Think of it a bit like doping tests in sports. As long as you're just competing in amateur races for fun then take all the steroids you want. Once you want to start competing in serious races be prepared for people demanding blood and urine samples.
Kernel level anti-cheat is meaningless.
The average cheater is paying $10-50 for cheat software. You may not like the anti-cheat software, but it works against the most common cheats.
I think they could have an opt-out league that doesn’t require anti-cheat but remains separate. You might be one of the few non-cheaters in there, but at least it would be an option.
Heuristic software works against the most common cheats. Standard anti-piracy tricks work against the most common cheats. Kernel-level anticheat is only useful against a very specific kind of high-end cheat, and if you're going that far, you might as well use an undefeatable hardware cheat.
Meanwhile we are letting shady companies illegally spy on users [0] and mine crypto [1], for what? What is the gain? What is the value proposition of kernel-level drivers in the anti-cheat application? What's more, the average gamer doesn't know anything about computers. How can they be expected to make an informed decision about whether or not they should buy a game with kernel-level anticheat if they don't know what that means? Even worse, there is no legal requirement that a game's marketing material say anything about its anti-cheat implementation. These aren't tin-foil hat concerns, these are the enablers of real scandals that have happened and are happening.
0. https://www.wired.com/story/kernel-anti-cheat-online-gaming-...
My observation is that competitive online gaming is over. It's just a cesspool of cheaters now.
Some cheat dev only needs to develop that "high-end software cheat" once and can sell it millions of times around the world, with super easy distribution over the internet. A setup with hardware video capture costs $50-$200 for every single user for hardware alone, and needs at least a bit of computer knowledge to set up.
Sounds like it works, then.
“Yes.”
“What did it cost?”
They're buying trained models from people who have the fancy hardware.
Emphatically, it does not. Writing exploits and mitigating them is an arms race, and it is always easier to exploit than it is to defend. The entire reason for such software being sold is after all that it works, even when it is the bad/easy fundamentally detectable kind that runs inside the same OS as the game.
If kernel level anti-cheat lead to "serious cheats" having to resort to the above, then kernel level anti-cheat is actually pretty fucking effective.
Cheat behavior is obvious. Ridiculous long distance accuracy. Weird movement. Weird map awareness. Weird awareness of other players. Etc.
Behavioural anti-cheats are not the answer. Implementations are crap and under-developed, and I don’t blame them: you would need tremendous (server-sided) power to correctly process the models considering how complex multiplayer games are, and it just isn’t worth the investment and complexity to them.
It’s just cheaper to pay rootkit developers (like EAC or BattlEye) and knowingly infect client devices. Hell, their drivers are even WHQL signed by Microsoft. And when false positives hit? Just blame the anti-cheat vendor. Potential HR problem dodged.
[1] https://www.i3d.net/products/hosting/anti-cheat-software/
Robocalypse Now: Using Deep Learning to Combat Cheating in Counter-Strike: Global Offensive https://www.youtube.com/watch?v=kTiP0zKF9bc
If you play with lower ranked friends and do really good in matches you will get reported a lot which will tank your trust factor and almost guarantees it that will only see hackers from them on.
They say they use other factors like account metadata, but I have a 10 year old account, with purchased games and verified phone and still got "Low Trust Factor" after playing with friends and started to have an obvious hacker every other match.
That is why I am a former CSGO player
Why use deep learning when so, so many bots (and their host accounts) could be blocked with trivial heuristics? My only guess is allowing spinbots/farming somehow provides a financial gain in CSGO?
Valve devs have a lot more leeway than your average developer. They honestly might have just thought it would be cooler.
Beyond that they now have the infrastructure to detect more subtle forms of cheating through deep learning using Overwatch (the reporting system, not the game) as ground truth data to train their AI.
I guess your last encounter with aimbots was in the early 00s…
Besides, it's not just a matter of improving accuracy. Elite players are elite in multiple facets of the game. Movement, general awareness, map awareness, accuracy, etc. Many of these metrics are easy to measure.
Cheaters will show up as outliers and it is at that point that their accounts should be manually reviewed.
With casual gaming I really don't even care if someone is "cheating" to improve so long as I feel the game was fair. I can put a red dot on my screen to improve my aim, as an example.
This was impossible in Q3A (1998) without introducing an input lag thanks to client side prediction. Server also didn't send you updates on other clients that are too far away, behind a hill - you'd pretty much only receive positions of those you could see, hear or that could see you. In Warzone, you can see everyone on the map with a wallhack.
I really wonder why the game is designed this way. I guess it might be to limit required computation power of the servers? They still do stuff like hit detection, so server surely has some idea of the physics.
On top of all that, this stuff is possible even today, months or even years after such exploits being widely known. They do have a kernel-level AC driver, but they don't even seem to detect trivial hacks from the server-side.
Cheaters quit after a while because the game loses its challenge, and people being cheated leave because the game.feela unfair, and eventually there's not much of a community left.
Check what a top player can do: https://youtu.be/8Qf5Xlty1Cg I doubt an AI will be anywhere close in the next 10 years.
