll over 32 randoms on the other team.
    - furi 7y ago
      That's a double edged sword though. Humans being bad at telling the difference between cheating and skill is not good for training your AI to spot cheaters but at the same time it lowers the bar for how good your AI needs to be. The metric for whether or not your anti-cheat works is "whether or not humans can tell others are cheating". It doesn't matter so much if it can't identify the subtler ones if the players can't either.
    - jiofih 7y ago
      Those people are not looking at the other players’ screens. CS Overwatch works by saving replays and is pretty accurate
- saagarjha 7y ago
  Cheating is a real problem, but I don’t see why we need to solve it with what’s essentially invasive spyware. If it’s degrading the experience of other people, let them tell you about it, not your kernel hook buried deep in the computers of all your users.
  - vlozko 7y ago
    It’s because cheating software runs at a level that only invasive software can detect. Without any detection software, it becomes a far more manual (and likely unscalable) problem of having to deal with individual player reports of suspected cheating.
- Aperocky 7y ago
  The real solution? Send only information players are supposed to see. Sacrifice some speed for true cheat proof games.
  - dharmab 7y ago
    That wouldn't prevent commonly used cheats such as aimbots.
    - Aperocky 7y ago
      You’re right.
    - AnthonyMouse 7y ago
      Maybe the solution there is to stop making games be about the things computers are better at. They're better at aiming, fine, let them be. Put the aimbot in the game from the start. Then instead you have a FPS with multiple weapons and it takes several seconds to switch between them. One has a high rate of fire but is useless against players with armor, another is the opposite. Cheaters don't know if the opponent is wearing armor (or what kind) because the server doesn't tell them that until they're in the same room, by which point it's too late. Make certain weapons better against certain defenses, so it's a matter of predicting what your opponent will do and being ready for it. Make the humans do the things that humans are still better at, instead of trying to prevent a computer from beating them at things computers are better at.
      - spathi_fwiffo 7y ago
        first person/multi-player rock paper scissors. would be an interesting game. probably family friendly. should make it.
        AnthonyMouse 7y ago
        It doesn't even have to be that arbitrary. You've got an opponent with a defense against all your current weapons, but you can run faster than them, so you can escape but you still need to find something that can kill them. They need to find something that can make them faster so they can catch you, or take their chances by giving up the defense which is slowing them down. There can still be strategy in it without leaving any easy way to cheat.
- CodeArtisan 7y ago
  cloud gaming only or enforcing signed code at the hardware level may reduce online cheating significantly.
  - m4rtink 7y ago
    Just what we need - removing any control from the users all together & peddling trusted computing. Marvelous.
    - anonymousab 7y ago
      Removing user control overlaps too much with other desired outcomes than just anti cheat. It's too profitable to not be an inevitability.
  - blibble 7y ago
    cloud gaming has already been beaten by the cheaters bots for wow now run on a different machine to that of the game client, process the game's visual output and send inputs to the game client in the same way a human would the only way you can detect this is heuristically
  - SlowRobotAhead 7y ago
    > enforcing signed code at the hardware level Consoles. I dropped PC in favor of Xbox/ps and won’t go back. Just NEVER having to deal with cheaters or people that buy more expensive hardware and/or drastically lower their settings for an advantage is well worth the lower visual fidelity. I’ll take consoles because I can sit down and ENJOY the game.
- willis936 7y ago
  There exist good solutions, but none of these companies have the competence or will to actually solve the problem. It’s security theatre a la malware. “Hey everyone install this rootkit to pretend like we’re preventing cheaters. Don’t worry about the keylogging and screenshot uploading.” What’s most surprising is that the vast majority of gamers aren’t outraged by this at all, despite repeated demonstrations of untrustworthiness by anticheat companies. https://youtu.be/SnRgW54EWwA https://youtu.be/SnRgW54EWwA
  - deleted 7y ago
    [deleted]
  - maccard 7y ago
    > There exist good solutions, but none of these companies have the competence or will to actually solve the problem Could you share what some of the good solutions are? As someone who works in games, (not in anticheat) it's a stretch to say that companies arent competent enough to implement good anticheat.
    - willis936 7y ago
      See the video above. It’s a condensed recap of Valve’s GDC 2018 presentation on VACnet. The actual presentation is worth listening to if you have the time. https://youtube.com/watch?v=ObhK8lUfIlc https://youtube.com/watch?v=ObhK8lUfIlc I disagree on the statement that developers, publishers, and/or anticheat companies are too incompetent to implement good solutions. They have not been putting serious effort into the problem or else the state of cheating in video games wouldn’t be as bad as it is today.
