8 ms·

Arguably necessary when cheats people install themselves are actual rootkits.

by judge2020 5y ago

10000truths 5y ago
Not 'arguably necessary'. Cheats can just as easily be detected from the server side through statistical analysis.
- gruez 5y ago
  That can only detect obvious hacking. Subtle hacking is hard enough to detect that you'd either have to accept high amounts of false positives or false negatives.
  - AmericanChopper 5y ago
    Eliminating obvious hacking would be an improvement in a lot of games. You can get good enough to outplay a waller with a subtle aimbot, especially considering the cheaters are typically not very good at the game. The “rage hacks” offer no level of counter play at all.
- shreddit 5y ago
  That so called “guessing” has an awful amount of false positives
- ketralnis 5y ago
  Oh great, so you've solved the problem then. The entire industry just hasn't discovered your one simple trick. You should let them know.
  - pstrateman 5y ago
    Yeah except he's right, the vast majority of cheaters can be detected server side. Literally no game does this, because ?????
    - nightowl_games 5y ago
      Sounds like a startup opportunity. Lookin' forward to the pitch deck!
      - TillE 5y ago
        What kind of massive startup ROI are you expecting to make from a highly niche bit of middleware? Just because something is possible doesn't make it profitable.
        pstrateman 5y ago
        Worse the game publishers make more money from cheaters than from legit players. Cheaters have to keep re-buying the game when they get banned. The incentives are for publishers to ban cheaters... but not too fast... and that's exactly what we see happening in practice. Kinda interesting huh
        esyir 5y ago
        I doubt it. Especially since the games where cheaters are most rampant are f2p.
        fletchowns 5y ago
        Video game industry is massive, and cheating is rampant and ruining peoples experience in game. I don't think it's the craziest idea
    - sudosysgen 5y ago
      CS:GO does do this.
    - erk__ 5y ago
      Valve have been doing it with Counter Strike for at least 3 years. And the "VACnet" they have is still far from perfect. Especially with the less obvious cheats. They used to be a talk on youtube, but it seems to have been taken down.
  - echlebek 5y ago
    I don't think that level of snark is really warranted here.
  - sudosysgen 5y ago
    Valve does this though. I'm pretty sure their VACnet is more effective than their classical anticheat. It's just a lot more effort.
    - mrguyorama 5y ago
      VACnet IS more effective than their previous system, but that's a LOW bar. CS:GO is still full of obvious spinbotters and wallhackers that get to ruin a hundred competitive games before eventually getting banned, and just grabbing a new account. VACnet for some reason can't even get the obvious stuff; Spinbotting looks nothing like a normal person playing, to the point that you could probably write "if average rotation rate > some high bar then ban" and do better
    - deleted 5y ago
      [deleted]
  - AmericanChopper 5y ago
    You’d be very surprised how much of the industry hasn’t discovered this. There’s lots of stats that can be used to reliably detect cheating. * New account * K/D ratio that’s multiple times better than the best players in the game * Using incredibly off-meta “cheater builds” * Consistent record breaking total kill count * Inhumanly low TTK and headshot ratio * Speed hacks that allow you to move around the map much faster than you should be * Time to lock on/switch between targets All of those are incredibly easy to statistically analyze. I play a fair amount of Warzone, and I often run in to cheaters that would fail a very basic “definitely cheating” stats check. You can even get a rather reliable indication of whether there’s an obvious cheater in the lobby by how quickly the surviving player count goes down. A 3rd party implemented an app that looks up the stats of every player in your lobby, that players were using to detect the more obvious cheaters. There’s no non-cheating explanation for a double-digit K/D player getting 50+ kills for the past few matches in this game, but you’ll find players like that in your games routinely. The developer response was to declare the app against ToS and modify the public end points that provided those stats, breaking the app. That’s one of the biggest games in the world, they’re clearly not utilizing even simple statistical methodology, and they don’t want users doing it themselves to decide what lobbies to back out of.
- nx7487 5y ago
  Client-side analysis allows the game to identify unauthorized access to game state, which is the root cause of most cheating (probably not going to prevent computer vision aimbots that just analyze frames). It's just a much simpler and effective solution than fine-tuning a statistical model.
  - 10000truths 5y ago
    If it's running on the client, it can be patched out. Any checks done on the client side can be bypassed. Sure, obfuscation will deter most people from trying to reverse engineer the checks, but all it takes is one person to succeed and distribute their cheat program to others.
- babypuncher 5y ago
  I think if this were true, somebody would have successfully done it by now.
pstrateman 5y ago
Sure except EAC doesn't work, even on windows with the full kernel rootkit installed. Money back guarantee SaaS cheats are like $10/month that are undetected by EAC.
- AustinDev 5y ago
  And those aren't even cheaters using a full DMA module and separate PC which is nearly impossible to detect if done properly.
  - temporarrry0923 5y ago
