Game Developers Cracking Down on Cheating

Hector73 writes "ZDNet has an article discussing a growing concern for the makers of on-line video games. Cheaters and trolls are making it harder for casual users and newbies to get hooked on the on-line versions of games. Considering that on-line gaming may become the major revenue source for game makers over the few years, maybe they will actually do something about it."

Comments

Xbox live to combat cheating

[magicsquid]

This is precisely why Microsoft announced that all of the Xbox's online games will be run off of Microsoft controller servers. They've seen how cheating can rapidly cause a subscriber base to shrink. By controlling everything themselves they hope to limit the damage done by those looking for ways to cheat. I imagine that just in case anything should go wrong, this means frequent backups that can be restored upon a users requests.

CS 1.4

[wbav]

Well, we have seen valve put in code with Counterstrike 1.4 that checks to see if your opengl.dll is correct, to stop people with cheats like OGC. However, this sucks for all those using wine, becuase wine uses a hacked version of opengl to run windows games in linux. I've been cs free for about a month now, as a result.

The real irony is, wine will not load cheats (as far as I can tell), so people using wine cannot cheat. I had a similar issue with Cheating-Death.

Re:CS 1.4

[Dimensio]

Why not inform Valve of this and give them the hacked opengl files so they can add it to their checksums?

A perfect world?

[bahtama]

Let's see. We have a world where most people behave themselves, except for a small minority that run around stealing and causing problems. Yeah, that sounds so strange and alien!

The bottom line is that there are cheaters in every aspect of life, whether it be real or virtual. Game companies, much like governments, can only do so much. The rest of the problems people just have to live with. Virtual worlds will never be perfect and people will always try and ruin someone else's day.

Social stigma

[LBrothers]

I've played my share of online games, from the simple telnets to the varied mmorpgs. Technological and admin based solutions never seems to adequately solve any real poroblem.

You can boot players, ban IPs, reprimand, close servers, but the miscreants always find a way back in, because its an enjoyable game to them... annoying others.

The only viable solution I've ever come across is the social stigma. This method of self-regulations fails if the game doesn't implement a system of reliance on other players though. As long as several players are needed to band together to achieve certain goals, social stigma works.

Picture a mmorpg where you need 3 other players to help you defeat a certain barrier. There's no other way, its part of the game structure. If you're a cheater, others won't help and you're limited in your game play. Where's the fun now?

Game builders have to be aware that cheaters exist and really strive to construct game play in such a manner where players can self-regulate like that. Admins and code-limitations never seem to solve the real problem.

Re:Public voting

[LowneWulf]

I know lots of Counterstrike players who are constantly banned from servers for winning too much: unless the other players are at the same level, they assume the better players must be cheating.

(of course, this never happens to me; nobody could cheat and still suck so badly)

Perhaps a ranking system. Players of approximately equal skill are pooled together by the server automatically after a certain minimum number of games. Cheaters can then play to their heart's content, but will end up with other cheaters and those who are so good that they can take on cheaters and still live.

Technology backed social fixes

[ChaosDiscordSimple]

Games with huge numbers of people like EverQuest will suffer from a certain number of bad apples, just like the real world. They're ultimately going to need to rely on policing, technology can't solve everything.

Fortunately, many games don't have huge numbers of players. Quake games peak at a few dozen. Even as small scale games grow, there are practical limits that will keep size down.

There is a partial solution I haven't seen implemented yet: trust networks. To play, you generate a public key and share it with all of the other players. As you play, you mark other players as being friends. (You can also blacklist them, but it's easy for the other person to create a new identity, so it's only a very small part of the solution.) When you mark another player as a friend, your client provides them with a signature proving that you marked them as such. Then based on these networks of trust you can make judgements about who to play with. When you create a game, you might limit it to "my friends, my friends' friends, and 3rd generation friends if they have at least three references from 2nd generation friends." Maybe you leave a spot or two open for anyone to hop in on as a way to make new friends (and if they're a punk, you and your friends can blacklist him quickly).

This will make it harder for truely new people to make initial friends. Many gamers will know at least a few real-life friends who can give them a hand up. For the rest, they'll regrettably have to spend some time learning who they can trust. It's a shame, but it's just like real-life.

