4 ms·

Are there alternatives for anti cheat that don't require as much access?

by rascul 2y ago

viraptor 2y ago
I don't know if you can solve everything in an alternative way, but after watching the drama in Tarkov last year, I think the game companies are leaving a lot of low hanging fruit. For example people who can see through walls will track someone coming from behind the wall, before they can be seen. The server has the record of it. In the specific case of Tarkov, people got more information about other players by pointing at their wallhacked silhouettes. Again, the server knows. So did external people have to make videos about "the wiggle" to cause any change? There's so much that could be done through basic behaviour analysis and injecting false data. Yet, instead of that, games just come loaded with anti-cheats that barely work.
GaggiX 2y ago
The new VAC ban wave has been achieved using machine learning on the server side.
- verandaguy 2y ago
  100% this. VAC remains one of the more effective anti-cheats out there while retaining relatively few privileges on the client machines. A gaming youtuber, 3kliksphilip, made a 10-minute rundown of the state of VAC and where it may be going from here: https://www.youtube.com/watch?v=6DHMAwAeRMA https://www.youtube.com/watch?v=6DHMAwAeRMA. I'm unaffiliated with the channel. The video front-loads some information that many readers here will already be familiar with (along the lines of "what's a kernel and who decided to put so many rings on it") but overall it's a nice light watch.
  - mrguyorama 2y ago
    VAC is laughable. The state of cheating in CounterStrike has always been one of the worst games in the industry. VAC doesn't even stop blatant spin botters. This is especially bad because in CounterStrike, a "game" is a one hour commitment with the same group of people, and most people near the higher levels of rankings report getting a match with a cheater in about 1/10 matches or more. It's so bad, there are MULTIPLE third party companies whose entire product is "we install a rootkit style anticheat software so you can actually play counterstrike" like Faceit. Counterstrike official servers are unplayable because of cheating. I mean, christ, Warowl literally had a video last week about how it's impossible to play the new counterstrike because of cheating! Philip should definitely be aware of that situation. Holding it up as some sort of pillar of achievement is absurd.
    - GaggiX 2y ago
      Have you seen the latest VAC ban wave?
jerf 2y ago
Anti-cheat is physically an uphill battle, because, in the end, it's all just numbers. Anti-cheat is basically trying to say "you can send these numbers but you can't send those numbers". But I can send "those" numbers. I can send any numbers I want. You can make it difficult to send the right numbers, but I've got your numbers that describe how to send the numbers right in front of me, which is a rather large help. That's not to say it's hopeless. Sibling comments point out various options that can be run purely server-side. But there's no perfect solution. Even cloud gaming can't prevent cheating because I can take the resulting video stream and run computer vision algorithms on it and still send wrong-numbers back up as my input stream. This may not let me see through walls but is still plenty to implement an aimbot, for instance. Push it into a DRM'd device and I can grab the HDMI stream and hack apart my controller to directly apply voltages to the controller. DRM the HDMI stream and I can point a camera at my TV. Detect my aimbot through machine learning and I can put together a machine learning network with a few hundred of my buddies to precisely characterize the thresholds the server is using and stay below them while still having a cheat system that plays better than I do. And so forth. (And do not underestimate the extent that people will go to to cheat. I don't really consider "get together with a hundred of my buddies and use machine learning to characterize your machine learning ban algorithm" to be something that could not happen. The amount of effort people will put into cheating is not bounded by your credulity. Weirder things have already happened.) The deck is fundamentally stacked against preventing cheating. You can certainly take a bite out of it but precisely hitting the exact right contour to exactly nail the cheaters and never hit anyone by mistake is effectively impossible.
- sillysaurusx 2y ago
  It always seemed strange that anticheat wasn’t based on statistics. If you send too many number Ns, then you get banned. Then tuning the false positive rate is an exercise for an ML model. It won’t work perfectly, or perhaps even well, but maybe it’d work well enough to avoid rooting your customers’ PCs.
  - FreakLegion 2y ago
    The ones I'm familiar with (e.g. Riot's) do use statistics, along with just about anything else you can think of. Code that does nothing but act as a honeypot for cheaters? Of course that's a thing. I'm actually surprised that people focus so much on the kernel part given the scale of the data collection, though the collected data is pretty innocuous.
gjsman-1000 2y ago
I still don't understand why Microsoft just hasn't made a generic kernel anti-cheat driver yet with restricted scope and permissions, and then allowed commercial entities like Vanguard to integrate with that driver. Theoretically, such a driver could allow anti-cheat systems like Vanguard the same permissions as before, but provide information to the user on exactly what it is doing and accessing. Even that would be an improvement. (And in the future, if the driver had a stable API surface, it would make Linux porting easier.)
- Workaccount2 2y ago
  For years I have wanted hardware level anti-cheat in CPU's, memory, and GPU's that came in optional "anti-cheat" editions that would get their own servers in games. Yes, there are still possible ways of getting around this, but it becomes much harder than "Download this cheat, install, and you're aimbotting"
  - gjsman-1000 2y ago
    Well, isn’t that just called a game console?
thomastjeffery 2y ago
Yes. It's called moderation, and it's what we were doing for decades. The problem is that multiplayer game servers aren't run by players anymore; which means they aren't moderated by players anymore. Game studios have monopolized the responsibility of moderation, and tried (utterly failed) to replace it with a rootkit.
- mrguyorama 2y ago
  It's really funny. They took a system that was essentially free to them (player run servers and moderation) and replaced them with expensive, in house run servers, such that if your game is more popular than you expected, everyone has a miserable time because your infra dies. But they """had""" to, because they want to sell cosmetics and "microtransactions", nevermind that a digital costume that costs as much as a candybar or soda shouldn't be called a "micro" transaction. You can't sell anything if you give away the authoritative server software. Valve tried to get around this by having third party servers contact an official server with a "who actually owns what" style api but nobody gives a fuck. Ah man, it's almost like a costume that took your character artist a week to put together when they would have otherwise been sitting on their hands shouldn't cost $5

