4 ms·

> “You can freely manipulate the kernel, and there’s no user mode calls to attest that it’s even genuine,” says Koskinas. “You could make a Linux distribution t

> “You can freely manipulate the kernel, and there’s no user mode calls to attest that it’s even genuine,” says Koskinas. “You could make a Linux distribution that’s purpose-built for cheating and we’d be smoked.” These are features, not bugs. Cheating must be detected serverside. Never trust the client, this is basic security. Breaking the user's client security is not a valid solution, and I get increasingly frustrated with these gaming companies that insist that a rootkit is "fine" and "normal" and "something a regular user should install without question"

yodon 2y ago
>Cheating must be detected serverside. Never trust the client, this is basic security. As long as rendering happens on the client, it's going to require client-side anti-cheat to stop players from looking through walls or adding aimbots. Client side rendering means the client has information like the location of the opponent even when the opponent is not visible. The server is unable to tell on its own whether the client is using this information inappropriately.
- Spunkie 2y ago
  Server side cheat detection is not just about actually detecting active cheating on the server side. It's also about the server providing the client the absolute minimum amount of information needed to function/render.
  - zeta0134 2y ago
    Yes, for an FPS I don't really see a practical way around having the server do some rendering work, in order to detect occlusion and stop sending visual updates when it's pretty sure the client isn't able to see that object. There's a balance to be struck. Other techniques include simple statistical analysis: it's usually pretty damn obvious when a player is making inputs that shouldn't be humanly possible consistently, or reacting to information they shouldn't be able to see. That doesn't have to be done in realtime, it can be stored and reviewed later. (That might even be a feature on its own: delayed bans make it harder for cheaters to know if their techniques were detectable.)
    - mjr00 2y ago
      > That might even be a feature on its own: delayed bans make it harder for cheaters to know if their techniques were detectable. Bans have typically been done in waves for a long time for exactly this reason, yes.
  - ThatPlayer 2y ago
    Lag compensation makes the absolute minimum relatively high. For example you need the client to know about an enemy player behind them that doesn't get rendered, because the client can turn around faster than the server can tell them about that player. Otherwise it can lead to a super frustrating experience where the enemy player pops into existence on the client in the middle of the screen, and you couldn't have reacted because there was nothing there. So if you're sending that data to the client, well now cheats can look for that and detect if there's a player behind you and warn you, giving an advantage. The same thing applies to corners and other occlusions, just less extreme, but still just as frustrating.
- Buxato 2y ago
  That are hacks that change the behavior and historic skill of a player, could be detected server side too. Also a client side anticheat couldn't detect modern aim hacking via external camera and custom hardware mouse.
  - consteval 2y ago
    You don't even need an external camera, you could probably intercept the DP signal.
extr 2y ago
Sounds like you have it all figured out. Apply to work at one of these companies and let them know they're doing anti-cheat all wrong.
- Spunkie 2y ago
  Don't be a snarky ass, especially when you are wrong. The community HAS figured it out. If you want cheating reduced you do server side cheat detection not just client side and/or you release real dedicated servers. Neither of which shitty game companies are interested in, because it either cost more money to implement or means a minor loss of control.
  - cma 2y ago
    After the dedicated server code is decompiled, I could see that causing more cheats.
    - Spunkie 2y ago
      It would also result in cheats getting identified and reported by the community. The TF2 dedicated server mailing lists, back in the day, were filled with new cheats, crashes, and exploits being found and reported by server admins.
      - doublepg23 2y ago
        That's pretty cool. How is cheating in TF2 in 2024 by the way?
        Spunkie 2y ago
        The increase in bots and cheaters got progressively worse as matchmaking took over and ate away at the ability of private servers to maintain a community. Also before that, TF2 becoming a giant microtransaction experiment certainly didn't help. Still though even today I can open up TF2 and still have a few favorited servers that have been going for a decade+. I can join those servers and play bot and cheater free for the most part.
cma 2y ago
How are you going to prevent automatically seeing people through foliage?
cortesoft 2y ago
How can you detect whether a player aimed their mouse and shot vs a cheat aiming and shooting? To the server, those actions would be identical.
- zeta0134 2y ago
  Typically by things like reaction time, input latency, smoothness of motion, etc. A real human is surprisingly nondeterministic about these things, and their hardware adds all sorts of other interesting noise to the data. A naive aimbot will look unnaturally smooth and linear. You can somewhat cat-and-mouse this by attempting to humanize the inputs, but it's surprisingly difficult to replicate "natural" motion as input by a human. The humanized aimbot will end up with its own detectable signature. Besides that though, don't let perfect be the enemy of good enough. Catching the low-hanging-fruit (the stuff that is easy to detect) is *most* of the problem. Leave the crazy advanced stuff to the professional leagues, where players are under higher scrutiny anyway. Mind that I don't meant to argue against clientside cheat detection. You can still do a lot of that in userspace, and you really should. It's more data to analyze and it raises the bar for casuals. But since you inherently can't trust the client, you need to also do serverside detection, and really the serverside stuff (being remote, unknowable, and much harder to exploit) is going to be the stronger signal.
deteccphilippe 2y ago
No current level of server-sided classification can discriminate between good players and humanized aimbots. Similarly, no instantaneous window of input scrutiny can detect informational cheats (like ESP). You'd need days/weeks of data, and oops too late—they're radiant already. Also, server-sided anti-cheat is far cheaper than client-sided. I see the inverse quoted everywhere, but it's just not true.
consteval 2y ago
I imagine in the future as the internet improves and compression algorithms improve, games will be streamed. This would probably be cheaper for the consumer since hardware follows economy of scale for the game companies. Also, you won't be required to run any special software on people's computers. Porting to new platforms is trivial, game consoles become super cheap, and everyone can play together. The downside is you don't own the game. But this is more or less the case right now, with DRM and all. And for online games, you're already beholden to the servers.

yodon 2y ago

>Cheating must be detected serverside. Never trust the client, this is basic security. As long as rendering happens on the client, it's going to require client-side anti-cheat to stop players from looking through walls or adding aimbots. Client side rendering means the client has information like the location of the opponent even when the opponent is not visible. The server is unable to tell on its own whether the client is using this information inappropriately.

