Hacker News Reader

Comment by jtms | Hacker News Reader

This is great and all, but I feel like all of these client side cheat detection tools are basically a waste of time. Trying to enforce the trustworthiness of the client is basically an unwinnable arms race between anti-cheat and the cheat makers. A better approach is for the server to treat all clients as hostile and untrustworthy and use a combination of heuristics and statistics to ferret out malicious client behavior. Valve has been doing some very interesting stuff with VACnet where they employ deep learning to flag potential cheater accounts in CS:GO and then have humans review and rule on the output. From what I have read and watched, it has been very successful.

View on HN

I used to write cheats for various source engine games (running vac), and later more interesting games like pubg which run battleeye. Those are two very different anticheats, and I think comparing them is interesting

An important thing to point out is that it requires a lot of reversing work and low level knowledge to make a cheat, and usually at the end of the day cheats all end up with the same core features anyways. This means that there’s a huge stigma amongst cheat developers around knowledge sharing, which makes a lot of that initial work all the more arduous. Anticheats further increase that initial work, and incur an ongoing maintenance cost since each update can break your cheat (especially of you specifically work to break the public methods that everyone is using).

Last time I looked at VAC, it was doing stuff like looking for stuff like modifications to the .text section to detect hooks implemented by writing e.g. jmps to some injected code, but never actually adapted when people started just modifying vtable entries (most source engine constructs are exposed to developers as pure virtual cpp classes). Since they stagnated, it got easier and easier to cheat over time as more and more people spread knowledge on how to hook in an undetected way. Hell, in gmod some lua anticheat developer (gmod is a sandbox game with a lua scripting interface) found a vuln in the clientside lua implementation that allowed arbitrary memory io and used that primitive to implement checks for injected dlls when people started cheating at that level in that game, which was far more effective than VAC ever was.

BE was another universe, it felt extremely prohibitive to touch the game in usermode & even in the kernel I started to feel cramped. You can still totally get past it, but it felt more like writing a very specific rootkit than actually making a cheat.

So, from the other side, anticheats raise the cost of initially developing and maintaining a cheat. If used effectively, they can also kill paysites. I think they have value, even if they aren’t achieving a 99.99999% success rate.

Much like anti-virus software.

What is BE?

BattlEye maybe.

BattleEye

This is a fascinating perspective to read, thank you.

As someone that has played CSGO recently, it's still normal to come across cheaters. Server side cheat prevention is preferred when possible, but there are just too many opportunities for client side cheating in multiplayer FPSs. You can't prevent the client from auto-aiming or knowing the enemy player position behind a nearby wall. If you do not stay on top of cheating, cheaters will ruin your game.

>You can't prevent the client from auto-aiming or knowing the enemy player position behind a nearby wall

Valorant and Edan.gg's defender [1] has the best fog of war system I've ever seen. CSGO has probably the worst; in fact, at one point, the game had NONE and sent player pos's to everyone at all times.

I completely agree, but there are a lot of server-side mitigations that haven't been nearly as explored as I'd hope.

[1]: https://edan.gg/defender

I'm a little skeptical that that's the case. When I cheated in CS:GO years ago (1856 days ago in 2016), I specifically remember being unable to see where people went at the beginning of the round, and sniping double-doors on dust2 showed people only when they were about to pass by the opening. This was on official competitive servers, so maybe you only mean self-hosted servers don't have FOW.

I mean, it has fog of war, yes. It's not as good or strict as it could be. I have seen discussions with the devs and they say that if it is more "strict" (ie hiding player positions until they are closer) would be more taxing on CSGO servers, AND would screw with high ping players (they would experience pop-in).

Check out https://edan.gg/defender to see the comparison between CSGO and a better FoW system.

I'm not a CSGO player, but I assume you also have to be able to play e.g. footstep sounds for someone coming up around the corner, so you at least need to send the info that someone is nearby.

Another source engine cheat dev here. Source has had dormant entities at long ranges in culled-off areas [sectors of the map demarcated by func_areaportal] since... as long as I can remember.

Your cheat couldn't see those players because the server was doing a very cheap and primitive visibility calculation, deciding the player entities are dormant for you, and choosing to not send you the data for them.

This is different from the later-enabled player PVS system, which does more expensive ray casting once you get a certain distance away, which cut down on wallhack cheats a lot more [although they are still very useful]

> Your cheat couldn't see those players

Would an anticheat work if you did the opposite of this? Send the client random movement data above and behind them and if they spin and shoot towards it instant permaban forever

Random wonder. I have no idea in or around anticheating, please do feel free to shred it as an idea to pieces

I've seen, in other games, anti-cheats that spawn fake [player-specific] entities that if you attacked too much you would get hit with a ban.

I thought the idea of this deep learning cheat detection was looking for subtle cueues?

Like how someone wall hacking would behave differently from someone who is not. Maybe by reacting before the player is actually seen.

Maybe I'm just thinking it's more impressive than what it actually is.

