5 ms·

The problem is the cheats use kernel drivers so the anti cheat providers have to to keep up. Edit: rather than downvoting can someone offer a reason as to why?

Bancakes 5y ago
Because human moderation after an AI serverside filter is much more consistent and less desperate than solving the halting problem clientside 2 rings below your app's privilege level.
- maccard 5y ago
  Can you give an example of some games that take that approach that it works for? I'd also suggest that human moderation is definitely less consistent, and definitely less able to scale. Nobody is trying to solve the halting problem in the kernel either. If a cheat runs as a kernel level driver, and anticheat doesnt you've lost the battle already.
  - Bancakes 5y ago
    CSGO and Overwatch come to mind. I watch a talk on the latter, how the devs transitioned and optimised their anticheat system. It makes sense the cheat I wrote would run as admin. It's my PC after all. I also don't have access to the server in any meaningful way and modify other people's data, either. It's a good trade-off. Devs can also write arbitrarily good statistical analyses for the game. It's their responsibility. The question is simple - is this person performing abnormally? Well, games gather tons of telemetry nowadays, and the harder-to-detect cheats like wallhacks or fluorescent player textures are also the least useful. I am a hard silver I in CSGO. With or without aids, when I see someone run around the corner, I'll duck and magdump. Any gold nova will overpower me either way.
- DizzyDoo 5y ago
  I do think you're correct, but one particularly sticky issue is what you do with all the subtle cheats. Rather than developing an exploit with wall-clip, radar, auto-headshots and so on - all obvious to a human moderator - what if you make one that just lowers recoil by a smidgen, 20% or so. If you're watching the game as a moderator you could never tell that's what's happening. Yet -20% recoil, especially for a competitive esports player, would be such a massive advantage as to make that player the best in the world, but a way that looks quite legitimate.
  - gbrown 5y ago
    Wouldnt that be trivially detectable in the data by comparing the nominal recoil configuration, reported hitscan trajectories, and mouse input profiles? Especially since the cheats need to be available somewhere, so the developers should certainly be able to get their hands on them to test...
    - the8472 5y ago
      I assume that the argument is that pros can compensate recoil to some extent (i.e. the game doesn't just add increasingly random offsets to the trajectors but actually moves the crosshair and you can move it back if you're fast enough). If so then a cheat only has to simulate sufficiently realistic inputs based on the pixel outputs of the game, which is practically undetectable if you do it on external hardware. The only advantage the game devs would have is a larger amount of data they can use to determine what passes as realistic. And how are they going to identify false positives?
    - sodality2 5y ago
      Not when the inputs are all randomized, it's nearly identical to a real human recoil control
the8472 5y ago
That is a cat-and-mouse game you cannot win, similar to DRM. There already are hardware cheating devices that use DMA to peek and poke main memory. Or cheats could run in a hypervisor or on vulnerable hardware in a SMM rootkit. And if the response to that is ever more invasive surveillance technology then that's a security problem.
- maccard 5y ago
  And the mistake people make is thinking it's a win or lose thing, it's not. It's about reducing the impact of cheaters and raising the bar high enough that an average Joe isn't willing to put up with the hassle needed to cheat. Just vexauwe you can't detect everyone doesn't mean you shouldn't ever try.
  - the8472 5y ago
    > It's about reducing the impact of cheaters It's putting the collateral damage of these measures on the honest people to deter a few. These rootkits make everyone's systems less secure and less stable. Some even keep running after you close the game. This is a hidden cost put on the consumers so that the game developers can profit without having to design a game that is safe when dealing with untrusted clients.
    - maccard 5y ago
      > it's putting the collateral damage of these measures on the honest people to deter a few. It's putting the collateral on _everyone_ to deter a few who have a substantial impact. It's completely different to DRM where there is no knock on impact to other legit customers. > Some even keep running after you close the game. They all do. If they don't, then the cheat just needs to run first. > game developers can profit without having to design a game that is safe when dealing with untrusted clients. This isn't about profit, and thinking it is is pushing your agenda. On the most extreme side you can just pixel stream a rendered video feed, but the latency is awful for many kinds of games. You inevitably need to let the client have some sort of say (I shot at X), and it _will_ be abused.
useryman 5y ago
So, when cheats are implemented as rootkits/VM hosts, will that be required for the anticheat too? I think at that point, it's turtles all the way down.
- maccard 5y ago
  They already are rootkits and running in VMs. That's exactly why were talking about this. Most anticheat programs attempt to detect running in a VM host too and stop that..
okamiueru 5y ago
It has always seemed like a flawed argument to me. The effort made into detecting running cheats requires the ability to monitor processes and give a level of access that has no place in a game. How many computers have Valorant's anti-cheat installed on some computer it shouldn't be installed on, that suddenly gives the ability to decrypt and monitor tls traffic on the device, without detection? It would make a lot more sense to detect cheating based on user input. Even stochastic cheats are possible to detect (where you say improve your aim in more subtle ways), yet, the most egregious auto-lock-on go on for years. Kernel level anti-cheats are attractive, because you suddenly have a rootkit installed on millions of computers that you control. Monitoring the behaviour of them is also no good, because a targeted update can make it do whatever.

