7 ms·

Server side only anti-cheat is one of the problem domains that I'd really love to work on at some point in my career. This is the type of adversarial arms race

Server side only anti-cheat is one of the problem domains that I'd really love to work on at some point in my career. This is the type of adversarial arms race that just seems really fun to think long and hard about.

Night_Thastus 2y ago
Only problem is, a lot of companies do NOT want to pay for it. It's 'treadmill work'. No matter how many people and how much money you throw at the problem, it still ends up just coming back. It's a losing battle because there are many, many more players than there are developers.
- anamexis 2y ago
  Are there more sophisticated cheat developers though?
  - Night_Thastus 2y ago
    Cheat development these days is incredibly sophisticated. There are swathes of tutorials, old and recent examples to research, advanced inspection tools, etc. It's so much easier to make cheats today than it was, say, 10 years ago. It's also easier because more and more games are sharing common infrastructure like game engines, as compared to the past. What works in one Unreal game may save you a lot of time developing a cheat for another Unreal game. These days, many online games encounter serious cheats within the first couple of days of release - if not the day OF release.
    - oneplane 2y ago
      Some of the sophistication is not really in the technical breaking of the game or protocol anymore, figuring out if something is plausible might yield detections that you cannot "cheat" because it no longer matters if your cursor clicked on a head at the right time or not, it matters if your posture/reputation/experience makes your behaviour plausible. Cheating and anti-cheat used to rely a lot on the pure technical parts (like "is something sneaking some reads from the memory the game engine uses to clip models?"), which is ultimately not something you will win as a game developer (DMA/Hardware attacks or even just frame grabbing the eDP or LVDS signal and intercepting the USB HID traffic has been on the market for quite a while). But implausible actions and results for a player can only be attributed to luck so many times. Do 30 360noscope flick headshots in a row on a brand new account and you can be pretty sure something is wrong. If we can get plausibility vs. luck sorted out to a degree where the method of cheating no longer matters, that's when the tide turns. Works for pure bots as well. But it's difficult to do, and probably not something every developer is able/willing to develop or invest in.
      - Night_Thastus 2y ago
        It's hard to balance around those sorts of things. For example, imagine a cheat that gives the player additional info about where enemies are and their state (ie: health). Even if they are of totally normal skill level in terms of movement and aim, that info will allow them to be substantially better than others. How are you going to detect that, and differentiate it from players who simply have a great sense of map awareness and a good ability to keep track of enemies and when to punish them? Anything that makes assumptions about player's skills runs into problems too. For any online PvP game, the skill ceiling will rise with time. What once may have been considered improbable may soon become what's consistent for the top 1% or even 0.1% of the playerbase given a few years. As well, it can run into problems as rebalancing occurs and new abilities are released.
        oneplane 2y ago
        Even the base example would make that specific scenario trivial: an account that is new has no business "being better" than everyone else. The only group you'd punish with that is skilled players that lose their account (and create a new one), but if you use a moving skill window they can grow back into their plausibility pretty quickly, and it's a small cost compared to everything else. And you could even mitigate that by making things like the first 10 matches require a different plausibility score than the matches after that. And with different I don't mean "no scoring at all" or something like that. But a cheater tends to not cheat "a little bit". You might have togglers, but that sticks out like a sore thumb (people don't suddenly lose or gain skill like that). And even if that fails (lots of "cheating a little bit" for example), you've still managed to boot out the obvious persistent cheating. And that's just with 1 example and 1 scenario. Granted, that bypasses the fact that it is still difficult and doing it broader than one example/scenario is even more difficult, but that's why I ended the previous comment pointing out the difficulty and associated cost, which goes hand in hand with the balancing difficulty you pointed out. Even tribunal-assisted methods (not sure if Riot games still does that) have the same problem.
        Night_Thastus 2y ago
    - berbec 2y ago
      It can happen in days sometimes. 0: https://www.ign.com/articles/final-fantasy-14s-latest-raid-sparks-controversy-as-world-first-winners-accused-of-cheating https://www.ign.com/articles/final-fantasy-14s-latest-raid-s...
    - BlueTemplar 2y ago
      It's funny, with "sophisticated", I would have expected "so much harder". But I guess the documentation and standardization are even more advanced ?
    - xpuente 2y ago
      Secure enclaves can solve the problem once for all. I don't understand why is not applied (given the support in current hardware).
- willcipriano 2y ago
  My idea: 1. Determine minimum human reaction times and limit movement to within those parameters on the client side. (For example a human can't swing their view around [in a fps] in a microsecond so make that impossible on the client) this will require a lot of user testing to get right, get pro players and push their limits. 2. Build a 'unified field theory' for your game world that is aware of the client side constraints as well as limits on character movement, reload times, bullet velocities, etc. Run this [much smaller than the real game] simulation on server. 3. Ban any user who sends input that violates physics. Now cheating has to at look like high level play instead of someone flying around spinbotting everyone from across the map. Players hopefully don't get as frustrated when playing against cheaters as they assume they are just great players. Great players should be competitive against cheaters as well.