      - eq_sd_ 7y ago
        I have worked on some server-side anti-cheat detection for a game recently. Competence is not a problem, it's actually very difficult to even do detection some would think is "easy".
  - deleted 7y ago
    [deleted]
- vintermann 7y ago
  I have a suspicion that the people who impulsively reach for cheats overlap a lot with those who impulsively reach for in-game purchases.
- kitsunesoba 7y ago
  I don’t know how well it’d work for FPS games, but for MMORPGs I think a lot more could be done with serverside pattern recognition. Bots and cheaters in that genre behave very differently than real players do, often to the extent that real players can identify bots out in the open world within a couple of seconds of seeing them. It’s a bit more difficult for other forms of cheating (like duping, wallhacking, etc) but still plenty doable — just create sets of rules to asynchronously sanity check every Nth player action against. No it won’t be free, but you’d likely make back the costs with happy players staying subscribed.
- clSTophEjUdRanu 7y ago
  The only alternative seems to be things like Stadia. ;) Users will forever have the ability (and the right) to inspect the memory on their own machine.
  - wdroz 7y ago
    You can still implement images-based aimbots. I tried for fun, in less than 30h I had a working aimbot that use deep learning to get faces positions.
- milesvp 7y ago
  The good alternative is good matchmaking. My experience, is that cheaters usually aren't actually very good. They tend to use things like wall hacks and aim bots as a crutch. With good match making it doesn't really matter. They're going to be at your general level, so you've still got an even chance at winning the game. And if the matchmaking is really good, then all the cheaters just end up playing with themselves, and there's even less impact on the general community. I could even see people ending up in separate "augmented" tiers, and then you don't even have to feel bad for being lower ranked. In fact, you could end up with bragging rights if you end up in the augmented tier because you look like an aim bot (I've played with players that were almost indistinguishable from aim bots).
  - tobias3 7y ago
    Yeah, but matchmaking only works if you have enough players per region and/or small matches. With 64 players per match this becomes difficult really fast. Battlefield has the additional difficulty that some pleople want to (only) play planes or tanks, so another dimension on which to match...
  - dageshi 7y ago
    It depends on the game, but some communities loathe skill based match making. Apex Legends is currently up in arms about it because upper 20% players are being matched in with top 0.1% players and that means every single game has to be played at peak effort by everyone. There are no "casual" games any more and it's impossible to team up with friends who might have a lower skill level because they'll be matched in with that 0.1% and be decimated.
  - Thaxll 7y ago
    MM doesn't solve any problems in case of cheating. Also there is no such things as "MM being really good" it's a tradoff between many criterias.
  - baby 7y ago
    Having played in the counter strike competitive scene I can tell you that extremely good players were caught cheating online AND at lan parties during tournaments.
- Red_Leaves_Flyy 7y ago
  By far, the best approach I've seen is pooling players by metrics that cause the least controversy within said pools. Ban the hackers in waves for those extra sales, ala steam. In between just match them against each other and get the popcorn. Same for griefers, tryhards, casuals, children, etc.
- gcb0 7y ago
  > reasonable solution to me. A proper balancing algo solves a lot. Balance players and clump cheaters with other cheaters (maybe they even have fun while at it and continue being paying clients!). but yeah, that's a lot of work on the server (cost++) and installing a rootkit also gives you a lot of telemetry data for free! with a big percentage of the user base willing to bend over and stating "reasonable solution to me" i'd pick that option too. We only have the "gamers" to blame i guess. The companies are doing what we would do in the same situation.
- zemnmez 7y ago
  as someone who works in the gaming industry, i think anti-cheat exists in part because of the culture of game development. every games company i have worked with has valued releasing the content they want to release above everything else – they'll request API changes and the removal of security hurdles to meet their release deadlines. crunch culture is very real. As a small, real and not at all outlier example I was asked once if the game's backend servers could establish a persistent mutual TLS connection to authentication servers so game clients wouldn't need to implement oauth / oidc, in which they'd request whatever data they wanted in essence. Multiplayer games are only a continuation of this philosophy. For quite a few games, the 'multiplayer' aspect is created by simply replicating identical game state across all clients, meaning clients end up with a ton of information the player shouldn't be able to see being beamed to their computer. most game UIs are literally flash, or embedded chrome instances that dynamically load their content from user input or straight from the web, often over unencrypted connections. These browsers also often have direct sandbox bypasses to the game engine. Making games