Skill tunable AI, developed by a private poorly funded group, that plays the game for you https://www.youtube.com/watch?v=revk5r5vqxA
AlphaStar, developed by a large corp, mopping the floor with Battle.Net's Starcraft 2 players https://www.youtube.com/watch?v=o1zhmGPmAAM
OpenAI, developed by a large corp, beats top DotA2 team https://www.youtube.com/watch?v=tfb6aEUMC04
On one hand, it's exciting tech [old] news. On the other, people who play competitive games must hope for a solution against abuse. The rest of us must hope it isn't an invasive solution such as, what effectively is, kernel malware.
AlphaStar and OpenAI have nothing to do with the conversation here, right off the bat.
This video is so cringey too with random burps and "skynet" references. The external hosting is not related at all to the "soft" cheating, and that in turn has nothing to do with AI. Packet sniffing vs OpenCV vs Tensorflow for finding a head is not a meaningful difference.
Years ago, and I mean years ago cheat developers were building this type of "soft aim" cheats that don't snap.
And the separate input via controller _is_ detectable if this becomes enough of an issue... your "AI" is generating input and it often will generate input that controllers wouldn't. Because the "AI" is ML and only being applied to finding on screen targets.
-
Making a second model to generate realistic input would be a whole other achievement no one has even bothered with because... they don't need to.
On-host hacking is rampant and these games can't seem to stop it, so no one has bothered.
I'd be for kernel-level anti-cheat if it actually worked, but script kiddies are beating this "kernel level anti-cheat" handily.
To me the answer is boring simple statistical analysis, increasing the cost of recovering from bans, etc...
But that doesn't sound as sexy so I guess we can keep this farce of a cat and mouse game going.
That's where anticheat is going imo: algorithmiclly defining what the fastest more precise human should be capable of. Anything beyond that is "cheating".
You see no cheap aimbots and conclude the anti-cheat is not relevant anymore. May be the right conclusion is that they're working.
Not saying this justifies the kernel drivers. I don't trust my gaming computer precisely for this reason. I wonder if some form of containerization/virtual machine could make it possible to both allow for this kind of kernel-level anti-cheat without exposing my whole system to untrusted code.
No. Because then you could write an aim-bot that runs in the host machine…
This may be true for a class of cheats, but it isn't broadly true. That means these category of cheats can only enhance what is already visible.
In FPS games, being able to see players position through walls is a super valuable cheat _and_ requires access to the underlying game engine (to extract player location).
Maybe because doing the math to figure out if it should be visible is handled completely on the frontend to keep latency low?
This is the equivalent of a bank API giving you everyone's information, and the frontend SPA filtering it to only the logged in user.
https://technology.riotgames.com/news/demolishing-wallhacks-...
There are also videos on Youtube demonstrating it in actions
But there is plenty when you google the key words.
Anti-Cheat on the Account-Level is meaningless. You ban a cheater? Who cares. He will back with a new Account some Minutes later. Hardware Bans are useless aswell, as they can easily be spoofed. The only effective strategy for Anti-Cheat is a Universal Identity Provider, which can proof you are a real Human with no Cheat Record.
Isn't that what you are talking about here?
You can create a new Steam account, sure, but that would start you again from scratch as a total newbie (and losing access to anything you'd bought)
I've wondered if there's some sort of economy here, i.e. someone with a ton of stolen accounts monetizing them by offering to cheat all day on your competitor's server.
Most of these accounts have security questions set, so you can't change the email and truly "take ownership" of the account, but it's good enough for cheating on servers.
Some shops even have an API for generating accounts or tokens, so your hack client can have a feature where you get a new account right from your game. Get banned, reconnect in a few seconds.
Personally, I'm completely fed up with online competitive multiplayer for other reasons so it doesn't really affect me. I just don't by the games that would use kernel-level anti-cheat to begin with.
I don't disagree with your general take, but you can't accuse Valve Anti Cheat of being a failure.[0]
The benefits of this sort of income may be high compared to the benefit of being a "serious competitive game".
I think Minecraft servers are instructive, because they're often run just as cynically as free to play games, but with less competence, so it's easier to see what's going on. You do see a lot of pay-to-unban there, for instance.
I wonder if we'll eventually end up at a point where all competitive gaming is run entirely sever side and IO is streamed to cryptographically signed and verified hardware.
So while anti-cheat helps protect the pro/serious players (who in some ways are community/marketing leaders in this world of Twitch and YouTube), it also creates a fair environment for all the casual and aspiring players who keep spending money on the game in droves.
Pro cheating uses hardware to cheat. It streams the video output and keyboard/mouse input to an AI/ML. Making these kernel anti-cheat useless there.
Casual players looking to spend money on cosmetics aren't affected by cheaters because the system influencing the players to buy isn't affected by the cheaters. The way most of these "influence systems" work is by using marketing strategies. It'll augment your match, or otherwise the players you meet, to see cosmetics you don't have. Coupled with gambling mechanics to induce addiction and sheer marketing material ("best offer now!") makes for this whole pro-kernel-anti-cheat industry move highly dubious.
Source: i worked at a company that writes such systems. The day I decided to quit was when my naive ass heard the team lead, on a recruitment call, explain to a candidate what we do: "we refine a company's ability to get kids addicted".
It's a completely different game (no pun intended) than what news outlets want us to think.
This is a rather confused thing to say. Are there players out there that just grind cosmetics and don't care about win rate, game quality, or wasted time? Probably a handful.