There are few details I'm admittedly handwaving (key revokation, special case exceptions), but they're all solvable problems. I'd really like to see a system like them when I play Quake, Half-Life, Diablo II, or Dungeon Siege online.

Re:Question.

[Peridriga]

Dongles, in the historic sense have been cracked/emulated a long time ago.

A great sound editing software for the Mac was Power Tools. Originally package with a dongle to prevent piracy. The dongle was emulated about 24 hours after the release of the product.

Now though with the cheap USB storage devices hitting the market the concept of dongles might come back. Although the only way to truely secure it would be with a strong cryptographic code to secure both the device itself and the traffic between the device and the software. Althogh you still come down to the fundemental problem that the information is still passing through the users computer and is open to sniffing and cracking.

Securing end client software has always been an extremely difficult problem to solve....

Re:Solving cheating requires closed source!

[alriddoch]

At WorldForge we have obviously been considering this point since soon after we started, and we believe that this is not the case. It is true that to achieve the twitch responce of a first person shooter it is extremely difficult to detect client side cheating, but the more moderate pace of online RPGs can be different. If a model is chosen where the client is totally untrusted, the players ability to cheat by modifying the source of the client is minimised. An additional benefit is that this security model means it is far more difficult to cheat using add-on programs like those available for many current online RPGs.

Now /that's/ a mature attitude!

[devphil]

From the article (ya know, that thing you should read before commenting on its contents):

"We have a very straightforward attitude to cheating: We see it; you're gone," Jacobs said. "I will happily sacrifice a small portion of my paying customers to ensure the rest of them have a quality experience."

Kick. Ass. I know nothing about this company or their games, but I like them already.

Which Is Only Half Of It

[EXTomar]

Because nothing guarentees the data getting to their carefully guarded servers is valid if their communication protocol is weak.

Aim cheats have nothing to do with server stored data. It all has to do with the fact the classic protocols requires all players in the field to tell all other players in the field their positions in the field. If you can snoop the positions of people then you can calculate an accurate "from the hip" shot with merciless robotic accuracy. If an aim cheat isn't possible, then you can just snoop the data and realize where the other players are hiding and their positing.

The way to beat cheaters is to apply tried and true security practices. Don't trust that the machine on the other end of the connection is really a client(so don't feed it any extra data beyond what it should need to know to function). Don't blindly accept any data coming back from supposed clients(does the client really have "permission" do what it is telling the server to do?).

Protecting the data is a good thing but just like server farms just locking the machines behind a door isn't enough. You have to secure the lines of transmition as well.

The author needs to check their facts

[Corby911]

In multi-player action games such as "Quake III" and "Half-Life," hackers will try to tap into the servers running online games to execute cheats that let them see through walls or automatically aim weapons.

Most, if not all of the cheats for Half-life and Quake III are client-side or proxy cheats.

Proxy cheats require 2 computers: the one you game on and a proxy that you connect to the server through. The proxy keeps track of what's going on in the game by analyzing the packets that get sent through it. It then makes adjustments (ie aiming corrections) to the packets as they are sent out to the server. This in no way involves breaking into the server.

The common transparency cheats are to a) replace the textures used on the walls with translucent/transparent ones or b) hack your video card's drivers. Neither of those affects the server in any way.

There's a multitude more of these types of cheats. I know because I used to run a decent Half-life and Counterstrike server. I got so depressed at the prevalence of cheating (and cheating accusations), I shut down the server and very rarely play any online games.

PKI?

[eddy]

I agree. Playing with people you know is probably much more fun too.

The only other solution I see is a -- and you've heard me say this before -- a web of trust. Integrate game-matching / chat and a PKI. Players will sign the keys (this can be abstracted in the GUI of course to make it simple) of players they trust and enjoy playing with.

Then it is up to the players, some may risk it and play with anyone, others might only play with close friends, and the majority might opt for the middle ground and play with any player within some distance of the web of trust.

You could do a lot of things with this. A client could chose to play any other client based on the number of signatures and their age (trusting it even if there is no path to it), etc.

HSX Cheaters

[jamesmartinluther]

This article is right on, especially with regard to tapping your game players for help in regulating and busting cheaters.

At the Hollywood Stock Exchange simulated stock market, there have been problems with cheaters for many years. HSX cheaters - called "manipulators" and "shills" - use information tactics and coordinated buying and selling patterns to dishonestly make HSX dollars.