is hard. Making games secure is something games companies don't want to invest in, and they've largely just eaten the risk with bolt-on anticheat software. Games companies are in a similar but slightly worse position than the financial industries where, due to historically not valuing security talent they can't and don't acquire it, instead opting for whatever off-the-shelf solutions, mitigations and contractors they can use to help stem the bleeding with the exception of less than a handful of household name shops. It is possible, depending on the game to take good steps to make games harder to cheat at. Dota 2, for example took steps (in their rather favourable context) to thwart cheating by not sending information to the player on objects they should not be able to see (though mistakes are made in this on a regular basis). For any other industry, such a filter would be the standard way to implement the server-client relationship but this is not a priority in game development as it stands. There's simply no other non-security software one downloads to their computer that comes with a heavy and intrusive rootkit that attempts to try to see if you're messing with it, because no other industry as wealthy or influential as gaming considers security an afterthought.
  - meheleventyone 7y ago
    Not sending info about objects you can’t see is a fairly standard thing to do. Not to big up the lack of security (which is a problem in some cases) but games often have to balance sending over to much information against other concerns. For example in an FPS you could theoretically determine exact visibility but tend to send everything within a certain radius because you want to avoid sending information late both because the client is predicting and a half-round trip of latency before an enemy that appeared round a corner showing up is bad for gameplay. Not to mention that you want the server to run reasonably quickly and visibility determination is expensive. Hence “ESP” hacks. Then you have the mechanical helpers like aimbots that can’t be solved easily even if you perfectly restricted data sent across the network to that which was visible. So we’re kind of stuck with invasive programs trying to spot hacks and broad strokes statistic analysis.
- rl3 7y ago
  >Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me. That's like saying it's acceptable for innocent people to rot in prison as an acceptable price to pay for catching criminals. Obviously this isn't as serious, but the comparison stands. Then again, I would argue that in an MMO context, banning a long-time player who's innocent could easily lead to their suicide. >It’s often difficult to distinguish anti-cheat software from rootkits or spyware. >It's unfortunate that it is necessary, ... I don't think it is necessary. Virtually anything can be defeated, including invasive rootkits. The best defense is simply updating the game on a regular basis, and in doing so changing up the game's internal data structures such that reversing it on any sort of ongoing basis becomes completely untenable. To do this however, you would have to integrate anti-cheat into the very fabric of the software, and unfortunately nobody does this. Instead, anti-cheat is usually approached as a third-party add-on service after the fact. Statistical analysis is another promising angle that's passive and has a very low false positive rate if used correctly. In other words, a small amount of players end up fucked over because larger publishers are cheap and lazy.
  - vlozko 7y ago
    DICE claims that they’ve only ever had a handful of false claims in 2018: https://www.ea.com/games/battlefield/battlefield-5/news/anti-cheat-in-battlefield-5 https://www.ea.com/games/battlefield/battlefield-5/news/anti... With regards to the use of Linux, I suspect there’s more to this that DICE is unwilling to disclaim. Possibly that there’s a lack of ability to differentiate cheaters in Linux vs non-cheaters on a software level? DICE never officially supported Linux and stated what the requirements of the game were (Windows). However, I couldn’t find anything in their EULA or elsewhere about a platform requirement to use the software (maybe I overlooked it?). Regardless, the notice players are getting for their reason is due to cheat software so I think that may be irrelevant.
- soraminazuki 7y ago
  Forcing malware on users is far worse than doing nothing.
- Iv 7y ago
  It is not a question of lacking good alternative, it is a question of lacking good solutions. Games like FPS that emphasize fast clicking can always be defeated by anything that can emulate clicks and keypresses and see the display. If you take the problem to the limits: a camera looking at the physical screen and a robot actually moving the mouse and keyboard is going to be able to have users cheating. You simply need a reputation system. Allow people to vote on someone being a cheater or simply refuse subsequent match with them.
- whatsmyusername 7y ago
  Geoip banning China will take care of a large chunk of it.
- jdnenej 7y ago
  Also virtually all cheaters will try to claim that they did nothing and the system just failed.
- Mirioron 7y ago
  >Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me. Can those people then get full refunds for any game they purchased? Because they're paying money for the game, which they are banned from playing.
- arendtio 7y ago