But the overwhelming majority of players in a game are there to have fun and cheaters utterly destroy that. Cheaters, smurfs, etc, are a plague on online multiplayer gaming where one troll ruins everything for everyone else match.
At the end of the day it's just a game, and if the game disappears or whatever humanity will go on. So let's not lose perspective. But saying casual players aren't affected by cheaters is flat out wrong.
I worked in gaming as well, so I'm familiar with the issues you're referencing, but hyperbolic exaggerations don't help us address it.
No, the other way around. On "pro" servers there is moderation that makes cheating a non-issue. It's in the casual space that cheaters ruin everything, because there isn't any human moderation.
I'd phrase it as "you can still play the game, just not against other humans".
I often care about online multiplayer, but only with my friends (who I trust not to cheat). I don't want to install a rootkit for that.
Let me put it this way - I'd much rather play an online shooter with a hardcore kernel level anticheat than a one without it.
And yes, community moderation is great, except that it has mostly gone away in most games.
a) can't allow "vote to kick" from the opposing team in a competitive environment. That has obvious abuse written all over it, either intentionally or unintentionally (opposing team is losing or opposing player is legit good but they think he is cheating) b) when you allow vote kicking of "same team only", like CSGO, there is a lot of grief type of harassing where parties of players (like a 3 queue) can vote kick teammates just for general griefing reasons, intentionally deranking, and the like.
The worst thing gaming has ever done was think it was anything like professional sports. I think that I'm in favor of cheating in games just because it rankles people who take gaming way too seriously.
Every activity has its own popularity, and number of fans of various seriousness... Cat and dog shows, caber toss, curling, singing competitions, on and on and on, the list is about infinite, since it encompasses everything within which someone could potentially be more skilled.
Singling out video games among all the other things humans do competitively feels like a personal bias.
I personally don't care about probably 99% of the 'competitions' out there, but I don't give anyone crap for being obsessed about their own thing.
(I don't play games online multiplayer style, so I'm not in the target group anyway.)
I don't think there's such a thing as "gaming", as you use the word... everyone involved does their own thing, in infinite variety as well.
Sure the technological barrier is important, but I fail to see how they're categorically different depending on what they require of the participants.
I don't have an issue saying they both should not be taken seriously, or that both should be taken seriously, but to draw a line between them in terms of "seriousness" I think needs elaborating to me.
Also stupid. Athlete worship is as bad or worse than celebrity worship. The obsession with and tribalism from professional sports has creates some of the most obnoxious bores in the world. All for a bunch of people kicking or throwing a ball around.
Almost ALL exhibit rootkit behaviour. Capture all OS events, dig through system and user directories, list all processes, fetch DNS and browser histories, block certain system calls, and more just to name a few. But hey! Their software (including drivers) are signed by Microsoft, so that’s alright :))
Funny part is that all those drivers are created by no other than ex-community members, under no advisory from system specialists or security experts. So guess what? Security vulnerabilities all around. Pretty much all their drivers are wide open and unsecure.
Nice fun having persistent, kernel-level, system-trusted exploits auto-installed on your system!
Oh, almost forgot, BattlEye has the ability to download custom bytecode from their servers and execute it. RCE baked right in. Good stuff.
So your frustration is more than reasonable..
EDIT: I will try to find the posts pointing to all vulns that I mentioned, and cite them.
We need a real solution to this honestly, it’s not enough to just kick up a fuss about game devs including anti-cheat and ever-more-invasive anti-cheat, but actually providing solutions people can use.
The economic incentives do not exist on consoles to cheat, so publishers are convinced that control of the platform is the problem.
On release they made a big deal about how small the kernel level portion is and how most of the complexity of the anti-cheat was still in user space. I'd be interested to hear how true that is and if that makes much of a difference in your mind how trustworthy it is.
Generally speaking though; the size of the components that run in the kernel is not important. The kernel mode software can act as a window to the rest of the system.
Let me say that I have been working in AAA online game development for more than 7 years now;
I have worked on games that had 10's of millions of players, and these were full fat $60 AAA games.
Cheating was the second[0] biggest issue of our games, it sucked the entire enjoyment out- getting ganked by a bunch of players shooting through walls is not fun.
Why did we "allow" cheating?: Well, we never did, we used some of the best anti-cheat software we could afford, but it was still possible to cheat.
"Don't trust the client" is a common response, but being fully synchronised to the server has drawbacks too; servers typically "tick" at about 10-20fps, theres a lot of tricks we pull off to make it seem as if it's going the 144-240Hz of your monitor, like showing hitmarkers (but not damage numbers) to make it feel as if it's fast, if your movements were synced to the server you would feel as though you were walking through water, as the movement would be very slow as it needs to do a 150ms round trip to sync a step.
The truth of it is if we fully synchronised every action to the server: not only would it feel abhorrently slow; it would require a full 3d rendered simulation of the game world, we'd be able to run maybe 3-4 users on 40 core machines with 256G of ram... that's not feasible.
"Don't make online games" is another common response to hearing the realities and difficulties of making these kinds of games.
But I'd suggest, if that's your response; even if we made them that doesn't mean you have to install them.
We're both making a decision here: We decided to make an online game because it can be a lot of fun, you decided to install an online game because it can be a lot of fun.
Cheaters want to ruin that fun, we have woefully few tools to prevent that.