    Or worse machine-learning-to-bounding-box that takes the video stream through HDMI, identifies character heads, intercepts the USB HID mouse, and injects movement commands to move the center of the screen towards the nearest "head". Literally (not nearly) impossible to detect, there is no difference between this and just aiming by hand. The video is already out of the box, and the USB HID packets look the same as the real mouse's commands. I spent about two months creating training data for this and it now runs smoothly on a sister PC with a capture card. I gave up because I got bored (and perhaps felt guilty about cheating) but I wholeheartedly believe I could have played top 500 region online matches and gotten away with it, as investigations usually trigger manual DMA checks by ESEA/Faceit mods, and a manual ("automated") ban in that case. But there is no DMA in my setup. The only way to get banned would be to play stupidly and obviously cheat, and to be honest that's a plus of my setup: the neural network is not perfect, so the aimbot can't be perfect. Like a built-in humanizer.
    - cooljacob204 5y ago
      To be honest I have completely given up on competitive fps games. The cheating situation has only gotten worse and I really don't see anti-cheat makers winning.
      - temporarrry0923 5y ago
        I wish I could reply to this with a rallying cry for you to keep trying. But it's true, every 14 year old kid with a keyboard can cheat in competitive now.
Razengan 5y ago
> cheats people install themselves are actual rootkits. reply Examples? That’s like the “Apple shouldn’t allow third-party stores because of malware” argument.
- sascha_sl 5y ago
  Vanguard blocked some tools that had easily exploitable kernel modules at the start because people were using them to get cheats into kernel mode.
tablespoon 5y ago
> Arguably necessary when cheats people install themselves are actual rootkits. There's a hardware cheat that's actually in the wild that uses a capture card, computer vision, and hardware input devices to run entirely outside the OS: https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-computer-vision-auto-aim-that-works-on-any-game/ https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-...
- rcoveson 5y ago
  With all my heart, I'm rooting for the authors of this approach. Anti-cheat and DRM hide behind the defense of practicality and cost efficiency, but these products are absolutely evil. As personal computers are becoming more and more an extension of our bodies and minds, it is essential that they act in our interests and nobody else's. Imagine a prosthetic leg that phoned the insurance company if it detected illegal drugs in your blood. That's how I feel about these rootkit anti-cheats. So please, let the cheaters turn to human-interface cheating methods. Force companies to deal with these problems in the proper way, like any other security problem: Don't trust the client at all. Infecting the client with your own agents is not an option. Can't make it work? Then use a different business model. Have your users put time and money into the game, and require more time and money the higher up the ranked ladder they climb. If they're buying as many in-game cosmetics as the average user, and playing for as much time as the average user must to reach a given level, then they never notice. If not, don't let them climb the ladder until they do. If they get reported by other players as cheaters, and manual validation confirms it, then they lose their investment. With that approach, you could have the most obviously hacked account in the world and it wouldn't be able to impact anybody for long without covering the costs of its own detection and banning.
  - thirtyseven 5y ago
    Not a game dev but I don't think that's really feasible in a world where network latency is a thing, and it's necessary to send game state to a client that may not currently be visible on screen, unless you'd like us to move to a Stadia-like model of game streaming and dumb terminals.
devwastaken 5y ago
Epics anti cheat doesn't even work. flocks of kids get actual aim bots that epic can't deal with. CSGO anti cheat is yet to be matched in quality because it relies on players and statistics. It turns out that you can't control client software and hardware. Good competitive cheaters use hardware aim assist. Any software you make will be modified. The only way to stop cheaters is math, and people.
- Kaze404 5y ago
  > The only way to stop cheaters is math, and people. And clever game design
- raydev 5y ago
  In competitive Fortnite it seems like Epic is quick to permaban cheaters. Personally, in the last year of playing, I'm not sure I've run into more than a couple obvious aimbotters. But I guess Epic has games besides Fortnite.
  - devwastaken 5y ago
    Aimbots are a form of obvious cheat. If anti cheat worked, they wouldn't be possible. The movement of the player input and accuracy is mathematically obvious. The problem is anti cheats aren't designed to prevent cheating, they're designed to sell a product that non programmers want to buy. Same as DRM. Somewhere down the list is actually having the anti cheat work, it's not the main goal.
- anonymousab 5y ago
  > The only way to stop cheaters is math, and people. People are plenty enough. Let them run their own servers with robust moderation tools and custom software and then the community can deal with cheaters effectively. And false positives can simply find another server, since availability in a popular game will be higher than developer provided servers. Over a decade of locking online gameplay even further behind developer and publisher control has been one of the greatest boons for cheaters.
adapiz 5y ago
We need to go deeper! Cheat Makers produce their own kernels that trick the kernel modules by intercepting everything theses modules do. I don't know if there is even cheat software on Linux, but if there's a market, there might be a product.