  - bob1029 2y ago
    This is kind of getting into my idea - Statistical methods & maybe a sprinkle of old-school machine learning. What I would try is to hire a red team & blue team and put them in a sandbox environment. The red team cheats on purpose. The blue team is guaranteed to be playing legitimately. Both teams label their session data accurately. I then use this as training & eval set for a model that will be used on actual player inputs. The only downside is that you will get a certain % of false positives, but the tradeoff is that there is literally nothing the cheaters can do to prevent detection unless they infiltrate your internal operations and obtain access to the data and/or methods.
  - berbec 2y ago
    This is a slippery slope which we can view in real-time looking at the speedrunning community. Many current real person runs are using strategies once thought to be computer-only. A Mario run from 2024 would be viewed as totally impossible in 2004.
    - jwagenet 2y ago
      This isn’t really a relevant concern for online games since speed running is mostly rehearsed play with predictable game mechanics, not inhuman response to novel stimulus.
- J_Shelby_J 2y ago
  > Only problem is, a lot of companies do NOT want to pay for it. Because they're 10 years behind the curve and don't understand that a game's lifespan is contingent on anti-cheat. Once it becomes clear to the casual player that a hacker is going to effect every gaming session, the game dies quickly. Many games have gone so far as to obfuscate the presence of hackers so that players are less likely to notice them (CoD)! Other games build from the ground up with anti-cheat in mind (Valorant). Other games have an ID verified 3rd party system for competitive play (CSGO). Personally, I think there is a middle ground between root level hardware access, and treating cheating as an afterthought. I'd lean more heavily on humans in the process... Use ML models to detect potential cheaters, and build a team of former play testers to investigate these accounts. There is zero reason a cheater should be in the top 100 accounts; An intern could investigate them in a single day! More low hanging fruit would be investigating new accounts that are over-performing. I'd also change the ToS so legal action could be persued for repeat offenders. Cheaters do real economic damage to a company, and forcing them to show up in small claims court would heavily de-incentivize ban evaders. This probably sounds expensive and overkill, but in the grand scheme of things it's cheap; it could be done on the headcount budget of 2-3 engineers. It'd also be a huge PR win for the game.
  - globalnode 2y ago
    even though im not a cheater in games, i wouldnt play a game that threatened to take me to court if they deemed me to be one. interesting thought though.
  - TechDebtDevin 2y ago
    > Many games have gone so far as to obfuscate the presence of hackers so that players are less likely to notice them (CoD)! How does CoD accomplish this, or other games that use similar strategies. I can't wrap my mind around how you could do this effectively while also not identifying hackers for the purpose of banning. Banning = Cheater buying another license to the game, I thought they like banning people for that reason :/
    - J_Shelby_J 2y ago
andrewmcwatters 2y ago
The state of the art is pretty boring and you can learn about user command payloads in an afternoon. The world is much more complex now that YOLO-based aimbots exist, and I think the real answer is that anti-cheats are now defeatable, period. You can craft a private binary that has no hash registered to any major anti-cheat service on the client-side, and on the server-side you’re limited to what is allowed by game rules. Since there’s no mechanisms for preventing super human reflexes, and there probably shouldn’t be, it’s an issue that cannot be solved anymore. So you need community judgement, and that too is boring. Good players being accused of cheating in Counter Strike is a years old and entertaining problem.
- BlueTemplar 2y ago
  > now that YOLO-based aimbots exist the what ?!?
  - mardifoufs 2y ago
    Probably refers to the YOLO family of object detection/classification models. Though I wasn't aware that they could be used for something like cheating in csgo. They are really fast compared to most AI models but I thought that it still wouldn't be fast enough to give you a real advantage (especially for pros), as cheats usually depend on "wall hacks" or similar, and being able to see more than what you could see on your screen.
  - deleted 2y ago
    [deleted]
  - genpfault 2y ago
    https://en.wikipedia.org/wiki/You_Only_Look_Once https://en.wikipedia.org/wiki/You_Only_Look_Once
arminiusreturns 2y ago
Something I'm working on now. The real issue is that you get more perf hits trying to do all the important stuff server side, so devs have become lazy and offloaded more to the client than they should have, and then that became the standard. Moving all important actions server side isn't easy or cheap but it's how you prevent cheating much more holistically. Now add in that I'm running a physics-heavy game with 120 tickrate, (considering higher after more tests), with fine motor control action combat, aimed to scale to mmorpg size, and it really becomes a challenge!
the_clarence 2y ago
It also significantly improves people's lives. Entire online games are reduced to no man's lands due to cheaters. I remember buying a number of battlefield games a couple years ago and a number of them were unplayable due to cheaters speedhacking and aimboting. I remember thinking "this is easy to detect on the server side, why arent they doing anything".
itsTyrion 2y ago
I’ve only done it for Minecraft and it was kinda fun.

