5 ms·

It's impossible to prevent cheating from the server-side only. Something like an aimbot can operate purely on information you need to have as a client (to rende

by arp242 2y ago

It's impossible to prevent cheating from the server-side only. Something like an aimbot can operate purely on information you need to have as a client (to render the other players on the screen), and still be a huge advantage because it can respond faster than any human can.

baseballdork 2y ago
Shouldn't that be detectable?
- heromal 2y ago
  Without kernel level anti cheat you can detect (some) other usermode cheats, but not kernel level cheats. With kernel level anticheat, you can detect the vast majority of other kernel level cheats. Vanguard is effective enough that most successful cheaters are using external devices and DMA to bypass the kernel altogether (or they just use Macs because Apple doesn't allow Vanguard). And despite Riot's insistence to the contrary, they have not "detected" DMA cheats.
  - coretx 2y ago
    Advanced DMA/IOMMU attacks are hard, soft and firmware specific. In order to detect it, you'll have to do a ton of very expensive work all the while you risk destroying the customers soft, firm and hardware. Good luck explaining the judge what you did.
- Cthulhu_ 2y ago
  It should be - if a server firehose streams all players' network data to an analysis thing, it should be able to detect patterns of impossible accuracy and response time, even though there is some margin for error due to e.g. lag and packet loss (iirc intentional lag / packet loss are some strategies cheaters use to obfuscate things like aimbots, e.g. generating movements that shoot someone in the head but holding them back for a second or so so that in theory a competent player could have done the required motions within a second instead of 1/100th thereof)
- intended 2y ago
  Nope. Evolutionary pressures on cheaters drives them to get better. Eventually someone finds a stable chink in the server armor and it is exploited en masse. The goal is to make it inconvenient to cheat on average. There’s probably some ratio of games with cheaters to games without cheaters that players can tolerate that governs this.
gpderetta 2y ago
On the other hand an aimbot can operate purely on informations you /need/ to send in and out to the physical machine (input peripherals and the screen), so there's that...
plopz 2y ago
I think server side statistical analysis can go a long way to detect stuff like that. Obviously its always a cat and mouse game between devs and cheaters, and there are always workarounds, but theres a lot more the devs could be doing without relying on invasive client side detection.
- evoke4908 2y ago
  I think the problem is that that kind of work requires a good deal of developer resources for a long time. What company wants to pay upkeep on a shipped product? You could save hundreds of thousands of dollars a year by shipping a rootkit to players and not worrying about server security.
  - vkazanov 2y ago
    Any company that makes big money on long-living multiplayer games?
  - phito 2y ago
    It would not only take a lot of developer resources, but also computing power.
  - a_wild_dandan 2y ago
    I suppose Valve, who trained a neural network to detect/ban cheaters exhibiting unnatural behavior.
    - babypuncher 2y ago
      It hasn't paid off very much, CS2 still has a rampant cheating problem. VAC has been a joke for years at this point.
      - nicce 2y ago
        It only needs to be good enough that people keep buying (or not) the Prime when their old account gets banned. There is good reason that it exist, also from cheating perspective.
darknavi 2y ago
Client <-> Server architecture can still take you a long way. Culling what you send to the client and relying less on client-side "hiding" of state, server authoritative actions with client-side prediction, etc. At the end of the day someone could be using hardware "cheats" but you can get down to a pretty good spot to stop or disincentivize cheaters without running rootkits on their devices.
- Rohansi 2y ago
  Latency significantly reduces the effectiveness of culling via the server. There will always be a place for client side anti-cheat if games are running on players' computers.
  - nicce 2y ago
    Funnily, for example, using GeForce Now prevents almost all kind of cheats. Maybe the future of the competitive gaming is that you only use remote client for remote server which is hosted by the game company.
    - Rohansi 2y ago
      Yes, but even some cheats are possible through streaming. Basic things like scripted no-recoil all the way to aimbots based on image recognition. People are even using AI to recognize and highlight players on your screen - and even some built into monitors!
    - anonymousab 2y ago
      There are hardware cheating setups that utilize an external camera+device with basic image recognition and spoof a normal mouse over USB. From software's perspective, all you see on the client side is normal mouse inputs from a Logitech or razer mouse. At the very least, this is less capable than wallhacks from reading memory.
      - nicce 2y ago
        Yes, it is true that you can use optics still, but everything memory related is always much more effective and can completely prevented. No need to use rootkits. I would say that it takes few years still before people have good enough hardware before AI can be used in real-time. You can use OpenCV and train things against specific game to get a decent performance with image recognition, but it is not that reliable.
nickphx 2y ago
if you have a large enough player base to sample, you can determine who is cheating with math. EA Fairplay is pretty good.. Steam's VAC is good, and not some kernel level nonsense..
- heromal 2y ago
  VAC is absolutely terrible, are you kidding? You have to rage to get VAC banned.
  - Brian_K_White 2y ago
    False positives with no process for recourse and nice perfect fingerprinting to prevent ban evasion is better? I think they intentionally have the knob turned all the way up to 0.1 initially, for PR and lube reasons.
- Rohansi 2y ago
  To some degree, yes. But there are actually many cheaters that intentionally don't play perfectly to avoid detection. That way they appear higher skilled but still within human range.
- jsheard 2y ago
  VAC is so not-good that there are not one but two popular third-party matchmaking services for Valves games whose main selling point is much stronger (read: more invasive) anti-cheat than VAC, and one of them even charges a subscription to play, which highly skilled players gladly pay to get away from the cheaters in high-rank VAC servers. https://play.esea.net https://play.esea.net / https://www.faceit.com https://www.faceit.com
zamalek 2y ago
There is a startup attempting to use ML to find cheaters: https://www.youtube.com/watch?v=LkmIItTrQP4 https://www.youtube.com/watch?v=LkmIItTrQP4 (this video might be overly optimistic) - https://anybrain.gg https://anybrain.gg They even claim to be able to fingerprint players according their playstyle, thwarting all methods of ban evasion. Skepticism should be abundant here, but this one of the oldest tricks in ML: categorization/clustering. I'm cautiously hopeful. This would be server-side by nature.
akira2501 2y ago
It makes it way easier to detect it. If a player can pre move their aim to be at the point near where the aimbot would take it by using a wallhack they can hide the action much more clearly. If they're constantly doing 180 no scopes you've got a pretty good indication something is wrong. Also if your guns aren't _perfectly_ accurate then the aimbot can't actually predict much of anything.