Internally we have an "SEC", which consists of individuals who seek out cheating patterns in the trading data. We also get suggestions from players as to who may be cheating and how they are able to cheat. HSX Traders that are "guilty" of manipulation are fined according to set procedures.

One of the most interesting cases of cheating was when we received an AIM transcript of real-time cheating behavior. It read like someting out of "Wall Street", except with lots of net slang. We busted them and fined their accounts (after an investigation and due process, of course).

Despite the "threat" that cheating poses to the "civility" of a game community, cheaters and the interesting tactics that they use no doubt make online games more interesting. I often ponder about how to better design game play which can harness the criminal instincts of simulated market manipulators (for the betterment of the game).

As cool as this sounds, I do not think that unleashing 1980's style "media raiders" onto the trading community will ever happen at HSX. HSX trades are transformed into marketing data used by movie production studios, hence requiring us to ensure that game play is fair, and, generally, that trades reflect the real media preferences of HSX traders.

- James

Re:They need to

[Bonker]

They need to take cheats out of the game all together.

That works real well until you realized that many players cheat by unfairly reading information with a different application or proxy.

A good example of this is the 'aiming' proxy, which is a proxy application that sits between your FPS client and the server. The proxy parses the packets sent beteen client and server. Since the client is responsible for telling the server what actions you make and the server is responsible for telling the client what all the other players are doing, the proxy applies a little bit of math to the two pieces of information and 'corrects' your shot so that it hits another player despite where you really aimed.

Unless your game can somehow telepathically guess where the players are, there's no real way to hide this information from the client. Encryption strong enough to prevent a reasonable crack is too math intensive to run at the same time, meaning that hard encryption just isn't the answer.

There are apps out there for all the FPS servers that attempt to detect this sort of thing, but most of them work by checking ratios. If you happen to get luck and exceed the ratio of possible good shots to bad shots, you're tagged as a cheater.

If you can read the client-server data stream, you can cheat.

That's why the answer to cheaters lies not only in designing applications to prevent cheating, but allowing players to flag cheaters and bump them from the game.

In MMOG's, this means that GM's should respond quickly, intelligently, and decisively to player complaints. In smaller scale actions, players should always have a 'cheater' button that allows them to collectively police the game by booting and banning malicious players.

Dump them into a dungeon

[Animats]

If you can identify cheaters from the server side, don't kick them off, just dump them into a dungeon. One where they can frag NPCs all day without affecting the other customers. That way, the cheaters keep playing, theyr're happy, and they're diverted from getting a new account and making more trouble.

There's only one solution

[Rogerborg]

And it's the one that the designers of the open source multiplayer action game Netrek figured out from day 1. You accept that the clients will be compromised, and you design your server and your network model appropriately.

It's only very recently that commercial games developers are even beginning to understand this, and they're still not getting it right. For example, Counterstrike now attempts to check that your opengl.dll is correct. Fine, but that still relies on the client being uncompromised and reporting the correct number. That's a small barrier for a crackers with a hex editor.

They really need to get it through their heads: you can't trust the client. Every packet that comes in has to be assumed to come from a borg or robot client, and dealt with accordingly. What this means in practice is:

• The server has the final word on the world state. It accepts only requests for actions from the client, not state data, and it verifies that the client is in a state that it should be requesting this action. If that means that it rejects valid actions from a human player experiencing lag, tough, that's the cost of trust.
• The server sends only the information that each client needs to know. The Netrek server sends position, heading and speed information to clients, but only if there's a friendly unit close enough to scan them, less frequently for distant units, and when it sends information about cloaked units it lies, so that even if you hack the client to display cloaked units, you end up displaying an infrequently updating image of where they might be, which can sometimes be more of a hinderance than a help. All this requires extra processing on the server. Tough. Hardware gets cheaper by the day. Sometimes it means that clients miss out on information, and see things appearing and disappearing. Again, you have to accept that as a necessary price to pay.
• You design your game so that perfect execution doesn't guarantee you perfect results. Unlike the rail gun in quake, for example, in Netrek if you fire perfect vector torpedoes aimed precisely where your target is going, a decent human player will dodge them nearly every time. Instead, you have to use your (human) skill and judgement to decide where your (human) target will dodge once you fire, and fire where he's going to go, not where he was going. Or you fire where you don't want him to go, for strategic purposes. A netrek client firing perfect vector torpedoes is actually a liability against clued players!

