10 ms·

Game Hacking – Valve Anti-Cheat (VAC)

164 points by LorenDB 1y ago

eGQjxkKF6fif 1y ago
When VAC was originally introduced, CPUs only had 32bit architecture, not that 64bit hindered anything; but you could inject cheats in a near infinite amount of way, or have cheats read from memory directly, or have cheats do things especially through video drivers. Hell, glitching your nvidia drivers and setting things like Negative LOD Bias would allow you to see through textures in some cases (wall hacks) It's been a cat and mouse game since the dawn of gaming and e-sports. Fun fact: CS 1.6 competetive had what was called "Organner" when teams switched over from CAL to CEVO (first paid e-sports online league) and as well as ESEA which is acclaimed for its anti-cheats; the pro players you see/saw such as n0thing, summit-1g (not saying he did cheat, he wasn't pro in CS1.6, 1g was a pug team that meant 1st generation and a lot of us were in it) -- but everybody in the pro scene around that did cheat, or had cheaters on their team. n0thing was banned from CAL rigorously for cheating in CAL-Premier and rejoined with complexity after ringing for other teams in CS1.6 matches (ban evading). he's admitted to cheating in CS 1.6, and found fame with Counter-Strike 1.6'd Evil Geniuses organization which encompanied the old compLexity roster. These dickheads went on to make fortunes; not to say that they weren't good in their own respects, but people such as n0thing openly admit, and will admit if you ask them on the stream if they cheated in 1.6 to get to where they're at. You could inject cheat codes through your mouse drivers at LANs and if you set a low FOV aimbot, it was undetectable: IE triggers when you aim at their chest, aims up to hit the head; and had advanced net code modifiers to land bullets in places you weren't aiming all together. Knowing this, completely ruined the pro scene and wanting to watch these matches and personalities all together. To know how many legitimate players out there were passionate about these games, looking to go pro, and really enjoy competing at the highest levels couldn't because the skill gap was so significant, and then even more so because pro players had undetectable cheats. Still to this day it is virtually impossible to detect hacks, however games such as DotA2 make it signifcantly harder to cheat by only sending frames/updates when it should; rather than old games sending all player data. I believe Valorant has a decent system but all in all; I helped run the leagues and the level and problem at which cheating was occurring, was known about, and not being able to prove what you know, would make you SICK if you ever enjoyed competing in e-sports.
- henrebotha 1y ago
  Yet another reason why fighting games are the superior competitive scene. The only "cheat" you could realistically see at an offline event is macros, and the chances of a macro increasing your win rate are slim to none. And there are so, so many good offline events. Online there are more potential ways to cheat, but nobody really cares. Just blacklist the player and move on.
  - eGQjxkKF6fif 1y ago
    Fucking agreed. But if you check out street fighter on youtube with 'Street Fighter mike ross tool assisted' https://www.youtube.com/watch?v=pWS3Kq5p77k https://www.youtube.com/watch?v=pWS3Kq5p77k You can inject cheats directly in to the Xbox's back then directly through the fight sticks You'd know though if somebody was cheating so not sure how crazy the SF scene had cheats but check out tool assisted; when I originally saw it I just put my head down
  - nyanpasu64 1y ago
    Reminded of the Super Pichu story where someone modded his ISO of Melee to increase Pichu's stats during a Melee tournament.
  - heraldgeezer 1y ago
    Yea but boring or too complex, just not fun to watch. There is a reason CS and DoTA/LoL is waaaaay bigger :)
    - henrebotha 1y ago
      You cannot tell me fgs are "too complex" and then mention DOTA in the same breath. I personally prefer watching a game that doesn't have downtime. Watching teams buy items and walk around is not interesting. So, so much downtime in all these big team games.
    - CarVac 1y ago
      Smash is a great spectator esport but... Nintendo hates the scene.
sim7c00 1y ago
nice write up! clear and informative. i was surprised to learn they roll it all in user mode, even though its not unbeatable its pretty good anti cheat, especially considering no kernel stuff (which can take shady or impractical turns for some other anti cheat ..)
duskwuff 1y ago
> To be continued Unfortunately, doesn't look like the followup post (about analyzing the VAC DLLs) has been written.
- SirFatty 1y ago
  Maybe Valve sent Moose and Rocco to have a conversation with the author (Caddyshack reference).
  - mathgeek 1y ago
    Better than moose and squirrel.
delusional 1y ago