  I hate anti-cheat software, because I had a lot more trouble with it than I had with cheaters. After all, anti-cheat software is meant to solve just one problem (people modifying the technology), but there are other ways too to destroy the gaming experience of the other players (teamkilling, wasting resources, deconstructing buildings, etc.). All those problems are not being solved by anti-cheat software. But the tools to solve them (IP-range banning, server-lockdown to known/trusted players, etc.), are also quite good at solving the cheater problem. In my experience, having a good admin community is a lot better than playing the cat and mouse game of developing an anti-cheat software.
- neop1x 7y ago
  There is simply NO excuse to use anti-cheat rootkits. Machine learning is starting to be mainstream and soon there will be bots interacting with HID like humans, with all anti-cheat running. You simply can't trust anonymous clients, never. Anti-cheat won't change that. You have to implement the game so that the actual players know each other and invite each other to the game, eventually kicking/blocking some themselves. Or simply play competition games on the local LAN. Or simply admit there will be cheaters on the public anonymous games. Blocking Linux is a terrible, terrible practice and they should be boycotted.
utopian3 7y ago
Is there a book (or long blog post) on the underground history of anti-cheat software & DRM? I would love to read that..
- papreclip 7y ago
  I would be interested in this, too. I read an interesting write-up by the guy who wrote the first .dll to hook functions in some FPS, I forget if it was quake or counterstrike. Sadly I can't seem to find it, now Detailed discussion of how cheats and anti-cheats work is somewhat lacking as all the experts on either side of the issue would prefer to keep their secrets. These days an anti-cheat team that's serious about their job will lurk cheat forums and even try to poach talent there.
- chithanh 7y ago
  Occasionally, some anti-cheat software gets dissected and the analysis posted publicly. Here is an analysis of BattlEye with some information on its development history: https://vmcall.blog/battleye-anticheat-analysis-and-mitigation/ https://vmcall.blog/battleye-anticheat-analysis-and-mitigati... Typically, anti-cheat is separated into a frontend and a backend. The frontend becomes active at an enumerated set of events/criteria and collects data (screenshots, keystrokes, directory listings, process lists, results of memory scans, if instructed by the backend also memory contents or file contents) to the backend for further analysis. These criteria are often ad-hoc (such as "if processes are running out of a user directory, capture them") and usually accumulate over time.
nerdponx 7y ago
they never reversed all of the bans for the very first WoW Wine ban wave This is really depressing. I can't imagine working on an anti-cheat moderation team would be a pleasant job.
ryandrake 7y ago
> However with EA I don’t really have utmost confidence they will pay any attention to this, so I’d guess it’s time to get loud if you want any hope of this being fixed. Or, stop buying games that are essentially rootkits...
matthewfcarlson 7y ago
I recently saw an interesting idea, put the game inside a lightweight container and give it a virtual GPU. The latency took a small but noticeable hit but you had verified code that you could verify that the game code hasn't been modified. Granted it wouldn't be perfect security since your threat model is someone with root access, but it makes the effort required to hack the game large though that it hopefully discourages some would be hackers
- clSTophEjUdRanu 7y ago
  Not all cheats inject code. Many cheats use a set of offsets to find game objects in memory and draw an overlay or minimap. This data can also be tied to autoaim hacks that uses mouse input directly for aiming.
- throwaway2048 7y ago
  A container doesn't bring much but additional complexity.
- cooljacob204 7y ago
  Some hacks do run games inside a 'container' or VM because the host machine just modifies the guests memory from the outside. (Take this with a grain of salt, I have heard some very expensive hacks work like this through word of mouth)
- Keenuts 7y ago
  > give it a virtual GPU That will be hard part As far I as recall, this is not something you can easily do with common consumer hardware. Real GPU virtualization is not possible on classic GPUs, and workaround methods are a bit hacky. (As far as I recall OC)
WhompingWindows 7y ago
I recall facing map-hackers in BW, SC2, and WC3...it was very frustrating, but at the same time, they were generally correspondingly worse at every game mechanic. If you played a solid, standard, scouting-based, conservative style, you could beat these players despite their handicaps. On the other hand, maphackers totally counter risk-taking players who play secretive strategies like DT rush, DT drop, high-tech rushes, players who love big drops, hidden bases...players like that would get slaughtered by map hackers. So, if you l2p, you'd be able to beat them with superior skills. Can't say the same for shooters, though, those games are ruined by hackers.
djsumdog 7y ago
It's all based on finger printing like shitty old virus scanners (that are themselves an attack surface). I know people who get by them by writing their own programs instead of using ones found online; naming them "Google Chrome" and running them as the system user so they can read/debug game processes.
- p410n3 7y ago
  I wish

