5 ms·
This is great and all, but I feel like all of these client side cheat detection tools are basically a waste of time. Trying to enforce the trustworthiness of th
by jtms 5y ago
This is great and all, but I feel like all of these client side cheat detection tools are basically a waste of time. Trying to enforce the trustworthiness of the client is basically an unwinnable arms race between anti-cheat and the cheat makers. A better approach is for the server to treat all clients as hostile and untrustworthy and use a combination of heuristics and statistics to ferret out malicious client behavior. Valve has been doing some very interesting stuff with VACnet where they employ deep learning to flag potential cheater accounts in CS:GO and then have humans review and rule on the output. From what I have read and watched, it has been very successful.
- donkarma 5y agoAll Valve has done is made it so people cheat and pretend to be legitimate, you can't beat cheaters outside of making it a non-cheatable game, you can just reduce it. Then again, if nobody notices that you're a cheater, are you a cheater?
- s_dev 5y ago>Then again, if nobody notices that you're a cheater, are you a cheater? Yes, you're just a successful cheater as all cheaters are deceptive by definition.
- Mandatum 5y agoThey’ve been doing interesting stuff but have completely failed to succeed with anything. VAC is a joke. VACnet continues to be a pipe dream.
- temporarrry0923 5y agoVACnet hurts cheaters, and also probably 25% of legits as well. In low trust this can be verified pretty quickly. Even in the gutter of trust, redder than red, you still have about 50-60% of players cheating. That's nearly half of everyone in the WORST trust factor of the game, who are there while not cheating. Though some are probably griefers/mic-spammers/toxics, it's certainly not all of them.
- fwip 5y agoYou mean that 50-60% of players appear to be currently cheating in ways that are detectable by you.
- temporarrry0923 5y agoIf there's one thing that all cheaters have in common, it's an inflated ego. If the enemy is cheating, and half your teammates are, and it's casual, you're gonna toggle on harder. There is no way to get banned in casual, unless it's by VAC, in which case you already have it injected so it doesn't matter. You are right, though; my estimate is just personal experience
- Thaxll 5y agoBecause it's not as trivial as you think it is to get good results if you rely only on the server side, if it was the case everyone would do that. Server side cheat detection actually don't detect that much, like how do you known someone is wallhacking? As for manual review it just does no scale, when you see that CoD banned 100k cheaters, imagine if one person from activision would have to review every cases. Cloud gaming is the solution against cheats.
- thaumasiotes 5y ago> Cloud gaming is the solution against cheats. The solution to cheating is to stop playing with strangers.
- franknine 5y agohttps://twitter.com/anticheatpd/status/1412024189561851904?s=21 https://twitter.com/anticheatpd/status/1412024189561851904?s... There are cheats doing CV on video stream and they work on consoles. I guess they would also work on cloud gaming services.
- SXX 5y agoUh oh what would stop my ML-based auto-aim from cheating in FPS running on cloud? Cheats now might be fine with just video feed as input.
- tester756 5y agoIf that was 2015 or 2010 then I'd say: why would people competent in computer vision waste time on making 30$ cheats when they can use their skills at faang for probably 200k? but nowadays idk whether it stands
- novok 5y agoBecause they are kids and they use it as a practice ground to gain those skills inadvertently. Or they use it as a practice ground where they don't have to deal with bigtech BS and can just develop with no design reviews and all the miles of BS getting in your way.
- sneak 5y agoSimply because a tech arms race is theoretically unwinnable doesn't mean that trying to win a little doesn't deliver value to the company and its ecosystem. You can emulate an android and run snapchat and screenshot the emulator, but the screenshot reporting inside of snapchat is still valued by millions (and shapes the behavior of millions).
- MMS21 5y agoiirc there are modified Snapchat apks that can screenshot snaps without notifying the sender
- sevenf0ur 5y agoAs someone that has played CSGO recently, it's still normal to come across cheaters. Server side cheat prevention is preferred when possible, but there are just too many opportunities for client side cheating in multiplayer FPSs. You can't prevent the client from auto-aiming or knowing the enemy player position behind a nearby wall. If you do not stay on top of cheating, cheaters will ruin your game.
- temporarrry0923 5y ago>You can't prevent the client from auto-aiming or knowing the enemy player position behind a nearby wall Valorant and Edan.gg's defender [1] has the best fog of war system I've ever seen. CSGO has probably the worst; in fact, at one point, the game had NONE and sent player pos's to everyone at all times. I completely agree, but there are a lot of server-side mitigations that haven't been nearly as explored as I'd hope. [1]: https://edan.gg/defender https://edan.gg/defender
- judge2020 5y agoI'm a little skeptical that that's the case. When I cheated in CS:GO years ago (1856 days ago in 2016), I specifically remember being unable to see where people went at the beginning of the round, and sniping double-doors on dust2 showed people only when they were about to pass by the opening. This was on official competitive servers, so maybe you only mean self-hosted servers don't have FOW.