Arguably necessary when cheats people install themselves are actual rootkits.

10000truths 5y ago

Not 'arguably necessary'. Cheats can just as easily be detected from the server side through statistical analysis.

gruez 5y ago
That can only detect obvious hacking. Subtle hacking is hard enough to detect that you'd either have to accept high amounts of false positives or false negatives.
- AmericanChopper 5y ago
  Eliminating obvious hacking would be an improvement in a lot of games. You can get good enough to outplay a waller with a subtle aimbot, especially considering the cheaters are typically not very good at the game. The “rage hacks” offer no level of counter play at all.
shreddit 5y ago
That so called “guessing” has an awful amount of false positives
ketralnis 5y ago
Oh great, so you've solved the problem then. The entire industry just hasn't discovered your one simple trick. You should let them know.
- pstrateman 5y ago
  Yeah except he's right, the vast majority of cheaters can be detected server side. Literally no game does this, because ?????
  - nightowl_games 5y ago
    Sounds like a startup opportunity. Lookin' forward to the pitch deck!
    - TillE 5y ago
      What kind of massive startup ROI are you expecting to make from a highly niche bit of middleware? Just because something is possible doesn't make it profitable.
      - pstrateman 5y ago
        Worse the game publishers make more money from cheaters than from legit players. Cheaters have to keep re-buying the game when they get banned. The incentives are for publishers to ban cheaters... but not too fast... and that's exactly what we see happening in practice. Kinda interesting huh
        esyir 5y ago
        I doubt it. Especially since the games where cheaters are most rampant are f2p.
      - fletchowns 5y ago
        Video game industry is massive, and cheating is rampant and ruining peoples experience in game. I don't think it's the craziest idea
  - sudosysgen 5y ago
    CS:GO does do this.
  - erk__ 5y ago
    Valve have been doing it with Counter Strike for at least 3 years. And the "VACnet" they have is still far from perfect. Especially with the less obvious cheats. They used to be a talk on youtube, but it seems to have been taken down.
- echlebek 5y ago
  I don't think that level of snark is really warranted here.
- sudosysgen 5y ago
  Valve does this though. I'm pretty sure their VACnet is more effective than their classical anticheat. It's just a lot more effort.
  - mrguyorama 5y ago
    VACnet IS more effective than their previous system, but that's a LOW bar. CS:GO is still full of obvious spinbotters and wallhackers that get to ruin a hundred competitive games before eventually getting banned, and just grabbing a new account. VACnet for some reason can't even get the obvious stuff; Spinbotting looks nothing like a normal person playing, to the point that you could probably write "if average rotation rate > some high bar then ban" and do better
  - deleted 5y ago
    [deleted]
- AmericanChopper 5y ago
  You’d be very surprised how much of the industry hasn’t discovered this. There’s lots of stats that can be used to reliably detect cheating. * New account * K/D ratio that’s multiple times better than the best players in the game * Using incredibly off-meta “cheater builds” * Consistent record breaking total kill count * Inhumanly low TTK and headshot ratio * Speed hacks that allow you to move around the map much faster than you should be * Time to lock on/switch between targets All of those are incredibly easy to statistically analyze. I play a fair amount of Warzone, and I often run in to cheaters that would fail a very basic “definitely cheating” stats check. You can even get a rather reliable indication of whether there’s an obvious cheater in the lobby by how quickly the surviving player count goes down. A 3rd party implemented an app that looks up the stats of every player in your lobby, that players were using to detect the more obvious cheaters. There’s no non-cheating explanation for a double-digit K/D player getting 50+ kills for the past few matches in this game, but you’ll find players like that in your games routinely. The developer response was to declare the app against ToS and modify the public end points that provided those stats, breaking the app. That’s one of the biggest games in the world, they’re clearly not utilizing even simple statistical methodology, and they don’t want users doing it themselves to decide what lobbies to back out of.
nx7487 5y ago
Client-side analysis allows the game to identify unauthorized access to game state, which is the root cause of most cheating (probably not going to prevent computer vision aimbots that just analyze frames). It's just a much simpler and effective solution than fine-tuning a statistical model.
- 10000truths 5y ago
  If it's running on the client, it can be patched out. Any checks done on the client side can be bypassed. Sure, obfuscation will deter most people from trying to reverse engineer the checks, but all it takes is one person to succeed and distribute their cheat program to others.
babypuncher 5y ago
I think if this were true, somebody would have successfully done it by now.

pstrateman 5y ago

Sure except EAC doesn't work, even on windows with the full kernel rootkit installed. Money back guarantee SaaS cheats are like $10/month that are undetected by EAC.