Night_Thastus 2y ago

Only problem is, a lot of companies do NOT want to pay for it. It's 'treadmill work'. No matter how many people and how much money you throw at the problem, it still ends up just coming back. It's a losing battle because there are many, many more players than there are developers.

anamexis 2y ago
Are there more sophisticated cheat developers though?
- Night_Thastus 2y ago
  Cheat development these days is incredibly sophisticated. There are swathes of tutorials, old and recent examples to research, advanced inspection tools, etc. It's so much easier to make cheats today than it was, say, 10 years ago. It's also easier because more and more games are sharing common infrastructure like game engines, as compared to the past. What works in one Unreal game may save you a lot of time developing a cheat for another Unreal game. These days, many online games encounter serious cheats within the first couple of days of release - if not the day OF release.
  - oneplane 2y ago
    Some of the sophistication is not really in the technical breaking of the game or protocol anymore, figuring out if something is plausible might yield detections that you cannot "cheat" because it no longer matters if your cursor clicked on a head at the right time or not, it matters if your posture/reputation/experience makes your behaviour plausible. Cheating and anti-cheat used to rely a lot on the pure technical parts (like "is something sneaking some reads from the memory the game engine uses to clip models?"), which is ultimately not something you will win as a game developer (DMA/Hardware attacks or even just frame grabbing the eDP or LVDS signal and intercepting the USB HID traffic has been on the market for quite a while). But implausible actions and results for a player can only be attributed to luck so many times. Do 30 360noscope flick headshots in a row on a brand new account and you can be pretty sure something is wrong. If we can get plausibility vs. luck sorted out to a degree where the method of cheating no longer matters, that's when the tide turns. Works for pure bots as well. But it's difficult to do, and probably not something every developer is able/willing to develop or invest in.
    - Night_Thastus 2y ago
      It's hard to balance around those sorts of things. For example, imagine a cheat that gives the player additional info about where enemies are and their state (ie: health). Even if they are of totally normal skill level in terms of movement and aim, that info will allow them to be substantially better than others. How are you going to detect that, and differentiate it from players who simply have a great sense of map awareness and a good ability to keep track of enemies and when to punish them? Anything that makes assumptions about player's skills runs into problems too. For any online PvP game, the skill ceiling will rise with time. What once may have been considered improbable may soon become what's consistent for the top 1% or even 0.1% of the playerbase given a few years. As well, it can run into problems as rebalancing occurs and new abilities are released.
      - oneplane 2y ago
        Even the base example would make that specific scenario trivial: an account that is new has no business "being better" than everyone else. The only group you'd punish with that is skilled players that lose their account (and create a new one), but if you use a moving skill window they can grow back into their plausibility pretty quickly, and it's a small cost compared to everything else. And you could even mitigate that by making things like the first 10 matches require a different plausibility score than the matches after that. And with different I don't mean "no scoring at all" or something like that. But a cheater tends to not cheat "a little bit". You might have togglers, but that sticks out like a sore thumb (people don't suddenly lose or gain skill like that). And even if that fails (lots of "cheating a little bit" for example), you've still managed to boot out the obvious persistent cheating. And that's just with 1 example and 1 scenario. Granted, that bypasses the fact that it is still difficult and doing it broader than one example/scenario is even more difficult, but that's why I ended the previous comment pointing out the difficulty and associated cost, which goes hand in hand with the balancing difficulty you pointed out. Even tribunal-assisted methods (not sure if Riot games still does that) have the same problem.
        Night_Thastus 2y ago
  - berbec 2y ago
    It can happen in days sometimes. 0: https://www.ign.com/articles/final-fantasy-14s-latest-raid-sparks-controversy-as-world-first-winners-accused-of-cheating https://www.ign.com/articles/final-fantasy-14s-latest-raid-s...