(by the by: I'm not in favour of kernel level anti-cheat, but fuck are cheaters the bane of my existence).
[0]: Biggest issue was actually bugs, but when we fixed bugs, cheaters were the next primary complaint.
This patterns of thinking "Well I'll just download a binary onto my clients machine and force it into compliance, then I can throw all of them into a big pot and they'll all mix just fine!" Is a kind of persistent insanity that is leading to your woes, more than it is the lack of a stiffer boot to land on the necks of client machines.
"If we just control the platform"
"If we just control the hardware"
"If we just control the software"
"If we just control everything".
"And what of tools to moderate bad actors?"
"Eh? Sure, here's a kick function."I’m not saying it’s impossible to cheat on consoles but it wasn’t a problem for us (lag switching aside; which was actually easy to detect).
Things like stadia help the platform more than consumers think; but people resoundedly rejected Stadia for a myriad of reasons.
I think everyone here paints a rosy picture of what content moderation is, and maybe we stretched our hand a bit thin regarding having enough humans involved (despite games taking 700-1400 people 4+ years to make in the first place)- but the rub is that people can’t have everything.
We can’t expect you not to try to tamper with the binaries and ruin games for others.
You can’t expect us not to try preventing it.
Because at the end of the day; people do submit reimbursement claims because of cheaters ruining their experience, and if there’s one thing that I can promise it’s that no amount of human review will ever be sufficient, we already put 70 or so humans on reviewing reports, and even then it was difficult to punish people, because if you ban someone they just buy another key from a Russian third market reseller for €3 (or if you make the game free god help you)
I'm saying that players often have the barest bones of ways, if they have anything at all, to say who they would and who they would not like to play with.
Players refunding over cheating are also refunding because, when they discover cheating, they can do absolutely nothing about it. If they're lucky, they might get to scream into the void and hope a moderator listens. Some brand new player on a $3 key just waltzed into the pool of players and everyone has to trust them as equally as everyone else. This is not how trust works.
But then how should one do it? I don't know! Precious little work has been done here. And why? Because it's been wasted on pretending that one can trust the clients machine if we just download enough malware to it.
Of course, I don't expect AAAs to offer an experience like this, because human moderation doesn't scale cheaply to 10s of millions of players.. race to the bottom <3
Cheaters also do things like buy CD codes/stolen accounts which are sold cheaply on various websites.
It also doesn’t help when there are promotional campaigns that let people play the game for free or very cheaply.
We even had a problem with people buying the game with stolen credit cards.
Regardless of that, human moderation efforts are a full time job, personally I’d be happy to release the server, but the server requires 40 cores and 256G of ram to boot, many people don’t have that, and that’s not including the kinds of nefarious things people did with the binaries of other games gameservers we gave out (like saving garbage back to our persistence, or trying to inject statistics to the leaderboards systems if there are any.)
It sounds easy from the outside; if you think it’s easy I really do have a job for you. Maybe I’m stupid.
But I was not told (for business reasons anyway) to hold on to the game server binaries.
We did it because making the game was easier/possible that way and the gameserver itself is nearly impossible to load for most people anyway.
I promise you that it is not cheap to host gameservers — if we could we would have pushed that burden onto players. (Speaking purely economically)
So you didn't check the demo corresponding to the reporter's account and timestamp? Why not? Why don't you have IDs in logs?
My experience comes from 100% free games. Codes and accounts were irrelevant. If you can't earn some reputation and trust on a public server, you can't get invited to a private one. Simple as that. It doesn't matter if wannabe-cheaters can make a million accounts.
> Regardless of that, human moderation efforts are a full time job
For many clans and gaming communities, moderating their turf is a passion project and having the keys is a sought-after position of privilege. They love to spectate and look out for potential new "hires" while keeping the chat clean and kicking out any griefers and cheaters.
> personally I’d be happy to release the server, but the server requires 40 cores and 256G of ram to boot
> the gameserver itself is nearly impossible to load for most people anyway.
I think you lack some imagination. Letting gamers operate their own servers doesn't mean they have to host their own servers. Just like discord "servers" aren't actually hosted by their "owners".
> It sounds easy from the outside; if you think it’s easy I really do have a job for you.
Sorry, not interested in AAA games.
> Maybe I’m stupid.
You're probably not stupid but it's all too common to see people not being able to think outside the box.
Logs are great, but people are not great at reporting cheaters. Some resort to recording their screen or cheaters bypass the “report” button by acting in a way that prevents that button from popping up.
We must have lost thousands of man hours on people falsely hitting the report button when someone was being better than them. Everything in it’s time.
Community moderation is a very comforting idea, but the reality is actually not conducive to a good online experience except for a very small minority; the kinds of problems that crop up are obviously exclusion but also go into the area of power abusing operators.
I know you’re going to say “go to another server” but honestly, that’s naive. Oper abuse is even more deeply unpleasant than cheating. It is enough to put you off a game entirely.
So the gatekeeping, politics aspect are obviously not good but what is also true is that there is a large contingent of people who desire good matchmaking, good matchmaking depends heavily on:
A) regionality
B) a large population to pull from
C) consistency of the platform and administration.
If you get into a “random” game and someone cheats, that’s no different than if you joined a “random” game and the admin of the server did something within their power.
