Slashdot Mirror
Valve's Battle Against Cheaters
wjousts writes "IEEE Spectrum takes a look behind the scenes at Valve's on-going efforts to battle cheaters in online games: 'Cheating is a superserious threat,' says [Steam's lead engineer, John] Cook. 'Cheating is more of a serious threat than piracy.' The company combats this with its own Valve Anti-Cheat System, which a user consents to install in the Steam subscriber agreement. Cook says the software gets around anti-virus programs by handling all the operations that require administrator access to the user's machine. So, how important is preventing cheating? How much privacy are you willing to sacrifice in the interests of a level playing field? 'Valve also looks for changes within the player's computer processor's memory, which might indicate that cheat code is running.'"
Team Fortress is overrun with cheaters and Valve seems completely unable to do anything about it.
Women are like electronics: you don't know how damaged they are until you try to turn them on.
What all these anti-cheating efforts fail to realize is that cheating is an integral part of the game, especially in computer gaming. Given that such a cheat can be performed by anyone, the playing field is *always* level in the aggregate. By removing actions that they consider cheating, they are removing key gameplay elements and ultimately changing the face of the game.
Additionally, it says a lot that they must resort to installing what is essentially a rootkit just to make sure someone isn't taking advantage of superior technology or extra knowledge. If these games are so unplayable with cheating enabled, perhaps the designers shouldn't have put those features in.
Crippling superior players is Communism.
I don't run Windows for privacy, I run it to play games. My real work stays on my Linux/OS X machine.
"Superserious" is one step below "superserial" which is, of course, a description reserved solely for the dreaded Manbearpig. That alone should tell you how much of a threat online cheating really is. It might not threaten us all as severely as Manbearpig, but that doesn't mean it won't kill you in your sleep. The sooner we stop online cheating, the sooner we become one step closer to defeating Manbearpig....
EXCELSIOR!
"So after all this, you make my case for me. To end this stalemate, you must die..."
Which part of this infers a threat to privacy? You need to think of this too- The system is running Windows, which is a black box and they could be doing whatever they want and you wouldn't know about it.
I think the intent is closer to:
"Cheating kills your game because it makes legit players not want to play it anymore, whereas pirates don't affect your legit users"
So the crazy idea is this: don't tell the client systems where the avatars are located. Maybe your system says "I'm here, looking this way", and all you get back is a bunch of data for drawing textured triangles. Triangles might be part of another player's avatar, or a wall, or who knows what; but your system doesn't know of what it is either, so there's nothing for an aimbot to go on to do its thing. It's more data, and more work for the server, but maybe it's not TOO MUCH more data or work for the server, and it'd be cheat-free.
(Unless you write some spiffy image recognition software, but hey, at least we get some advances in AI out of the deal that way...)
Those who fail to understand communication protocols, are doomed to repeat them over port 80.
Cheating is a social problem, not a technical problem. Technical solutions for social problems usually do not work. However, we have fixed this problem already with various other online activities, where people even regularly spend real money to buy something from complete strangers. Reputation systems like eBay and Amazon use seem to work quite well, but then of course you can no longer blame the cheaters for poor sales.
OS Reviews: Free and Open Source Software
Until I need a disk in my CD/DVD drive and/or an Internet connection for single player mode. Or until it's used as an excuse to inflate the price of entertainment.
I want this account deleted.
Comment removed based on user account deletion
This might have been a sound argument if the DRM crap actually affected piracy..
There are two big problems with VAC over PunkBuster
1) All power resides specifically with VAC. There are no tools for the server admin to make things like md5 or cvar checks, no screenshot facility to check players, or even the ability to kick a player. As such, you HAVE to rely on VAC doing all the work, and you as a server admin have nothing to say about it. If you see a cheater that VAC is failing to catch, your outta luck.
2) VAC gives no information as to what it is doing. You never see a player being kicked due to VAC detection, so you have no idea what VAC is actually doing. Is it truly detecting anything, and if so, how would you know? With PunkBuster, it gives you kick messages which if not displayed on the screen, are at least logged in the server and client logs.
No accountability is never a good thing.
WTF are you smoking?
You are apparently living in cheaterland, where you have no hand-eye coordination and you rely on software to play for you.
None of modern existance is automated. You are just trying to rationalize your cheating. Epic FAIL!
They're using their grammar skills there.
A cheater killing you instantly every time you come within a few lightyears of his avatar is still orders of magnitude worse than having a DVD in your DVD drive when you start the game.
It may be inconvenient, maybe even damaging the DVD drive, who knows. Replacing the DVD drive after 3 years and the DVD you possibly have to buy a second time when you got a minimal scratch that messes with the copy protection is just money. Unnecessary money, but you could factor it into the experience of playing an expensive game.
Cheaters on the other hand will ruin the game experience altogether. No amount of money will get you a balanced and fair Modern Warfare 2 right now. (Short of setting up your a LAN tournament on tightly secured computers you own and control)
One pirate is just lost income, who maybe would've never bought it full price anyway. One cheater can frustrate 63 paying customers per server all day long. As a paying customer, I would rather play with 63 pirates than with 63 other paying customers with one cheater among them.
I am an admin in one of the larger gaming communities in my country, and have a history of competitive gaming. I was never a gamer before I saw the teamplay in CS 5on5 matches (example video). I still play the orginal game once a week or so. Just for the record, CS is a team-game where aiming and firing is only part of the skill. Knowing and practicing with your team is essential just like any other sport.