by arp242 2y ago

baseballdork 2y ago

Shouldn't that be detectable?

heromal 2y ago
Without kernel level anti cheat you can detect (some) other usermode cheats, but not kernel level cheats. With kernel level anticheat, you can detect the vast majority of other kernel level cheats. Vanguard is effective enough that most successful cheaters are using external devices and DMA to bypass the kernel altogether (or they just use Macs because Apple doesn't allow Vanguard). And despite Riot's insistence to the contrary, they have not "detected" DMA cheats.
- coretx 2y ago
  Advanced DMA/IOMMU attacks are hard, soft and firmware specific. In order to detect it, you'll have to do a ton of very expensive work all the while you risk destroying the customers soft, firm and hardware. Good luck explaining the judge what you did.
Cthulhu_ 2y ago
It should be - if a server firehose streams all players' network data to an analysis thing, it should be able to detect patterns of impossible accuracy and response time, even though there is some margin for error due to e.g. lag and packet loss (iirc intentional lag / packet loss are some strategies cheaters use to obfuscate things like aimbots, e.g. generating movements that shoot someone in the head but holding them back for a second or so so that in theory a competent player could have done the required motions within a second instead of 1/100th thereof)
intended 2y ago
Nope. Evolutionary pressures on cheaters drives them to get better. Eventually someone finds a stable chink in the server armor and it is exploited en masse. The goal is to make it inconvenient to cheat on average. There’s probably some ratio of games with cheaters to games without cheaters that players can tolerate that governs this.

gpderetta 2y ago

On the other hand an aimbot can operate purely on informations you /need/ to send in and out to the physical machine (input peripherals and the screen), so there's that...

plopz 2y ago

I think server side statistical analysis can go a long way to detect stuff like that. Obviously its always a cat and mouse game between devs and cheaters, and there are always workarounds, but theres a lot more the devs could be doing without relying on invasive client side detection.