Bancakes 5y ago

Because human moderation after an AI serverside filter is much more consistent and less desperate than solving the halting problem clientside 2 rings below your app's privilege level.

maccard 5y ago
Can you give an example of some games that take that approach that it works for? I'd also suggest that human moderation is definitely less consistent, and definitely less able to scale. Nobody is trying to solve the halting problem in the kernel either. If a cheat runs as a kernel level driver, and anticheat doesnt you've lost the battle already.
- Bancakes 5y ago
  CSGO and Overwatch come to mind. I watch a talk on the latter, how the devs transitioned and optimised their anticheat system. It makes sense the cheat I wrote would run as admin. It's my PC after all. I also don't have access to the server in any meaningful way and modify other people's data, either. It's a good trade-off. Devs can also write arbitrarily good statistical analyses for the game. It's their responsibility. The question is simple - is this person performing abnormally? Well, games gather tons of telemetry nowadays, and the harder-to-detect cheats like wallhacks or fluorescent player textures are also the least useful. I am a hard silver I in CSGO. With or without aids, when I see someone run around the corner, I'll duck and magdump. Any gold nova will overpower me either way.
DizzyDoo 5y ago
I do think you're correct, but one particularly sticky issue is what you do with all the subtle cheats. Rather than developing an exploit with wall-clip, radar, auto-headshots and so on - all obvious to a human moderator - what if you make one that just lowers recoil by a smidgen, 20% or so. If you're watching the game as a moderator you could never tell that's what's happening. Yet -20% recoil, especially for a competitive esports player, would be such a massive advantage as to make that player the best in the world, but a way that looks quite legitimate.
- gbrown 5y ago
  Wouldnt that be trivially detectable in the data by comparing the nominal recoil configuration, reported hitscan trajectories, and mouse input profiles? Especially since the cheats need to be available somewhere, so the developers should certainly be able to get their hands on them to test...
  - the8472 5y ago
    I assume that the argument is that pros can compensate recoil to some extent (i.e. the game doesn't just add increasingly random offsets to the trajectors but actually moves the crosshair and you can move it back if you're fast enough). If so then a cheat only has to simulate sufficiently realistic inputs based on the pixel outputs of the game, which is practically undetectable if you do it on external hardware. The only advantage the game devs would have is a larger amount of data they can use to determine what passes as realistic. And how are they going to identify false positives?
  - sodality2 5y ago
    Not when the inputs are all randomized, it's nearly identical to a real human recoil control

the8472 5y ago

That is a cat-and-mouse game you cannot win, similar to DRM. There already are hardware cheating devices that use DMA to peek and poke main memory. Or cheats could run in a hypervisor or on vulnerable hardware in a SMM rootkit. And if the response to that is ever more invasive surveillance technology then that's a security problem.

maccard 5y ago
And the mistake people make is thinking it's a win or lose thing, it's not. It's about reducing the impact of cheaters and raising the bar high enough that an average Joe isn't willing to put up with the hassle needed to cheat. Just vexauwe you can't detect everyone doesn't mean you shouldn't ever try.
- the8472 5y ago
  > It's about reducing the impact of cheaters It's putting the collateral damage of these measures on the honest people to deter a few. These rootkits make everyone's systems less secure and less stable. Some even keep running after you close the game. This is a hidden cost put on the consumers so that the game developers can profit without having to design a game that is safe when dealing with untrusted clients.
  - maccard 5y ago
    > it's putting the collateral damage of these measures on the honest people to deter a few. It's putting the collateral on _everyone_ to deter a few who have a substantial impact. It's completely different to DRM where there is no knock on impact to other legit customers. > Some even keep running after you close the game. They all do. If they don't, then the cheat just needs to run first. > game developers can profit without having to design a game that is safe when dealing with untrusted clients. This isn't about profit, and thinking it is is pushing your agenda. On the most extreme side you can just pixel stream a rendered video feed, but the latency is awful for many kinds of games. You inevitably need to let the client have some sort of say (I shot at X), and it _will_ be abused.

useryman 5y ago

So, when cheats are implemented as rootkits/VM hosts, will that be required for the anticheat too? I think at that point, it's turtles all the way down.

maccard 5y ago
They already are rootkits and running in VMs. That's exactly why were talking about this. Most anticheat programs attempt to detect running in a VM host too and stop that..

okamiueru 5y ago

It has always seemed like a flawed argument to me. The effort made into detecting running cheats requires the ability to monitor processes and give a level of access that has no place in a game. How many computers have Valorant's anti-cheat installed on some computer it shouldn't be installed on, that suddenly gives the ability to decrypt and monitor tls traffic on the device, without detection? It would make a lot more sense to detect cheating based on user input. Even stochastic cheats are possible to detect (where you say improve your aim in more subtle ways), yet, the most egregious auto-lock-on go on for years. Kernel level anti-cheats are attractive, because you suddenly have a rootkit installed on millions of computers that you control. Monitoring the behaviour of them is also no good, because a targeted update can make it do whatever.