  - BlueTemplar 2y ago
    It's funny, with "sophisticated", I would have expected "so much harder". But I guess the documentation and standardization are even more advanced ?
  - xpuente 2y ago
    Secure enclaves can solve the problem once for all. I don't understand why is not applied (given the support in current hardware).
willcipriano 2y ago
My idea: 1. Determine minimum human reaction times and limit movement to within those parameters on the client side. (For example a human can't swing their view around [in a fps] in a microsecond so make that impossible on the client) this will require a lot of user testing to get right, get pro players and push their limits. 2. Build a 'unified field theory' for your game world that is aware of the client side constraints as well as limits on character movement, reload times, bullet velocities, etc. Run this [much smaller than the real game] simulation on server. 3. Ban any user who sends input that violates physics. Now cheating has to at look like high level play instead of someone flying around spinbotting everyone from across the map. Players hopefully don't get as frustrated when playing against cheaters as they assume they are just great players. Great players should be competitive against cheaters as well.
- bob1029 2y ago
  This is kind of getting into my idea - Statistical methods & maybe a sprinkle of old-school machine learning. What I would try is to hire a red team & blue team and put them in a sandbox environment. The red team cheats on purpose. The blue team is guaranteed to be playing legitimately. Both teams label their session data accurately. I then use this as training & eval set for a model that will be used on actual player inputs. The only downside is that you will get a certain % of false positives, but the tradeoff is that there is literally nothing the cheaters can do to prevent detection unless they infiltrate your internal operations and obtain access to the data and/or methods.
- berbec 2y ago
  This is a slippery slope which we can view in real-time looking at the speedrunning community. Many current real person runs are using strategies once thought to be computer-only. A Mario run from 2024 would be viewed as totally impossible in 2004.
  - jwagenet 2y ago
    This isn’t really a relevant concern for online games since speed running is mostly rehearsed play with predictable game mechanics, not inhuman response to novel stimulus.
J_Shelby_J 2y ago
> Only problem is, a lot of companies do NOT want to pay for it. Because they're 10 years behind the curve and don't understand that a game's lifespan is contingent on anti-cheat. Once it becomes clear to the casual player that a hacker is going to effect every gaming session, the game dies quickly. Many games have gone so far as to obfuscate the presence of hackers so that players are less likely to notice them (CoD)! Other games build from the ground up with anti-cheat in mind (Valorant). Other games have an ID verified 3rd party system for competitive play (CSGO). Personally, I think there is a middle ground between root level hardware access, and treating cheating as an afterthought. I'd lean more heavily on humans in the process... Use ML models to detect potential cheaters, and build a team of former play testers to investigate these accounts. There is zero reason a cheater should be in the top 100 accounts; An intern could investigate them in a single day! More low hanging fruit would be investigating new accounts that are over-performing. I'd also change the ToS so legal action could be persued for repeat offenders. Cheaters do real economic damage to a company, and forcing them to show up in small claims court would heavily de-incentivize ban evaders. This probably sounds expensive and overkill, but in the grand scheme of things it's cheap; it could be done on the headcount budget of 2-3 engineers. It'd also be a huge PR win for the game.
- globalnode 2y ago
  even though im not a cheater in games, i wouldnt play a game that threatened to take me to court if they deemed me to be one. interesting thought though.
- TechDebtDevin 2y ago
  > Many games have gone so far as to obfuscate the presence of hackers so that players are less likely to notice them (CoD)! How does CoD accomplish this, or other games that use similar strategies. I can't wrap my mind around how you could do this effectively while also not identifying hackers for the purpose of banning. Banning = Cheater buying another license to the game, I thought they like banning people for that reason :/
  - J_Shelby_J 2y ago