> Being banned from all “GoldSrc” games This isn't true, or at least it wasn't back in the day. The logic Valve seemed to follow was that VAC was "engine" bans. If you got banned in a GoldSrc game, you'd be banned in all games using that engine, but you'd be allowed to continue playing source games. The same was also true in the opposite case. More importantly, this meant that getting banned in Modern Warfare 2, wouldn't get you banned in any other game, since no other games were released on that engine.
- eGQjxkKF6fif 1y ago
  It would show on people's accounts though and in in Counter-Strike scrims and matches if somebody had a VAC ban on their record/profile you just kicked them if you could and found a new team to play. So while engine specific, people still judged you, especially in pubs (public servers) Been a _long_ time since I've played. Fucking cheaters.
bob1029 1y ago
I am not a fan of the signature-based techniques used by VAC, et. al. I've lost a few steam accounts to accurate but unintended (i.e., not actually cheating) detection of debugging tools attached to totally unrelated processes on the same machine. Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. Ethical hacking and malicious hacking are indistinguishable from the perspective of this kind of machine-wide blind signature detection. Statistical techniques can dramatically reduce false positives in cases like this. If someone at Valve had taken 10 seconds to review my stats during the detected interval, they should have been able to conclude I was not a threat to fair play.
- psini 1y ago
  I understand the sentiment but I can't bring myself to think valve is to blame or should be doing more. Getting a case of "Yes officer, I have an NO2 bottle in my trunk, but what it is plugged to is not actually the air intake for my car but something entirely unrelated, if you just take 2 hours to dig around and take it apart you'll also realize this"
  - MaxikCZ 1y ago
    Thats such a bad example. Ofc you can carry NO2 bottles plugged into something, if its not air intake of your car, and investigation should happen finding you not guilty.
    - PaulHoule 1y ago
      … unless you plug it into your mouth
  - mystified5016 1y ago
    When you're accused of breaking the law, your accuser must prove you have broken the law. If they cannot, there are actions you can take to recoup your damages. Valve can ban you for any or no reason with no means of recourse or refund. Totally the same thing, yeah.
garrettjoecox 1y ago
Years ago for educational purposes I decided to venture down understanding how easy/difficult it was to create a hack for Counterstrike. After just a few hours of watching YouTube tutorials and translating what I could grasp from C/C# into JavaScript (the only language I knew at the time), I had a working Node.js executable that edited memory offsets (using data from hazedumper[1]), letting me see enemies through walls and auto-fire as soon as they entered my crosshair. I obviously only tried it out on an alt steam account for fear of the infamous VAC ban, but no such ban happened. I only toyed with it for a few weeks as I then grew disinterested but that definitely left a sour taste in my mouth for the "effectiveness" of VAC if a script kiddie like me at the time could throw together something custom in just a few hours, I'm sure it'd be much easier now with ChatGPT... [1] https://github.com/frk1/hazedumper https://github.com/frk1/hazedumper
- SteveNuts 1y ago
  I'll never understand what people actually get out of cheating in games. I'll admit I've tried it a few times just for giggles (way back in the Age of Empires II/MSN Gaming Zone days), but the novelty quickly wears off and then it's just not even fun anymore. There must be some very interesting psychology behind this.
  - eszed 1y ago
    My perception of the psychology is a malformed competitive drive. Competition is fun! But when it gets someone to the place of "Must win at all costs" it can be life-destroying. For the video game cheats, I think it starts out as "Must beat the other players", but then that gets (mostly) boring once they are actually are beating the other players, and it shifts to "Must beat the anti-cheat system."
    - esyir 1y ago
      I think you, and a lot of other people really overestimate the number of people for whom the technical challenge is why they cheat. Seeing that the cheating industry is relatively large, and functions on a subscription basis; For the vast majority of cheaters the challenge is entering their credit card to get their cheat subscription. These are people who want to win at all costs, other users be damned.
snickerdoodle12 1y ago
Remote Code Execution like loading DLLs from a server and executing them sounds like malware.
- rvnx 1y ago
  It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Google_FOIA_Request.pdf https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely in practice.