You can track statistics of players aiming at same spot in enemy model every time, looking directly at other players behind obstacles outside sound range, you can send probes with bogus player position data behind a wall from suspect player and analyze reaction.

> From what I have read and watched, it has been very successful.

Let me guess, you have not played CS:GO? There is an insane number of obvious cheaters, more than in other games I played.

Also, there is TeamFortress 2 that's just has been abandoned and they can not an anti-cheat to it, it seems.

> unwinnable

It seems winnable so far if you look at the Xbox One and later, at least. I'm not aware of anyone successfully modifying game code on those consoles.

The downside is that it a requires a completely locked down system.

In the cases where end-to-end vendor control over the hardware from the player's fingers to the HDMI out exists, yes that seems possible.

But on a PC? Where the user can install whatever software they like? Much harder.

It feels like stopping aimbots will ultimately fail as eventually we'll see bots that use machine-vision to spot heads and pick them off. You wouldn't even need to run it on the cheating machine, this could be a separate device doing passthrough on the mouse, keyboard, and monitor.

Someone else mentioned doing this: https://news.ycombinator.com/item?id=28634631

Even if they turn on HDCP, you could just get a low-lag monitor and point a camera at it.

You can just buy an HDCP stripper. https://www.amazon.com/Easyday-Stripper-Splitter-Signal-Ampl...

Cheat dev here. Check out this prior art of someone utilizing PS4 jailbreak exploits to modify GTA V's scripting VM at runtime:

https://github.com/2much4u/PS4-GTA-V-Native-Caller

All Valve has done is made it so people cheat and pretend to be legitimate, you can't beat cheaters outside of making it a non-cheatable game, you can just reduce it. Then again, if nobody notices that you're a cheater, are you a cheater?

>Then again, if nobody notices that you're a cheater, are you a cheater?

Yes, you're just a successful cheater as all cheaters are deceptive by definition.

It's an unwinnable arms race if your goal is zero cheating.

It can work well enough if your goal is 'ban/hellban cheaters relatively quickly'. If the time/money cost of creating a new account is non-trivial, this can very well get cheating down to some acceptable level.

Server-side statistics can be used in addition to this kind of client-side monitoring, but there's only so much that can be inferred from statistics. It may not be too difficult to determine if someone is using, say, an aimbot from statistics, but it's very difficult to determine if they are using a radar - because the cheater still has to make fuzzy, human decisions, based on the information that radar gives them - and because its difficult to tell radar apart from good gamesense.

They’ve been doing interesting stuff but have completely failed to succeed with anything. VAC is a joke. VACnet continues to be a pipe dream.

Simply because a tech arms race is theoretically unwinnable doesn't mean that trying to win a little doesn't deliver value to the company and its ecosystem.

You can emulate an android and run snapchat and screenshot the emulator, but the screenshot reporting inside of snapchat is still valued by millions (and shapes the behavior of millions).

iirc there are modified Snapchat apks that can screenshot snaps without notifying the sender

Perhaps if you want a perfect solution, but in practice most people aren't cheaters, and those that cheat tend to eventually make a mistake and get caught by the anti-cheat. The remaining 1337 you can manage manually.

Cheating in CS:GO's casual mode is still very common, not sure about competitive. But yes, server-side detection would make more sense.

Because it's not as trivial as you think it is to get good results if you rely only on the server side, if it was the case everyone would do that.

Server side cheat detection actually don't detect that much, like how do you known someone is wallhacking?

As for manual review it just does no scale, when you see that CoD banned 100k cheaters, imagine if one person from activision would have to review every cases.

Cloud gaming is the solution against cheats.

> Cloud gaming is the solution against cheats.

The solution to cheating is to stop playing with strangers.

https://twitter.com/anticheatpd/status/1412024189561851904?s...

There are cheats doing CV on video stream and they work on consoles. I guess they would also work on cloud gaming services.

Uh oh what would stop my ML-based auto-aim from cheating in FPS running on cloud? Cheats now might be fine with just video feed as input.

If that was 2015 or 2010 then I'd say: why would people competent in computer vision waste time on making 30$ cheats when they can use their skills at faang for probably 200k?

but nowadays idk whether it stands

Because they are kids and they use it as a practice ground to gain those skills inadvertently. Or they use it as a practice ground where they don't have to deal with bigtech BS and can just develop with no design reviews and all the miles of BS getting in your way.

VACnet hurts cheaters, and also probably 25% of legits as well. In low trust this can be verified pretty quickly. Even in the gutter of trust, redder than red, you still have about 50-60% of players cheating. That's nearly half of everyone in the WORST trust factor of the game, who are there while not cheating. Though some are probably griefers/mic-spammers/toxics, it's certainly not all of them.

You mean that 50-60% of players appear to be currently cheating in ways that are detectable by you.

If there's one thing that all cheaters have in common, it's an inflated ego. If the enemy is cheating, and half your teammates are, and it's casual, you're gonna toggle on harder. There is no way to get banned in casual, unless it's by VAC, in which case you already have it injected so it doesn't matter.

You are right, though; my estimate is just personal experience

Reply on news.ycombinator.com