Spunkie 2y ago
Server side cheat detection is not just about actually detecting active cheating on the server side. It's also about the server providing the client the absolute minimum amount of information needed to function/render.
- zeta0134 2y ago
  Yes, for an FPS I don't really see a practical way around having the server do some rendering work, in order to detect occlusion and stop sending visual updates when it's pretty sure the client isn't able to see that object. There's a balance to be struck. Other techniques include simple statistical analysis: it's usually pretty damn obvious when a player is making inputs that shouldn't be humanly possible consistently, or reacting to information they shouldn't be able to see. That doesn't have to be done in realtime, it can be stored and reviewed later. (That might even be a feature on its own: delayed bans make it harder for cheaters to know if their techniques were detectable.)
  - mjr00 2y ago
    > That might even be a feature on its own: delayed bans make it harder for cheaters to know if their techniques were detectable. Bans have typically been done in waves for a long time for exactly this reason, yes.
- ThatPlayer 2y ago
  Lag compensation makes the absolute minimum relatively high. For example you need the client to know about an enemy player behind them that doesn't get rendered, because the client can turn around faster than the server can tell them about that player. Otherwise it can lead to a super frustrating experience where the enemy player pops into existence on the client in the middle of the screen, and you couldn't have reacted because there was nothing there. So if you're sending that data to the client, well now cheats can look for that and detect if there's a player behind you and warn you, giving an advantage. The same thing applies to corners and other occlusions, just less extreme, but still just as frustrating.
Buxato 2y ago
That are hacks that change the behavior and historic skill of a player, could be detected server side too. Also a client side anticheat couldn't detect modern aim hacking via external camera and custom hardware mouse.
- consteval 2y ago
  You don't even need an external camera, you could probably intercept the DP signal.

extr 2y ago

Sounds like you have it all figured out. Apply to work at one of these companies and let them know they're doing anti-cheat all wrong.

Spunkie 2y ago
Don't be a snarky ass, especially when you are wrong. The community HAS figured it out. If you want cheating reduced you do server side cheat detection not just client side and/or you release real dedicated servers. Neither of which shitty game companies are interested in, because it either cost more money to implement or means a minor loss of control.
- cma 2y ago
  After the dedicated server code is decompiled, I could see that causing more cheats.
  - Spunkie 2y ago
    It would also result in cheats getting identified and reported by the community. The TF2 dedicated server mailing lists, back in the day, were filled with new cheats, crashes, and exploits being found and reported by server admins.
    - doublepg23 2y ago
      That's pretty cool. How is cheating in TF2 in 2024 by the way?
      - Spunkie 2y ago
        The increase in bots and cheaters got progressively worse as matchmaking took over and ate away at the ability of private servers to maintain a community. Also before that, TF2 becoming a giant microtransaction experiment certainly didn't help. Still though even today I can open up TF2 and still have a few favorited servers that have been going for a decade+. I can join those servers and play bot and cheater free for the most part.

cma 2y ago

How are you going to prevent automatically seeing people through foliage?

cortesoft 2y ago

How can you detect whether a player aimed their mouse and shot vs a cheat aiming and shooting? To the server, those actions would be identical.

zeta0134 2y ago
Typically by things like reaction time, input latency, smoothness of motion, etc. A real human is surprisingly nondeterministic about these things, and their hardware adds all sorts of other interesting noise to the data. A naive aimbot will look unnaturally smooth and linear. You can somewhat cat-and-mouse this by attempting to humanize the inputs, but it's surprisingly difficult to replicate "natural" motion as input by a human. The humanized aimbot will end up with its own detectable signature. Besides that though, don't let perfect be the enemy of good enough. Catching the low-hanging-fruit (the stuff that is easy to detect) is *most* of the problem. Leave the crazy advanced stuff to the professional leagues, where players are under higher scrutiny anyway. Mind that I don't meant to argue against clientside cheat detection. You can still do a lot of that in userspace, and you really should. It's more data to analyze and it raises the bar for casuals. But since you inherently can't trust the client, you need to also do serverside detection, and really the serverside stuff (being remote, unknowable, and much harder to exploit) is going to be the stronger signal.

deteccphilippe 2y ago

No current level of server-sided classification can discriminate between good players and humanized aimbots. Similarly, no instantaneous window of input scrutiny can detect informational cheats (like ESP). You'd need days/weeks of data, and oops too late—they're radiant already. Also, server-sided anti-cheat is far cheaper than client-sided. I see the inverse quoted everywhere, but it's just not true.

consteval 2y ago

I imagine in the future as the internet improves and compression algorithms improve, games will be streamed. This would probably be cheaper for the consumer since hardware follows economy of scale for the game companies. Also, you won't be required to run any special software on people's computers. Porting to new platforms is trivial, game consoles become super cheap, and everyone can play together. The downside is you don't own the game. But this is more or less the case right now, with DRM and all. And for online games, you're already beholden to the servers.