by jchw 7y ago

coldpie 7y ago

> Anti-cheat software is an absolute shit show of cat-and-mouse tactics. It’s often difficult to distinguish anti-cheat software from rootkits or spyware. They’re invasive and user hostile, and they frequently cause collateral damage that is swept under the rug and that support tacitly refuses to acknowledge. Sure, but I don't see a good alternative. Cheating is a real problem and will quickly destroy your online community (see other comments in this thread). Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me. It's unfortunate that it is necessary, but people are jerks.

alkonaut 7y ago
Don’t join a server without an admin. Problem solved. I wouldn’t join some random server hosted by the game publisher where there are no admins and no votebans.
anonymousab 7y ago
>Sure, but I don't see a good alternative Allow users to votekick and voteban. Provide the server software for players to host their own servers and provide their own solutions to these problems. These are tools and approaches that we had in past games and while they are not perfect, they are better than these black box invasive anticheat solutions born from a desire to avoid giving community control to users. >Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me Only if you provide a robust and empowered support staff to quickly unban and resolve false positives. That is, actually take responsibility, which is something game developers and major publishers seem allergic to.
- lossolo 7y ago
  > Allow users to votekick and voteban. Provide the server software for players to host their own servers and provide their own solutions to these problems. How would that work in case of MMORPG with open world ? One clan would votekick competing clan? Any group votekick whoever they want? Or in case of FPS games lets vote to kick player X because he is just too good (killing us all) so he is cheating for sure? > Provide the server software for players to host their own servers and provide their own solutions to these problems. Dosen't apply for most MMO games.
  - anonymousab 7y ago
    The false positive of someone getting kicked for being too good is a better negative outcome than the false positive of a ban, especially in an opaque system with poor support staffing and resolution processes. When users can trivially provide and administrate and experiment with their own servers, then the effect of not being able to return to the same server is lessened. >MMO games They're a different beast entirely. But in the case of battlefield, you have a capped playercount that is orders of magnitude smaller than an MMO, and much more manageable.
    - deleted 7y ago
      [deleted]
jiofih 7y ago
AI will save us. If a human can detect cheating by looking at the screen, it’s doable.
- saagarjha 7y ago
  Humans are notoriously bad at this. See countless examples of people claiming “hax” when they’re against a player that’s much better than them.
  - magicalhippo 7y ago
    Back when I played a lot more, I would usually call it a bad day if I didn't get accused of cheating a few times. I guess it's the Dunning-Kruger effect, where players think they're a lot better than they really are, so they can't imagine how someone can be _that_ much better than them.
    - lozaning 7y ago
      This brings me back. When I used to play competitive BF2 in one of the tops clans in TWL, we'd start our thrice weekly practises by squading up in a pub server and play until we got votekicked and then switch to our private server. IDK if it's still the same these days, but in BF2, 8 people in a squad all working together and doing their role within the squad could easily roll over 32 randoms on the other team.
  - furi 7y ago
    That's a double edged sword though. Humans being bad at telling the difference between cheating and skill is not good for training your AI to spot cheaters but at the same time it lowers the bar for how good your AI needs to be. The metric for whether or not your anti-cheat works is "whether or not humans can tell others are cheating". It doesn't matter so much if it can't identify the subtler ones if the players can't either.
  - jiofih 7y ago
    Those people are not looking at the other players’ screens. CS Overwatch works by saving replays and is pretty accurate
saagarjha 7y ago
Cheating is a real problem, but I don’t see why we need to solve it with what’s essentially invasive spyware. If it’s degrading the experience of other people, let them tell you about it, not your kernel hook buried deep in the computers of all your users.
- vlozko 7y ago
  It’s because cheating software runs at a level that only invasive software can detect. Without any detection software, it becomes a far more manual (and likely unscalable) problem of having to deal with individual player reports of suspected cheating.
Aperocky 7y ago
The real solution? Send only information players are supposed to see. Sacrifice some speed for true cheat proof games.
- dharmab 7y ago
  That wouldn't prevent commonly used cheats such as aimbots.
  - Aperocky 7y ago
    You’re right.
  - AnthonyMouse 7y ago
    Maybe the solution there is to stop making games be about the things computers are better at. They're better at aiming, fine, let them be. Put the aimbot in the game from the start. Then instead you have a FPS with multiple weapons and it takes several seconds to switch between them. One has a high rate of fire but is useless against players with armor, another is the opposite. Cheaters don't know if the opponent is wearing armor (or what kind) because the server doesn't tell them that until they're in the same room, by which point it's too late. Make certain weapons better against certain defenses, so it's a matter of predicting what your opponent will do and being ready for it. Make the humans do the things that humans are still better at, instead of trying to prevent a computer from beating them at things computers are better at.
    - spathi_fwiffo 7y ago
      first person/multi-player rock paper scissors. would be an interesting game. probably family friendly. should make it.
      - AnthonyMouse 7y ago
        It doesn't even have to be that arbitrary. You've got an opponent with a defense against all your current weapons, but you can run faster than them, so you can escape but you still need to find something that can kill them. They need to find something that can make them faster so they can catch you, or take their chances by giving up the defense which is slowing them down. There can still be strategy in it without leaving any easy way to cheat.
CodeArtisan 7y ago
cloud gaming only or enforcing signed code at the hardware level may reduce online cheating significantly.
- m4rtink 7y ago
  Just what we need - removing any control from the users all together & peddling trusted computing. Marvelous.
  - anonymousab 7y ago
    Removing user control overlaps too much with other desired outcomes than just anti cheat. It's too profitable to not be an inevitability.
- blibble 7y ago