  - snickerdoodle12 1y ago
    I get chromium & firefox from my distro's repos
    - bflesch 1y ago
      Linux distros are vulnerable to the same supply chain attacks. Did you ever do a background check on your distro maintainers? How many of them have email addresses from non-democratic TLDs?
      - snickerdoodle12 1y ago
        If they want to publicly publish their exploit chain for everyone who uses the distro that's their choice.
  - gruez 1y ago
    >If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".
jmuguy 1y ago
Arriving at college back in 2001 my roommate and I setup a CS server. A lot of the freshman were getting their own computers for the first time, and had not ever played computer games before so we basically kickstarted a CS community. I think it took about a month before a lot of them started cheating. It is kind of ridiculous how much of a plague cheating is on competitive gaming. Back then we would just observe the players and then ban their IPs. Which was luckily enough given how the campus network worked.
rimunroe 1y ago
Back in 2000-2005 I was very active in a community centered around 20 or so modded Counter-Strike servers which I volunteered as an admin on. We were generally good about having at least one admin on each server at any given time to deal with cheaters. Occasionally someone wouldn’t be around though. There was a period of time lasting about a month or two where a player with a name like BELT SANDER or ANGLE GRINDER or TABLE SAW hung around. They were pleasant and unremarkable, but they frequently used new Steam accounts and switched IPs. This person definitely wasn’t supposed to be an admin, but if they were around when someone was cheating and no actual admins were there, they’d somehow elevate their own permissions and ban the offending player. We tried to figure out what was happening and to see if we could somehow stop them, but we never did manage it. They were somehow gaining rcon access to the host server. After a while we just shrugged our shoulders. They didn’t seem to be harming anything, other than our peace of mind about our security. Overall they were actually really helpful for stopping late night/early morning disruptions.
- malwrar 1y ago
  I used to write cheats for CSS & other Source games. Not sure if the original CS would have the same vuln, but iirc you used to be able to use an INetChannel::ReceiveFile function with path traversal to grab the server config. There were a few cool hacks around the file path filtering logic they added in my era that (combined with ::SendFile) enabled a fun period of arbitrary RCE on Source servers. I knew one person who made a wormable payload for a game I won’t disclose which used that method. The methods are in engine.dll so it’s symmetric, clients would infect servers, which in turn infects more clients, etc. Around then was when I decided to start gaming from a VM lol.
  - hnlmorg 1y ago
    > Around then was when I decided to start gaming from a VM lol How? Maybe I’m getting my dates mixed up but CS was released in the late 90 / early 90s and consumer virtualisation wasn’t nearly good enough to game in for another 10 years. Consumer CPUs didn’t have virtualisation extensions and GPU paravirtualisation wasn’t available either in the early 2000s. VMWare wasn’t even any good for just running Windows 2000 (I mean, it was seriously impressive tech for its time, but it was dog slow even for just basic basic things). So you’d be stuck with Xen for anything serious. And that wasn’t trivial to get set up back then. Plus given the lack of drivers for virtualised hardware like soundcards and network interfaces, you’d likely be stuck with full fat emulation for those devices.
ValveFan6969 1y ago
[dead]
koakuma-chan 1y ago
Can you even get a VAC ban these days? I feel like it just destroys your trust factor but doesn't actually ban you, and to be honest that seems to be pretty effective for isolating honest players from cheaters.
deleted 1y ago
[deleted]
jokoon 1y ago
I stopped playing because I felt I could not trust other players, I was getting too paranoid. There were not that many blatant cheaters, but with closet cheaters, it's now very difficult to know if your opponent is better than you or cheating in subtle ways. It's a grey zone. I guess it's the combination of a frustration of losing matches and the constant suspicion. I was constantly trying to probe things and watching replays, it ruined the game because I was always focusing on cheating. Ultimately, I think most CS players don't really care about subtle/closet cheaters, so as long as they don't feel it, it's fine, the game keeps its high player count, so it's a good facade and valve is happy with that. CS is a game I can really enjoy, until I couldn't anymore.
- qskousen 1y ago