Having a small population for a game like apex legends means that the outcome is nearly always the same.
Having low regionality of hosted servers means people in South America have extremely bad experiences; as severs there are expensive and finding a population to fund it amongst themselves is difficult.
Also, obviously, a 40 core 256G windows PC costs in the region of €300/mo (not including the windows server license). Given people are already very cost conscious when it comes to games; getting people to shell out the price of a game each every month to run a server seems unlikely.
I'm sharing my experience. I can say that I had very good experience with community moderation for many many years across numerous different games.
By the sound of it, you haven't even tried it, you're just explaining why you don't believe it works?
And the end result then is that you have no moderation. Cheaters can still cheat, griefers can still grief, and hosting your game for a better experience is impossible. Yeah, that's the kind of thing that puts me off a game entirely.
I think it does scale, but it requires users being able to host their own servers for your game. It doesn't scale in a way that maximizes control for the IP holder, however.
Here's a good perspective on the situation by someone who was cheating: https://www.reddit.com/r/thedivision/comments/4k17n8/confess...
However, there is nothing there that should be hard to pick up by modelling normal behavior, and then being able to flag the anomalies. Most things he manipulated were known server side. Going the route of installing rootkits seems like fools errand to me, of which I can understand a possible non-nefarious intention behind... but it starts stinking to high water unless the other more obvious approaches are not seriously exhausted.
Develop mathematical models for likelihoods of cheating based on user input, and non-conforming game states. Create a heuristic that takes into account time spent and the possible cost of losing progress. Move possible cheaters into isolated environments where they go up against each-other. Or subtly punish by reducing drop rates.
In the post you linked to, he mentioned things like. 125-500% move speed. 200-2500% DMG increases, by manipulating client side states. However, surely, this is trivial to detect server side?
The hardest things I can imagine detecting are probably stochastic cheats like randomly improving your aim and reaction time, but these arguably less severe, to a point where if it becomes super-human, it again becomes detectable. And, these are also the kind of cheats that typically can be done through user input, and thus very easy to make undetectable to any root-kit like anti cheat.
For lest than the cost of one AAA game, you can buy the hardware required to do this processing completely outside of any rootkit. If cheating is your thing, and based on the post in question, the cheater could make back this investment in 15 minutes... arguably.
----
But, to sort reply to your answer to my question. I'm curious, do you have some more details other than "yes"? The post you linked, to me, read as "nope, The Division does not do that this at all. And if they did, very few things this person did would have been possible".
Video games are a hobby for 99% of people out there, including myself. I can do without a plaything if it means not handing over the keys of the computer I built with my own hands to nefarious actors. That is FAR AND AWAY more important to me, and I'd hope most people.
But you are correct in saying that it's a personal choice for everyone to make for themselves, based on how much they value fair play in their hobby of choice.
Particularly for anyone who puts hundreds (thousands?) of hours into getting good at their competitive multiplayer game of choice, the trade between installing an anti-cheat, suffering cheaters, or giving up on their hobby, is probably not the same math you're doing.
Fair criticism. I used Tencent as the example as they are one of the most prominent offenders. I don't trust any company to install these drivers, period, Chinese or otherwise.
> You lost me there to be honest, if you think the "true" purpose of anti-cheat drivers is for a foreign power to spy on us boring ordinary uninteresting people.
That's fine, but I definitely don't think keeping your "gaming experience" as hacker free as possible is the primary goal of these programs. I've worked in software too long to not know better.
What is it about games that makes you particularly worried about this? Why is that an industry that is more susceptible to this kind of "nefarious" activity as you put it?
Wouldn't it make more sense for business-related products to do this, since the odds of being on a computer that has actual useful information to steal would be much, much higher?
Why would a company invest in this kind of tech, in a highly visible field, full of people who will go over it with a fine-toothed comb (gamers are obsessive), for what seems like a very low-percentage hit rate on obtaining information?
Curious about your viewpoint on this..
Because it targets a younger, more ignorant user base that is much more likely than a company with security audits to blindly install. I certainly was at that age.
> Wouldn't it make more sense for business-related products to do this, since the odds of being on a computer that has actual useful information to steal would be much, much higher?
It does happen, but its less successful due to folks that work in operational security. If I suggested installing software with this type of driver at any job I've ever worked at with a security professional halfway worth their salt, I'd instantly be rejected.
> full of people who will go over it with a fine-toothed comb (gamers are obsessive)
Show me a gamer that has seen the code of one of these drivers. Name a single person. Those programs are black box by design.
You forgot to tell them it’s a state-of-the-art antivirus solution.
> Show me a gamer that has seen the code of one of these drivers.
They don’t want to see the code, they just want to know it works and allows them to play games with a much lower chance of playing against a cheater. The ban waves that end up on Reddit every year[0] are good enough for them.
0: https://reddit.com/r/GlobalOffensive/comments/52mj1m/untrust...
Not necessarily. That gaming machine has good odds of being in a local network with other, more important and interesting machines. It can also scan local Wi-Fi area and scoop up even more information that can be used later.
Thought these were obvious.
> Why would a company invest in this kind of tech, in a highly visible field, full of people who will go over it with a fine-toothed comb (gamers are obsessive), for what seems like a very low-percentage hit rate on obtaining information?