  cloud gaming has already been beaten by the cheaters bots for wow now run on a different machine to that of the game client, process the game's visual output and send inputs to the game client in the same way a human would the only way you can detect this is heuristically
- SlowRobotAhead 7y ago
  > enforcing signed code at the hardware level Consoles. I dropped PC in favor of Xbox/ps and won’t go back. Just NEVER having to deal with cheaters or people that buy more expensive hardware and/or drastically lower their settings for an advantage is well worth the lower visual fidelity. I’ll take consoles because I can sit down and ENJOY the game.
willis936 7y ago
There exist good solutions, but none of these companies have the competence or will to actually solve the problem. It’s security theatre a la malware. “Hey everyone install this rootkit to pretend like we’re preventing cheaters. Don’t worry about the keylogging and screenshot uploading.” What’s most surprising is that the vast majority of gamers aren’t outraged by this at all, despite repeated demonstrations of untrustworthiness by anticheat companies. https://youtu.be/SnRgW54EWwA https://youtu.be/SnRgW54EWwA
- deleted 7y ago
  [deleted]
- maccard 7y ago
  > There exist good solutions, but none of these companies have the competence or will to actually solve the problem Could you share what some of the good solutions are? As someone who works in games, (not in anticheat) it's a stretch to say that companies arent competent enough to implement good anticheat.
  - willis936 7y ago
    See the video above. It’s a condensed recap of Valve’s GDC 2018 presentation on VACnet. The actual presentation is worth listening to if you have the time. https://youtube.com/watch?v=ObhK8lUfIlc https://youtube.com/watch?v=ObhK8lUfIlc I disagree on the statement that developers, publishers, and/or anticheat companies are too incompetent to implement good solutions. They have not been putting serious effort into the problem or else the state of cheating in video games wouldn’t be as bad as it is today.
    - eq_sd_ 7y ago
      I have worked on some server-side anti-cheat detection for a game recently. Competence is not a problem, it's actually very difficult to even do detection some would think is "easy".
- deleted 7y ago
  [deleted]
vintermann 7y ago
I have a suspicion that the people who impulsively reach for cheats overlap a lot with those who impulsively reach for in-game purchases.
kitsunesoba 7y ago
I don’t know how well it’d work for FPS games, but for MMORPGs I think a lot more could be done with serverside pattern recognition. Bots and cheaters in that genre behave very differently than real players do, often to the extent that real players can identify bots out in the open world within a couple of seconds of seeing them. It’s a bit more difficult for other forms of cheating (like duping, wallhacking, etc) but still plenty doable — just create sets of rules to asynchronously sanity check every Nth player action against. No it won’t be free, but you’d likely make back the costs with happy players staying subscribed.
clSTophEjUdRanu 7y ago
The only alternative seems to be things like Stadia. ;) Users will forever have the ability (and the right) to inspect the memory on their own machine.
- wdroz 7y ago
  You can still implement images-based aimbots. I tried for fun, in less than 30h I had a working aimbot that use deep learning to get faces positions.
milesvp 7y ago
The good alternative is good matchmaking. My experience, is that cheaters usually aren't actually very good. They tend to use things like wall hacks and aim bots as a crutch. With good match making it doesn't really matter. They're going to be at your general level, so you've still got an even chance at winning the game. And if the matchmaking is really good, then all the cheaters just end up playing with themselves, and there's even less impact on the general community. I could even see people ending up in separate "augmented" tiers, and then you don't even have to feel bad for being lower ranked. In fact, you could end up with bragging rights if you end up in the augmented tier because you look like an aim bot (I've played with players that were almost indistinguishable from aim bots).
- tobias3 7y ago
  Yeah, but matchmaking only works if you have enough players per region and/or small matches. With 64 players per match this becomes difficult really fast. Battlefield has the additional difficulty that some pleople want to (only) play planes or tanks, so another dimension on which to match...
- dageshi 7y ago
  It depends on the game, but some communities loathe skill based match making. Apex Legends is currently up in arms about it because upper 20% players are being matched in with top 0.1% players and that means every single game has to be played at peak effort by everyone. There are no "casual" games any more and it's impossible to team up with friends who might have a lower skill level because they'll be matched in with that 0.1% and be decimated.
- Thaxll 7y ago
  MM doesn't solve any problems in case of cheating. Also there is no such things as "MM being really good" it's a tradoff between many criterias.
- baby 7y ago
  Having played in the counter strike competitive scene I can tell you that extremely good players were caught cheating online AND at lan parties during tournaments.
Red_Leaves_Flyy 7y ago
By far, the best approach I've seen is pooling players by metrics that cause the least controversy within said pools. Ban the hackers in waves for those extra sales, ala steam. In between just match them against each other and get the popcorn. Same for griefers, tryhards, casuals, children, etc.
gcb0 7y ago
> reasonable solution to me. A proper balancing algo solves a lot. Balance players and clump cheaters with other cheaters (maybe they even have fun while at it and continue being paying clients!). but yeah, that's a lot of work on the server (cost++) and installing a rootkit also gives you a lot of telemetry data for free! with a big percentage of the user base willing to bend over and stating "reasonable solution to me" i'd pick that option too. We only have the "gamers" to blame i guess. The companies are doing what we would do in the same situation.
zemnmez 7y ago