evoke4908 2y ago
I think the problem is that that kind of work requires a good deal of developer resources for a long time. What company wants to pay upkeep on a shipped product? You could save hundreds of thousands of dollars a year by shipping a rootkit to players and not worrying about server security.
- vkazanov 2y ago
  Any company that makes big money on long-living multiplayer games?
- phito 2y ago
  It would not only take a lot of developer resources, but also computing power.
- a_wild_dandan 2y ago
  I suppose Valve, who trained a neural network to detect/ban cheaters exhibiting unnatural behavior.
  - babypuncher 2y ago
    It hasn't paid off very much, CS2 still has a rampant cheating problem. VAC has been a joke for years at this point.
    - nicce 2y ago
      It only needs to be good enough that people keep buying (or not) the Prime when their old account gets banned. There is good reason that it exist, also from cheating perspective.

darknavi 2y ago

Client <-> Server architecture can still take you a long way. Culling what you send to the client and relying less on client-side "hiding" of state, server authoritative actions with client-side prediction, etc. At the end of the day someone could be using hardware "cheats" but you can get down to a pretty good spot to stop or disincentivize cheaters without running rootkits on their devices.

Rohansi 2y ago
Latency significantly reduces the effectiveness of culling via the server. There will always be a place for client side anti-cheat if games are running on players' computers.
- nicce 2y ago
  Funnily, for example, using GeForce Now prevents almost all kind of cheats. Maybe the future of the competitive gaming is that you only use remote client for remote server which is hosted by the game company.
  - Rohansi 2y ago
    Yes, but even some cheats are possible through streaming. Basic things like scripted no-recoil all the way to aimbots based on image recognition. People are even using AI to recognize and highlight players on your screen - and even some built into monitors!
  - anonymousab 2y ago
    There are hardware cheating setups that utilize an external camera+device with basic image recognition and spoof a normal mouse over USB. From software's perspective, all you see on the client side is normal mouse inputs from a Logitech or razer mouse. At the very least, this is less capable than wallhacks from reading memory.
    - nicce 2y ago
      Yes, it is true that you can use optics still, but everything memory related is always much more effective and can completely prevented. No need to use rootkits. I would say that it takes few years still before people have good enough hardware before AI can be used in real-time. You can use OpenCV and train things against specific game to get a decent performance with image recognition, but it is not that reliable.

nickphx 2y ago

if you have a large enough player base to sample, you can determine who is cheating with math. EA Fairplay is pretty good.. Steam's VAC is good, and not some kernel level nonsense..

heromal 2y ago
VAC is absolutely terrible, are you kidding? You have to rage to get VAC banned.
- Brian_K_White 2y ago
  False positives with no process for recourse and nice perfect fingerprinting to prevent ban evasion is better? I think they intentionally have the knob turned all the way up to 0.1 initially, for PR and lube reasons.
Rohansi 2y ago
To some degree, yes. But there are actually many cheaters that intentionally don't play perfectly to avoid detection. That way they appear higher skilled but still within human range.
jsheard 2y ago
VAC is so not-good that there are not one but two popular third-party matchmaking services for Valves games whose main selling point is much stronger (read: more invasive) anti-cheat than VAC, and one of them even charges a subscription to play, which highly skilled players gladly pay to get away from the cheaters in high-rank VAC servers. https://play.esea.net https://play.esea.net / https://www.faceit.com https://www.faceit.com

zamalek 2y ago

There is a startup attempting to use ML to find cheaters: https://www.youtube.com/watch?v=LkmIItTrQP4 https://www.youtube.com/watch?v=LkmIItTrQP4 (this video might be overly optimistic) - https://anybrain.gg https://anybrain.gg They even claim to be able to fingerprint players according their playstyle, thwarting all methods of ban evasion. Skepticism should be abundant here, but this one of the oldest tricks in ML: categorization/clustering. I'm cautiously hopeful. This would be server-side by nature.

akira2501 2y ago

It makes it way easier to detect it. If a player can pre move their aim to be at the point near where the aimbot would take it by using a wallhack they can hide the action much more clearly. If they're constantly doing 180 no scopes you've got a pretty good indication something is wrong. Also if your guns aren't _perfectly_ accurate then the aimbot can't actually predict much of anything.