If you didn't already know, Counter-Strike (CS) is still one of the largest on-line games out there, peaking 75k users yesterday. I'm talking about the version 1.6 and not the CSS (CS Source) version. There is still a larger userbase for other Steam-games, but we still regard the original CS to be the game played by the eSports community because of its smooth gameplay and predictable recoil patterns when firing guns. Many "elite"-players have tried moving on to newer games, but get disappointed and still comes back for the good old CS 1.6 where graphics may suck, but you get a predictable gameplay where the player is not that much affected by randomness.
The story of cheating in CS has been a long annoying trip. People have even been cheating at LAN-events where they used aim-key, and they even won price money and got away with it. The story is long, and websites profiting from selling cheats are very active today. Some of the cheats go very deep in kernel and hide itself just like a root-kit. Ring 0-cheats are common.
VAC (Valve Anti Cheat) has been the attempts from Valve to stop the cheats, however VAC has always been ages behind any new cheat and has never taken all cheats available for free at the net. There has been attempts from the community at steampowered to scare users with passive detections and delayed bans so users could not be sure which cheat got them banned, but mainly VAC seem to me being a low priority project at Valve. Valve is still, like any other company, prioritizing new projects and just leaving maybe one programmer doing some cheat-detection-code on his free-time. The situation is a win for cheaters and others. And also a win for Valve, since there are a lot of people trying cheats and thus they sometimes get banned, ending up buying a new copy of the game (the price for a new CS at Steam is currently available at 7,99€ which is annoyingly cheap). Valve still sells a lot of copies (in the years 1999-2008, Valve had sold 4,8 million copies!).
Various anti-cheat communities has gathered during the years, where one try syncing ban-lists and communities constantly have players monitoring other players trying to spot cheats by spectating. As VAC is such a failure, many still go undetected. Especially if one hides their cheats well. The community RADAR is one of these initiatives which accept new communities for sharing such ban-list.
The latest addition; Easy Anti Cheat (EAC) is a project created by a skilled programmer that is based upon deep-level detection accompanied with screenshots. This programmer may seem hard-core, and this is mainly because he used to be a cheat author(!). This is currently the best anti-cheat system available for CS, but it's still only used in Clan Wars/eSports. The public-area for normal players is still depending upon VAC, as the EAC requires a 3rd party client installed which is a tough barrier to overcome.
The future now seem brighter, as we have now left VAC and we are mainly no longer depending on it. I wish Valve software good luck in the future, but it seem to me that if VAC remains a low-priority project it will still annoy thousands of everyday players and leaving a few cheaters laughing, destroying the on-line experience.
Yours
On the flip side, how many of these "bugs" are due to cheaters trying to weasel their way back into VAC servers?
There's sadly no way to know for sure, really, except for maybe people you know IRL.
"Hardware failures and software bugs."
What hardware "failure" looks like a wire grid and wallhack on screenshots? And why should I as a server admin care if you unknowingly or willfully used this bug?
What software "bugs" will have a detection signature like the latest aimbot? Which software bug will produce a registry entry and ..\system32-fallout like a wallhack?
We know how likely an md5 hash collision is with hack X and legitimate program Y. Not very. With an increasing number of wallhacks and legitimate programs, we will see hash collisions sooner or later, but I'm not really convinced unless you have dozens of very very rare but innocent programs on your system that no one else has AND anyone else having them is also banned.
Think of the online arena like a dance club: you paid for entry and yet the bouncers can throw you out at the first hint of trouble. And all other guests are cheering and complimenting them for doing so. A few dimwits, idjits and griefers can just cause so much fallout in such a short time that even drastic and unwarranted measures are usually applauded by the audience.
Face it: bouncers and anti-cheat admins don't have the resources to assess every single case pondering over preponderance of evidence. It would twentyfold the cost of operating a dance club or game server and most customers are not willing not pay for a Constitution-class jury system.
If the choice is having "1 collateral damage for 50 cheaters banned" or "0 collateral damage for 25 cheaters banned" - or a huge increase in paralegal costs for the server admin, I will opt for the collateral damage. War is not fair anyway.
Cheats such as Aimbots, Bunny-Hopping and Speed-hack are fairly obvious and easy to detect. The results of such cheats are visible within the game. Other cheats, such as Wall-hacks and Radar-hacks, are more difficult to discern and can only be detected by observing player actions over time. Such cheats, however, are enabled by the game engine itself. The engine provides the data of what is behind the wall, or what are all the player positions to each client. In normal mode, the game does not present this information to the player. The cheats utilize the available data and presents it to the player providing them an unfair advantage. If the engine did not provide this information to the end-client PC, these cheats would not be able to work. The engine needs to be designed so that this "extra" information is not made available to the end-player.
Comment removed based on user account deletion
No thank you.
I don't cheat.
But I also don't want programs running arbitrary deep-level scans on my system and phoning home either.
ESPECIALLY since I can't see the data.
Chas - The one, the only.
THANK GOD!!!
After MANY years (10+) of playing various FPS'es and being the victim of rampant cheating, I decided to pay for a one month subscription to callofdutyhacks.com for COD4 WAW2.
Essentially I had a schadenfreude-esque experience tormenting others with my rampant aimbotting for about 5 days. It didnt take long for the novelty to wear off and I completely stopped playing the game at the end of the 5 days.
Being the victim of cheating removed any enjoyment of playing FPS style games I had. Victimizing others for a brief period while I was using a cheat framework ended up being just as empty an experience.