This isn't theoretical. I wrote a 'borg client for Netrek (bypassing the pretty darn good RSA binary check that still surpasses that in many commercial games), and found that it gave me at most a marginal advantage. It hardly effected my combat ability at all, and it made only a slight improvement to my strategic ability (by recording the limited information it received and making best guesses about what was actually going on in the game state). It certainly didn't spoil play balance like many FPS hacks do, and it didn't require any server fixes, because I simply could not exploit it very far to start with.

The reason why the Netrek developers understood all this was that it was open source (so it was trivial to hack up a client), and also that servers developers were somewhat separate from the client developers. The server developers could dictate the architecture and packets and the client developers had to work with what they were given. Contrast that with the way that commercial games development tends to get done, with the same people writing both server and client, with a mandate to get it working as quickly and easily as possible.

If I was back in commercial games development, this is the first change I'd make: separate the server developers and client developers, and only let them communicate through the code - and with the server guys calling all the shots. That sounds inefficient, but if you don't make the effort early on, you'll damn well have to do it later, once the problems are out there in the field. We need to fix the attitude endemic in commercial games development that there's never time to do it right, but always time to do it twice.

Supplemental reading

[defile]

The ZDNet article is missing the link to my original article which is what lead the news.com writer to interview me.

I can see why they left it out though, it calls a lot of the people they interviewed in addition to me names. ;)

My cheating experiences

[icey5000]

First off, I'll start by saying that I AM a casual online gamer and have had a number of bad experiences with cheating. In fact, I ONLY play with direct connections to friends because of these problems. Quite frankly, I have been burned badly enough and often enough that I WILL NOT go online to play in a public game -- whether it is free or not. I've tried many times and have given up -- this really sucks since it seemed to have great potential. Here is why...

My first online game experinces was on Yahoo Games. It looked interesting: meet new people, have some fun. I was a newbie, and so, went to the newbie area. I a game of cards seemed like fun but was dropped out of the game (lag). When I returned to the server I was chased and verbally harassed (with swears) through 3 other card games. I've never been back... and will never go back.

Sometime later I regained my curiosity and thought I'd try Diablo online. Foolishly I took a high level character (can't remember how high, but had made it to hell difficulty) online and was killed instantly (twice! once in town!). I didn't know anything about 'hacks' then and persisted thinking this was due to server lag (or bugs). Then all of my equipment was stolen after a healing spell was cast on me. No backups, so goodbye all the effort. That was my last Diablo I game online.

The pattern seems to repeat itself with frightening regularity: Quake II: dead, dead, dead and dead again), Unreal Tournament: similar to Quake, Starcraft: rushed (after making no rushing agreements) and had defences repelled by infinite numbers of enemies and attacks that failed even with overwhelming technical and numerical superiority, AOE 2: faced impossible tech advances and armies, Diablo 2: PK'd in no-pk mode. The list goes on.

I make no claims to be an expert player in these games and would have no problem being beaten by a better player -- I find that's often the best way to improve! But, I have taken efforts to use the newbie areas to find other newbies to play with. Unfortunately, cheaters look at these areas as their playground too!

I give up. Too bad, it could have been fun.

Re:Taking it too serious...

[JohnCub]

Online, the "newbie" or "novice" channels seem to be full of experts getting their jollys off by fragging inexperienced players. Tell me, how is *that* not cheating?

I understand what you are saying here and I call this "dirty playing" but not cheating. Cheating is running a program / plugin / etc that specifically allows you an advantage. I've never become very good at any online games, though I have tried from time to time, specifically in the Half Life (and mods) areas. When I suspect someone to be cheating I go into spectator mode to see if they are just hella good or if they are walking through walls. When they are walking through walls or making shots that are simply unbelievable (through the wall, through the post behind the wall, straight between the center of the eyes), I give up. I can accept being owned by a better player. I cannot play if I am being owned by a cheater.

And in that case, the odds of me using my personal purchasing power to get another online game? Not gonna happen. Who is left to suffer from this? Well, the cheaters have one less PLAYER to kill and the game companies won't be getting their part of the purchase price from my wallet.