  I'm closing in on 3000 hours on cs2, and I often get accused of cheating, but I never have. You're definitely right about people being upset and thinking that someone is hacking. I'm pretty good at spotting "togglers" (people who turn their hacks on and off) but there are certainly times where it's really hard to tell, people can be very sneaky about hiding it. Then sometimes someone will call them out and they'll stop pretending. It's been quite a while since I've seen anyone spinbotting though.
- vintermann 1y ago
  In one specific area, I think this was actually the point, and that was Minecraft servers. Minecraft minigame servers were very competitive, and very shady, using every dark pay-to-win, gacha psychology trick in the book and even some new ones (in particular, pay-to-unban). They also had very public, competitive popularity rankings among themselves, which players actually used to pick a server. So I'm pretty sure they also actually paid account stealers to go to competing servers and cheat. The account stealers didn't have any better ways to monetize their huge lists of stolen account credentials. What makes me think this is the huge number of accounts who would cheat in obvious ways and immediately get banned for it. There didn't seem to be much effort to avoid bans, but when you can join minigame after minigame, and all of them have one guy who ruins it by cheating and immediately gets banned, I think that's economics at play, not just psychology.
- 1y ago
doublerabbit 1y ago
Not quite CS, but I was part of a hacking scene that used to exploit C&C Red Alert 2, YR via Teds Relay and discovering the IRC lobby password being "supersecret". Fun times were had as a script kiddie spawning the president and placing it in an IFV and just go demolishing the other players base with this fancy laser. But hey, I was 15 at the time. Habbo Hotel too, being part of a "mafia" with a habbo multi hacker app; the flicker glitch that made your character blink causing lag. That and placing furni in rooms in the walls using ArtMoney filters. I discovered perl while messing with MSN bots; I miss those ages. Others include NeoPets and Flash game hacking including RCEing the Money Tree claiming the loot before anyone else. Then I discovered IRC and Rx/PHAT botnets infecting via Windows 98 DCOM/NetSend exploits. Tried it at school and next thing two of the colleges rejected my application, parents called and banished from using any computer in secondary school for the next two years. The college I went to was low-level polytechnic but the couple of the lecturers I had noticed my skill and homed me on a different path than being a BlackHat. My moral compass kicked in and even now it's an itch I really want to scratch nowadays but PenTesting/CyberSecurity are too "prestigious" that the only chance is to fall in to. So I've been an Sys/Unix Admin for past 18 years watching the world burn. I was using Linux (Debian/Slackware) when the kernel was at version 2 and Xorg was XFree86. Luckily FreeBSD 8 gave me some fresh air after some IRC user rooted my box hosting my IRCd (on 56k) and did the honours of replacing Debian Linux with Debian kBSD. They left me a PM on IRC telling me to stay out of trouble and I've been using FBSD ever since. I'm 36. Never saw them again. "Hey kid, stay out of trouble. btw your irc is down". I will always remember that message waking up to a login MoTD with new root/password of some strange OS I had never used. I was angry that I lost my five botnet (T2 army) but I am grateful nowadays for it saving grace. Not until many years later, I couldn't work out how they did until I came across of a backup of my early PHP3 script that allowed you to issue commands to the host. Apache was running as root and this was hosted in a public web directory (doy).
- slavik81 1y ago
  > Fun times were had as a script kiddie spawning the president and placing it in an IFV and just go demolishing the other players base with this fancy laser. Oh. That's what happened to me. I always wondered where those lasers came from. I thought it was just a weird custom map.
pugworthy 1y ago
As an early admin of the Steam forums it was always fun when people came on to say they’ve been false VAC banned. There was sometimes the grand denial of any cheating, then the “well my little brother did install something but I didn’t use it”, followed by silence as they gave up.
schmorptron 1y ago
Woah, cool to see a bit of how it all works. Seems similar to basic antivirus signature checking? As a side note, a few years back, they had a GDC talk about a (then-new) machine learning based approach to catching cheaters. Regardless of how it worked out, I found it fascinating. The presenter delivered the problem and solution approach so well I'd still like to work on something like this some time. I think they're still updating this for CS2, so it would be really cool to see how far it's gotten now. https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc

164 points by LorenDB 1y ago

When VAC was originally introduced, CPUs only had 32bit architecture, not that 64bit hindered anything; but you could inject cheats in a near infinite amount of way, or have cheats read from memory directly, or have cheats do things especially through video drivers. Hell, glitching your nvidia drivers and setting things like Negative LOD Bias would allow you to see through textures in some cases (wall hacks) It's been a cat and mouse game since the dawn of gaming and e-sports. Fun fact: CS 1.6 competetive had what was called "Organner" when teams switched over from CAL to CEVO (first paid e-sports online league) and as well as ESEA which is acclaimed for its anti-cheats; the pro players you see/saw such as n0thing, summit-1g (not saying he did cheat, he wasn't pro in CS1.6, 1g was a pug team that meant 1st generation and a lot of us were in it) -- but everybody in the pro scene around that did cheat, or had cheaters on their team. n0thing was banned from CAL rigorously for cheating in CAL-Premier and rejoined with complexity after ringing for other teams in CS1.6 matches (ban evading). he's admitted to cheating in CS 1.6, and found fame with Counter-Strike 1.6'd Evil Geniuses organization which encompanied the old compLexity roster. These dickheads went on to make fortunes; not to say that they weren't good in their own respects, but people such as n0thing openly admit, and will admit if you ask them on the stream if they cheated in 1.6 to get to where they're at. You could inject cheat codes through your mouse drivers at LANs and if you set a low FOV aimbot, it was undetectable: IE triggers when you aim at their chest, aims up to hit the head; and had advanced net code modifiers to land bullets in places you weren't aiming all together. Knowing this, completely ruined the pro scene and wanting to watch these matches and personalities all together. To know how many legitimate players out there were passionate about these games, looking to go pro, and really enjoy competing at the highest levels couldn't because the skill gap was so significant, and then even more so because pro players had undetectable cheats. Still to this day it is virtually impossible to detect hacks, however games such as DotA2 make it signifcantly harder to cheat by only sending frames/updates when it should; rather than old games sending all player data. I believe Valorant has a decent system but all in all; I helped run the leagues and the level and problem at which cheating was occurring, was known about, and not being able to prove what you know, would make you SICK if you ever enjoyed competing in e-sports.

henrebotha 1y ago
Yet another reason why fighting games are the superior competitive scene. The only "cheat" you could realistically see at an offline event is macros, and the chances of a macro increasing your win rate are slim to none. And there are so, so many good offline events. Online there are more potential ways to cheat, but nobody really cares. Just blacklist the player and move on.
- eGQjxkKF6fif 1y ago
  Fucking agreed. But if you check out street fighter on youtube with 'Street Fighter mike ross tool assisted' https://www.youtube.com/watch?v=pWS3Kq5p77k https://www.youtube.com/watch?v=pWS3Kq5p77k You can inject cheats directly in to the Xbox's back then directly through the fight sticks You'd know though if somebody was cheating so not sure how crazy the SF scene had cheats but check out tool assisted; when I originally saw it I just put my head down
- nyanpasu64 1y ago
  Reminded of the Super Pichu story where someone modded his ISO of Melee to increase Pichu's stats during a Melee tournament.
- heraldgeezer 1y ago
  Yea but boring or too complex, just not fun to watch. There is a reason CS and DoTA/LoL is waaaaay bigger :)
  - henrebotha 1y ago
    You cannot tell me fgs are "too complex" and then mention DOTA in the same breath. I personally prefer watching a game that doesn't have downtime. Watching teams buy items and walk around is not interesting. So, so much downtime in all these big team games.
  - CarVac 1y ago
    Smash is a great spectator esport but... Nintendo hates the scene.

sim7c00 1y ago

nice write up! clear and informative. i was surprised to learn they roll it all in user mode, even though its not unbeatable its pretty good anti cheat, especially considering no kernel stuff (which can take shady or impractical turns for some other anti cheat ..)

duskwuff 1y ago

> To be continued Unfortunately, doesn't look like the followup post (about analyzing the VAC DLLs) has been written.