as someone who works in the gaming industry, i think anti-cheat exists in part because of the culture of game development. every games company i have worked with has valued releasing the content they want to release above everything else – they'll request API changes and the removal of security hurdles to meet their release deadlines. crunch culture is very real. As a small, real and not at all outlier example I was asked once if the game's backend servers could establish a persistent mutual TLS connection to authentication servers so game clients wouldn't need to implement oauth / oidc, in which they'd request whatever data they wanted in essence. Multiplayer games are only a continuation of this philosophy. For quite a few games, the 'multiplayer' aspect is created by simply replicating identical game state across all clients, meaning clients end up with a ton of information the player shouldn't be able to see being beamed to their computer. most game UIs are literally flash, or embedded chrome instances that dynamically load their content from user input or straight from the web, often over unencrypted connections. These browsers also often have direct sandbox bypasses to the game engine. Making games is hard. Making games secure is something games companies don't want to invest in, and they've largely just eaten the risk with bolt-on anticheat software. Games companies are in a similar but slightly worse position than the financial industries where, due to historically not valuing security talent they can't and don't acquire it, instead opting for whatever off-the-shelf solutions, mitigations and contractors they can use to help stem the bleeding with the exception of less than a handful of household name shops. It is possible, depending on the game to take good steps to make games harder to cheat at. Dota 2, for example took steps (in their rather favourable context) to thwart cheating by not sending information to the player on objects they should not be able to see (though mistakes are made in this on a regular basis). For any other industry, such a filter would be the standard way to implement the server-client relationship but this is not a priority in game development as it stands. There's simply no other non-security software one downloads to their computer that comes with a heavy and intrusive rootkit that attempts to try to see if you're messing with it, because no other industry as wealthy or influential as gaming considers security an afterthought.
- meheleventyone 7y ago
  Not sending info about objects you can’t see is a fairly standard thing to do. Not to big up the lack of security (which is a problem in some cases) but games often have to balance sending over to much information against other concerns. For example in an FPS you could theoretically determine exact visibility but tend to send everything within a certain radius because you want to avoid sending information late both because the client is predicting and a half-round trip of latency before an enemy that appeared round a corner showing up is bad for gameplay. Not to mention that you want the server to run reasonably quickly and visibility determination is expensive. Hence “ESP” hacks. Then you have the mechanical helpers like aimbots that can’t be solved easily even if you perfectly restricted data sent across the network to that which was visible. So we’re kind of stuck with invasive programs trying to spot hacks and broad strokes statistic analysis.
rl3 7y ago
>Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me. That's like saying it's acceptable for innocent people to rot in prison as an acceptable price to pay for catching criminals. Obviously this isn't as serious, but the comparison stands. Then again, I would argue that in an MMO context, banning a long-time player who's innocent could easily lead to their suicide. >It’s often difficult to distinguish anti-cheat software from rootkits or spyware. >It's unfortunate that it is necessary, ... I don't think it is necessary. Virtually anything can be defeated, including invasive rootkits. The best defense is simply updating the game on a regular basis, and in doing so changing up the game's internal data structures such that reversing it on any sort of ongoing basis becomes completely untenable. To do this however, you would have to integrate anti-cheat into the very fabric of the software, and unfortunately nobody does this. Instead, anti-cheat is usually approached as a third-party add-on service after the fact. Statistical analysis is another promising angle that's passive and has a very low false positive rate if used correctly. In other words, a small amount of players end up fucked over because larger publishers are cheap and lazy.
- vlozko 7y ago
  DICE claims that they’ve only ever had a handful of false claims in 2018: https://www.ea.com/games/battlefield/battlefield-5/news/anti-cheat-in-battlefield-5 https://www.ea.com/games/battlefield/battlefield-5/news/anti... With regards to the use of Linux, I suspect there’s more to this that DICE is unwilling to disclaim. Possibly that there’s a lack of ability to differentiate cheaters in Linux vs non-cheaters on a software level? DICE never officially supported Linux and stated what the requirements of the game were (Windows). However, I couldn’t find anything in their EULA or elsewhere about a platform requirement to use the software (maybe I overlooked it?). Regardless, the notice players are getting for their reason is due to cheat software so I think that may be irrelevant.
soraminazuki 7y ago
Forcing malware on users is far worse than doing nothing.
Iv 7y ago
It is not a question of lacking good alternative, it is a question of lacking good solutions. Games like FPS that emphasize fast clicking can always be defeated by anything that can emulate clicks and keypresses and see the display. If you take the problem to the limits: a camera looking at the physical screen and a robot actually moving the mouse and keyboard is going to be able to have users cheating. You simply need a reputation system. Allow people to vote on someone being a cheater or simply refuse subsequent match with them.
whatsmyusername 7y ago
Geoip banning China will take care of a large chunk of it.
jdnenej 7y ago
Also virtually all cheaters will try to claim that they did nothing and the system just failed.
Mirioron 7y ago
>Sacrificing a small percent of your playerbase in the name of having a functioning online system at all seems like a reasonable solution to me. Can those people then get full refunds for any game they purchased? Because they're paying money for the game, which they are banned from playing.
arendtio 7y ago
I hate anti-cheat software, because I had a lot more trouble with it than I had with cheaters. After all, anti-cheat software is meant to solve just one problem (people modifying the technology), but there are other ways too to destroy the gaming experience of the other players (teamkilling, wasting resources, deconstructing buildings, etc.). All those problems are not being solved by anti-cheat software. But the tools to solve them (IP-range banning, server-lockdown to known/trusted players, etc.), are also quite good at solving the cheater problem. In my experience, having a good admin community is a lot better than playing the cat and mouse game of developing an anti-cheat software.
neop1x 7y ago
There is simply NO excuse to use anti-cheat rootkits. Machine learning is starting to be mainstream and soon there will be bots interacting with HID like humans, with all anti-cheat running. You simply can't trust anonymous clients, never. Anti-cheat won't change that. You have to implement the game so that the actual players know each other and invite each other to the game, eventually kicking/blocking some themselves. Or simply play competition games on the local LAN. Or simply admit there will be cheaters on the public anonymous games. Blocking Linux is a terrible, terrible practice and they should be boycotted.