1. They invest nothing out of the ordinary. They already have programmers on the payroll. Not like they spend 200 million on this alone. (Although there are companies like Google and Facebook who absolutely would and have invested much more than this just to be able to scoop up as much private info as possible -- not sure why this seems so unlikely to you, today, in 2022.)
2. The field is EVERYTHING BUT VISIBLE. Nobody has ever seen the source of these programs (outside of the authoring companies). Nobody. Ever.
3. Games are obsessive but most of them are technically illiterate. They install these things without a flicker of doubt.
4. The low-percentage is how it seems to you. Do it on a few hundred million machines and you are bound to find something very interesting in a good volume. It's statistics.
Tencent anticheat has a hard baked logger that prints out every network call it makes, which believe it or not was intended to create trust.
You can see in the disassembled code that it can’t make outbound calls without that function that prints the payload.
We can’t be open because it’s too risky. We can’t be closed because people think we’re scum.
Why not just make console games? This thread has me depressed.
Certainly was not my aim, and I sympathize. I've said many times I'd never move into game dev because of the workload and sheer work-to-flame ratio, and this thread isn't an exception. Likewise, thank you for providing some light from within the industry, it is appreciated.
I'd sign that NDA in a heartbeat if it didn't anonymize me, but I don't want my name floating around in databases I know nothing about. It's mighty tempting to see how the sausage is made, though.
I will ask this: Does the decision to include such an anti-cheat come from the studio usually, or the publisher?
Some studios might have some bean counter at the publisher asking about things they think are good ("You gotta have anti-cheat/DRM!")
Other studios might be coerced to "if you're going to use anti-cheat, why not use this one we have a good deal with".
But ultimately it has been a studio decision.
I'm even swapping my current anti-cheat due to this kind of Sinophobia.
Ironically, we had to specifically ask Tencent for their anti-cheat (because it was the best available..) but.. people thought it was spyware[0]. To the point that you literally see nothing else about my game it seems.
Double ironically: we still had cheaters on the platform[1]... it will probably be worse with EAC (as it was in the division days[2], some people even blamed the state of cheating on "not enough anti-cheat"[3])
But, to answer your question: in my experience it's the studio's choice, but some people in the publishing chain might try to coerce a decision.
[0]: https://www.reddit.com/r/BloodHunt/comments/pkpr1t/so_whats_...
[1]: https://futuregaming.io/gaming-news/bloodhunt-cheating-probl...
[2]: https://kotaku.com/race-to-clear-the-division-2s-new-raid-ma...
[3]: https://www.reddit.com/r/thedivision/comments/4k17n8/confess...
And immediately land in a list of potential suspects the moment those cheats are broken by somebody else but not me? No, thanks. :( We live in a world where such an intellectual curiosity flags you as a criminal so I am never going to risk it.
If you want to demonstrate good will then maybe posting these files somewhere and making a "Show HN" thread is going to work better in showing the world that you're normal hardworking people?
> We can’t be open because it’s too risky. We can’t be closed because people think we’re scum.
I understand your position and I am not blaming you. But you are not the executive team of the company and you don't know their intentions and strategic plans.
You probably need to be reminded that before the Snowden revelations people who were saying the same as him were laughed at? Ridiculed?
Nothing stops this to be a part of a bigger scheme, you know? Sweep as many machines as you can with whatever means possible.
You over-fixate on gaming and are IMO missing a potential bigger picture. Plus China has proven that it is hostile to privacy many times, including a recent story here on HN where a laptop ordered from China came with preloaded spyware on a pretty deep / low level.
And even if you ignore all that, I still don't want a random rootkit to be able to take control of my machine any time somebody figures they'll flip a remote switch. Doesn't matter what their motivations are, at all, doesn't matter if we are "boring uninteresting people". They still have no business being able to control my machine THAT well remotely.
People said the same thing about NSA spying, until the Snowden leaks.
Convince me that won't happen...
Second, this was already a solved problem since we could run our own servers and kick whoever we wanted. But this has largely been taken away, to the point that people don't know it ever existed.
It's not a binary thing. There will always be cheats. It's about raising the bar to be difficult enough for enough people to not bother. If you want an example of the effect cheating can have on games, look at Fall guys. It shipped as a unity game, was immediately reverse engineered and the game was effectively unplayable on PC [0]. They added easy anti cheat, and the problem effectively disappeared overnight.
> this was already a solved problem since we could run our own servers and kick whoever we wanted.
Banning someone from your server isn't solving the problem, it's pushing it onto another person. Abuse of these systems was rampant too, I have distinct memories of being kicked from battlefield and counter strike servers on the early 00's because I killed someone and they didn't like it. Having community run servers also has its one share of problems when combined with live service games. At best, you force community servers to keep up to date, or more than likely you end up with dozens of fragmented versions of games that are incompatible with each other, and if I want to play on server A with this group and server B with another, I need multiple copies of the game installed.
[0] https://www.gamerant.com/fall-guys-massive-cheater-problem/
It does not do that either. I've been on certain... interesting forums, shall we say (in Tor; and I don't remember the names, was a casual stroll through it and I made no effort to write down any place I checked on -- before you ask). Whoever wants a cheat eventually finds the best cheat authors who are quiet and are not drawing attention to themselves but have public Web 2.0 sites where they sell their software.