SirFatty 1y ago
Maybe Valve sent Moose and Rocco to have a conversation with the author (Caddyshack reference).
- mathgeek 1y ago
  Better than moose and squirrel.

delusional 1y ago

> Being banned from all “GoldSrc” games This isn't true, or at least it wasn't back in the day. The logic Valve seemed to follow was that VAC was "engine" bans. If you got banned in a GoldSrc game, you'd be banned in all games using that engine, but you'd be allowed to continue playing source games. The same was also true in the opposite case. More importantly, this meant that getting banned in Modern Warfare 2, wouldn't get you banned in any other game, since no other games were released on that engine.

eGQjxkKF6fif 1y ago
It would show on people's accounts though and in in Counter-Strike scrims and matches if somebody had a VAC ban on their record/profile you just kicked them if you could and found a new team to play. So while engine specific, people still judged you, especially in pubs (public servers) Been a _long_ time since I've played. Fucking cheaters.

bob1029 1y ago

I am not a fan of the signature-based techniques used by VAC, et. al. I've lost a few steam accounts to accurate but unintended (i.e., not actually cheating) detection of debugging tools attached to totally unrelated processes on the same machine. Having anything open like cheat engine or Tsearch while you join a lobby is a guaranteed ban no matter what. Ethical hacking and malicious hacking are indistinguishable from the perspective of this kind of machine-wide blind signature detection. Statistical techniques can dramatically reduce false positives in cases like this. If someone at Valve had taken 10 seconds to review my stats during the detected interval, they should have been able to conclude I was not a threat to fair play.

psini 1y ago
I understand the sentiment but I can't bring myself to think valve is to blame or should be doing more. Getting a case of "Yes officer, I have an NO2 bottle in my trunk, but what it is plugged to is not actually the air intake for my car but something entirely unrelated, if you just take 2 hours to dig around and take it apart you'll also realize this"
- MaxikCZ 1y ago
  Thats such a bad example. Ofc you can carry NO2 bottles plugged into something, if its not air intake of your car, and investigation should happen finding you not guilty.
  - PaulHoule 1y ago
    … unless you plug it into your mouth
- mystified5016 1y ago
  When you're accused of breaking the law, your accuser must prove you have broken the law. If they cannot, there are actions you can take to recoup your damages. Valve can ban you for any or no reason with no means of recourse or refund. Totally the same thing, yeah.

garrettjoecox 1y ago

Years ago for educational purposes I decided to venture down understanding how easy/difficult it was to create a hack for Counterstrike. After just a few hours of watching YouTube tutorials and translating what I could grasp from C/C# into JavaScript (the only language I knew at the time), I had a working Node.js executable that edited memory offsets (using data from hazedumper[1]), letting me see enemies through walls and auto-fire as soon as they entered my crosshair. I obviously only tried it out on an alt steam account for fear of the infamous VAC ban, but no such ban happened. I only toyed with it for a few weeks as I then grew disinterested but that definitely left a sour taste in my mouth for the "effectiveness" of VAC if a script kiddie like me at the time could throw together something custom in just a few hours, I'm sure it'd be much easier now with ChatGPT... [1] https://github.com/frk1/hazedumper https://github.com/frk1/hazedumper

SteveNuts 1y ago
I'll never understand what people actually get out of cheating in games. I'll admit I've tried it a few times just for giggles (way back in the Age of Empires II/MSN Gaming Zone days), but the novelty quickly wears off and then it's just not even fun anymore. There must be some very interesting psychology behind this.
- eszed 1y ago
  My perception of the psychology is a malformed competitive drive. Competition is fun! But when it gets someone to the place of "Must win at all costs" it can be life-destroying. For the video game cheats, I think it starts out as "Must beat the other players", but then that gets (mostly) boring once they are actually are beating the other players, and it shifts to "Must beat the anti-cheat system."
  - esyir 1y ago
    I think you, and a lot of other people really overestimate the number of people for whom the technical challenge is why they cheat. Seeing that the cheating industry is relatively large, and functions on a subscription basis; For the vast majority of cheaters the challenge is entering their credit card to get their cheat subscription. These are people who want to win at all costs, other users be damned.

snickerdoodle12 1y ago

Remote Code Execution like loading DLLs from a server and executing them sounds like malware.