Are there alternatives for anti cheat that don't require as much access?

by rascul 2y ago

Are there alternatives for anti cheat that don't require as much access?

I don't know if you can solve everything in an alternative way, but after watching the drama in Tarkov last year, I think the game companies are leaving a lot of low hanging fruit. For example people who can see through walls will track someone coming from behind the wall, before they can be seen. The server has the record of it. In the specific case of Tarkov, people got more information about other players by pointing at their wallhacked silhouettes. Again, the server knows. So did external people have to make videos about "the wiggle" to cause any change? There's so much that could be done through basic behaviour analysis and injecting false data. Yet, instead of that, games just come loaded with anti-cheats that barely work.

GaggiX 2y ago

The new VAC ban wave has been achieved using machine learning on the server side.

verandaguy 2y ago
100% this. VAC remains one of the more effective anti-cheats out there while retaining relatively few privileges on the client machines. A gaming youtuber, 3kliksphilip, made a 10-minute rundown of the state of VAC and where it may be going from here: https://www.youtube.com/watch?v=6DHMAwAeRMA https://www.youtube.com/watch?v=6DHMAwAeRMA. I'm unaffiliated with the channel. The video front-loads some information that many readers here will already be familiar with (along the lines of "what's a kernel and who decided to put so many rings on it") but overall it's a nice light watch.
- mrguyorama 2y ago
  VAC is laughable. The state of cheating in CounterStrike has always been one of the worst games in the industry. VAC doesn't even stop blatant spin botters. This is especially bad because in CounterStrike, a "game" is a one hour commitment with the same group of people, and most people near the higher levels of rankings report getting a match with a cheater in about 1/10 matches or more. It's so bad, there are MULTIPLE third party companies whose entire product is "we install a rootkit style anticheat software so you can actually play counterstrike" like Faceit. Counterstrike official servers are unplayable because of cheating. I mean, christ, Warowl literally had a video last week about how it's impossible to play the new counterstrike because of cheating! Philip should definitely be aware of that situation. Holding it up as some sort of pillar of achievement is absurd.
  - GaggiX 2y ago
    Have you seen the latest VAC ban wave?