- temporarrry0923 5y agoI mean, it has fog of war, yes. It's not as good or strict as it could be. I have seen discussions with the devs and they say that if it is more "strict" (ie hiding player positions until they are closer) would be more taxing on CSGO servers, AND would screw with high ping players (they would experience pop-in). Check out https://edan.gg/defender https://edan.gg/defender to see the comparison between CSGO and a better FoW system.
- 5y ago
- slezyr 5y ago> From what I have read and watched, it has been very successful. Let me guess, you have not played CS:GO? There is an insane number of obvious cheaters, more than in other games I played. Also, there is TeamFortress 2 that's just has been abandoned and they can not an anti-cheat to it, it seems.
- Unklejoe 5y ago> unwinnable It seems winnable so far if you look at the Xbox One and later, at least. I'm not aware of anyone successfully modifying game code on those consoles. The downside is that it a requires a completely locked down system.
- Pxtl 5y agoIn the cases where end-to-end vendor control over the hardware from the player's fingers to the HDMI out exists, yes that seems possible. But on a PC? Where the user can install whatever software they like? Much harder. It feels like stopping aimbots will ultimately fail as eventually we'll see bots that use machine-vision to spot heads and pick them off. You wouldn't even need to run it on the cheating machine, this could be a separate device doing passthrough on the mouse, keyboard, and monitor.
- nitrogen 5y agoSomeone else mentioned doing this: https://news.ycombinator.com/item?id=28634631 https://news.ycombinator.com/item?id=28634631 Even if they turn on HDCP, you could just get a low-lag monitor and point a camera at it.
- shadilay 5y agoYou can just buy an HDCP stripper. https://www.amazon.com/Easyday-Stripper-Splitter-Signal-Amplifier/dp/B01FKL8Z46 https://www.amazon.com/Easyday-Stripper-Splitter-Signal-Ampl...
- half-kh-hacker 5y agoCheat dev here. Check out this prior art of someone utilizing PS4 jailbreak exploits to modify GTA V's scripting VM at runtime: https://github.com/2much4u/PS4-GTA-V-Native-Caller https://github.com/2much4u/PS4-GTA-V-Native-Caller
- vkou 5y agoIt's an unwinnable arms race if your goal is zero cheating. It can work well enough if your goal is 'ban/hellban cheaters relatively quickly'. If the time/money cost of creating a new account is non-trivial, this can very well get cheating down to some acceptable level. Server-side statistics can be used in addition to this kind of client-side monitoring, but there's only so much that can be inferred from statistics. It may not be too difficult to determine if someone is using, say, an aimbot from statistics, but it's very difficult to determine if they are using a radar - because the cheater still has to make fuzzy, human decisions, based on the information that radar gives them - and because its difficult to tell radar apart from good gamesense.
- malwrar 5y agoI used to write cheats for various source engine games (running vac), and later more interesting games like pubg which run battleeye. Those are two very different anticheats, and I think comparing them is interesting An important thing to point out is that it requires a lot of reversing work and low level knowledge to make a cheat, and usually at the end of the day cheats all end up with the same core features anyways. This means that there’s a huge stigma amongst cheat developers around knowledge sharing, which makes a lot of that initial work all the more arduous. Anticheats further increase that initial work, and incur an ongoing maintenance cost since each update can break your cheat (especially of you specifically work to break the public methods that everyone is using). Last time I looked at VAC, it was doing stuff like looking for stuff like modifications to the .text section to detect hooks implemented by writing e.g. jmps to some injected code, but never actually adapted when people started just modifying vtable entries (most source engine constructs are exposed to developers as pure virtual cpp classes). Since they stagnated, it got easier and easier to cheat over time as more and more people spread knowledge on how to hook in an undetected way. Hell, in gmod some lua anticheat developer (gmod is a sandbox game with a lua scripting interface) found a vuln in the clientside lua implementation that allowed arbitrary memory io and used that primitive to implement checks for injected dlls when people started cheating at that level in that game, which was far more effective than VAC ever was. BE was another universe, it felt extremely prohibitive to touch the game in usermode & even in the kernel I started to feel cramped. You can still totally get past it, but it felt more like writing a very specific rootkit than actually making a cheat. So, from the other side, anticheats raise the cost of initially developing and maintaining a cheat. If used effectively, they can also kill paysites. I think they have value, even if they aren’t achieving a 99.99999% success rate.
- swinglock 5y agoMuch like anti-virus software. What is BE?
- heinrich5991 5y agoBattlEye maybe.
- 5y ago
- sigotirandolas 5y agoPerhaps if you want a perfect solution, but in practice most people aren't cheaters, and those that cheat tend to eventually make a mistake and get caught by the anti-cheat. The remaining 1337 you can manage manually.
- rastafang 5y agoCheating in CS:GO's casual mode is still very common, not sure about competitive. But yes, server-side detection would make more sense.