utopian3 7y ago

Is there a book (or long blog post) on the underground history of anti-cheat software & DRM? I would love to read that..

papreclip 7y ago
I would be interested in this, too. I read an interesting write-up by the guy who wrote the first .dll to hook functions in some FPS, I forget if it was quake or counterstrike. Sadly I can't seem to find it, now Detailed discussion of how cheats and anti-cheats work is somewhat lacking as all the experts on either side of the issue would prefer to keep their secrets. These days an anti-cheat team that's serious about their job will lurk cheat forums and even try to poach talent there.
chithanh 7y ago
Occasionally, some anti-cheat software gets dissected and the analysis posted publicly. Here is an analysis of BattlEye with some information on its development history: https://vmcall.blog/battleye-anticheat-analysis-and-mitigation/ https://vmcall.blog/battleye-anticheat-analysis-and-mitigati... Typically, anti-cheat is separated into a frontend and a backend. The frontend becomes active at an enumerated set of events/criteria and collects data (screenshots, keystrokes, directory listings, process lists, results of memory scans, if instructed by the backend also memory contents or file contents) to the backend for further analysis. These criteria are often ad-hoc (such as "if processes are running out of a user directory, capture them") and usually accumulate over time.

nerdponx 7y ago

they never reversed all of the bans for the very first WoW Wine ban wave This is really depressing. I can't imagine working on an anti-cheat moderation team would be a pleasant job.

ryandrake 7y ago

> However with EA I don’t really have utmost confidence they will pay any attention to this, so I’d guess it’s time to get loud if you want any hope of this being fixed. Or, stop buying games that are essentially rootkits...

matthewfcarlson 7y ago

I recently saw an interesting idea, put the game inside a lightweight container and give it a virtual GPU. The latency took a small but noticeable hit but you had verified code that you could verify that the game code hasn't been modified. Granted it wouldn't be perfect security since your threat model is someone with root access, but it makes the effort required to hack the game large though that it hopefully discourages some would be hackers

clSTophEjUdRanu 7y ago
Not all cheats inject code. Many cheats use a set of offsets to find game objects in memory and draw an overlay or minimap. This data can also be tied to autoaim hacks that uses mouse input directly for aiming.
throwaway2048 7y ago
A container doesn't bring much but additional complexity.
cooljacob204 7y ago
Some hacks do run games inside a 'container' or VM because the host machine just modifies the guests memory from the outside. (Take this with a grain of salt, I have heard some very expensive hacks work like this through word of mouth)
Keenuts 7y ago
> give it a virtual GPU That will be hard part As far I as recall, this is not something you can easily do with common consumer hardware. Real GPU virtualization is not possible on classic GPUs, and workaround methods are a bit hacky. (As far as I recall OC)

WhompingWindows 7y ago

I recall facing map-hackers in BW, SC2, and WC3...it was very frustrating, but at the same time, they were generally correspondingly worse at every game mechanic. If you played a solid, standard, scouting-based, conservative style, you could beat these players despite their handicaps. On the other hand, maphackers totally counter risk-taking players who play secretive strategies like DT rush, DT drop, high-tech rushes, players who love big drops, hidden bases...players like that would get slaughtered by map hackers. So, if you l2p, you'd be able to beat them with superior skills. Can't say the same for shooters, though, those games are ruined by hackers.

djsumdog 7y ago

It's all based on finger printing like shitty old virus scanners (that are themselves an attack surface). I know people who get by them by writing their own programs instead of using ones found online; naming them "Google Chrome" and running them as the system user so they can read/debug game processes.

p410n3 7y ago
I wish