jerf 2y ago

Anti-cheat is physically an uphill battle, because, in the end, it's all just numbers. Anti-cheat is basically trying to say "you can send these numbers but you can't send those numbers". But I can send "those" numbers. I can send any numbers I want. You can make it difficult to send the right numbers, but I've got your numbers that describe how to send the numbers right in front of me, which is a rather large help. That's not to say it's hopeless. Sibling comments point out various options that can be run purely server-side. But there's no perfect solution. Even cloud gaming can't prevent cheating because I can take the resulting video stream and run computer vision algorithms on it and still send wrong-numbers back up as my input stream. This may not let me see through walls but is still plenty to implement an aimbot, for instance. Push it into a DRM'd device and I can grab the HDMI stream and hack apart my controller to directly apply voltages to the controller. DRM the HDMI stream and I can point a camera at my TV. Detect my aimbot through machine learning and I can put together a machine learning network with a few hundred of my buddies to precisely characterize the thresholds the server is using and stay below them while still having a cheat system that plays better than I do. And so forth. (And do not underestimate the extent that people will go to to cheat. I don't really consider "get together with a hundred of my buddies and use machine learning to characterize your machine learning ban algorithm" to be something that could not happen. The amount of effort people will put into cheating is not bounded by your credulity. Weirder things have already happened.) The deck is fundamentally stacked against preventing cheating. You can certainly take a bite out of it but precisely hitting the exact right contour to exactly nail the cheaters and never hit anyone by mistake is effectively impossible.

sillysaurusx 2y ago
It always seemed strange that anticheat wasn’t based on statistics. If you send too many number Ns, then you get banned. Then tuning the false positive rate is an exercise for an ML model. It won’t work perfectly, or perhaps even well, but maybe it’d work well enough to avoid rooting your customers’ PCs.
- FreakLegion 2y ago
  The ones I'm familiar with (e.g. Riot's) do use statistics, along with just about anything else you can think of. Code that does nothing but act as a honeypot for cheaters? Of course that's a thing. I'm actually surprised that people focus so much on the kernel part given the scale of the data collection, though the collected data is pretty innocuous.

gjsman-1000 2y ago

I still don't understand why Microsoft just hasn't made a generic kernel anti-cheat driver yet with restricted scope and permissions, and then allowed commercial entities like Vanguard to integrate with that driver. Theoretically, such a driver could allow anti-cheat systems like Vanguard the same permissions as before, but provide information to the user on exactly what it is doing and accessing. Even that would be an improvement. (And in the future, if the driver had a stable API surface, it would make Linux porting easier.)

Workaccount2 2y ago
For years I have wanted hardware level anti-cheat in CPU's, memory, and GPU's that came in optional "anti-cheat" editions that would get their own servers in games. Yes, there are still possible ways of getting around this, but it becomes much harder than "Download this cheat, install, and you're aimbotting"
- gjsman-1000 2y ago
  Well, isn’t that just called a game console?

thomastjeffery 2y ago

Yes. It's called moderation, and it's what we were doing for decades. The problem is that multiplayer game servers aren't run by players anymore; which means they aren't moderated by players anymore. Game studios have monopolized the responsibility of moderation, and tried (utterly failed) to replace it with a rootkit.

mrguyorama 2y ago
It's really funny. They took a system that was essentially free to them (player run servers and moderation) and replaced them with expensive, in house run servers, such that if your game is more popular than you expected, everyone has a miserable time because your infra dies. But they """had""" to, because they want to sell cosmetics and "microtransactions", nevermind that a digital costume that costs as much as a candybar or soda shouldn't be called a "micro" transaction. You can't sell anything if you give away the authoritative server software. Valve tried to get around this by having third party servers contact an official server with a "who actually owns what" style api but nobody gives a fuck. Ah man, it's almost like a costume that took your character artist a week to put together when they would have otherwise been sitting on their hands shouldn't cost $5