AustinDev 5y ago
And those aren't even cheaters using a full DMA module and separate PC which is nearly impossible to detect if done properly.
- temporarrry0923 5y ago
  Or worse machine-learning-to-bounding-box that takes the video stream through HDMI, identifies character heads, intercepts the USB HID mouse, and injects movement commands to move the center of the screen towards the nearest "head". Literally (not nearly) impossible to detect, there is no difference between this and just aiming by hand. The video is already out of the box, and the USB HID packets look the same as the real mouse's commands. I spent about two months creating training data for this and it now runs smoothly on a sister PC with a capture card. I gave up because I got bored (and perhaps felt guilty about cheating) but I wholeheartedly believe I could have played top 500 region online matches and gotten away with it, as investigations usually trigger manual DMA checks by ESEA/Faceit mods, and a manual ("automated") ban in that case. But there is no DMA in my setup. The only way to get banned would be to play stupidly and obviously cheat, and to be honest that's a plus of my setup: the neural network is not perfect, so the aimbot can't be perfect. Like a built-in humanizer.
  - cooljacob204 5y ago
    To be honest I have completely given up on competitive fps games. The cheating situation has only gotten worse and I really don't see anti-cheat makers winning.
    - temporarrry0923 5y ago
      I wish I could reply to this with a rallying cry for you to keep trying. But it's true, every 14 year old kid with a keyboard can cheat in competitive now.

Razengan 5y ago

> cheats people install themselves are actual rootkits. reply Examples? That’s like the “Apple shouldn’t allow third-party stores because of malware” argument.

sascha_sl 5y ago
Vanguard blocked some tools that had easily exploitable kernel modules at the start because people were using them to get cheats into kernel mode.

tablespoon 5y ago

> Arguably necessary when cheats people install themselves are actual rootkits. There's a hardware cheat that's actually in the wild that uses a capture card, computer vision, and hardware input devices to run entirely outside the OS: https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-computer-vision-auto-aim-that-works-on-any-game/ https://arstechnica.com/gaming/2021/07/cheat-maker-brags-of-...

rcoveson 5y ago
With all my heart, I'm rooting for the authors of this approach. Anti-cheat and DRM hide behind the defense of practicality and cost efficiency, but these products are absolutely evil. As personal computers are becoming more and more an extension of our bodies and minds, it is essential that they act in our interests and nobody else's. Imagine a prosthetic leg that phoned the insurance company if it detected illegal drugs in your blood. That's how I feel about these rootkit anti-cheats. So please, let the cheaters turn to human-interface cheating methods. Force companies to deal with these problems in the proper way, like any other security problem: Don't trust the client at all. Infecting the client with your own agents is not an option. Can't make it work? Then use a different business model. Have your users put time and money into the game, and require more time and money the higher up the ranked ladder they climb. If they're buying as many in-game cosmetics as the average user, and playing for as much time as the average user must to reach a given level, then they never notice. If not, don't let them climb the ladder until they do. If they get reported by other players as cheaters, and manual validation confirms it, then they lose their investment. With that approach, you could have the most obviously hacked account in the world and it wouldn't be able to impact anybody for long without covering the costs of its own detection and banning.
- thirtyseven 5y ago
  Not a game dev but I don't think that's really feasible in a world where network latency is a thing, and it's necessary to send game state to a client that may not currently be visible on screen, unless you'd like us to move to a Stadia-like model of game streaming and dumb terminals.

devwastaken 5y ago

Epics anti cheat doesn't even work. flocks of kids get actual aim bots that epic can't deal with. CSGO anti cheat is yet to be matched in quality because it relies on players and statistics. It turns out that you can't control client software and hardware. Good competitive cheaters use hardware aim assist. Any software you make will be modified. The only way to stop cheaters is math, and people.

Kaze404 5y ago
> The only way to stop cheaters is math, and people. And clever game design
raydev 5y ago
In competitive Fortnite it seems like Epic is quick to permaban cheaters. Personally, in the last year of playing, I'm not sure I've run into more than a couple obvious aimbotters. But I guess Epic has games besides Fortnite.
- devwastaken 5y ago
  Aimbots are a form of obvious cheat. If anti cheat worked, they wouldn't be possible. The movement of the player input and accuracy is mathematically obvious. The problem is anti cheats aren't designed to prevent cheating, they're designed to sell a product that non programmers want to buy. Same as DRM. Somewhere down the list is actually having the anti cheat work, it's not the main goal.
anonymousab 5y ago
> The only way to stop cheaters is math, and people. People are plenty enough. Let them run their own servers with robust moderation tools and custom software and then the community can deal with cheaters effectively. And false positives can simply find another server, since availability in a popular game will be higher than developer provided servers. Over a decade of locking online gameplay even further behind developer and publisher control has been one of the greatest boons for cheaters.

adapiz 5y ago

We need to go deeper! Cheat Makers produce their own kernels that trick the kernel modules by intercepting everything theses modules do. I don't know if there is even cheat software on Linux, but if there's a market, there might be a product.