Nobody has defeated a certain class of cheats yet. They hook up to the kernel even before the anti-cheat system and it's game over from there.
Let's not pretend that all this is for the user's safety. It probably is intended like so but nowadays it feels like the companies are just digging their heels in and doubling down on a measure that doesn't stop the truly dedicated cheaters whose software is very affordable to buy to the casual 13 year old who wants to have the best K/D ratio in Battlefield in their school.
And everybody else loses, including the companies because if Valve wants to install a kernel rootkit on my Linux machine they'll lose my business there (and I suspect most Linux users because we are of a certain mindset). And all casual gamers HATE the series of "Install X?" and "Are you sure?" banners, too. Annoy them for long enough and they'll just shrug and move to XBox / PS / Switch. I've seen it happen a good amount of times already.
It clearly does. There's a world of difference between running tor/finding onion links, and googling "cheats for battlefield 2042". There are multiple stories out there of games destroyed by cheaters who add in Anti-cheat after the fact and the problem practically disappears. Note that doesn't mean no cheaters, but for games like Fall Guys (post linked above) it was practically every game was won by a cheater literally `noclip`'ing to the finish line.
> Whoever wants a cheat eventually finds the best cheat authors who are quiet and are not drawing attention to themselves but have public Web 2.0 sites where they sell their software.
While those cheats will continue to exist, most people aren't going to go to the trouble of installing Tor, finding an unlisted website and buying via bank transfer, they're going to google "Cheats for <Insert game name here>" and if the first link lets them spend $40 they will. _Those_ cheats are what utterly destroy games.
> And everybody else loses, including the companies because if Valve wants to install a kernel rootkit on my Linux machine they'll lose my business there
Honestly, the number of people who care enough to not install the kernel level anticheat is so small for modern games it doesn't really matter. I'd put $20 that there are cheaters out there that would install linux to avoid the kernel level anticheat than there are legit players who are ok with running closed source games, but not closed source kernel modules.
Everybody but all the non-cheating gamers that don't have to face cheaters in literally every single match. Where I think you and many others in this thread differ from folks like me is that you seem to expect a perfect solution whereas I will accept a solution that reduces the problem enough that it is barely noticeable. I don't care if "dedicated cheaters" will still cheat.
The DRM anticheat drivers turn Linux PCs into a closed standard, closed OS platforms where your software kills itself (even if it's single-player) when you step out of the locked down platform.
You're trying to picture a difference where there is none.
This is why Linux users using Wine keep being banned from these platforms - they detect "unusual" runtime environment and ban the players because it doesn't fit into their narrow hash of an "acceptable" system.
It is an outright definition of sealing off your OS from modification.
If you're playing against someone who's sniping you across the map every thirty seconds, it (usually) does not matter whether or not they're cheating or doing it legitimately. Both outcomes aren't fun for players, and both outcomes make the game less competitive. The idea that toxic behavior saps the fun out a game only when it's automated is just silly -- cheating doesn't really change anything about that dynamic.
Yes, this is admittedly more complicated than I'm making it sound, and yes, there is a valid conversation to be had about players wanting to feel that multiplayer games are fair, even when they mostly aren't. But while that player instinct around fairness does exist, it is also true that for a huge portion of your playerbase if someone is cheating convincingly enough that other players are still having fun then (outside of esports leagues) it often doesn't really matter. Let them, especially if they're convincing enough that players can't tell the difference. And if someone is purposefully creating a bad/toxic experience for other players, they should be either matched differently or banned anyway, even if they're just that good entirely out of their own skill. Good players who legitimately win can still be toxic and annoying to play against.
This isn't a universal hard rule, but in general you should optimize for the outcomes you want, not for the way that people get there. It is better to have a game with cheaters/bots where people are still constantly playing at the edge of their skill level, where there are consequences for griefing, and where players are trying to create competitive/fun matches, than a game where all of your energy is devoted to just figuring out whether or not a match was miserable for "legitimate" reasons.
And for a lot of games, probably >90% of your playerbase is in this group where they care more about competitive, interesting matches that help them grow as a player and get better at the game than they care about the extreme low-level integrity of the game. Most of your playerbase is frankly not good enough or competitive enough at your game at the global levels where it matters whether or not everybody on the global ladder deserves their win count. So why are we collectively optimizing everything around such a small percentage of players?
Then it is up for game developers to find a better solution to the problem, not for us to accept a violation of our privacy.
I would make an exception if someone managed to get Linus Torvalds to sign off their kernel code. Nobody ever bothered and there were always awkward but predictable silent pauses from vendors.
Oh and add to this all of the servers handled the most sensitive data to ever touch the internet. Vendors would sometimes entertain the idea of their code getting 3rd party code and security reviews but it never got past the idea stage.
The issue of course is that would reveal just how much of our data those things Hoover up.
That being said, I agree it would be harder to maintain an open source anticheat effectively.
The client can lie about being modified. E.g. it can send false hashes.
How much data a in-kernel or user-land anti-cheat can easily be detected by observing the traffic that flows out from your network, so it really doesn't matter if it's open source or not.
The biggest roadblock to a open source in-kernel anti-cheat is not "exposing the amount of data they extract from you", but rather it exposes how the anti-cheat is working, which is working against the efficiency of the anti-cheat. If you know how they detect you're cheating, it's much easier to overcome that hurdle.