rvnx 1y ago
It's "just" an automatic update, like Chrome, etc. It's one entry-point among others for RCE. If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Google_FOIA_Request.pdf https://epic.org/wp-content/uploads/privacy/nsa/foia/NSA-Goo... Google and NSA have a "partnership". Valve could also have such partnership in theory, through VAC, though unlikely in practice.
- snickerdoodle12 1y ago
  I get chromium & firefox from my distro's repos
  - bflesch 1y ago
    Linux distros are vulnerable to the same supply chain attacks. Did you ever do a background check on your distro maintainers? How many of them have email addresses from non-democratic TLDs?
    - snickerdoodle12 1y ago
      If they want to publicly publish their exploit chain for everyone who uses the distro that's their choice.
- gruez 1y ago
  >If tomorrow NSA wants to gather any files on your computer, all they need to do is to ask Google to push an update for you through Google Omaha. They could in theory, but has this actually happened in practice? Pushing a rogue update isn't exactly a novel idea, but despite decades of government document leaks and APTs being analyzed, there's scant evidence that any government pressured a company to push a rogue update. Same goes for other threat models like "government pressuring CAs into issuing a certificate".

jmuguy 1y ago

Arriving at college back in 2001 my roommate and I setup a CS server. A lot of the freshman were getting their own computers for the first time, and had not ever played computer games before so we basically kickstarted a CS community. I think it took about a month before a lot of them started cheating. It is kind of ridiculous how much of a plague cheating is on competitive gaming. Back then we would just observe the players and then ban their IPs. Which was luckily enough given how the campus network worked.

rimunroe 1y ago

Back in 2000-2005 I was very active in a community centered around 20 or so modded Counter-Strike servers which I volunteered as an admin on. We were generally good about having at least one admin on each server at any given time to deal with cheaters. Occasionally someone wouldn’t be around though. There was a period of time lasting about a month or two where a player with a name like BELT SANDER or ANGLE GRINDER or TABLE SAW hung around. They were pleasant and unremarkable, but they frequently used new Steam accounts and switched IPs. This person definitely wasn’t supposed to be an admin, but if they were around when someone was cheating and no actual admins were there, they’d somehow elevate their own permissions and ban the offending player. We tried to figure out what was happening and to see if we could somehow stop them, but we never did manage it. They were somehow gaining rcon access to the host server. After a while we just shrugged our shoulders. They didn’t seem to be harming anything, other than our peace of mind about our security. Overall they were actually really helpful for stopping late night/early morning disruptions.

malwrar 1y ago
I used to write cheats for CSS & other Source games. Not sure if the original CS would have the same vuln, but iirc you used to be able to use an INetChannel::ReceiveFile function with path traversal to grab the server config. There were a few cool hacks around the file path filtering logic they added in my era that (combined with ::SendFile) enabled a fun period of arbitrary RCE on Source servers. I knew one person who made a wormable payload for a game I won’t disclose which used that method. The methods are in engine.dll so it’s symmetric, clients would infect servers, which in turn infects more clients, etc. Around then was when I decided to start gaming from a VM lol.
- hnlmorg 1y ago
  > Around then was when I decided to start gaming from a VM lol How? Maybe I’m getting my dates mixed up but CS was released in the late 90 / early 90s and consumer virtualisation wasn’t nearly good enough to game in for another 10 years. Consumer CPUs didn’t have virtualisation extensions and GPU paravirtualisation wasn’t available either in the early 2000s. VMWare wasn’t even any good for just running Windows 2000 (I mean, it was seriously impressive tech for its time, but it was dog slow even for just basic basic things). So you’d be stuck with Xen for anything serious. And that wasn’t trivial to get set up back then. Plus given the lack of drivers for virtualised hardware like soundcards and network interfaces, you’d likely be stuck with full fat emulation for those devices.

ValveFan6969 1y ago

[dead]

koakuma-chan 1y ago

Can you even get a VAC ban these days? I feel like it just destroys your trust factor but doesn't actually ban you, and to be honest that seems to be pretty effective for isolating honest players from cheaters.

deleted 1y ago

[deleted]

jokoon 1y ago

I stopped playing because I felt I could not trust other players, I was getting too paranoid. There were not that many blatant cheaters, but with closet cheaters, it's now very difficult to know if your opponent is better than you or cheating in subtle ways. It's a grey zone. I guess it's the combination of a frustration of losing matches and the constant suspicion. I was constantly trying to probe things and watching replays, it ruined the game because I was always focusing on cheating. Ultimately, I think most CS players don't really care about subtle/closet cheaters, so as long as they don't feel it, it's fine, the game keeps its high player count, so it's a good facade and valve is happy with that. CS is a game I can really enjoy, until I couldn't anymore.