andrewmcwatters 2y ago

The state of the art is pretty boring and you can learn about user command payloads in an afternoon. The world is much more complex now that YOLO-based aimbots exist, and I think the real answer is that anti-cheats are now defeatable, period. You can craft a private binary that has no hash registered to any major anti-cheat service on the client-side, and on the server-side you’re limited to what is allowed by game rules. Since there’s no mechanisms for preventing super human reflexes, and there probably shouldn’t be, it’s an issue that cannot be solved anymore. So you need community judgement, and that too is boring. Good players being accused of cheating in Counter Strike is a years old and entertaining problem.

BlueTemplar 2y ago
> now that YOLO-based aimbots exist the what ?!?
- mardifoufs 2y ago
  Probably refers to the YOLO family of object detection/classification models. Though I wasn't aware that they could be used for something like cheating in csgo. They are really fast compared to most AI models but I thought that it still wouldn't be fast enough to give you a real advantage (especially for pros), as cheats usually depend on "wall hacks" or similar, and being able to see more than what you could see on your screen.
- deleted 2y ago
  [deleted]
- genpfault 2y ago
  https://en.wikipedia.org/wiki/You_Only_Look_Once https://en.wikipedia.org/wiki/You_Only_Look_Once

arminiusreturns 2y ago

Something I'm working on now. The real issue is that you get more perf hits trying to do all the important stuff server side, so devs have become lazy and offloaded more to the client than they should have, and then that became the standard. Moving all important actions server side isn't easy or cheap but it's how you prevent cheating much more holistically. Now add in that I'm running a physics-heavy game with 120 tickrate, (considering higher after more tests), with fine motor control action combat, aimed to scale to mmorpg size, and it really becomes a challenge!

the_clarence 2y ago

It also significantly improves people's lives. Entire online games are reduced to no man's lands due to cheaters. I remember buying a number of battlefield games a couple years ago and a number of them were unplayable due to cheaters speedhacking and aimboting. I remember thinking "this is easy to detect on the server side, why arent they doing anything".

itsTyrion 2y ago

I’ve only done it for Minecraft and it was kinda fun.