In most cases, security-by-obscurity is obviously flawed, but when it comes to cheat/fraud detection, exposing how it happens makes it's core value less efficient.
They even backpedaled when people found out that they were analyzing your DNS cache on Windows to search for known cheat provider websites.[0]
[0]. https://www.reddit.com/r/gaming/comments/1y70ej/valve_vac_an...
Since then, they've focused on other avenues to combat cheating (e.g. Overwatch, a replay reviewing system involving the community, or VACnet, a ML model that they trained to recognize in-game behaviours linked to cheating).
I don't play a lot of FPS, but In Dota2 I see a bunch of hackers where the replay literally shows you how they do not even react with their mouse to a threat that appears suddenly but still manage to cast a spell somehow. I don't even think that machine learning is needed to detect that kind of hack.
Downside to all of this is it would have to take longer to get into matches to keep players in their pools. I know games already do this, but they seem to match players up or down too quickly to keep the velocity of matches going.
As I type this I realize this system wouldn't work. Pro players would complain about long waits whiles average players would play the most frequently. Lose pros and you lose average players.
That or giving up the problem.
Especially given the poor record of video game companies to take security seriously [0]. Even Rockstar's cash cow game [1], there was the lowest of low hanging performance fruit available that was not addressed by any ongoing effort. Why should I believe that any game company rushing to push some release out the door is going to take their kernel patch seriously? Security is hard and Intel/AMD/professional kernel devs screw it up all the time.
[0] https://www.vice.com/en/article/wjwd8n/hacker-drops-steam-ze...
[1] https://nee.lv/2021/02/28/How-I-cut-GTA-Online-loading-times...
Edit: fixed the formatting
Generally speaking, I was also livid when I learned about how Riot planned to solve cheating in Valorant with it's own rootkit - and I think Microsoft isn't crazy about the idea either. My two cents are on this being one of the major reasons MS decided to make TPM mandatory for Windows 11.
Unless you run flatpak, nix, lxc containers, or some other process isolation scheme, all programs on eg. A debian desktop have this sort of free reign. It’s not uncommon for accidents to happen that take out chunks of a system[0].
0: https://github.com/MrMEEE/bumblebee-Old-and-abbandoned/issue...
Well yes, sandboxing should be the goal! Installing Steam from Flathub is a good first step on desktop machines. But as long as games require anti-cheat software at the kernel level, I'll keep a Windows partition around to sandbox the gaming world as a whole.
In other words, follow the money. No one is watching someone else play Super Tux Kart on Twitch. (lol) They're watching someone play the latest AAA game, where the financial incentives to cheat are the highest.
I agree that we should take a stance and I don't like kernel-level drivers any more than you do.
Kernel-level drivers are required on Windows. However, we even know if this is also going to be required on Linux?
As far as I understand, it is coming via Proton/Wine, so these programs would need some kind of kernel level access as well (if they don't have it currently)? Or maybe they're just emulating Windows kernel calls or something like that. I mean, less intrusive (but also less effective) in a Linux system.
There will always be trade-offs in freedom when you try to implement rules to improve the freedom of those that want to play on a balanced playing field.
This is true in society as well.
Kernel level drivers are a whole different can o' worms. A corporation could make my gaming rig into part of what amounts to a spyware botnet with me being none the wiser other than encrypted traffic coming OUT of my machine. Those drivers by design are black boxes, and there is no way to monitor what your machine is actually doing. That shit shouldn't be on mine or anyone else's system, especially under the premise of a "fair gameplay environment".
For the average user they can do that with basic permissions anyway. I wouldn't notice a steady stream of 2-300 kbps of binary data uploading from my machine, for example. I'd chalk it down to shitty programming.
On any windows or Linux system, there is nothing stopping a binary from sniffing your clipboard, reading your .ssh directory, or just deleting your home folder/filling the files with garbage.
In case you're curious, it's a horse thing: https://www.merriam-webster.com/words-at-play/usage-free-rei...
This is the case for user level anticheats too. 99% of what a malware wants to do it can do from userspace.
Yes, and that's the decision you have available to you. I would make the same decision, but I still think the developers are smart to put those kernel level anti-cheat schemes in their games. I don't do much multiplayer gaming anyway, but when I have, rampant cheating entirely ruins the experience.
What’s the issue here, really? Who’s being affected by a game they don’t play and don’t want to play?
The presence of 15 year old script kiddies using aimbots does NOT IN ANY WAY justify having kernel level control over my machine, Linux or otherwise. Valve, and every other company that contributes to gaming in general, kindly stay the fuck out of our kernels.
EDIT: I feel a few folks in the comments are getting mixed up between the concepts of DRM and kernel-level anti-cheat drivers. DRM is what keeps folks from pirating software, as well as diminishing the freedom of where and how you can install the software. It sucks, but I understand why it exists, and that isn't what I'm talking about here
Kernel-level drivers, on the other hand, are drivers that run outside your sphere of influence (so-called user-space) and exist outside the checks and balances of your operating system that keep programs from doing whatever the hell they please.
Add on the fact that these programs are black boxes by design, and all of the sudden a company essentially has free reign to do whatever they want with your machine under your nose. This is dangerous and unacceptable.