qskousen 1y ago
I'm closing in on 3000 hours on cs2, and I often get accused of cheating, but I never have. You're definitely right about people being upset and thinking that someone is hacking. I'm pretty good at spotting "togglers" (people who turn their hacks on and off) but there are certainly times where it's really hard to tell, people can be very sneaky about hiding it. Then sometimes someone will call them out and they'll stop pretending. It's been quite a while since I've seen anyone spinbotting though.
vintermann 1y ago
In one specific area, I think this was actually the point, and that was Minecraft servers. Minecraft minigame servers were very competitive, and very shady, using every dark pay-to-win, gacha psychology trick in the book and even some new ones (in particular, pay-to-unban). They also had very public, competitive popularity rankings among themselves, which players actually used to pick a server. So I'm pretty sure they also actually paid account stealers to go to competing servers and cheat. The account stealers didn't have any better ways to monetize their huge lists of stolen account credentials. What makes me think this is the huge number of accounts who would cheat in obvious ways and immediately get banned for it. There didn't seem to be much effort to avoid bans, but when you can join minigame after minigame, and all of them have one guy who ruins it by cheating and immediately gets banned, I think that's economics at play, not just psychology.
1y ago

doublerabbit 1y ago

Not quite CS, but I was part of a hacking scene that used to exploit C&C Red Alert 2, YR via Teds Relay and discovering the IRC lobby password being "supersecret". Fun times were had as a script kiddie spawning the president and placing it in an IFV and just go demolishing the other players base with this fancy laser. But hey, I was 15 at the time. Habbo Hotel too, being part of a "mafia" with a habbo multi hacker app; the flicker glitch that made your character blink causing lag. That and placing furni in rooms in the walls using ArtMoney filters. I discovered perl while messing with MSN bots; I miss those ages. Others include NeoPets and Flash game hacking including RCEing the Money Tree claiming the loot before anyone else. Then I discovered IRC and Rx/PHAT botnets infecting via Windows 98 DCOM/NetSend exploits. Tried it at school and next thing two of the colleges rejected my application, parents called and banished from using any computer in secondary school for the next two years. The college I went to was low-level polytechnic but the couple of the lecturers I had noticed my skill and homed me on a different path than being a BlackHat. My moral compass kicked in and even now it's an itch I really want to scratch nowadays but PenTesting/CyberSecurity are too "prestigious" that the only chance is to fall in to. So I've been an Sys/Unix Admin for past 18 years watching the world burn. I was using Linux (Debian/Slackware) when the kernel was at version 2 and Xorg was XFree86. Luckily FreeBSD 8 gave me some fresh air after some IRC user rooted my box hosting my IRCd (on 56k) and did the honours of replacing Debian Linux with Debian kBSD. They left me a PM on IRC telling me to stay out of trouble and I've been using FBSD ever since. I'm 36. Never saw them again. "Hey kid, stay out of trouble. btw your irc is down". I will always remember that message waking up to a login MoTD with new root/password of some strange OS I had never used. I was angry that I lost my five botnet (T2 army) but I am grateful nowadays for it saving grace. Not until many years later, I couldn't work out how they did until I came across of a backup of my early PHP3 script that allowed you to issue commands to the host. Apache was running as root and this was hosted in a public web directory (doy).

slavik81 1y ago
> Fun times were had as a script kiddie spawning the president and placing it in an IFV and just go demolishing the other players base with this fancy laser. Oh. That's what happened to me. I always wondered where those lasers came from. I thought it was just a weird custom map.

pugworthy 1y ago

As an early admin of the Steam forums it was always fun when people came on to say they’ve been false VAC banned. There was sometimes the grand denial of any cheating, then the “well my little brother did install something but I didn’t use it”, followed by silence as they gave up.

schmorptron 1y ago

Woah, cool to see a bit of how it all works. Seems similar to basic antivirus signature checking? As a side note, a few years back, they had a GDC talk about a (then-new) machine learning based approach to catching cheaters. Regardless of how it worked out, I found it fascinating. The presenter delivered the problem and solution approach so well I'd still like to work on something like this some time. I think they're still updating this for CS2, so it would be really cool to see how far it's gotten now. https://www.youtube.com/watch?v=kTiP0zKF9bc https://www.youtube.com/watch?v=kTiP0zKF9bc